# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-AdminGuide

1 December, 2013

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 106
- 107

SECRET//ORCON//NOFORN
• Service Injection
• Standalone service
Module Type
The module type tag describes the type of the catalog module that will be
described within. Currently the only supported module types are “Payload” and
“PersistenceModule”. An example of both types is shown above.
Name
The Name field contains the name of the catalog entry that will be displayed in
the builder and the various XML files. It can be any string that describes the
module described in the entry.
In the examples above, the names provided in the two modules are: “Assassin
Injection Extractor” and “Null Persist”.
Obfuscate Type
The Obfuscate tag defines whether or not Grasshopper should apply an
obfuscation method to the binary. This tag is optional, and if not provided, the
binary will be left in the clear. For more information on binary obfuscation see
the user manual section on obfuscation.
In the examples above, the payload module is set to have its binary obfuscated
using the “reorder” technique using a block size range of 50 to 100 bytes. The
persistence module has no obfuscate tag and it will be left in the clear.
Parameters
The Parameters field tells Grasshopper whether the payload needs parameters
of any kind. If the prompt value is set to “no”, the user will not be prompted. In
any case, if a “Default” tag is within the Parameters tag, the parameter value
will be initialized to that value. There is also an option to define a Usage value
that defines the usage string that will be displayed when the user is prompted
for the parameters value.
In the example above, the payload module sets the prompt attribute to “no”, and
there is no default value defined, so this module doesn’t require any parameters
to execute.
Rule
The Rule tag contains the file path, relative or complete, to the rule file that will
be processed before the module is deployed. A rule file is required for all
Persistence Modules.. For more information on rule files see the user manual
section describing rule files.
In the example above, the rule is set to “crab.rule”.
Rule Data
The Rule Data tag is only used in Payload Modules and it consists of a required
Default Rule tag and optional Override Rule tags. The Default Rule defines the
10
SECRET//ORCON//NOFORN

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 106
- 107