# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.3 Addendum

13 January, 2014

- 1
- 2
- 3
- 4
- 5
…
- 7
- 8

SECRET//NOFORN
(S) ARCHIMEDES 1.3
(S//NF) This document is supplemental to the following documents:
• Fulcrum User Manual 0.6
• Archimedes 1.0 User Guide
• Archimedes 1.1 Addendum
• Archimedes 1.2 Addendum
(S//NF) Please see the above documents for a complete description of the tool’s functionality.
Archimedes 1.3 is an update to the Archimedes toolset which adds ICEv3 support and the
ability to run on targets with multiple gateways or IP addresses assigned to a single adapter.
Archimedes 1.3 supersedes Archimedes 1.2.
(S//NF) Archimedes 1.3 makes the following modifications to the 1.2 version:
1. Adds “IP” configuration option (“-a” via command line) for specifying the local IP
address that should be used for adapters that have multiple addresses defined.
2. Adds the ability to cycle through entries to identify the correct gateway address to
use for adapters with multiple gateway addresses defined for a single adapter.
3. Adds support for the NOD In Memory Code Execution (ICE) specification version 3
FINAL. Archimedes can be injected as an ICEv2 or ICEv3 DLL.
(U) FILE INFORMATION
(S) Appendix B contains a list of the binaries delivered in Archimedes 1.3 along with MD5
sums and file sizes that can be used to verify file integrity.
(S//NF) DEBUG BINARIES ARE CLASSIFIED SECRET//NOFORN AND SHOULD NOT/NOT
BE DEPLOYED ON TARGET
(S//NF) Note that the delivery includes both debug and release builds of each binary. The
debug builds contain additional instrumentation that can be helpful in pin-pointing errors
and unexpected behavior and will generate log information that can be used to trace the
program’s execution. Debug versions should not be deployed outside of a controlled
CLASSIFIED environment. The additional information in them makes the software
particularly vulnerable to reverse engineering and analysis. Debug versions of the
tool should be used in controlled test environments only.
3
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
…
- 7
- 8