# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - CONOP

26 January, 2009

- 1
- 2
…
- 4
- 5
- 6
- 7

SECRET//NOFORN
o Caution count NVRAM variable “Count” is set to zero.
 If “Status” indicates success {‘2’, ’3’} and there was a kernel panic
o Increment the caution count NVRAM variable “Count” by one. If the
variable “Count” does not exist then it is assumed to be zero.
 If “Status” indicates caution {‘\0’, ’0’, ‘4’} and there was not a kernel panic
o Increment the caution count NVRAM variable “Count” by one. If the
variable “Count” does not exist then it is assumed to be zero.
 If “Status” indicates caution {‘\0’, ’0’, ‘4’} and there was a kernel panic
o Increment the caution count NVRAM variable “Count” by two.
 If “Status” indicates and error {‘1’, ‘5’}
o Set the caution count NVRAM variable “Count” to the value of “Limit”.
Next, “Count” is examined. If “Count” is greater than or equal to “Limit” then
DarkSeaSkies and its payload are deleted from the firmware. Otherwise DarkSeaSkies
will load, link, and hook the SeaPea kernel implant into the RAM image of the Mac OSX
10.5 operating system. DarkSeaSkies will also write the pre-generated NightSkies
configuration to the “Config” NVRAM variable if it does not already exist. The name of
the “Config” variable is saved in the file “config.name” and the GUID in the file
“config.guid”. Once the root file system becomes writable SeaPea will write the
NightSkies tool into a temporary file, execute NightSkies, and secure delete the
NightSkies tool.
NightSkies then operates as documented in NightSkies CONOPS with the addition that
NightSkies must set the “Status” NVRAM variable at each boot appropriate to its status.
NightSkies may also read and report the “Count” NVRAM variable to the operator, and
allow the operator to set the “Limit” NVRAM variable.
5. System CONOPS (Not Applicable)
6. Notes
6.1 Acronyms/Abbreviations
The Acronyms/Abbreviations used in this document are shown in Table 6.1 -1.
Table 6.1-1 Acronyms/Abbreviations
Acronym/Abbreviation Term
EFI Extensible Firmware Interface
NVRAM Non-Volatile Random Access Memory
GUID Globally Unique IDentifier
6.2 Definitions
Definitions of common terms used within this document may be found in the
Engineering Development Group Program Management Lexicon.
The terms and definitions unique to this As-Built Specification are shown in Table 6.2
-2.
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 CONOP_Rev New_2009-01-26.doc
3
SECRET//NOFORN

- 1
- 2
…
- 4
- 5
- 6
- 7