WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 14
- 15

SECRET//NOFORN
Hive Engineering Development Guide Overview
protocols associated with the well known port numbers being used. For example, one would expect to
see SSH traffic associated with TCP port 443, rather than raw TCP data.
Both of the raw TCP and UDP packet formats were resignatured using a similar coding strategy, but the
lengths of packet are now randomized. The new packet format is shown in Figure 2 below.
Each trigger packet is built starting with a buffer sized to the maximum packet size and filled with
random data. A CRC checksum is computed on a fixed length of the random data beginning after a
starting pad. The CRC is then used to generate an offset from the start of the buffer where it is stored
followed by a two-byte validation key (N) that is generated using a one-byte random number multiplied
by 127. The common twelve-byte encoded trigger (as defined above in section 2.2) is further encoded by
XORing it with random data from the buffer. The start of this random data is located before the CRC,
after the start pad and computed from the CRC in combination with other parameters. The trigger is then
placed in the buffer surrounded by predefined padding lengths (PAD1 and PAD2). The end of the packet
is then set by computing the number of bytes to follow, once again using the CRC.
SECRET//NOFORN//20391015 3
Figure 2: Hive 2.6 Raw TCP / UDP Trigger Format

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 14
- 15