WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Beacon Infrastructure

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 15
- 16

9
Raw TCP/UDP Trigger
CRC
Random
Data
CRC
Random Data of length
CRC % 200
12-byte
PAD
25-byte
PAD
Encoded
12-byte
Trigger
8-bytes
Random
Data
Random Data
400 Bytes
Integer
N x 127
CRC
Random
Data
CRC
Random Data of length
CRC % 200
8-byte
PAD1
8-bytes
Random
Data
126 Bytes Minimum / 472 Bytes Maximum
Integer
N x 127
Encoded
12-byte
Trigger
8-byte
PAD2
Random Data of length
CRC % 146
8 920
1-byte
XOR
value
2-
byte
PAD
The twelve byte trigger is encoded by XORing the 1-byte XOR value with the first five bytes of the trigger and the remaining trigger bytes or XORed with 0xB6.
The twelve byte trigger is encoded by computing an offset of CRC % 72 into the CRC random data field and XORing each of the twelve following bytes
with the corresponding byte of the twelve-byte trigger payload.
8 920
Hive 2.5 Algorithm
Hive 2.6 Algorithm
SECRET//NOFORN
SECRET//NOFORN

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 15
- 16