# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Cherry Blossom

# SRI-SLO-FF-2012-177-CherryBlossom_UsersManual_CDRL-12_SLO-FF-2012-171

- 1
- 2
…
- 22
- 23
- 24
- 25
- 26
…
- 174
- 175

SECRET//20350112
6 (U) Device Support
(S) This section discusses CB device support. To say that a particular wireless
networking device is “supported” by CB means that the CB implant can be built into the
manufacturer’s original firmware for the device, and that through a firmware upgrade
with this CB-implanted firmware, the device can be converted to a Flytrap, able to
perform all of the functions of section 5.2.
(S) One CB goal is to ever increase the number of CB-supported devices (referred to
internally as “platform expansion”). CB maintains an information database of wireless
network devices in the “WiFi Devices.xls” document. This database contains information
about hundreds of network devices, including manufacturer, make, model, version,
reference design, FCC ID, network processor, wireless chipset, operating system, default
username/password, etc. It also contains firmware analysis information about exact make,
model, hardware versions, and firmware versions supported by CB (in “WiFi
Devices.xls”, see the purple and red columns to the far right under “Device Feature
Support”). As of August 2012, CB-implanted firmwares can be built for roughly 25
different devices from 10 different manufacturers (including Asus, Belkin, Buffalo, Dell,
Dlink, Linksys, Motorola, Netgear, Senao, and US Robotics), although only 7 devices
have undergone the formal FAT procedure (see 6.2). Additionally, the CB implant has
been built for a few Motorola WiMax devices under the Roundhouse project.
(S) In general, once a make, model, and hardware version of a device is supported, it is
straightforward to implant any later firmware versions, or international firmware
versions, so long as the device has not changed its underlying hardware or operating
system. This has happened, for example, with the Linksys WRT54G version 4 and
version 5. Version 4 is linux-based, but version 5 moved to the VxWorks operating
system and a different hardware reference design with smaller Flash and RAM chips.
(S) Device support is far from trivial. Manufacturers are constantly changing hardware
and firmware versions of current models and offering new models. Barring guidance
from the Sponsor with regards to particular devices of interest, Cherry Blossom has
attempted to support wireless network devices that are ubiquitous and readily available
(at least in the US).
(S) Supporting a device involves a few steps. The first is an inspection of the
manufacturer’s original firmware (MOFW). Starting with the MOFW is key to fulfilling
the requirement of “Minimal Interference with Normal Device Operation or Look and
Feel” (as in 5.2.3.14). In addition, web research is typically conducted for each device.
Firmware inspection information, including the difficulty/confidence of supporting a
device (see 6.1), is then added to the wireless network device database (“WiFi
Devices.xls”). After firmware inspection, if a device is selected for support, a number of
the devices are procured. Procurement can be particularly difficult for legacy or
international devices. After successful device procurement, the MOFW is then integrated
into the Image Formation tool (see 15.5). Once CB-implanted firmware can be built and
successfully reflashed to the device, the database is updated with any special feature
support information or other notes.
24
SECRET//20350112

- 1
- 2
…
- 22
- 23
- 24
- 25
- 26
…
- 174
- 175