# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - User Manual

26 January, 2009

- 1
- 2
…
- 6
- 7
- 8
- 9

which the Status variable does not exist or it exists but is not ‘3’. The Count variable is
independently incremented in the case of a kernel panic. Therefore, if Status is not ‘3’
and a kernel panic is detected, then the Count variable is increased by 2. Otherwise the
Count variable is deleted. A non-existent Count variable is considered to have the value
zero. The Status variable will not exist in the case that the target was booted to an OS
other than Mac OSX 10.5 or to an EFI application such as Refit.
The Limit variable may be set to override the limit on continuous cautious boots as
follows: > nvram $(cat limit.guid):$(cat limit.name)=%xx%xx%xx
%xx, where limit.guid is the GUID of the Limit variable and limit.name is the
name of the Limit variable as defined in section 3.1 and the value %xx%xx%xx%xx is a
four byte hexadecimal number in little-endian byte order with the % character before each
byte. For instance %02%00%00%00 is the value 2.
DarkSeaSkies is uninstalled during a boot in which the Count variable is greater than or
equal to the Limit variable. DarkSeaSkies may be explicitly uninstalled by setting the
Status variable to ‘5’ as follows: > nvram $(cat status.guid):$(cat
status.name)=5, where status.guid is the GUID of the Status variable and
$status.name is the name of the Status variable as defined in section 3.1. The system
must then be cleanly shutdown (not a kernel panic and not holding the power button
down for ten seconds) so that the Status is written to NVRAM. On the next boot
DarkSeaSkies will be un-installed.
4.6 Assistance and Problem Reporting
Contact NCS/IOC/EDG/AED/UDB for assistance.
5. Additional Operational Procedures (Not Applicable)
6. System Backup and Restore (Not Applicable)
7. Troubleshooting
In the event that the Configuration NVRAM variable becomes corrupted it can be deleted
so that DarkSeaSkies will generate the default configuration. Delete the Configuration
variable with the following command:
> sudo nvram –d $(cat config.guid):$(cat config.name).
This should be followed by a reboot.
8. Error Messages
The only error message available in DarkSeaSkies is the Status NVRAM variable. See
section 3.1 for more information.
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 User Manual_Rev New_2009-01-26.doc
5
SECRET//NOFORN

- 1
- 2
…
- 6
- 7
- 8
- 9