# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Elsa

# ELSA User Manual

27 September, 2013

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
…
- 41
- 42

Elsa User Manual.doc
14
SECRET//NOFORN
5. (U) Deployment
(S) As described in the config settings, ELSA supports several running modes, each with
slightly different installation procedures. In all modes the configured dll generated by the
PATCHER must first be copied onto the target machine.
Mode: Description: Installation Overview:
SvcHost Runs the dll as a service, visible in
the Services panel
RegSvr32 and net start commands
DllHost Runs the dll as a scheduled task,
visible in the Task Scheduler
RegSvr32 and an install script
RunDll32 A general tool for loading and
running dlls.
RunDll32 command – this is not
really an 'installation' and will not
persist
AppInit Add Elsa to a list of dlls that load
when any app runs.
Edit registry keys
Figure 12 - (S) Overview of Elsa Modes and Installation
(S) During deployment it is often helpful to use the tasklist command to see if the dll is
loaded and running somewhere. You can also use asterisks as wildcards in the dll name
argument to double check that you don't have any old versions of the dll loaded:
> tasklist /m <dll name>
(S) Elsa uses the Microsoft Windows RegSvr32 tool to perform the installation; however,
this tool will not install if the dll is placed in the C:\Windows\system32 directory. The
Elsa dll can be installed from other directories such as the ‘C:\Windows’ or the
‘C:\Program Files’ directories.
(S) General practice is for 64 bit dlls to be deployed to 64 bit systems; however, if an
installation host such as 32 bit Taper is used then the operator will want to be aware that
the 64 bit version of Windows contains two copies of RegSvr32.exe. The first is a 64 bit
executable located in the C:\Windows\System32 directory and the second is a 32 bit
executable located in the C:\Windows\SysWOW64 directory. Deploying the 64 bit
version of the dll requires the 64 bit version of RegSvr32.
(S) The following command line syntax can be used to install x64 bit elsa dlls from a 32
bit process:
> %WINDIR%\sysnative\regsvr32.exe /s %WINDIR%\ELSA_x64.dll

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
…
- 41
- 42