# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - CONOP

26 January, 2009

- 1
- 2
- 3
- 4
- 5
- 6
- 7

SECRET//NOFORN
3. Mission Overview (Not Applicable)
4. User CONOPS
The DarkSeaSkies User CONOPS is primarily the combined CONOPS of SeaPea and
NightSkies, with the following additions.
DarkSeaSkies is installed from a bootable flash drive. The target system is booted while
holding down the “option” key until the screen displays a boot drive selection menu.
Select the flash drive. Once the DarkSeaSkies installer has started the screen will blank
and a ‘:’ will appear in the upper left corner of the screen. On a successful installation a
‘)’ will follow the ‘:’. On an unsuccessful installation a ‘(‘ will follow the ‘:’.
Once installed, DarkSeaSkies will wait for the configured enable date to begin operation.
The configured enable date is saved in the file “enable.time”.
Once operational, DarkSeaSkies will examine the following NVRAM variables at each
boot to determine the action to take for this boot. All variables have configurable names
and randomized GUIDs. Each delivery of DarkSeaSkies has different randomized GUIDs
for firmware variables and EFI drivers.
 “Status” indicates the status of the payload from the previous boot. The name of
the “Status” variable is saved in the file “status.name” and the GUID in the file
“status.guid”. It has the following values.
o ‘\0’ indicates an unknown status, for example the first boot after install
o ‘0’ indicates that the user-space payload has been dropped
o ‘1’ is reserved for future use
o ‘2’ is reserved for future use
o ‘3’ indicates that the user-space payload executed successfully
o ‘4’ indicates that the user-space payload encountered an error condition
o ‘5’ indicates that DarkSeaSkies should uninstall itself and its payload
o Any other value is equivalent to ‘5’.
 “Count” maintains a counter used to track the number of cautious boots. A
cautious boot is defined fully below. If “Count” does not exist then it is assumed
to be zero. The name of the “Count” variable is saved in the file
“warning_count.name” and the GUID in the file “warning_count.guid”.
“Limit” indicates the value of “Count” at which DarkSeaSkies will uninstall itself and its
payload. If “Limit” does not exist then a pre-configured value will be used. The name of
the “Limit” variable is saved in the file “warning_threshold.name” and the GUID in the
file “warning_threshold.guid”.
DarkSeaSkies also determines if a kernel panic occurred. If a panic did occur then the
NVRAM variables associated with the panic are deleted so that it is not reported to the
operating system.
Based on this input DarkSeaSkies updates “Count” as follows.
 If “Status” indicates success {‘2’, ’3’} and there was not a kernel panic
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 CONOP_Rev New_2009-01-26.doc
2
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7