# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# Sonic Screwdriver

29 November, 2012

- 1
- 2
…
- 5
- 6
- 7
- 8

(S//NF) The volume name that will be search for is:
FILER
(S//NF) Please note that the volume name above is case sensitive in filesystems that allow for case
sensitivity, such as HFS+.
(S//NF) The file path to be execute under the volume FILER will be:
/EFI/BOOT/BOOTX64.efi
(S//NF) The file path above is the specified default boot path for EFI systems. For example, a EFI
complaint Lunix distro DVD will have this path with the file BOOTX64.efi as the Linux bootloader for
that distro. If it is desired to have the implanted ethernet adaptor launch this distro, one would only need
to modify its volume name to be FILER. If it is desired to have the implanted ethernet adapter launch an
EFI implant, one would need to rename the volume and copy the EFI implant to the file path above on an
appropriate media device.
4. (S) Executing Sonic Screwdriver on Target Machine
4.1. (U) Steps to gain executions
(S//NF) The implanted ethernet adapter needs to be plugged into the Thunderbolt port when the computer
is powered on in order for code to be executed. If the adapter is plugged it after the machine is powered
on, no implant code will be executed.
1. (U) Plug in ethernet adapter to Thunderbolt port.
2. (U) Plug in boot media configured from Section 3.2.
3. (U) Power on machine.
4. (U) The device should automatically boot without any key presses.
a. (U) If it does not, there has been observations that certain models of Apple Macs does
not pick up certain USB devices. Take the follow step if this is occurring.
b. (S//NF) Repeat steps 1-3, but now hold the OPTION key while booting up. Once either
a boot list or firmware password screen boots, unplug the boot media device and plug it
in again. It should then automatically get loaded.
4.1..11. (U) Using Sonic Screwdriver with EDG Tool DerStarke
(S//NF) DerStarke is an EDG/AED EFI firmware implant against Apple Mac laptops and desktops. It is
installed with physical access via a USB thumb stick or CD/DVD disc. Please refer to DerStarke 1.3
User’s Guide for information on how to build the USB thumb stick or CD/DVD.
SECRET//NOFORN
Sonic Screwdriver User’s Guide – Nov 2012 7
SECRET//NOFORN

- 1
- 2
…
- 5
- 6
- 7
- 8