# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-AdminGuide

1 December, 2013

- 1
- 2
…
- 31
- 32
- 33
- 34
- 35
…
- 106
- 107

SECRET//ORCON//NOFORN
2.3.6 Use Imported Rules
The Grasshopper rule ending provides a mechanism for keeping common rule
sets in a central location, which can then be imported to other rule files. An
example of this is shown below:
and {
rule.import(..\..\Rules\is-32.rule)
rule.import(extractor.rule)
}
In the above example, the rule consists of an “and” operator that combines two
imported rules: “is-32.rule” and “extractor.rule”. The “is-32.rule” is imported
from the common rule directory and is shown below:
os.bitness(32)
The above rule validates that the target operating system is 32-bit. The next
import is a payload specific rule shown below:
RULE_DIR=..\..\Rules
and {
rule.import(RULE_DIR\am-admin.rule)
rule.import(RULE_DIR\no-avira.rule)
or {
# Flagged by 32-bit rising, not 64-bit
rule.import(RULE_DIR\no-rising.rule)
rule.import(RULE_DIR\is-64.rule)
}
}
The above rule runs an additional series of imports combined by multiple
operators. This example shows how the rule writer can centralize common rule
values, and then bring them together for use in multiple payloads and persist
modules.
33
SECRET//ORCON//NOFORN

- 1
- 2
…
- 31
- 32
- 33
- 34
- 35
…
- 106
- 107