Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Updating DerStarke v1.4 to Yosemite
Prerequisite:
- Xcode 6 for 10.10 SDK
- Since Xcode 6 is also in beta, it is recommended to do this in a VMVirtual Machine or just non-primary dev box
Checkout DerStarke (ssh://git@stash.devlan.net:7999/derstarke/derstarke.git)
- Make sure to do a recursive clone or submodule update to get all submodules
- Create 'yosemite' branches in derstarke, extern/bokor, and extern/darkmatter
- bokor and darkmatter will be the only two submodules we need to modify on new OSOperating System release
- (let User #73580 handle the triton stuff ;b)
- (let User #73580 handle the triton stuff ;b)
- bokor and darkmatter will be the only two submodules we need to modify on new OSOperating System release
Changes to DerStarke
- in file preconfig.plist (and the two sample debug.plist and release.plist)
- Add a new plist entry for Yosemite under Persistence options
- config['Persistence Config']['Yosemite Support']
- Set this option to true, but might want to set Mountain Support to false since Xcode usually only ships with latest 2 SDK's
- You can add MLion SDKSoftware Development Kit from previous Xcode if wanted to support more than two OSXs
- Add a new plist entry for Yosemite under Persistence options
- in file darkmatter.py
- in function modify_inf
- Add 'if statement' for existence of config['Persistence Config']['Yosemite Support']
- note the added build option of '-DYOSEMITE_IMPLANT ' only needs to be given to loader_inf since no other component of darkmatter cares about OS
- note the space at the end of the build string is important
- Add 'if statement' for existence of config['Persistence Config']['Yosemite Support']
- in function modify_inf
- build1p4.py
- in function build_kernal_payload
- Add 'if clause' to TWO places for yosemite checks at beginning of function
- (One while iterating through plist config, and one while building bokor build string)
- Add 'if clause' to TWO places for yosemite checks at beginning of function
- documentations... help intro, filenames
- in function build_kernal_payload