Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
DerStarke 2.0
('toc' missing)
Building DerStarke (Developer)
Top-Level Builder (build.py)
build.py is intended to be a top-level builder that combines bokor (OSXApple operating system kernel injection), darkmatter (EFIExtensible Firmware Interface persistence), and a sample OSXApple operating system bundle. It can be used to create a fully configurable DerStarke release or used to setup a building environment for darkmatter testing/development. Note that there is a debug.plist and release.plist that has default values for a fully debug or release options. Feel free to use these files, but it is not recommended to modify them in that other files used them to make release builds (make_release.sh). If you need to tweak specific options, use preconfig.plist, or rename to anything you like.
Options
-
-c <FILE>, --config=<FILE>- (required) configuration plist that defines the build parameters
- See preconfig.plist for example... some notable options:
- CMOS Debug
- Used by darkmatter when serial or screen printing is not available. This is used in all darkmatter PEIPre-EFI Initialization drivers and parts of S3Sleep.efi when it is waking up from the S3 sleep. It is not recommended to turn this on unless you are debugging those specific drivers.
- CMOS Debug
- -d, --darkmatterbuild
- (optional) Will only setup an environment to start building within externals/darkmatter. Will build kernel implant with options in the config plist and a sample bundle and place them in the proper darkmatter locations. See section 'Building Inside externals/darkmatter' for me information.
- -n, --noninteractive
- (optional) Will not prompt user
- -p, --package_only
- (optional) This flag will create a full release of DerStarke, but will not build bokor or darkmatter. It uses previously generated binaries. This flag is very using if you are making modifications to the configuration pyz (derstarke_builder.pyz), and don't want to rebuild bokor/darkmatter.
Building Inside externals/darkmatter
A lot of EFIExtensible Firmware Interface functionality can be testing without needing to modify bokor code or needed to be written down to flash. If the functionality can be tested by running the EFIExtensible Firmware Interface executable in an EFIExtensible Firmware Interface Shell, execute the top-level builder with the '-d' option and follow the instructions below. If you need to do full end to end testing or need to be in the flash, it's easier to just build a debug DerStarke release, and use the ISOInternational Standard Organization image to create a flashable thumb stick.
darkmatter.plist (new config)
Darkmatter has a lot configuration values required to build an instance of darkmatter (initial values for things like enable time, guid values of it's NVRAMNon-volatile Random Access Memory variables, the file guid for files it uses, etc). These use to be separated out into individual files, but has been combined into one plist in version 2.0. Note that the default darkmatter.plist contains all required values for a build. scripts/build_config.py will auto generate the rest of the values (encryption keys, files guid, etc). An output of all values that the build of darkmatter used is located in out/dm_out.plist. If you require any of these values to be fixed when testing, you can modify the original darkmatter.plist.
A good example of wanting a fixed value that is normally auto generated would be the xxtea encryption key. If you are doing multiple builds of Loader.efi and running them at shell that uses an encrypted bundle loaded off the filesystem, you would have to copy both L.efi and bundle to your testing stick. If you fixed the xxtea key, you can use the same bundle on different builds of Loader. The easiest way to make sure you have the correct format would be to build once and copy the desired parameter from out/dm_out.plist (in this case it would be Root->General->Xxtea Key).
Makefile
Configuring DerStarke (Operator/Testing)