Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
DerStarke 2.0
('toc' missing)
Building DerStarke (Developer)
Top-Level Builder (build.py)
build.py is intended to be a top-level builder that combines bokor (OSXApple operating system kernel injection), darkmatter (EFIExtensible Firmware Interface persistence), and a sample OSXApple operating system bundle. It can be used to create a fully configurable DerStarke release or used to setup a building environment for darkmatter testing/development. Note that there is a debug.plist and release.plist that has default values for a fully debug or release options. Feel free to use these files, but it is not recommended to modify them in that other files used them to make release builds (make_release.sh). If you need to tweak specific options, use preconfig.plist, or rename to anything you like.
Options
-
-c <FILE>, --config=<FILE>- (required) configuration plist that defines the build parameters
- See preconfig.plist for example... some notable options:
- CMOS Debug
- Used by darkmatter when serial or screen printing is not available. This is used in all darkmatter PEIPre-EFI Initialization drivers and parts of S3Sleep.efi when it is waking up from the S3 sleep. It is not recommended to turn this on unless you are debugging those specific drivers.
- CMOS Debug
- -d, --darkmatterbuild
- (optional) Will only setup an environment to start building within externals/darkmatter. Will build kernel implant with options in the config plist and a sample bundle and place them in the proper darkmatter locations. See section 'Building Inside externals/darkmatter' for me information.
- -n, --noninteractive
- (optional) Will not prompt user
- -p, --package_only
- (optional) This flag will create a full release of DerStarke, but will not build bokor or darkmatter. It uses previously generated binaries. This flag is very using if you are making modifications to the configuration pyz (derstarke_builder.pyz), and don't want to rebuild bokor/darkmatter.
Building Inside externals/darkmatter
A lot of EFIExtensible Firmware Interface functionality can be testing without needing to modify bokor code or needed to be written down to flash. If the functionality can be tested by running the EFIExtensible Firmware Interface executable in an EFIExtensible Firmware Interface Shell, execute the top-level builder with the '-d' option and follow the instructions below. If you need to do full end to end testing or need to be in the flash, it's easier to just build a debug DerStarke release, and use the ISOInternational Standard Organization image to create a flashable thumb stick.
darkmatter.plist (new config)
Darkmatter has a lot configuration values required to build an instance of darkmatter (initial values for things like enable time, guid values of it's NVRAMNon-volatile Random Access Memory variables, the file guid for files it uses, etc). These use to be separated out into individual files, but has been combined into one plist in version 2.0. Note that the default darkmatter.plist contains all required values for a build. scripts/build_config.py will auto generate the rest of the values (encryption keys, files guid, etc). An output of all values that the build of darkmatter used is located in out/dm_out.plist. If you require any of these values to be fixed when testing, you can modify the original darkmatter.plist.
A good example of wanting a fixed value that is normally auto generated would be the xxtea encryption key. If you are doing multiple builds of Loader.efi and running them at shell that uses an encrypted bundle loaded off the filesystem, you would have to copy both L.efi and bundle to your testing stick. If you fixed the xxtea key, you can use the same bundle on different builds of Loader. The easiest way to make sure you have the correct format would be to build once and copy the desired parameter from out/dm_out.plist (in this case it would be Root->General->Xxtea Key).
Note that modifications of darkmatter.plist will only affect the output binaries in out/ for testing. Even with a modified darkmatter.plist, if you move a level up and do a top-level build, the deployment configurable DerStarke will get new patched in values. (i.e, don't worry that added a fixed xxtea key will propagate to a release build of DerStarke).
setupudk.py
Once you're inside /externals/darkmatter, you will need to run setupudk.py before using the Makefile. AED/EDB's UDK build uses a disk image (UDK2010.UP4_DarkBuilder.dmg) to build all their EFIExtensible Firmware Interface binaries. setupudk.py will modify the necessary UDK files inside the diskimage and setup symlinks to the CWD with respects to the configuration (can view the config at top of setupudk.py). Since the location of the source code is symlink'd inside the disk image, you would have to run setupudk.py if you checked out two copies of darkmatter on disk and were switching between the two.
You would only need to modify setupudk.py if you needed to add another INF file to your project (adding another EFIExtensible Firmware Interface driver or application) or was creating a new EFIExtensible Firmware Interface project. Read the top section of setupudk.py for more information on how to configure for either cases. Note that if you are using setupudk.py for a new project, this file will auto generate a Makefile to build your EFIExtensible Firmware Interface binary with basic options. If a non-autogenerated Makefile exist, it will not modify it, such as the case in the darkmatter Makefile. If you are creating a new project and wish to add options to the autogen Makefile and keep those changes, remove the "Autogeneration" comments at the top of the generated Makefile.
Makefile
Once you run setupudk.py, you can utilize the Makefile. Note a "make clean && make all" will generate all darkmatter binaries for a full deployment of derstarke. Some common Makefile options:
- make loader
- This option will only build L.efi (Loader) and the encrypted bundle (kernel.dmg) inside the out folder.
- If on-disk solution is configured, will also output encrypted loader (load.dmg)
- make ReadFirmware
- Creates a single application ReadFirmware.efi that can be run at an EFIExtensible Firmware Interface shell.
- make ai
- Makes the AppInstaller, S3Sleep, and PeiUnlock exploit application. This guys is the application that will either load the darkdream exploit if the flash is locked, or will load VerboseInstaller if unlock.
- make vi
- Makes the VerboseInstaller (and loader, peiloader, dxe
Configuring DerStarke (Operator/Testing)