Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » Marble Framework » Marble Framework Home
Component Diagram and Description
SECRET//NOFORN
For help setting up Marble for your project see Setting Up Marble Manually SECRET or Setting Up Marble With The EDG Project Wizard SECRET
Mibster
The Mibster is an executable in the Marble Framework that is responsible for modifying the source of a Project/Solution. The conceptual steps it takes include:
- It parses the Marble.h header file to generate a pool of available algorithms
- It then randomly chooses an algorithm from the pool and uses is to generate obfuscated versions of strings in source files. The Mibster verifies the scrambled string does not contain 3 consecutive characters that are the same as the original string (fails out if this is not true - Visual Studio error).
- Saves a copy of all source files that need modified. If it fails to create copies of the source, the Mibster fails out without modifying anything.
- Modifies all source by replacing the defined strings with an "insert" that is generated by the Marble.
-
Generates a receipt file that contains the framework version, algorithm used, and strings that were obfuscated.
Build Process
Although the Marble Framework can be used in Debug, it is intended for use in Release builds (as this will add time to your build process). Assuming you have correctly set up the Marble Framework for your Project/Solution, the build process should look like this:
Note: You will see in the output window that the Mibster has chosen an algorithm and is scrambling strings (gives you line numbers and source files).
Mender
The Mender restores the source files to the original state. The Mender will search the provided Solution/Project directories for source to restore to the original state. The Mender prints the restoration status to the output window. On a failure to restore, the executable will fail (you will see a visual studio error).
Validator
The Validator takes the receipt file that is generated by the Mibster and uses it to validate that none of the strings in the receipt are in the binary. The Validator will print the number of strings found in the binary. If some strings are found in the binary, you can use the receipt file to find the file and line number.
Debugging and Troubleshooting
I want to debug my code when the strings are obfuscated.
Steps you should take:
- Remove Mender code from the Post-Build Event list
- Build Project
- Do all debugging. When you identify issues do not fix them in this state!!!
- Run the Mender on your solution.
- Make the necessary changes to your code
- Reset the Mender as the first Post-Build Event
The Mibster failed, my string are obfuscated and I want to return to my original source
You should always be able to run the Mender to get back to the original state. If there are any issues with the framework please submit them using the process suggested on Marble Framework Home SECRET.
SECRET//NOFORN
Attachments:
Previous versions:
| 1 empty | 2 SECRET | 3 SECRET | 4 SECRET | 5 SECRET | 6 SECRET | 7 SECRET |