18. Appendices D–E: Source, Version, and Fidelity Map
This appendix identifies the source snapshots and execution boundaries behind the book. It is a working research artifact and will grow as the claim ledger is reviewed.
Source snapshots
| Component | Examined commit | Commit date | Declared or inferred line |
|---|---|---|---|
rcs-db |
6cff59d28634d718cac9fdd17cb629fd59a3cf3f |
2014-05-12 | 9.2.3; build 2014051201 |
rcs-common |
38290d4eab2b2c295bea021429848a3666647827 |
2015-03-31 | 9.6.0 |
rcs-collector |
42cf61af9ec3e7b886e87eac20e762c3ce51c78c |
2015-03-31 | 9.6 branch tip |
rcs-console |
a90041fcd32bf1a82276ac20c2cd5ecb7d108db0 |
2015-03-31 | sends RCS version 9.6.0 |
rcs-console-library |
97531201600a8a223392e955a35b2b2605c1c1d4 |
2015-03-31 | 9.6 branch tip; REST/service layer |
vector-exploit |
2cf574d3bf2ea44f67433e32ccc9906ded6218e0 |
2014-12-12 | catalogue build 2014093001 |
rcs-anonymizer |
0c4189b1e5d7e23ad0bf85d0f184d9d8e46decbe |
2015-04-03 | supporting static tree; commit identifies 9.6.0 |
The first six rows are the primary snapshots frozen before drafting; the
anonymizer is the supporting static tree cited by Chapter 9. The Git commit
date describes the examined repository tip. It is not a product release date
and offers no evidence that the components were deployed together. The connector
implementation cited in Chapters 9 and 10 resides inside the rcs-db tree at
lib/rcs-connector/ rather than in a separate repository.
Endpoint source snapshots
The static capability audit freezes a second set of repositories. Android’s native and audio trees are treated as supporting sources, and Windows’ 64-bit tree as a companion layer, rather than independent feature-complete implants.
| Repository | Examined commit | Commit date | Audit role |
|---|---|---|---|
core-android |
888e51b4ef778ee7f1ef63e22f622ddffb358b39 |
2014-12-16 | Android Java core and module factory |
core-android-audiocapture |
77b2c1bb09406fd1cfa69e8e1e9276167a664daa |
2015-05-13 | Android audio adjunct |
core-android-native |
731733239fa91b3d5b502f0fda51d10c9ae9d974 |
2015-06-26 | Android native adjuncts |
core-blackberry |
977aca189004365f0002766fd318bfc6bc2b4d17 |
2014-11-03 | BlackBerry core |
core-ios |
19868fcfce187b5d5282ba231854064ad9054a55 |
2015-04-09 | iOS internal and remote-agent registrations |
core-linux |
9252cba42283e71d7858292a400f6c94043ee8ff |
2015-02-11 | Linux core and registration table |
core-macos |
f412a71d51563db773c2f1b6bb8c5ef3b69cf201 |
2015-04-09 | macOS agents and task manager |
core-symbian |
eb5d3c477ee9b94751d83ed5c40d57a3f667f532 |
2011-03-09 | Symbian core and agent factory |
core-win32 |
8eb1326959fcb5c727513b59b86386dae7463683 |
2015-01-21 | Full Windows desktop core |
core-win64 |
a263105b32bc3416107c2950adc0e49f95186684 |
2014-01-16 | Partial Windows companion/IPC layer |
core-winmobile |
e5baa43ce352e8aa4de4f1604a95e691e2e85aaa |
2012-08-09 | Windows Mobile core |
core-winphone |
361510342e60778a003c535f5df48d27348661e1 |
2015-06-25 | Windows Phone core |
scout-win |
2368421c414b833e25b7f261a2a583245bad6102 |
2015-04-02 | Narrow Windows Scout stage |
soldier-win |
b0f86659d7f4a90206bd18b1053896fbd8709cd8 |
2015-03-19 | Intermediate Windows Soldier stage |
Their dates span more than four years. The matrix below must therefore not be read as one release’s cross-platform feature list.
Direct version evidence
| Claim | Evidence |
|---|---|
| Database identifies as 9.2.3 | rcs-db/config/VERSION:1; rcs-db/CHANGELOG:1-3 |
| Database build date is 12 May 2014 | rcs-db/config/VERSION_BUILD:1 contains 2014051201 |
| Database lockfile expects common 9.2.3 | rcs-db/Gemfile.lock:8-18 |
| Checked-out common library declares 9.6.0 | rcs-common/lib/rcs-common/version.rb:1-5 |
| Common history contains the expected 9.2.3 heartbeat/status interfaces | rcs-common commit 34da36c873873a50a5ef053aa8f055207c1f1f2f; refactored at 261e08dddf2f581e96a8798e041c182551dfd536; visible 9.3.0 bump at 9a770f8455d9c250b62ae1a0034c1d45cdc3fbbc |
| Console sends 9.6.0 | rcs-console/src/Console.mxml:31-41 |
| Exploit catalogue build is 30 September 2014 | vector-exploit/VERSION:1 contains 2014093001 |
Catalogue manifests declare 20140930 |
package info.yaml:1 files at repository HEAD |
Database accepts exploit manifest 20140512 only |
rcs-db/lib/rcs-db/build/exploit.rb:238-254 |
Fidelity matrix
| Component or behavior | Status | What the book may claim | Principal limitation |
|---|---|---|---|
rcs-db HTTPS REST |
Runs in lab | LAB behavior of examined 9.2.3 source | Runtime and dependency adaptations |
rcs-db WebSocket push |
Runs in lab | LAB behavior, including heartbeat and logout pushes | Proxied through lab nginx for the web port |
| MongoDB topology | Runs in lab | LAB storage and sharding behavior | Single-container physical topology |
rcs-worker evidence path |
Runs in lab; named replay passed | LAB behavior for synthetic DEVICE decrypt/store/alert/log/push | Begins at Worker ingress; no real implant/collector session or media-transform validation |
| Original AIR console | Static source/manual analysis | SOURCE and MANUAL workflows | AIR binary not executed on Linux |
| Web console | New, fully tested port | WEB PORT behavior and live backend contracts | Not an original HackingTeam executable |
| Collector | Static analysis | SOURCE protocol and host behavior | Public listener not run in the lab |
| Anonymizer chain | Model/UI and source analysis | SOURCE/MANUAL topology semantics | No real forwarding chain exercised |
| Network Injector | Source/manual analysis and render-only UI | SOURCE/MANUAL capabilities | Appliance and delivery flow not run |
Implants (core-*, Scout, Soldier) |
Systematic static capability audit | SOURCE claims that preserve implemented, conditional, disabled, referenced-only, absent-from-registry, and unresolved states | Never built, run, fixed, or improved; source does not prove a shipped build, compatibility, deployment, or collection success |
Exploits (vector-*) |
Metadata and history analysis | Catalogue contents and repository history | Never built, decrypted for execution, or run |
| Build/installer task | Render-only in web console | UI presence and server source contract | Web port must never create a build task |
| Synthetic demonstration evidence | Inserted through controlled lab tooling | UI/storage behavior | Not collected by an implant |
| Synthetic Worker evidence | Named automated replay with sanitized trace | Worker acceptance, DEVICE decode/store, alert log, and console push | Does not reproduce target-to-collector transport or media transforms |
Static endpoint capability matrix
The audit requires a registration or dispatch path, concrete implementation, and evidence/log/IPC sink before calling a capability Implemented. A build/runtime prerequisite makes it Conditional. Empty, commented, or deliberately inactive paths are Stub/disabled. A declaration or name without a complete local chain is Referenced only. Absence means only absence from the inspected registry. All states remain SOURCE claims.
| Platform or stage | Implemented or writer-validated families | Important qualifications |
|---|---|---|
| Android | messages/mail, contacts, calendar, device/application state, calls, chat, location, screenshots, camera, microphone, clipboard, credentials | Version-, privilege-, installed-app-, and schema-dependent paths remain conditional; native/audio trees are adjuncts |
| iOS | contacts, call list, camera, device, messages, microphone, calendar, chat | screenshot, URL, keylog, clipboard, application, and position are remote-agent registrations rather than concrete local classes |
| macOS | device, communications/chat, screen/camera, financial metadata, credentials, microphone, position, organizer, application, clipboard, files, key input, URL, VoIP-related evidence | several families use injected or IPC-backed companions |
| Linux | screenshots, device/application state, location, camera, mouse, credentials, URL, messages, contacts, chat, calls, key input, microphone, financial metadata | runtime/application prerequisites were not exercised |
| BlackBerry | messages/mail, contacts, calendar, call list, device, chat, location, screenshots, microphone, clipboard, application, URL | camera is build-conditional; password and keylog are absent from the checked registry |
| Symbian | contacts, calendar, location, messages/mail, screenshots, device, microphone, application | shared constants do not expand the eight-entry agent factory |
| Windows desktop | files, key input, screenshots, Wi-Fi location, URL, clipboard, webcam, mail, credential stores, IM/chat, device, financial metadata, mouse, application, contacts, microphone, social and VoIP-related evidence | print registration is disabled; core-win64 is a partial companion |
| Windows Mobile | messages, calendar, call list, device, location, clipboard, URL, call recording, screenshots, camera, application, microphone | declarations and mappings do not prove compatibility on every device |
| Windows Phone | direct writer confirmation for device, location, application, and camera; concrete registered bodies also exist for contacts, calendar, microphone, and screenshots | messages, call list, clipboard, and URL remain referenced or unresolved in this bounded review |
| Scout | device and screenshots | social is empty and webcam is commented out |
| Soldier | social/account data, location, clipboard, credentials, screenshots, camera, URL, device, file-related paths | standalone photo thread is disabled; provider-dependent families remain conditional |
The detailed control record, including tree hashes, representative file/line
anchors, classification rules, and remaining proof gaps, is
research/hackingteam-rcs/IMPLANT-CAPABILITY-AUDIT.md.
Runtime and compatibility patch summary
The complete original-to-lab patch inventory lists every carried source difference, omission group, new orchestration file, and verification hash. The summary groups are:
| Patch group | Files | Purpose | Claim impact |
|---|---|---|---|
| Dependency resolution | rcs-db/Gemfile, rcs-common.gemspec |
Pin versions compatible with Ruby 2.1 and the database snapshot; retain HackingTeam’s minitar fork | Runtime environment differs from an original installation |
| Cross-snapshot API shims | rcs-common/heartbeat.rb, systemstatus.rb |
Restore historically attested heartbeat hooks and status accessors onto the selected 9.6 body | Callback ordering and state mapping must identify the lab adaptation |
| Linux case sensitivity | rcs-common/evidence/url.rb |
Change require 'CGI' to require 'cgi' |
Loadability only |
| Optional historical database bindings | rcs-common/evidence/money.rb |
Avoid fatal load failure when unavailable BDB bindings are not used | Money decoding is not validated through this path |
| Worker native libraries | worker SRC, AMR, LAME, and Speex bindings |
Load Linux shared libraries and avoid fatal startup when optional codecs are absent | Rebuilt base startup and all individual transforms require recorded validation |
| Lab licence | rcs-db/make_license.rb |
Create a time-valid isolated-lab licence using keys extracted byte-exact from original source | Licence validation is original; the licence contents are synthetic |
| Container orchestration | Dockerfiles, entrypoints, Compose, Mongo setup | Recreate the expected services and sharded layout | Deployment packaging is new lab code |
| Console replacement | docker-lab/console-web/ |
Reimplement the AIR views against original contracts | All UI claims require WEB PORT or independent SOURCE/MANUAL support |
Removed Windows installers, binary dependencies, NSIS trees, OCR trees, and test material are omissions from the runtime copy rather than patches to the original archive. The read-only originals remain available for static research.
Provenance labels
| Label | Minimum evidence |
|---|---|
| LAB | Reproducible observation, command/test reference, and component version |
| SOURCE | Repository commit plus file and relevant lines |
| MANUAL | Manual title, edition/date, and printed or PDF page |
| WEB PORT | Port source/test and, when relevant, original MXML counterpart |
| REPORTING | Direct citation and wording no stronger than the source |
| INFERENCE | Explicit reasoning and the observations it connects |
Sources and evidence
- Original repositories under
data/HackingTeam/unpacked/hackedteam/. - Lab copies and documentation under
docker-lab/. - Console manual audit in
docker-lab/console-web/MANUAL-AUDIT.mdanddocker-lab/manual-audit.md.
↑ HackingTeam's RCS: Bringing a Commercial Spyware Platform Back to Life