Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Data Transfer
SECRET//NOFORN
Stash Repository: Data Transfer
Interface Description:
Currenty this interface exposes only the following functions:
virtual DataTransErr DumpData(WCHAR *wcPath, LPBYTE lpbData, DWORD dwDataLen, DWORD dwProgramId, DWORD dwFlags) = 0;
wcPath: The path to where the data should be written. Named pipe, file, etc.
lpbData: The data to be written.
dwDataLen: The lenght of the data to be written.
dwProgramId: The unique identifier of the program. This is needed to determine ownership of data chunks.
dwFlags: Any flags needed for the writing of the data. For example, file attributes.
Returns a DataTransError which is described in the Error Code Descriptions section.
virtual DataTransErr ReadData(WCHAR *wcPath, LPBYTE &lpbData, DWORD &dwDataLen, DWORD dwProgramId) = 0;wcPath: The path the data should be read from. Named pipe, file, etc.
lpbData: The buffer that will hold the returned data.
dwDataLen: The length of the returned data.
dwProgramId: The unique identifier of the program. This is needed to determine ownership of data chunks.
Returns a DataTransError which is described in the Error Code Descriptions section.
Library Conventions:
Naming convention of classes in the Data Transfer library:
- Prefix DT (Data Transfer)
- Medium of transfer (file, covert storage, pipe, etc)
- _ Crypt specifying tool/technique, abbreviated to 2-3 letters (EZC = EZCHEESE, Rap = Raptor, etc)
Example:
DTNtfsAds_BK
DT = Data Transfer
NtfsAds = NTFSNT filesystem (Windows) Alternate Data Streams
_BK = Brutal Kangaroo (made for Brutal Kangaroo)
Data Transfer Member List:
Transferring Data Using NTFSNTMicrosoft operating system filesystem (Windows) Alternate Data Streams (DTNtfsAds_BK - Brutal Kangaroo)
Data Transfer Via Data File (DTFile_GLPH - GLYPH)
Transfer Data By Appending To An Existing File (DTFile_PICT - PICTOGRAM)
Error Code Descriptions:
Return Code Type For The Data Transfer Library: enum DataTransErr: int.
Error codes >= 0 are successful. The return codes will work with the SUCCESS() and FAILED() macros.
enum DataTransErr : int
{
// SUCCESS CODES: >= 0
// GENERIC_SUCCESS
eDATATRANS_SUCCESS = 0,
eDATATRANS_MORE_DATA = 1, //More data left to be read
// DTNtfsAds_BK SUCESS
eDATATRANSBK_PATHS_ALREADY_GEN, //All of the link file paths have already been generated
// ERROR CODES: < 0
// GENERIC_ERROR
eDATATRANS_UNKNOWN = -1, //Unknown Failure : Unimplemented or undefined
eDATATRANS_INVALID_ARGS = -2, //Invalid Arguments
eDATATRANS_BAD_PATH = -3, //Path Not Valid
eDATATRANS_NO_MEM = -4, //Insufficient Memory
eDATATRANS_NO_MORE_DATA = -5, //No more data
eDATATRANS_CORRUPT_FILE = -6, //File is corrupted
//DTNtfsAds_BK Error
eDATATRANSBK_INVALID_FS = -35, // Volume is not NTFS
eDATATRANSBK_NO_MORE_FILES = -36, //No more files with that program id - resetting index
eDATATRANSBK_INVALID_FILE = -37, //File invalid (size to big or small)
//DTFILE_PICT Error
eDATATRANSPICT_NO_SIG = -70 //File does not contain the set signature
};Code Sample Using The Library Interface:
//Create Object
IDataTransfer *dtTransfer = new DTNtfsAds_BK();
//dump data to ADS
DataTransErr dtErr = dtTransfer->DumpData(wcNtfsVol, byData1, dwData1Len, 5, 0);
//Read data buffer
LPBYTE lpbReadData1 = NULL;
DWORD dwReadData1 = 0;
//Read in data, should match in size - ObjId0
dtErr = dtTransfer->ReadData(wcNtfsVol, lpbReadData1, dwReadData1, 5);SECRET//NOFORN