Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Data Transfer
SECRET//NOFORN
Stash Repository: Data Transfer
Interface Description:
Currenty this interface exposes only the following functions:
virtual DataTransErr DumpData(WCHAR *wcPath, LPBYTE lpbData, DWORD dwDataLen, DWORD dwProgramId, DWORD dwFlags) = 0;
wcPath: The path to where the data should be written. Named pipe, file, etc.
lpbData: The data to be written.
dwDataLen: The lenght of the data to be written.
dwProgramId: The unique identifier of the program. This is needed to determine ownership of data chunks.
dwFlags: Any flags needed for the writing of the data. For example, file attributes.
Returns a DataTransError which is described in the Error Code Descriptions section.
virtual DataTransErr ReadData(WCHAR *wcPath, LPBYTE &lpbData, DWORD &dwDataLen, DWORD dwProgramId) = 0;wcPath: The path the data should be read from. Named pipe, file, etc.
lpbData: The buffer that will hold the returned data.
dwDataLen: The length of the returned data.
dwProgramId: The unique identifier of the program. This is needed to determine ownership of data chunks.
Returns a DataTransError which is described in the Error Code Descriptions section.
Library Conventions:
Naming convention of classes in the Data Transfer library:
- Prefix DT (Data Transfer)
- Medium of transfer (file, covert storage, pipe, etc)
- _ Crypt specifying tool/technique, abbreviated to 2-3 letters (EZC = EZCHEESE, Rap = Raptor, etc)
Example:
DTNtfsAds_BK
DT = Data Transfer
NtfsAds = NTFSNT filesystem (Windows) Alternate Data Streams
_BK = Brutal Kangaroo (made for Brutal Kangaroo)
All modules should be compatible with Windows XPWindows operating system (Version) through the current version of Windows. This does not mean that all functionality be present. It does mean, however, that code should not crash the parent process of the library when running on Windows XPWindows operating system (Version) or greater.
Data Transfer Member List:
Transferring Data Using NTFSNTMicrosoft operating system filesystem (Windows) Alternate Data Streams (DTNtfsAds_BK - Brutal Kangaroo)
Data Transfer Via Data File (DTFile_GLPH - GLYPH)
Transfer Data By Appending To An Existing File (DTFile_PICT - PICTOGRAM)
Error Code Descriptions:
Return Code Type For The Data Transfer Library: enum DataTransErr: int.
Error codes >= 0 are successful. The return codes will work with the SUCCESS() and FAILED() macros.
enum DataTransErr : int
{
// SUCCESS CODES: >= 0
// GENERIC_SUCCESS
eDATATRANS_SUCCESS = 0,
eDATATRANS_MORE_DATA = 1, //More data left to be read
// DTNtfsAds_BK SUCESS
eDATATRANSBK_PATHS_ALREADY_GEN, //All of the link file paths have already been generated
// ERROR CODES: < 0
// GENERIC_ERROR
eDATATRANS_UNKNOWN = -1, //Unknown Failure : Unimplemented or undefined
eDATATRANS_INVALID_ARGS = -2, //Invalid Arguments
eDATATRANS_BAD_PATH = -3, //Path Not Valid
eDATATRANS_NO_MEM = -4, //Insufficient Memory
eDATATRANS_NO_MORE_DATA = -5, //No more data
eDATATRANS_CORRUPT_FILE = -6, //File is corrupted
//DTNtfsAds_BK Error
eDATATRANSBK_INVALID_FS = -35, // Volume is not NTFS
eDATATRANSBK_NO_MORE_FILES = -36, //No more files with that program id - resetting index
eDATATRANSBK_INVALID_FILE = -37, //File invalid (size to big or small)
//DTFILE_PICT Error
eDATATRANSPICT_NO_SIG = -70 //File does not contain the set signature
};Code Sample Using The Library Interface:
//Create Object
IDataTransfer *dtTransfer = new DTNtfsAds_BK();
//dump data to ADS
DataTransErr dtErr = dtTransfer->DumpData(wcNtfsVol, byData1, dwData1Len, 5, 0);
//Read data buffer
LPBYTE lpbReadData1 = NULL;
DWORD dwReadData1 = 0;
//Read in data, should match in size - ObjId0
dtErr = dtTransfer->ReadData(wcNtfsVol, lpbReadData1, dwReadData1, 5);
SECRET//NOFORN