Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Data Transfer Via Data File (DTFile_GLPH)
SECRET//NOFORN
OSB Library: Data Transfer.
Module Name: DTFile_GLPH (GLYPH)
Module Description: This module transfers or stores data by writing it to a file. Multiple chunks (calls to DumpData) from multiple programs can be written to the same file. The program id is used to identify the owner of a specific chunk.
PSP/OS Issues: No known issues.
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house (not a novel concept)
Notes:
- wcPath should be the path to the file to which data should be stored. The path should not point to a file that is already created unless it was created by this module.
- The program id should be unique and may not be 0.
- Multiple program ids can be written to the same path.
- A read chunk index is kept for optimization. If the program id changes, the read index is reset to 0.
Module Specific Structures:
The header used in data chunk storage.
struct DATA_HEAD_GLPH
{
DWORD dwProgramId;
DWORD dwDataLen;
};
Example Code:
//Create Object
IDataTransfer *dtTransfer = new DTFile_GLPH();
//dump and read multiple sets of data
WCHAR wcDrivePath[] = L"H:\\MyFile.dat";
DWORD dwAttribs = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_READONLY;
dtTransfer->DumpData(wcDrivePath, byData1, dwData1Len, 5, dwAttribs);
dtTransfer->DumpData(wcDrivePath, byData2, dwData2Len, 6, dwAttribs);
dtTransfer->DumpData(wcDrivePath, byData3, dwData3Len, 5, dwAttribs);
//Data Buffers
LPBYTE lpbReadData1 = NULL;
DWORD dwReadData1 = 0;
LPBYTE lpbReadData2 = NULL;
DWORD dwReadData2 = 0;
LPBYTE lpbReadData3 = NULL;
DWORD dwReadData3 = 0;
//Read Data
dtTransfer->ReadData(wcDrivePath, lpbReadData1, dwReadData1, 5);
dtTransfer->ReadData(wcDrivePath, lpbReadData2, dwReadData2, 5);
dtTransfer->ReadData(wcDrivePath, lpbReadData3, dwReadData3, 6); //Won't find data if index has already passed it. when reading different program id create new object
//Cleanup
if (lpbReadData1) free(lpbReadData1);
if (lpbReadData2) free(lpbReadData2);
if (lpbReadData3) free(lpbReadData3);
delete dtTransfer;
SECRET//NOFORN