Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Concepts: OSB Project Wizard
OSB Project Wizard:
- Works for Visual Studio 2010 through Visual Studio 2013
- Optimizes project settings
- Allows you to choose submodules (including the Dynamic Libraries)
- Sets up author/req #/desc etc
- Sets up a git local repository on creation of a new project
- Using the Project Wizard ensures compatibility
The OSBOperation Support Branch project wizard will help setup the project to allow you to use any and all of the OSBOperation Support Branch Libraries.
Located at
/*
* Filename: DataTransfer.h
*
* Library Maintainer: User #76935 - OSB
* Date Created: 6/26/2014
* Version 1.0: 6/26/2014 ()
*
*/
#pragma once
#include <Windows.h>
/*
-----------------------Class/Module Naming Convention----------------------
Naming convention of classes in the Persistence Library
Prefix PS (Persist)
E/D What type of payload the module will persist (E = .exe, D = .dll, ED = Supports both .exe and .dll)
Description of method/technique (scheduled task, run key, etc)
Crypt Name
Example:
PSEDSchedTask_TP
PS = Persist
ED = Supports persistence of .exe and .dll
SchedTask = Scheduled Task
_TP = Crypt - TrickPlay
*If persisting a DLLDynamic Link Library the module documentation should state whether the dll is persisted via a call to DllMain vs a supplied entry point
---------------------------------------------------------------------------
*/
//EVRET is to identify ExecutionVector return codes. These work with the SUCCEEDDED and FAILED macros.
enum PersistErr : int
{
// SUCCESS CODES: >= 0
// GENERIC_SUCCESS
ePERSIST_SUCCESS = 0,
// ERROR CODES: < 0
// GENERIC_ERROR
ePERSIST_UNKNOWN = -1, //Unknown Failure : Unimplemented or undefined
ePERSIST_INVALID_ARGS = -2, //Invalid Arguments
ePERSIST_BAD_PATH = -3, //Path Not Valid
ePERSIST_UNSUPPORTED = -4 //Unsupported function of the interface
};
class IPersist
{
public:
IPersist(void);
virtual ~IPersist(void) = 0;
/*
Persist your payload. Provide the target path of the payload residing on disk. A pvoid struct allows you to pass a module specific structure. This should include an identifier that should also be used in deciding which item to remove persistence from.
*/
virtual PersistErr PersistPayload(WCHAR *wcTargetPath, PVOID pvStruct) = 0;
/*
Remove persistence for a given payload. Supply a module specific structure that should help in identifying which item to remove persistence from.
*/
virtual PersistErr RemovePersistence(PVOID pvStruct) = 0;
};
Concepts: Git/Stash >>
Related articles
Related articles appear here based on the labels you select. Click to edit the macro and add or change labels.
('contentbylabel' missing)