Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Persistence
SECRET//NOFORN
Stash Repository: Persistence Library
Interface Description: The interface for the Persistence Vectors Library (IPersistence - IPersist is used already in Windows) specifies two functions: PersistPayload and RemovePersistence. The prototypes are as follows:
/*
Persist your payload. Provide the target path of the payload residing on disk. A pvoid struct allows you to pass a module specific structure. This should include an identifier that should also be used in deciding which item to remove persistence from.
*/
virtual PersistErr PersistPayload(WCHAR *wcTargetPath, PVOID pvStruct) = 0;
wcTargetPath: The path to the payload that you wish to persist.
pvStruct: A module specific structure (should be defined on the module page) allowing for configuration and identification of a persisting item.
Returns PersistErr documented in the error code description section.
/*
Remove persistence for a given payload. Supply a module specific structure that should help in identifying which item to remove persistence from.
*/
virtual PersistErr RemovePersistence(PVOID pvStruct) = 0;
pvStruct: A module specific structure (should be defined on the module page) specifying an identifier for the persisting item to be removed.
Returns PersistErr documented in the error code description section.
Library Conventions: Describe any and all conventions submissions should adhere to for this library. Applying a naming convention can help with the organization of the library. Any organizational requirements or notes go here as well.
XXXXXX Member List: (ex: Execution Vector Member List where the library is execution vectors)
Technique/Class 1 with Link or Anchor to Technique - Class Name: xxxxxx
Example of technique/class in Survey Library: Get User Name(Link to Get User Name Windows APIApplication Programming Interface Module Page) - Class Name: GetUsersName_WinApi
Error Code Descriptions: List error codes with descriptions. Use either a bulleted list or the code block macro. Remember, error codes must be compatible with the SUCCEEDED() and FAILED() macros.
- Error Codes List
Code Sample Using The Library Interface:
SECRET//NOFORN