Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Persistence
SECRET//NOFORN
Stash Repository: Persistence Library
Interface Description: The interface for the Persistence Vectors Library (IPersistence - IPersist is used already in Windows) specifies two functions: PersistPayload and RemovePersistence. The prototypes are as follows:
/*
Persist your payload. Provide the target path of the payload residing on disk. A pvoid struct allows you to pass a module specific structure. This should include an identifier that should also be used in deciding which item to remove persistence from.
*/
virtual PersistErr PersistPayload(WCHAR *wcTargetPath, PVOID pvStruct) = 0;
wcTargetPath: The path to the payload that you wish to persist.
pvStruct: A module specific structure (should be defined on the module page) allowing for configuration and identification of a persisting item.
Returns PersistErr documented in the error code description section.
/*
Remove persistence for a given payload. Supply a module specific structure that should help in identifying which item to remove persistence from.
*/
virtual PersistErr RemovePersistence(PVOID pvStruct) = 0;
pvStruct: A module specific structure (should be defined on the module page) specifying an identifier for the persisting item to be removed.
Returns PersistErr documented in the error code description section.
Library Conventions:
Naming convention of classes in the Persistence Library:
- Prefex PS (Persist)
- Indication of supported payload types (E = .exe, D = .dll, ED = supports both .exe and .dll persistence, etc)
- Description of method/technique (scheduled task, run key, etc)
_Crypt specifying the tool/technique. 2-5 letters
Example:
PSEDSchedTask_TP
PS = Persistence
ED = both .exe and .dll persistence
SchedTask = Scheduled Task
_TP = TrickPlay
All modules should be compatible with Windows XPWindows operating system (Version) through the current version of Windows. This does not mean that all functionality be present. It does mean, however, that code should not crash the parent process of the library when running on Windows XPWindows operating system (Version) or greater.
Persistence Library Member List:
Scheduled Task Persistence (PSEDSchedTask_TP - TrickPlay)
COM + Junction Folder User Persistence (PSDComJunction_HCLS - HighClass)
Error Code Descriptions: List error codes with descriptions. Use either a bulleted list or the code block macro. Remember, error codes must be compatible with the SUCCEEDED() and FAILED() macros.
- Error Codes List
Code Sample Using The Library Interface:
SECRET//NOFORN