Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Time Stomper
SECRET//NOFORN
Time Stomper
Description:
Time Stomper is a high-side utility inteded to aide in modifying timestamps for files and directories. This should help when prepping files and packages for operational use. This utility allows you to choose which timestamps you change (access, modified, creation, or a combination). The SetFileTime windows APIApplication Programming Interface is used for these operations.
Design:
Arguments:
- -c (Sets Create Time)
- -m (Sets Last Write Time)
- -a (Sets Last Access Time)
- -t (Date/Time String)
- -rt (Date Range)
- -p (Path to a file or directory)
Arguments may be done in any order except in the case where the argument specifically requires a follow on argument (-p C:\Users\Docs). When running this utility you are required to choose at least one filetime to modify (-c, -m, -a). You are also required to specify a path to a file or directory. If neither -t or -rt are specified, the current time is used as the timestamp to be set for the file/directory. Time Stomper sets timestamps for both files and directories during recursion. When specifying a time string the format must fit the following: m[m]-d[d]-yyyy [hh:mm:ss] UTC. When specifying a range the format must fit the following: m[m]-d[d]-yyyy:mm-dd-yyyy [hh:hh] UTC.
Examples Of Valid Time String Values:
5-5-2015 - Sets time to May 5, 2015 at a random hour, minute and second.
12-12-2014 - Sets time to Dec 12, 2014 at a random hour, minute and second.
3-3-2014 8 - Sets time to March 3, 2014 at 8 o'clock AM (UTCCoordinate Universal Time) with a random minute and second.
4-4-2014 0:0 - Sets time to April 4, 2014 at 12 o'clock AM (UTCCoordinate Universal Time) with a random second.
6-6-2014 16:22 - Sets time to June 6, 2014 at 4:22 PM (UTCCoordinate Universal Time) with a random second
7-7-2014 20:59:32 - Sets time to July 7, 2014 at 8:59:32 PM (UTCCoordinate Universal Time)
Examples Of Invalid Time String Values:
May 5 2015 - Does not handle string formats
0-5-2015 - 0 is an invalid month. Month values (1-12).
1-0-2015 - 0 is an invalid day. Day values are (1-31)
1-1-15 - A year must be specified in 4 digits
1-1-2015 24:0:0 - 24 is an invaild hour. Range (0-23)
1-1-2015 23:60:0 - 60 is an invalid minute range (0-59)
NOTE: If hours, minutes, and seconds are not specified, they will be randomly generated. Milliseconds are always randomly generated.
Examples of Valid Date Range Values:
1-1-2015:1-2-2015
1-1-2014:12-31-2014
1-1-2015:1-1-2015 8:16
1-1-2015:12-12-2015 2:4
Examples of Invalid Date Range Values:
0-0-2015:1-1-2015
1-1-15:1-2-15
1-1-2015:1-1-2014
1-1-2015:1-2-2015 8:4
NOTE: Hours are randomly generated in the full range if not specified (0-23). Minutes, seconds and milliseconds are always randomly generated.
Example Configurations:
Stash Repository: Time Stomper Repoistory
Change Log:
('excerpt' missing)
SECRET//NOFORN