Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

on the supplied device. If a previously installed version of BadMFS is found
nothing further
is required. If an appropriate location is found without a previous BadMFS
installation
bmfsInitialize will attempt to install BadMFS there.
bmfsPartitionInfo
Retrieves information about the BadMFS partition. Information may only be correct
for a limited time due to a multi-threaded and/or multi-process environment .
NTSTATUS bmfsPartitionInfo( [out] PBadMFS_FSINFO bmfsPartInfo );
Parameters
PBadMFS_FSINFO bmfsPartInfo [out]
Structure which will contain information about the BadMFS partition.
Return Value
STATUS_SUCCESS will be returned if bmfsPartitionInfo returns successfully, or
a NTSTATUS error
code if otherwise.
Upon successful return the supplied BadMFS_FSINFO structure will contain
information about
the BadMFS partition.
Remarks
Information returned by bmfsPartitionInfo cannot be guaranteed to be
relevant for an extended
amount of time. The structure will not necessarily be up to date from
moment to moment due
to BadMFS being potentially multi-threaded or multi-process. Use with care.
bmfsCreateFile
Creates or opens a file within BadMFS. The method will supply a handle if no errors
occur, which can be used to read or write to the file.
NTSTATUS MexCreateFile(
[in] PWCHAR pwcFileName,
[in] DWORD dwAccessFlags,
[in] DWORD dwCreateFlags,
[out] BadMFS_HANDLE *handle
);
Parameters
pwcFileName [in]
The name of the file to be created or opened.

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh