Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

Parameters
Return Value
Upon successful completion STATUS_SUCCESS will be returned.
Remarks
As bmfsDefrag() cleans up it will wipe any memory that may no longer be in
use.
bmfsDefrag() requires at least 15% of the volume be free to run successfully.
bmfsUninstall
Attempts to remove the file system.
NTSTATUS bmfsUninstall( void );
Parameters
Return Value
Upon successful completion STATUS_SUCCESS will be returned.
Remarks
bmfsUninstall will wipe all data on the BadMFS volume. Currently it does one
pass with zeros, which upon investigation could be a signal that something
has been there. Because data written to disk with BadMFS is not encrypted
in any way it is recommended that bmfsUninstall() be used to wipe the file
system before removing the tool making use of BadMFS.
bmfsScramble
Attempts to scramble data in the supplied buffer using a simple xor operation.
NTSTATUS bmfsScramble( [in|out] BYTE *buffer, [in] DWORD dwLen, [in] DWORD
dwPos );
Parameters
buffer [in|out]
Buffer to be scrambled.
dwLen [in]
Length of buffer to be scrambled.

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh