Skip to main content

files.cpp (File I/O)

Source: src/modules/files.cpp

The files module handles the physical transfer of data bytes between the implant's memory and the host's disk. It is divided into two distinct functions: get_file (Download) and put_file (Upload).

Function: get_file​

Reads a file from the host OS and returns it for exfiltration.

Function Signature​

ModuleResult get_file(std::string file_path);

Logic & Behavior​

  1. Handle Acquisition: Opens the file using CreateFileW with GENERIC_READ permissions and FILE_SHARE_READ (allowing other processes to read the file simultaneously).
  2. Size Calculation: Uses GetFileSizeEx to determine the exact number of bytes to allocate for the buffer.
  3. Reading: Reads the file contents into a std::string buffer.

Return Values (ModuleResult)​

  • data: The raw binary contents of the file.
  • windows_error_code:
    • ERROR_SUCCESS (0): File read successfully.
    • WinAPI Error: If the file is locked, doesn't exist, or access is denied, returns the relevant GetLastError() code.

Function: put_file​

Writes a stream of bytes from the implant to the host disk.

Function Signature​

ModuleResult put_file(std::vector<uint8_t> file_contents, std::string file_path);

Logic & Behavior​

  1. Handle Acquisition: Opens a handle using CreateFileW with GENERIC_WRITE, and a dwShareMode of 0 (this prevents other processes from Read, Write, or Delete while we write our info) .
  2. Creation Flags: Uses CREATE_NEW.
  • Note: This means the operation will fail if the file already exists. It does not overwrite by default to prevent accidental data destruction on the target.
  1. Locking: Uses 0 for share mode, preventing other processes from accessing the file while it is being written.

Return Values (ModuleResult)​

  • data: A status message (e.g., "File written successfully").
  • windows_error_code:
    • ERROR_SUCCESS (0): Write completed.
    • ERROR_FILE_EXISTS (80): Common error if the target file already exists (due to CREATE_NEW).