# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.61

15 November, 2011

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page19
2. Fromtheparentprocess,load thebinaryusingLoadLibrary
3. Fromtheparentprocess,gettheparameterlessexportusingGetProcAddress(func).This
functionssignatureis:voidfunc(void)
4. Fromtheparentprocess,callfunc
7.1.13 SHUTTINGDOWNFULCRUMWITHFULCRUMSHUTDOWNASANEXE
1. CopytheFULCRUMSHUTDOWNexecutable binary(fs32.exeorfs64.exe)tothedesiredlocation.
2. Double‐clickthe
FULCRUMbinaryShuttingDownFulcrumwithFulcrumShutdownasaDLLwith
rundll32.exe
ShuttingDownFulcrumwithFulcrumShutdownasaDLLwithLoadLibrary
7.1.14 SHUTTINGDOWNFULCRUMWITHFULCRUMSHUTDOWNASADLLUSING
RUNDLL32.EXE
1. CopytheFULCRUMSHUTDOWNDLLbinary(fs32.dll orfs64.dll)tothedesiredlocation.
2. Openacommandprompt
3. Changedirectoriestothelocationofthe
FULCRUMSHUTDOWNbinary.
4. Executethebinarybytypingthefollowingcommandintothecommandprompt:
rundll32.exefs32.dll,rundll_entry
7.1.15 SHUTTINGDOWNFULCRUMWITHFULCRUMSHUTDOWNASADLLUSINGLOADLIBRARY
1. CopytheFULCRUMSHUTDOWNDLLbinary(f32.dllorf64.dll)todesiredlocation.
2. Fromtheparentprocess,loadthebinaryusingLoadLibrary
3. Fromtheparentprocess,gettheparameterlessexportusingGetProcAddress(func).This
functionssignatureis:voidfunc(void)
4. Fromtheparentprocess,callfunc
7.1.16 REMOVINGFULCRUM
1. ShutdownFULCRUMusingoneofthemethods describedinSections7.1.13,7.1.14,or7.1.15
2. Deleteallofthefollowingfiles(notallwillbepresent):
a. f32.exe
b. f32.dll
c. fs32.exe
d. fs32.dll
e. f.cfg
f. f.log



- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
- 22
- 23