# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# Shadow v1.0 - User Guide

31 August, 2012

- 1
- 2
…
- 11
- 12
- 13
- 14

Shadow v1.0 User Guide SECRET
Version 5.0. A folder for components that are shared across applications. A typical path
is C:\Program Files\Common. Valid only for Windows NT, Windows 2000, and
Windows XP systems. Not valid for Windows Millennium Edition (Windows Me).
CSIDL_PROGRAM_FILES_COMMONX86 (FOLDERID_ProgramFilesCommonX86)
CSIDL_PROGRAMS (FOLDERID_Programs)
The file system directory that contains the user's program groups (which are themselves
file system directories). A typical path is C:\Documents and Settings\ username\Start
Menu\Programs.
CSIDL_RECENT (FOLDERID_Recent)
The file system directory that contains shortcuts to the user's most recently used
documents. A typical path is C:\Documents and Settings\ username\My Recent
Documents. To create a shortcut in this folder, use SHAddToRecentDocs. In addition to
creating the shortcut, this function updates the Shell's list of recent documents and adds
the shortcut to the My Recent Documents submenu of the Start menu.
CSIDL_RESOURCES (FOLDERID_ResourceDir)
Windows Vista. The file system directory that contains resource data. A typical path is
C:\Windows\Resources.
CSIDL_RESOURCES_LOCALIZED (FOLDERID_LocalizedResourcesDir)
CSIDL_SENDTO (FOLDERID_SendTo)
The file system directory that contains Send To menu items. A typical path is
C:\Documents and Settings\ username\SendTo.
CSIDL_STARTMENU (FOLDERID_StartMenu)
The file system directory that contains Start menu items. A typical path is C:\Documents
and Settings\ username\Start Menu.
CSIDL_STARTUP (FOLDERID_Startup)
The file system directory that corresponds to the user's Startup program group. The
system starts these programs whenever any user logs onto Windows NT or starts
Windows 95. A typical path is C:\Documents and Settings\ username\Start
Menu\Programs\Startup.
CSIDL_SYSTEM (FOLDERID_System)
Version 5.0. The Windows System folder. A typical path is C:\Windows\System32.
CSIDL_SYSTEMX86 (FOLDERID_SystemX86)
CSIDL_TEMPLATES (FOLDERID_Templates)
The file system directory that serves as a common repository for document templates. A
typical path is C:\Documents and Settings\ username\Templates.
CSIDL_WINDOWS (FOLDERID_Windows)
Version 5.0. The Windows directory or SYSROOT. This corresponds to the %windir%
or %SYSTEMROOT% environment variables. A typical path is C:\Windows.
Flags
CSIDL_FLAG_CREATE (KF_FLAG_CREATE)
Version 5.0. Combine with another CSIDL to force the creation of the associated folder
if it does not exist.
CSIDL_FLAG_DONT_UNEXPAND (KF_FLAG_DONT_UNEXPAND)
Combine with another CSIDL constant to ensure the expansion of environment variables.
CSIDL_FLAG_DONT_VERIFY (KF_FLAG_DONT_VERIFY)
SECRET
10

- 1
- 2
…
- 11
- 12
- 13
- 14