# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# Shadow v1.0 - User Guide

31 August, 2012

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 13
- 14

Shadow v1.0 User Guide SECRET
(U) Appendix A: CSIDLs
CSIDL (constant special item ID list) values provide a unique system-independent way to
identify special folders used frequently by applications, but which may not have the same name
or location on any given system. For example, the system folder may be "C:\Windows" on one
system and "C:\Winnt" on another. These constants are defined in Shlobj.h. A subset of them is
also defined in Shfolder.h.
Constants
CSIDL_ADMINTOOLS (FOLDERID_AdminTools)
Version 5.0. The file system directory that is used to store administrative tools for an
individual user. The Microsoft Management Console (MMC) will save customized
consoles to this directory, and it will roam with the user.
CSIDL_ALTSTARTUP (FOLDERID_Startup)
The file system directory that corresponds to the user's nonlocalized Startup program
group. This value is recognized in Windows Vista for backward compatibility, but the
folder itself no longer exists.
CSIDL_APPDATA (FOLDERID_RoamingAppData)
Version 4.71. The file system directory that serves as a common repository for
application-specific data. A typical path is C:\Documents and Settings\
username\Application Data. This CSIDL is supported by the redistributable Shfolder.dll
for systems that do not have the Microsoft Internet Explorer 4.0 integrated Shell installed.
CSIDL_BITBUCKET (FOLDERID_RecycleBinFolder)
The virtual folder that contains the objects in the user's Recycle Bin.
CSIDL_CDBURN_AREA (FOLDERID_CDBurning)
Version 6.0. The file system directory that acts as a staging area for files waiting to be
written to a CD. A typical path is C:\Documents and Settings\ username\Local
Settings\Application Data\Microsoft\CD Burning.
CSIDL_COMMON_ADMINTOOLS (FOLDERID_CommonAdminTools)
Version 5.0. The file system directory that contains administrative tools for all users of
the computer.
CSIDL_COMMON_ALTSTARTUP (FOLDERID_CommonStartup)
SECRET
6

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 13
- 14