<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
[
  <!ENTITY intro SYSTEM "intro.sgml">
  <!ENTITY before_we_start SYSTEM "before_we_start.sgml">
  <!ENTITY magic_of_elf SYSTEM "magic_of_elf.sgml">
  <!ENTITY readelf SYSTEM "readelf.sgml">
  <!ENTITY one_step_closer SYSTEM "one_step_closer.sgml">
  <!ENTITY entry_point SYSTEM "entry_point.sgml">
  <!ENTITY rst SYSTEM "rst.sgml">
  <!ENTITY additional_cs SYSTEM "additional_cs.sgml">
  <!ENTITY doing_it_in_c SYSTEM "doing_it_in_c.sgml">

  <!ENTITY % calc SYSTEM "out/calc.sgml">
  %calc;

  <!ENTITY http_main_site "http://wildsau.idv.uni-linz.ac.at/~k3032e4">

  <!ENTITY http_jargon "http://www.tuxedo.org/~esr/jargon/html/entry/">
  <!ENTITY http_jargon_backdoor "&http_jargon;back-door.html">
  <!ENTITY http_jargon_buffer_overflow "&http_jargon;buffer-overflow.html">
  <!ENTITY http_jargon_exploit "&http_jargon;exploit.html">
  <!ENTITY http_jargon_FUD "&http_jargon;FUD.html">
  <!ENTITY http_jargon_RTFM "&http_jargon;RTFM.html">
  <!ENTITY http_jargon_script_kiddies "&http_jargon;script-kiddies.html">
  <!ENTITY http_jargon_trojan "&http_jargon;Trojan-horse.html">
  <!ENTITY http_jargon_virus "&http_jargon;virus.html">
  <!ENTITY http_jargon_worm "&http_jargon;worm.html">

  <!ENTITY http_list_linuxdoc
    "http://list.linuxdoc.org/archive/index.htm?1">
  <!ENTITY http_silvio_cesare "http://www.big.net.au/~silvio">
  <!ENTITY http_nasm_site "http://nasm.2y.net">
  <!ENTITY ftp_elf_spec_canonical
    "ftp://tsx.mit.edu/pub/linux/packages/GCC/ELF.doc.tar.gz">
  <!ENTITY http_elf_spec_flat_text
    "http://www.muppetlabs.com/~breadbox/software/ELF.txt">
  <!ENTITY http_teensy_executables
    "http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html">
  <!ENTITY http_linuxassembly_startup
    "http://linuxassembly.org/startup.html">

  <!ENTITY http_securiteam "http://www.securiteam.com">
  <!ENTITY http_securiteam_5MP022K5GE
    "&http_securiteam;/unixfocus/5MP022K5GE.html">

  <!ENTITY http_vmyths "http://vmyths.com">
  <!ENTITY http_vmyths_osama "&http_vmyths;/rant.cfm?id=410&amp;page=4">

  <!ENTITY http_newsbytes "http://www.newsbytes.com">
  <!ENTITY http_newsbytes_02_173408 "&http_newsbytes;/news/02/173408.html">

  <!ENTITY http_vnunet "http://www.vnunet.com">
  <!ENTITY http_vnunet_1127965 "&http_vnunet;/News/1127965">

  <!ENTITY cert "http://www.cert.org">
  <!ENTITY linuxdoc "http://www.linuxdoc.org">
  <!ENTITY linuxdoc_security_HOWTO "&linuxdoc;/HOWTO/Security-HOWTO.html">
  <!ENTITY linuxdoc_security_HOWTO_10 "&linuxdoc;/HOWTO/Security-HOWTO-10.html">

  <!ENTITY faqs_org "http://www.faqs.org/faqs">
  <!ENTITY faq_unix "&faqs_org;/unix-faq/faq">
  <!ENTITY faq_suicide_methods "&faqs_org;/suicide_methods">

  <!ENTITY http_qualys "http://www.qualys.com">
  <!ENTITY http_newsforge "http://newsforge.com">
  <!ENTITY http_newsforge_181122
    "&http_newsforge;/article.pl?sid=02/01/25/1811226&amp;mode=thread">
  <!ENTITY http_sourceforge "http://www.sourceforge.org">
  <!ENTITY http_freshmeat "http://www.freshmeat.net">
]>
<article id="index">

<articleinfo>
  <title>The Linux Virus Writing And Detection HOWTO</title>
  <subtitle>
    post link-time code modification of ELF executables under Linux/i386
  </subtitle>
  <author>
    <firstname>Alexander</firstname>
    <surname>Bartolich</surname>
    <affiliation>
      <address>
	<email>alexander.bartolich@gmx.at</email>
      </address>
    </affiliation>
  </author>

  <abstract>
    <para>
      Measurement is the foundation of science. This document describes
      how to write parasitic file viruses infecting ELF executables on
      Linux/i386. Though it contains a lot of source code, no actual
      virus is included.
    </para>
    <para>
      <emphasis>
	Unfinished snapshot taken on 2002-03-28.
	As a computer, I find your faith in technology amusing.
      </emphasis>
    </para>
  </abstract>

</articleinfo>

<sect1 id="intro">
  <title>Introduction</title>
  &intro;
</sect1>
<sect1 id="before_we_start" xreflabel="Before we start">
  <title>Before we start</title>
  &before_we_start;
</sect1>
<sect1 id="magic_of_elf" xreflabel="The magic of the Elf">
  <title>The magic of the Elf</title>
  &magic_of_elf;
</sect1>
<sect1 id="readelf" xreflabel="readelf">
  <title>readelf</title>
  &readelf;
</sect1>
<sect1 id="one_step_closer" xreflabel="One step closer to the edge">
  <title>One step closer to the edge</title>
  &one_step_closer;
</sect1>
<sect1 id="entry_point" xreflabel="The entry point">
  <title>The entry point</title>
  &entry_point;
</sect1>
<sect1 id="rst" xreflabel="Remote shell trojan (RST)">
  <title>Remote shell trojan (RST)</title>
  &rst;
</sect1>
<sect1 id="additional_cs" xreflabel="Additional code segments">
  <title>Additional code segments</title>
  &additional_cs;
</sect1>
<sect1 id="doing_it_in_c" xreflabel="Doing it in C">
  <title>Doing it in C</title>
  &doing_it_in_c;
</sect1>

</article>
