The Linux Virus Writing HOWTO
Prev |  | Next

# A. Revision history

2002-03-09. Unfinished excerpt sent to Linux Documentation Project.

2002-03-11. Unfinished excerpt sent to David C. Merrill.

- Section One step closer to the edge rewritten & finished.

2002-03-14. Genie escaped the bottle.

- Added epigraphs to all chapters, removed one offending paragraph on the way.

- Added example for large scale scanning in The plan.

- Started The entry point.

- Started Credits.

2002-03-15. I predict that today will be remembered until tomorrow.

- First working example in The entry point.

- Lots of small fixes about everywhere.

- Renamed from "The Linux Virus Writing HOWTO" to "The Linux Virus Writing And Detection HOWTO".

2002-03-17. What we do not understand we do not possess.

- Added Before we start.

- Finished The entry point. Fixed a silly bug in the output of the heuristic scanner.

- Started Additional code segments.

2002-03-19. The mosquito exists to keep the mighty humble.

- Tuned Freedom is security.

- Changed The plan and Patching section headers to make infected executables safe for strip(1). Bug resulted from sloppy reading of the holy text.

- Started Remote shell trojan (RST).

2002-03-20. Calm down, it's *only* ones and zeroes.

- Finished Remote shell trojan (RST).

2002-03-24. Caution: Keep out of reach of children.

- Finished Additional code segments. Had to restructure One step closer to the edge to reuse framework.

2002-03-28. As a computer, I find your faith in technology amusing.

- Added In doubt use force to The magic of the Elf.

- Added Another theory to Remote shell trojan (RST).

- Simplified Additional code segments. No need to align everything to 0x1000.

2002-04-01. Be different: conform.

- Changed Target::infection and writeInfection.

- Started Doing it in C.

2002-04-06. Deliver yesterday, code today, think tomorrow.

- Reworked Introduction and Worm vs. virus.

- Progress and lots of fixes on Doing it in C. Had to change writeInfection again.

2002-04-09. Sinners can repent, but stupid is forever.

- Added alignment to One step closer to the edge and Additional code segments.

- Rewrote Dressing up binary code to emit numbers instead of a string literal. The terminating 0 would have complicated The stub.

- Added A section called .text and The stub.

2002-04-13. A doomed ship should sail under a courageous flag.

- Changed license to FDL and GPL.

- Renamed document back to original title.

- Output is generated through slightly modified `ldp.dsl`. I like `<formalpara>` to run the title in the paragraph.

- Using `<simpara>` instead of `<para>` where possible. Using `<inlinemediaobject>` instead of `<inlinegraphic>`.

- Finished Doing it in C.

2002-04-18. When you don't know what you are doing, do it neatly.

- Using `<citerefentry>` instead of `<command>`.

- Created A closer look by splitting stuff from The entry point and adding a second scanner.

- Started Suspicious code.

2002-04-23. Questionable day. Ask somebody something.

- Significantly extended abstract.

- The scanners in Turn the pages and Second scan now test the same set of files. This provides a time-warp effect for sequential readers, but makes development easier for me.

- Added more links to Paranoid android.

2002-04-25. The clash of ideas is the sound of freedom.

- Extended Behind the stages and Feedback.

2002-04-28. There are two ways to write error-free programs; only the third one works.

- Testing infections with strip(1). This affects One step closer to the edge, The entry point and Doing it in C. Additional code segments is not strip-safe, but who cares.

2002-05-05. A hacker does for love what others would not do for money.

- Doing it in C writes more than just ELF. Modified a lot of text, especially The stub.

- All implementations of `writeInfection` use constant ENTRY_POINT_OFS instead of plain `1`.

- Inserted chapter The stub revisited.

Road map. Things that might make it into the document one day.

- Setting up a chroot(1) environment.

- Analyzing a real virus with strace(1).

- Anti-debugging techniques.

- Silvio Cesare's File Virus.

- Silvio Cesare's PLT Virus (procedure linkage table).

- Subversive dynamic linking to libraries (based on a PDF by grugq).

- Have a look on Armouring the ELF: Binary encryption on the UNIX platform by grugq.

- Refute networks, heterogeneous and plausibility hosted at http://cybersoft.com/.

Prev | Home | Next
Suspicious code |  | GNU Free Documentation License