<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
[
  <!ENTITY intro SYSTEM "intro.sgml">
  <!ENTITY before.we.start SYSTEM "before_we_start.sgml">
  <!ENTITY magic.of.elf SYSTEM "magic_of_elf.sgml">
  <!ENTITY readelf SYSTEM "readelf.sgml">
  <!ENTITY one.step.closer SYSTEM "one_step_closer.sgml">
  <!ENTITY a.closer.look SYSTEM "a_closer_look.sgml">
  <!ENTITY entry.point SYSTEM "entry_point.sgml">
  <!ENTITY rst SYSTEM "rst.sgml">
  <!ENTITY additional.cs SYSTEM "additional_cs.sgml">
  <!ENTITY doing.it.in.c SYSTEM "doing_it_in_c.sgml">
  <!ENTITY stub.revisited SYSTEM "stub_revisited.sgml">
  <!ENTITY suspicious.code SYSTEM "suspicious_code.sgml">
  <!ENTITY revision.history SYSTEM "revision_history.sgml">

  <!ENTITY % calc SYSTEM "out/calc.sgml">
  %calc;

  <!ENTITY http.wildsau "http://wildsau.idv.uni-linz.ac.at/~k3032e4/">
  <!ENTITY http.peaceful "http://www.peacefulaction.org/">
  <!ENTITY http.enemy "http://virus.enemy.org/">
  <!ENTITY http.lwfug "http://www.lwfug.org/">
  <!ENTITY http.rick "http://linuxmafia.com/~rick/">

  <!ENTITY http.jargon "http://www.tuxedo.org/~esr/jargon/html/entry/">
  <!ENTITY http.jargon.backdoor "&http.jargon;back-door.html">
  <!ENTITY http.jargon.buffer.overflow "&http.jargon;buffer-overflow.html">
  <!ENTITY http.jargon.exploit "&http.jargon;exploit.html">
  <!ENTITY http.jargon.FUD "&http.jargon;FUD.html">
  <!ENTITY http.jargon.RTFM "&http.jargon;RTFM.html">
  <!ENTITY http.jargon.script.kiddies "&http.jargon;script-kiddies.html">
  <!ENTITY http.jargon.trojan "&http.jargon;Trojan-horse.html">
  <!ENTITY http.jargon.virus "&http.jargon;virus.html">
  <!ENTITY http.jargon.worm "&http.jargon;worm.html">

  <!--  <!ENTITY http.list.linuxdoc
    "http://list.linuxdoc.org/archive/index.htm?1"> -->
  <!ENTITY http.list.linuxdoc "http://en.tldp.org/mailinfo.html">
  <!ENTITY http.netgeo "http://netgeo.caida.org/perl/netgeo.cgi">
  <!ENTITY http.visualroute "http://visualroute.visualware.com">

  <!ENTITY http.silvio.cesare "http://www.big.net.au/~silvio">
  <!ENTITY http.nasm "http://nasm.2y.net">
  <!ENTITY http.octium "http://www.octium.net/">
  <!ENTITY http.nasmdoc "&http.octium;oldnasm/docs/">

  <!ENTITY ftp.elf.spec.canonical
    "ftp://tsx.mit.edu/pub/linux/packages/GCC/ELF.doc.tar.gz">
  <!ENTITY http.elf.spec.flat.text
    "http://www.muppetlabs.com/~breadbox/software/ELF.txt">
  <!ENTITY http.teensy.executables
    "http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html">
  <!ENTITY http.linuxassembly "http://linuxassembly.org/">
  <!ENTITY http.linuxassembly.startup "&http.linuxassembly;startup.html">
  <!ENTITY http.asmutils "&http.linuxassembly;asmutils.html">

  <!ENTITY http.securiteam "http://www.securiteam.com">
  <!ENTITY http.securiteam.5MP022K5GE
    "&http.securiteam;/unixfocus/5MP022K5GE.html">

  <!ENTITY http.vmyths "http://vmyths.com">
  <!ENTITY http.vmyths.osama "&http.vmyths;/rant.cfm?id=410&amp;page=4">

  <!ENTITY http.newsbytes "http://www.newsbytes.com">
  <!ENTITY http.newsbytes.02.173408 "&http.newsbytes;/news/02/173408.html">

  <!ENTITY http.vnunet "http://www.vnunet.com">
  <!ENTITY http.vnunet.1127965 "&http.vnunet;/News/1127965">

  <!ENTITY http.cert "http://www.cert.org">
  <!ENTITY http.linuxdoc "http://www.linuxdoc.org">
  <!ENTITY http.linuxdoc.security.HOWTO
    "&http.linuxdoc;/HOWTO/Security-HOWTO.html">
  <!ENTITY http.linuxdoc.security.HOWTO.10
    "&http.linuxdoc;/HOWTO/Security-HOWTO-10.html">

  <!ENTITY faqs.org "http://www.faqs.org/faqs">
  <!ENTITY faq.unix "&faqs.org;/unix-faq/faq">
  <!ENTITY faq.suicide.methods "&faqs.org;/suicide_methods">

  <!ENTITY http.sans.org "http://www.sans.org">
  <!ENTITY http.sans.org.ids
    "&http.sans.org;/newlook/resources/IDFAQ/ID_FAQ.htm">

  <!ENTITY http.qualys "http://www.qualys.com">
  <!ENTITY http.newsforge "http://newsforge.com">
  <!ENTITY http.newsforge.181122
    "&http.newsforge;/article.pl?sid=02/01/25/1811226&amp;mode=thread">
  <!ENTITY http.sourceforge "http://www.sourceforge.org/">
  <!ENTITY http.freshmeat "http://www.freshmeat.net/">
  <!ENTITY http.slashdot "http://www.slashdot.org/">

  <!ENTITY http.virus.plural "http://www.perl.com/language/misc/virus.html">
  <!ENTITY http.cybersoft "http://cybersoft.com/">
  <!ENTITY http.cybersoft.papers "&http.cybersoft;whitepapers/papers">

  <!ENTITY http.samhna "http://la-samhna.de/">
]>
<article id="index">

<articleinfo>
  <title>The Linux Virus Writing HOWTO</title>
  <titleabbrev>TLVWH</titleabbrev>
  <subtitle>
    post link-time code modification of ELF executables under Linux/i386
  </subtitle>

  <author>
    <firstname>Alexander</firstname>
    <surname>Bartolich</surname>
    <affiliation>
      <address>
	<email>alexander.bartolich@gmx.at</email>
      </address>
    </affiliation>
  </author>

  <abstract>
    <simpara>
      This document describes how to write parasitic file viruses
      infecting ELF executables on Linux/i386. Though it contains a
      lot of source code, no actual virus is included.
      Every mentioned infection method is accompanied with a
      practical guide to detection.
    </simpara>
    <simpara>
      This is work in progress. Expected outcome is convincing
      evidence that popular distributions contain everything
      necessary to develop, detect and control viruses.
      And that it requires considerable cooperation
      or outright negligent behavior to give viruses any foothold.
    </simpara>
    <simpara>
      <emphasis role="strong">Viruses are not a threat to Linux!</emphasis>
    </simpara>
    <simpara>
      A quote from
      <ulink url="http://linuxmafia.com/~rick/faq/#virus"
      >Rick's Rant on anti-virus software</ulink>:
    </simpara>
    <simpara>
      <emphasis>
	The problem with answering this question is that those asking
	it know only OSes where viruses, trojan-horse programs, worms,
	nasty Java scripts, ActiveX controls with destructive payloads,
	and ordinary misbehaved applications are a constant threat to
	their computing. Therefore, they refuse to believe Linux could
	be different, no matter what they hear. And yet it is. 
      </emphasis>
    </simpara>
  </abstract>

  <copyright>
    <year>2002</year>
    <holder>Alexander Bartolich</holder>
  </copyright>

  <revhistory>
    <revision>
      <revnumber>
        <link linkend="rev.2002.05.05"
	  >A hacker does for love what others would not do for money.</link>
      </revnumber>
      <date>2002-05-05</date>
      <revremark>
        <link linkend="doing.it.in.c">Doing it in C</link>
	writes more than just ELF. Inserted chapter
	<link linkend="stub.revisited">The stub revisited</link>.
      </revremark>
    </revision>
  </revhistory>

</articleinfo>

<sect1 id="intro" xreflabel="Introduction">
  <title>Introduction</title>
  &intro;
</sect1>
<sect1 id="before.we.start" xreflabel="Before we start">
  <title>Before we start</title>
  &before.we.start;
</sect1>
<sect1 id="magic.of.elf" xreflabel="The magic of the Elf">
  <title>The magic of the Elf</title>
  &magic.of.elf;
</sect1>
<sect1 id="readelf" xreflabel="readelf">
  <title>readelf</title>
  &readelf;
</sect1>
<sect1 id="one.step.closer" xreflabel="One step closer to the edge">
  <title>One step closer to the edge</title>
  &one.step.closer;
</sect1>
<sect1 id="a.closer.look" xreflabel="A closer look">
  <title>A closer look</title>
  &a.closer.look;
</sect1>
<sect1 id="entry.point" xreflabel="The entry point">
  <title>The entry point</title>
  &entry.point;
</sect1>
<sect1 id="rst" xreflabel="Remote shell trojan (RST)">
  <title>Remote shell trojan (<acronym>RST</acronym>)</title>
  &rst;
</sect1>
<sect1 id="additional.cs" xreflabel="Additional code segments">
  <title>Additional code segments</title>
  &additional.cs;
</sect1>
<sect1 id="doing.it.in.c" xreflabel="Doing it in C">
  <title>Doing it in C</title>
  &doing.it.in.c;
</sect1>
<sect1 id="stub.revisited" xreflabel="The stub revisited">
  <title>The stub revisited</title>
  &stub.revisited
</sect1>
<sect1 id="suspicious.code" xreflabel="Suspicious code">
  <title>Suspicious code</title>
  &suspicious.code;
</sect1>

<appendix id="revision.history">
  <title>Revision history</title>
  &revision.history;
</appendix>

<appendix id="license.FDL" xreflabel="GNU Free Documentation License">
  <title>GNU Free Documentation License</title>
  <!--
   ! 2002-04-11 Alexander Bartolich
   ! A plain mediobject produces unreadable text without
   ! line breaks or paragraps on my RedHat 7.2 setup.
  -->
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../FDL.txt" format="linespecific"
  ></imageobject></inlinemediaobject></programlisting>
</appendix>

<appendix id="license.GPL" xreflabel="GNU General Public License">
  <title>GNU General Public License</title>
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../GPL.txt" format="linespecific"
  ></imageobject></inlinemediaobject></programlisting>
</appendix>

</article>
