<epigraph>
  <attribution>R. W. Hamming</attribution>
  <simpara>You cannot have a science without measurement.</simpara>
</epigraph>

<simpara>
  Writing a program that inserts code into another program file is one
  thing. Writing that program so that it can be injected itself is a
  very different art. Although this document shows a lot of code
  and technique, it is far from being a
  <quote>Construction Kit For Dummies</quote>.
  You can't build a working virus just by copying whole lines from
  this text. Instead I'll try to show how things work.
  Translation of infecting code to a assembly is left as a
  (non-trivial) exercise to the reader.
</simpara>
<simpara>
  An astonishing number of people think that viruses require
  secret black magic. Here you will find simple code that patches
  other executables. It is not hard to write a virus (once you
  have a good understanding of assembler, compiler, linker and
  operating system). It's just hard to let it make any impact.
</simpara>
<simpara>
  Regular users can't overwrite system files (at least under serious
  operating systems). So you need root permissions. You can either
  trick the super user to run your virus. Or combine it with a
  root-exploit. But since all popular distributions come with
  checksum mechanisms, a single command can detect any modification.
  Unless you implement kernel-level stealth functionality&hellip;
</simpara>
<simpara>
  I do believe that free software is superior, at least in regard
  to security.  And I strongly oppose the argument that Linux viruses
  will flourish once it reaches a critical mass of popularity.
  On the contrary I question the credibility of people whose income
  relies on widespread use of ridiculously insecure operating systems.
</simpara>
<simpara>
  This document is my way to fight the
  <ulink url="&http.jargon.FUD;">FUD</ulink>.
  Use the information presented here in any way you like.
  I bet that Linux will only grow stronger.
</simpara>

<sect2 id="behind.the.stages" xreflabel="Behind the stages">
  <title>Behind the stages</title>

  <simpara>
    All sections titled <quote>Output</quote> are real product
    of source code and shell scripts included in this document.
    Most numbers and calculations are processed by a
    <application>Perl</application> script parsing these output files.
    The document itself is written in 
    <ulink url="http://docbook.sourceforge.net/">DocBook</ulink>,
    a SGML document type definition. Conversion to HTML is the last
    step of a Makefile that builds and runs all examples.
  </simpara>
  <simpara>
    I used an installation of
    <ulink url="http://www.redhat.com/">RedHat</ulink> 7.2 for
    development. The
    <ulink url="http://www.redhat.com/download/howto_download.html"
      >freely downloadable CDs</ulink> contains all necessary tools.
  </simpara>
  <simpara>
    This document is not yet officially accepted by LDP.
    You might want to look at the discussion on 
    <ulink url="&http.list.linuxdoc;">LDP-discuss</ulink>.
    For the time being you will find the document at the sites
    listed in appendix <xref linkend="mirrors">.
  </simpara>

</sect2>
<sect2 id="copyright">
  <title>Copyright &amp; trademarks</title>

  <simpara>
    This document, <emphasis>The Linux Virus Writing HOWTO</emphasis>,
    is copyrighted (c) 2002 by <emphasis>Alexander Bartolich</emphasis>.
  </simpara>
  <simpara>
    Permission is granted to copy, distribute and/or modify this
    document under the terms of the <xref linkend="license.FDL">,
    Version 1.1, or any later version published by the
    Free Software Foundation; with no Invariant Sections,
    with no Front-Cover Texts, and with no Back-Cover Texts.
  </simpara>
  <simpara>
    All accompanying source code, build scripts and makefiles is
    free software; you can redistribute it and/or modify it under
    the terms of the <xref linkend="license.GPL"> as published by
    the Free Software Foundation; either version 2 of the License,
    or (at your option) any later version.
  </simpara>
  <simpara>
    All copyrights are held by their respective owners, unless
    specifically noted otherwise. Use of a term in this document
    should not be regarded as affecting the validity of any trademark
    or service mark.
  </simpara>
  <simpara>
    Naming of particular products or brands should not be seen
    as endorsements.
  </simpara>

</sect2>

<sect2 id="disclaimer">
  <title>Disclaimer</title>

  <simpara>
    No liability for the contents of this documents can be accepted.
    Use the concepts, examples and other content at your own risk.
    As this is a new edition of this document, there may be errors
    and inaccuracies, that may of course be damaging to your system.
    Proceed with caution, the author does not take any responsibility.
  </simpara>
  <simpara>
    All software is distributed in the hope that it will be useful,
    but without any warranty; without even the implied warranty of
    merchantability or fitness for a particular purpose. 
    See the <ulink url="&http.gpl;">GPL</ulink> for more details.
  </simpara>
  <simpara>
    <emphasis>
      Who am I kidding? This is dangerous stuff!
      Stop reading immediately or risk lethal pollution of your systems!
    </emphasis>
  </simpara>
  <simpara>
    You are strongly recommended to take a backup of your system
    before major installations and backups at regular intervals.
  </simpara>
</sect2>

<sect2 id="credits" xreflabel="Credits">
  <title>Credits</title>

  <simpara>
    Everything in this document is either plain obvious or has been
    written by someone else long time ago. My meager contribution is
    nice formatting, reproducibility and the idea to take the subject
    to mainstream media. But I'm certainly not innovative.
  </simpara>

  <formalpara>
    <title>Silvio Cesare</title>
    <para>
      <email>silvio@big.net.au</email>
      Founder of the trade. Keeper of the source. Check out
      <ulink url="&http.silvio.cesare;">&http.silvio.cesare;</ulink>
      and admire the release date.
    </para>
  </formalpara>

  <formalpara>
    <title>John Reiser</title>
    <para>
      <email>jreiser@BitWagon.com</email>
      Found one bug and two superfluous bytes in <xref linkend="evil.magic">.
      Proved that I can't code a straight &calc.evil.magic.codesize.D;
      byte <quote>Hello World</quote>.
    </para>
  </formalpara>

  <formalpara>
    <title>paddingx</title>
    <para>
      Contributed technical details and implementation for
      <xref linkend="additional.cs"> and
      <xref linkend="doing.it.in.c">.
    </para>
  </formalpara>

  <formalpara>
    <title>Rick Moen</title>
    <para>
      <email>rick@linuxmafia.com</email>
      Has very inspiring pages at
      <ulink url="&http.rick;">&http.rick;</ulink>.
      And I shamelessly quote him in the
      <link linkend="index">abstract</link>.
    </para>
  </formalpara>

  <simpara>
    A lot of people helped me shape language and ethical position of
    this document (sorted by
    <citerefentry>
      <refentrytitle>perl</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>, blame Larry): &calc.credits;.
  </simpara>

</sect2>
<sect2 id="feedback" xreflabel="Feedback">
  <title>Feedback</title>

  <simpara>
    Feedback is most certainly welcome for this document.
    Please send your additions, comments, criticisms, flames
    and <quote>contributions</quote> to the following
    email address: <email>alexander.bartolich@gmx.at</email>
  </simpara>
  <simpara>
    A few people sent me executables for that other operating system.
    I am very grateful for this kindness.
    But you should know that this document is about Linux only.
  </simpara>

</sect2>
