# The Linux Virus Writing HOWTO

## post link-time code modification of ELF executables under Linux/i386

### Alexander Bartolich

alexander.bartolich@gmx.at

Copyright © 2002 by Alexander Bartolich

Revision History
Revision Communicate! It can't make things any worse. | 2002-05-20 |
Lots of internal changes. Progress in The stub revisited.

This document describes how to write parasitic file viruses infecting ELF executables on Linux/i386. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.

This is work in progress. Expected outcome is convincing evidence that popular distributions contain everything necessary to develop, detect and control viruses. And that it requires considerable cooperation or outright negligent behavior to give viruses any foothold.

Viruses are not a threat to Linux!

A quote from Rick's Rant on anti-virus software:

The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Java scripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux could be different, no matter what they hear. And yet it is.

|  | Next
|  | Introduction