<?xml version="1.0" encoding='ISO-8859-1'?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
[
<!-- configuration and evaluation -->
  <!ENTITY % config SYSTEM "../config.xml">
  %config;
  %calc;
  %ulink;

<!-- chapter entities -->

  <!ENTITY intro SYSTEM "intro.xml">
  <!ENTITY before.we.start SYSTEM "before.we.start.xml">
  <!ENTITY magic.of.elf SYSTEM "magic.of.elf.xml">
  <!ENTITY language.of.evil SYSTEM "language.of.evil.xml">
  <!ENTITY readelf SYSTEM "readelf.xml">
  <!ENTITY one.step.closer SYSTEM "one.step.closer.xml">
  <!ENTITY a.closer.look SYSTEM "a.closer.look.xml">
  <!ENTITY entry.point SYSTEM "entry.point.xml">
  <!ENTITY rst SYSTEM "rst.xml">
  <!ENTITY additional.cs SYSTEM "additional.cs.xml">
  <!ENTITY doing.it.in.c SYSTEM "doing.it.in.c.xml">
  <!ENTITY stub.revisited SYSTEM "stub.revisited.xml">
  <!ENTITY suspicious.code SYSTEM "suspicious.code.xml">
  <!ENTITY revision.history SYSTEM "revision.history.xml">
  <!ENTITY mirrors SYSTEM "mirrors.xml">

<!-- relative links -->

  <!ENTITY relative.archive "../../archive">
  <!ENTITY relative.nai "../../feedback/de/nai">

]>
<article id="index">

<articleinfo>
  <title>The ELF Virus Writing HOWTO</title>
  <titleabbrev>TEVWH &config.HOSTTYPE;</titleabbrev>
  <subtitle>&config.OS.CODE;</subtitle>

  <author>
    <firstname>Alexander</firstname>
    <surname>Bartolich</surname>
    <affiliation>
      <address><email>alexander.bartolich@gmx.at</email></address>
    </affiliation>
  </author>

  <!-- 
    post link-time code modification of <acronym>ELF</acronym>
    executables under &config.HOSTTYPE;.
  -->

  <abstract>
    <simpara>
      This document describes how to write parasitic file viruses
      infecting <acronym>ELF</acronym> executables on &config.HOSTTYPE;.
      Though it contains a lot of source code, no actual virus is
      included.  Every mentioned infection method is accompanied
      with a practical guide to detection.
    </simpara>
    <simpara>
      This is work in progress. Expected outcome is convincing
      evidence that popular distributions contain everything
      necessary to develop, detect and control viruses.
      And that it requires considerable cooperation
      or outright negligent behavior to give viruses any foothold.
    </simpara>
    <simpara>
      <emphasis role="strong">Viruses are not a threat to
      &config.UNAME;!</emphasis>
    </simpara>
    <simpara>
      A quote from Rick's Rant on anti-virus software:
      &note.rick.rant.virus;
    </simpara>
    <simpara>
      <emphasis>
	The problem with answering this question is that those asking
	it know only OSes where viruses, trojan-horse programs, worms,
	nasty Java scripts, ActiveX controls with destructive payloads,
	and ordinary misbehaved applications are a constant threat to
	their computing. Therefore, they refuse to believe Linux
	<footnote><simpara>
	  The first release of this document covered only Linux/i386.
	</simpara></footnote>
	could be different, no matter what they hear. And yet it is. 
      </emphasis>
    </simpara>
  </abstract>

  <copyright>
    <year>2002</year>
    <holder>Alexander Bartolich</holder>
  </copyright>

  <revhistory>
    <revision>
      <revnumber>
        <link linkend="rev.2002.06.30"
	  >When a camel flies, no one laughs if it doesn't get
	  very far.</link>
      </revnumber>
      <date>2002-06-30</date>
      <revremark>
        Renamed document. Restructed <link linkend="magic.of.elf"
	  >Magic of the ELF</link>.
	Links to other sites are now footnotes.
	Many portability issues.
      </revremark>
    </revision>
  </revhistory>

</articleinfo>

<sect1 id="intro" xreflabel="Introduction">
  <title>Introduction</title>
  &intro;
</sect1>
<sect1 id="before.we.start" xreflabel="Before we start">
  <title>Before we start</title>
  &before.we.start;
</sect1>
<sect1 id="magic.of.elf" xreflabel="The magic of the Elf">
  <title>The magic of the Elf</title>
  &magic.of.elf;
</sect1>
<sect1 id="language.of.evil" xreflabel="The languag of evil">
  <title>The language of evil</title>
  &language.of.evil;
</sect1>
<sect1 id="readelf" xreflabel="readelf">
  <title>readelf</title>
  &readelf;
</sect1>
<sect1 id="one.step.closer" xreflabel="One step closer to the edge">
  <title>One step closer to the edge</title>
  &one.step.closer;
</sect1>
<sect1 id="a.closer.look" xreflabel="A closer look">
  <title>A closer look</title>
  &a.closer.look;
</sect1>
<sect1 id="entry.point" xreflabel="The entry point">
  <title>The entry point</title>
  &entry.point;
</sect1>
<sect1 id="rst" xreflabel="Remote shell trojan (RST)">
  <title>Remote shell trojan (<acronym>RST</acronym>)</title>
  &rst;
</sect1>
<sect1 id="additional.cs" xreflabel="Additional code segments">
  <title>Additional code segments</title>
  &additional.cs;
</sect1>
<sect1 id="doing.it.in.c" xreflabel="Doing it in C">
  <title>Doing it in C</title>
  &doing.it.in.c;
</sect1>
<sect1 id="stub.revisited" xreflabel="The stub revisited">
  <title>The stub revisited</title>
  &stub.revisited
</sect1>
<sect1 id="suspicious.code" xreflabel="Suspicious code">
  <title>Suspicious code</title>
  &suspicious.code;
</sect1>

<appendix id="license.FDL" xreflabel="GNU Free Documentation License">
  <title>GNU Free Documentation License</title>
  <!--
   ! 2002-04-11 Alexander Bartolich
   ! A plain mediobject produces unreadable text without
   ! line breaks or paragraps on my RedHat 7.2 setup.
  -->
  <simpara>See &url.fdl; for details and updates.</simpara>
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../FDL.txt" format="linespecific"
  /></imageobject></inlinemediaobject></programlisting>
</appendix>

<appendix id="license.GPL" xreflabel="GNU General Public License">
  <title>GNU General Public License</title>

  <simpara>See &url.gpl; for details and updates.</simpara>
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../GPL.txt" format="linespecific"
  /></imageobject></inlinemediaobject></programlisting>
</appendix>

<appendix id="revision.history" xreflabel="Revision history">
  <title>Revision history</title>
  &revision.history;
</appendix>

<appendix id="mirrors" xreflabel="Mirrors">
  <title>Mirrors</title>
  &mirrors;
</appendix>

</article>
