# The ELF Virus Writing HOWTO

## redhat-linux-i386

### Alexander Bartolich

alexander.bartolich@gmx.at

Copyright © 2002 by Alexander Bartolich

Revision History
Revision When a camel flies, no one laughs if it doesn't get very far. | 2002-06-30 |
Renamed document. Restructed Magic of the ELF. Links to other sites are now footnotes. Many portability issues.

This document describes how to write parasitic file viruses infecting ELF executables on Linux/i386. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.

This is work in progress. Expected outcome is convincing evidence that popular distributions contain everything necessary to develop, detect and control viruses. And that it requires considerable cooperation or outright negligent behavior to give viruses any foothold.

Viruses are not a threat to Linux!

A quote from Rick's Rant on anti-virus software: [1]

The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Java scripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux [2] could be different, no matter what they hear. And yet it is.

### Notes

[1] | http://linuxmafia.com/~rick/faq/#virus
[2] | The first release of this document covered only Linux/i386.

|  | Next
|  | Introduction