<simplesect>
  <title>Revisions</title>

  <anchor id="rev.2002.03.09"/>
  <formalpara>
    <title>2002-03-09</title>
    <para>Unfinished excerpt sent to Linux Documentation Project.</para>
  </formalpara>

  <anchor id="rev.2002.03.11"/>
  <formalpara>
    <title>2002-03-11</title>
    <para>
      Unfinished excerpt sent to David C. Merrill.
      <itemizedlist>
	<listitem><simpara>
	  Section <xref linkend="one.step.closer"/> rewritten &amp;
	  finished.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.14"/>
  <formalpara>
    <title>2002-03-14</title>
    <para>
      Genie escaped the bottle.
      <itemizedlist>
	<listitem><simpara>
	  Added epigraphs to all chapters, removed one offending
	  paragraph on the way.
	</simpara></listitem>
	<listitem><simpara>
	  Added example for large scale scanning in
	  <xref linkend="the.plan"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="entry.point"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="credits"/>.
	</simpara>
	</listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.15"/>
  <formalpara>
    <title>2002-03-15</title>
    <para>
      I predict that today will be remembered until tomorrow.
      <itemizedlist>
	<listitem><simpara>
	    First working example in <xref linkend="entry.point"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Lots of small fixes about everywhere.
	</simpara></listitem>
	<listitem><simpara>
	  Renamed from <quote>The Linux Virus Writing HOWTO</quote>
	  to <quote>The Linux Virus Writing And Detection HOWTO</quote>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.17"/>
  <formalpara>
    <title>2002-03-17</title>
    <para>
      What we do not understand we do not possess.
      <itemizedlist>
	<listitem><simpara>
	  Added <xref linkend="before.we.start"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Finished <xref linkend="entry.point"/>.
	  Fixed a silly bug in the output of the heuristic scanner.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="additional.cs"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.19"/>
  <formalpara>
    <title>2002-03-19</title>
    <para>
      The mosquito exists to keep the mighty humble.
      <itemizedlist>
	<listitem><simpara>
	  Tuned <xref linkend="freedom.is.security"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Changed <xref linkend="the.plan"/> and
	  <xref linkend="patchShdr"/> to make infected executables
	  safe for
	  <citerefentry>
	    <refentrytitle>strip</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry>.
	  Bug resulted from sloppy reading of the holy text.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="rst"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.20"/>
  <formalpara>
    <title>2002-03-20</title>
    <para>
      Calm down, it's *only* ones and zeroes.
      <itemizedlist>
	<listitem><simpara>
	  Finished <xref linkend="rst"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.24"/>
  <formalpara>
    <title>2002-03-24</title>
    <para>
      Caution: Keep out of reach of children.
      <itemizedlist>
      <listitem><simpara>
	  Finished <xref linkend="additional.cs"/>.
	  Had to restructure <xref linkend="one.step.closer"/>
	  to reuse framework.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.03.28"/>
  <formalpara>
    <title>2002-03-28</title>
    <para>
      As a computer, I find your faith in technology amusing.
      <itemizedlist>
	<listitem><simpara>
	  Added <xref linkend="in.doubt.use.force"/> to
	  <xref linkend="magic.of.elf"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Added <xref linkend="another.theory"/> to <xref linkend="rst"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Simplified <xref linkend="additional.cs"/>.
	  No need to align everything to 0x1000.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.01"/>
  <formalpara>
    <title>2002-04-01</title>
    <para>
      Be different: conform.
      <itemizedlist>
	<listitem><simpara>
	  Changed <xref linkend="Target.infection"/>
	  and <xref linkend="writeInfection"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="doing.it.in.c"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.06"/>
  <formalpara>
    <title>2002-04-06</title>
    <para>
      Deliver yesterday, code today, think tomorrow.
      <itemizedlist>
	<listitem><simpara>
	  Reworked <xref linkend="intro"/> and
	  <xref linkend="worm.vs.virus"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Progress and lots of fixes on <xref linkend="doing.it.in.c"/>.
	  Had to change <xref linkend="writeInfection"/> again.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.09"/>
  <formalpara>
    <title>2002-04-09</title>
    <para>
      Sinners can repent, but stupid is forever.
      <itemizedlist>
	<listitem><simpara>
	  Added alignment to <xref linkend="one.step.closer"/> and
	  <xref linkend="additional.cs"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Rewrote <xref linkend="dressing.up.binary.code"/> to
	  emit numbers instead of a string literal.
	  The terminating 0 would have complicated
	  <xref linkend="the.stub"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Added <xref linkend="a.section.called.text"/> and
	  <xref linkend="the.stub"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.13"/>
  <formalpara>
    <title>2002-04-13</title>
    <para>
      A doomed ship should sail under a courageous flag.
      <itemizedlist>
	<listitem><simpara>
	  Changed license to <link linkend="license.FDL">FDL</link>
	  and <link linkend="license.GPL">GPL</link>.
	</simpara></listitem>
	<listitem><simpara>
	  Renamed document
	  <link linkend="rev.2002.03.15">back to original title</link>.
	</simpara></listitem>
	<listitem><simpara>
	  Output is generated through slightly modified
	  <filename>ldp.dsl</filename>.
	  I like <sgmltag>&lt;formalpara&gt;</sgmltag> to run
	  the title in the paragraph.
	</simpara></listitem>
	<listitem><simpara>
	  Using <sgmltag>&lt;simpara&gt;</sgmltag> instead of
	  <sgmltag>&lt;para&gt;</sgmltag> where possible.
	  Using <sgmltag>&lt;inlinemediaobject&gt;</sgmltag> instead of
	  <sgmltag>&lt;inlinegraphic&gt;</sgmltag>.
	</simpara></listitem>
	<listitem><simpara>
	  Finished <xref linkend="doing.it.in.c"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.18"/>
  <formalpara>
    <title>2002-04-18</title>
    <para>
      When you don't know what you are doing, do it neatly.
      <itemizedlist>
	<listitem><simpara>
	  Using <sgmltag>&lt;citerefentry&gt;</sgmltag> instead of
	  <sgmltag>&lt;command&gt;</sgmltag>.
	</simpara></listitem>
	<listitem><simpara>
	  Created <xref linkend="a.closer.look"/> by splitting stuff
	  from <xref linkend="entry.point"/> and adding a
	  <link linkend="second.scan">second scanner</link>.
	</simpara></listitem>
	<listitem><simpara>
	  Started <xref linkend="suspicious.code"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.23"/>
  <formalpara>
    <title>2002-04-23</title>
    <para>
      Questionable day. Ask somebody something.
      <itemizedlist>
	<listitem><simpara>
	  Significantly extended <link linkend="index">abstract</link>.
	</simpara></listitem>
	<listitem><simpara>
	  The scanners in <xref linkend="turn.the.pages"/> and
	  <xref linkend="second.scan"/> now test the same set of files.
	  This provides a time-warp effect for sequential readers,
	  but makes development easier for me.
	</simpara></listitem>
	<listitem><simpara>
	  Added more links to <xref linkend="paranoid.android"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.25"/>
  <formalpara>
    <title>2002-04-25</title>
    <para>
      The clash of ideas is the sound of freedom.
      <itemizedlist>
	<listitem><simpara>
	  Extended <xref linkend="behind.the.stages"/> and
	  <xref linkend="feedback"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.04.28"/>
  <formalpara>
    <title>2002-04-28</title>
    <para>
      There are two ways to write error-free programs;
      only the third one works.
      <itemizedlist>
	<listitem><simpara>
	  Testing infections with 
	  <citerefentry>
	    <refentrytitle>strip</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry>.
	  This affects
	  <link linkend="off.we.go">One step closer to the edge</link>,
	  <link linkend="patch.entry.addr.3.0">The entry point</link>
	  and
	  <link linkend="off.we.go.again">Doing it in C</link>.
	  <link linkend="to.serve.and.detect"
	    >Additional code segments</link>
	  is not strip-safe, but who cares.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.05.05"/>
  <formalpara>
    <title>2002-05-05</title>
    <para>
      A hacker does for love what others would not do for money.
      <itemizedlist>
	<listitem><simpara>
	  <xref linkend="doing.it.in.c"/> writes more than just
	  <acronym>ELF</acronym>. Modified a lot of text, especially
	  <xref linkend="the.stub"/>.
	</simpara></listitem>
	<listitem><simpara>
	  All implementations of <function>writeInfection</function>
	  use constant <literal>ENTRY_POINT_OFS</literal> instead
	  of plain <constant>1</constant>.
	</simpara></listitem>
	<listitem><simpara>
	  Inserted chapter <xref linkend="stub.revisited"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.05.09"/>
  <formalpara>
    <title>2002-05-09</title>
    <para>
      Paranoid schizophrenics outnumber their enemies at least two to one.
      <itemizedlist>
	<listitem><simpara>
	  Using
	  <citerefentry>
	    <refentrytitle>od</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry>
	  instead of 
	  <citerefentry>
	    <refentrytitle>readelf</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry>
	  <link linkend="command.entry.point.sh.gdb">here</link>
	  and
	  <link linkend="command.disassemble.it.again">here</link>.
	</simpara></listitem>
	<listitem><simpara>
	  The title of all listings contains the exact file name.
	  This is generated by <filename>fileref.pl</filename>.
	</simpara></listitem>
	<listitem><simpara>
	  Added <xref linkend="disassembly"/> to
	  <xref linkend="stub.revisited"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.05.20"/>
  <formalpara>
    <title>2002-05-20</title>
    <para>
      Communicate! It can't make things any worse.
      <itemizedlist>
	<listitem><simpara>
	  Rewrote <filename>src/calc.pl</filename>
	  (internal, no visible effect).
	</simpara></listitem>
	<listitem><simpara>
	  Excerpt of glibc sources feature line numbers in
	  <xref linkend="use.the.source.luke"/>
	</simpara></listitem>
	<listitem><simpara>
	  Progress in <xref linkend="stub.revisited"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Renamed <filename>core.inc</filename> to
	  <filename>body.inc</filename> in
	  <xref linkend="doing.it.in.c"/>.
	</simpara></listitem>
	<listitem><simpara>
	  Renamed directory <filename>out</filename> to
	  <filename>out/i386</filename>.
	</simpara></listitem>
	<listitem><simpara>
	  Moved parts of <xref linkend="intro"/> to new
	  <xref linkend="mirrors"/>.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.06.23"/>
  <formalpara>
    <title>2002-06-23</title>
    <para>
      All warranty and guarantee clauses become null and void
      upon payment of invoice.
      <itemizedlist>
	<listitem><simpara>
	  Lots of changes in <xref linkend="magic.of.elf"/>.
	  Major corrections in <xref linkend="address.of.main"/>.
	  Rewrote <xref linkend="dressing.up.binary.code"/>.
	  <literal>ENTRY_POINT_OFS</literal> is now part of
	  generated <filename>infection.inc</filename>.
	</simpara></listitem>
	<listitem><simpara>
	  Correction in <xref linkend="turn.the.pages"/>
	</simpara></listitem>
	<listitem>
	  <simpara>Finished <xref linkend="stub.revisited"/>.</simpara>
	</listitem>
	<listitem><simpara>
	  Lots of internal changes. <literal>tmp</literal> became
	  <literal>i386/tmp</literal>. Spreading to other platforms
	  is near.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <anchor id="rev.2002.06.30"/>
  <formalpara>
    <title>2002-06-30</title>
    <para>
      When a camel flies, no one laughs if it doesn't get very far.
      <itemizedlist>
	<listitem><simpara>
	  Renamed from <quote>The Linux Virus Writing HOWTO</quote>
	  to <quote>The ELF Virus Writing HOWTO</quote>.
	</simpara></listitem>
	<listitem><simpara>
	  Converted SGML files to XML. Moved them into directory
	  <filename>xml</filename>. Rendering is still done with
	  <application>jade/DSSSL</application>.
	</simpara></listitem>
	<listitem>
	  <simpara>Links to other sites are now footnotes.</simpara>
	</listitem>
	<listitem><simpara>
	  Revamped <xref linkend="executable.and.linkable.format"/>.
	  Added a lot of links.
	</simpara></listitem>
	<listitem><simpara>
	  Created <xref linkend="language.of.evil"/> by splitting
	  <xref linkend="magic.of.elf"/>.
	</simpara></listitem>
	<listitem><simpara>
	  New <xref linkend="magic.of.the.gnu"/> uses 
	  <citerefentry>
	    <refentrytitle>hexdump</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry> and a quote from LSB.
	</simpara></listitem>
      </itemizedlist>
    </para>
  </formalpara>

</simplesect>
<simplesect>
  <title>Road map</title>

  <para>
    Things that might make it into the document one day.
    <itemizedlist>
      <listitem>
	<simpara>Infecting statically linked executables.</simpara>
      </listitem>
      <listitem>
	<simpara>
	  Setting up a 
	  <citerefentry>
	    <refentrytitle>chroot</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry> environment.
	</simpara>
      </listitem>
      <listitem>
	<simpara>
	  Analyzing a real virus with
	  <citerefentry>
	    <refentrytitle>strace</refentrytitle>
	    <manvolnum>1</manvolnum>
	  </citerefentry>.
	</simpara>
      </listitem>
      <listitem>
	<simpara>Anti-debugging techniques.</simpara>
      </listitem>
      <listitem>
	<simpara>Silvio Cesare's File Virus.</simpara>
      </listitem>
      <listitem>
	<simpara>
	  Silvio Cesare's PLT Virus (procedure linkage table).
	</simpara>
      </listitem>
      <listitem>
	<simpara>
	  Subversive dynamic linking to libraries (based on a
	  <acronym>PDF</acronym> by grugq).
	</simpara>
      </listitem>
      <listitem>
	<simpara>
	  Have a look on <quote>Armoring the ELF: Binary
	    encryption on the UNIX platform</quote> &note.phrack.58.58;
	  by grugq.
	</simpara>
      </listitem>
      <listitem>
        <simpara>
	  Refute <quote>networks</quote>, &note.cybersoft.networks;
	  <quote>heterogeneous</quote> &note.cybersoft.heterogeneous;
	  and <quote>plausibility</quote> &note.cybersoft.plausibility;
	  hosted at &url.cybersoft;.
        </simpara>
      </listitem>
    </itemizedlist>
  </para>

</simplesect>
<simplesect>
  <title>Random links</title>

  <para>
    <simplelist>
      <member>
	<ulink url="http://dmoz.org/Computers/Hacking/Viruses/Authors/"
	  >http://dmoz.org/Computers/Hacking/Viruses/Authors/</ulink>
      </member>
      <member>
	<ulink url="http://www.ebcvg.com/sources.php"
	  >http://www.ebcvg.com/sources.php</ulink>
      </member>
      <member>
	<ulink url="http://vx.netlux.org/index.shtml"
	  >http://vx.netlux.org/index.shtml</ulink>
      </member>
      <member>
	<ulink url="http://www.cba.uiuc.edu/broker/startrek.htm"
	  >http://www.cba.uiuc.edu/broker/startrek.htm</ulink>
      </member>
    </simplelist>
  </para>
</simplesect>
