# The ELF Virus Writing HOWTO

## Introduction

### Alexander Bartolich

alexander.bartolich@gmx.at

Copyright © 2002 by Alexander Bartolich

Revision History
Revision We had joy, we had fun, we had seasons on a Sun. | 2002-10-23 |
Very big modifications in the first part of the platform specific part. Started port to sparc-sunos5.7.

This document describes how to write parasitic file viruses infecting ELF executables. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.

Viruses are not a threat to Linux! [1]

A quote from Rick's Rant on anti-virus software: [2]

The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Java scripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux could be different, no matter what they hear. And yet it is.

### Notes

[1] | The first release of this document covered only Linux/i386. Among the platforms using ELF it is considered the most viable for virus spread.
[2] | http://linuxmafia.com/~rick/faq/#virus

|  | Next
|  | Introduction