The ELF Virus Writing HOWTO: Introduction
Prev |  | Next

# C. Revision history

#### C.1. Revisions

2002-08-15 Don't let people drive you crazy when you know it's in walking distance.

- Split document in introduction and platform specific part. They are held together with relative HTML links.

- Flushed revision history. Converting links in old entries is too much work.

- Moved i386 development to Red Hat 7.3.

- Started port to sparc-debian-linux.

- Rework of document is in progress. "The magic of the Elf" and "The language of evil" are finished. All following chapters are probably broken.

2002-10-23 We had joy, we had fun, we had seasons on a Sun.

- Started port to sparc-sunos5.7.

- Ported all C++ code to plain C. Some hardware I'm working on is too slow.

- Rewrote most of `configure.pl`. Package version and path detection works with rpm, dpkg, Slackware and SunOS.

- `Makefile` does not require `GNU make` anymore.

- Directory `pre` is directory `src` pre-processed with `config.sed`. In `pre` all program names are absolute. Magic numbers and platform specific constants are verbatim.

- Lot's of changes about everywhere. Document is finished up to "Segment padding infection". All following chapters are probably broken.

#### C.2. Road map

Things that might make it into the document one day.

- Infecting statically linked executables.

- Setting up a chroot(1) environment.

- Analyzing a real virus with strace(1).

- Anti-debugging techniques.

- Silvio Cesare's File Virus.

- Silvio Cesare's PLT Virus (procedure linkage table).

- Subversive dynamic linking to libraries (based on a PDF by grugq).

- Have a look on "Armoring the ELF: Binary encryption on the UNIX platform" [1] by grugq.

- Refute "networks", [2] "heterogeneous" [3] and "plausibility" [4] hosted at http://cybersoft.com/.

#### C.3. Random links

http://dmoz.org/Computers/Hacking/Viruses/Authors/
http://www.ebcvg.com
http://vx.netlux.org/index.shtml
http://www.cba.uiuc.edu/broker/startrek.htm

### Notes

[1] | http://www.phrack.com/phrack/58/p58-0x05
[2] | http://cybersoft.com/whitepapers/papers/networks.shtml
[3] | http://cybersoft.com/whitepapers/papers/heterogeneous.shtml
[4] | http://cybersoft.com/whitepapers/papers/plausibility.shtml

Prev | Home | Next
GNU General Public License |  | Mirrors