# The ELF Virus Writing HOWTO

## Introduction

### Alexander Bartolich

alexander.bartolich@gmx.at

Copyright © 2002, 2003 by Alexander Bartolich

Revision History
Revision If you don't care where you are, then you ain't lost. | 2003-02-15 |
Systematic search for infection targets with scanner.

This document describes how to write parasitic file viruses infecting ELF executables. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.

Viruses are not a threat to Linux! [1]

A quote from Rick's Rant on anti-virus software: [2]

The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Java scripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux could be different, no matter what they hear. And yet it is.

### Notes

[1] | The first release of this document covered only Linux/i386. Among the platforms using ELF it is considered the most viable for virus spread.
[2] | http://linuxmafia.com/~rick/faq/#virus

|  | Next
|  | Introduction