Revision history

The ELF Virus Writing HOWTO: Introduction
Prev |  | Next

# C. Revision history

#### C.1. Revisions

2002-08-15 Don't let people drive you crazy when you know it's in walking distance.

- Split document in introduction and platform specific part. They are held together with relative HTML links.

- Flushed revision history. Converting links in old entries is too much work.

- Moved i386 development to Red Hat 7.3.

- Started port to sparc-debian-linux.

- Rework of document is in progress. "The magic of the Elf" and "The language of evil" are finished. All following chapters are probably broken.

2002-10-23 We had joy, we had fun, we had seasons on a Sun.

- Started port to sparc-sunos5.7.

- Ported all C++ code to plain C. Some hardware I'm working on is too slow.

- Rewrote most of `configure.pl`. Package version and path detection works with rpm, dpkg, Slackware and SunOS.

- `Makefile` does not require `GNU make` anymore.

- Directory `pre` is directory `src` pre-processed with `config.sed`. In `pre` all program names are absolute. Magic numbers and platform specific constants are verbatim.

- Lot's of changes about everywhere. Document is finished up to "Segment padding infection". All following chapters are probably broken.

2003-01-07 I'm not a nerd - I'm "socially challenged".

- Rewrote segment scanner in C. Required changes to infector framework. Now supports 64-bit ELF.

- Document is finished up to "Segment padding infection". All following chapters are probably broken.

2003-01-08 Quick!! Act as if nothing has happened!

- Fixed embarrassing bug in table of used rpm packages.

2003-02-15 If you don't care where you are, then you ain't lost.

- Systematic search for infection targets with scanner

- Infecting both static and dynamic executables

- Main development moved to i386-redhat8.0-linux

- Document is finished up to "Additional Code Segment". All following chapters are probably broken.

#### C.2. Road map

Things that might make it into the document one day.

- Setting up a `chroot` environment.

- Analyzing a real virus with `strace` or `truss`.

- Anti-debugging techniques

- Silvio Cesare's File Virus

- Silvio Cesare's PLT Virus (procedure linkage table).

- Subversive dynamic linking to libraries (based on a PDF by grugq).

- Have a look on "Armoring the ELF: Binary encryption on the UNIX platform" [1] by grugq.

- Refute "networks", [2] "heterogeneous" [3] and "plausibility" [4] hosted at http://cybersoft.com/.

#### C.3. Random links

http://dmoz.org/Computers/Hacking/Viruses/Authors/
http://www.ebcvg.com
http://vx.netlux.org/index.shtml
http://www.hackpalace.com/usa/
http://www.phreak.org/html/virii.shtml
http://www.cba.uiuc.edu/broker/startrek.htm

### Notes

[1] | http://www.phrack.com/phrack/58/p58-0x05
[2] | http://cybersoft.com/whitepapers/papers/networks.shtml
[3] | http://cybersoft.com/whitepapers/papers/heterogeneous.shtml
[4] | http://cybersoft.com/whitepapers/papers/plausibility.shtml

Prev | Home | Next
GNU General Public License |  | Mirrors