2002-03-09. Unfinished excerpt sent to Linux Documentation Project.
2002-03-11. Unfinished excerpt sent to David C. Merrill.
Section One step closer to the edge rewritten & finished.
2002-03-14. Genie escaped the bottle.
Added epigraphs to all chapters, removed one offending paragraph on the way.
Added example for large scale scanning in The plan.
Started The entry point.
Started Credits.
2002-03-15. I predict that today will be remembered until tomorrow.
First working example in The entry point.
Lots of small fixes about everywhere.
Renamed from "The Linux Virus Writing HOWTO" to "The Linux Virus Writing And Detection HOWTO".
2002-03-17. What we do not understand we do not possess.
Added Before we start.
Finished The entry point. Fixed a silly bug in the output of the heuristic scanner.
Started Additional code segments.
2002-03-19. The mosquito exists to keep the mighty humble.
Tuned Freedom is security.
Changed The plan and Patching section headers to make infected executables safe for strip(1). Bug resulted from sloppy reading of the holy text.
Started Remote shell trojan (RST).
2002-03-20. Calm down, it's *only* ones and zeroes.
Finished Remote shell trojan (RST).
2002-03-24. Caution: Keep out of reach of children.
Finished Additional code segments. Had to restructure One step closer to the edge to reuse framework.
2002-03-28. As a computer, I find your faith in technology amusing.
Added In doubt use force to The magic of the Elf.
Added Another theory to Remote shell trojan (RST).
Simplified Additional code segments. No need to align everything to 0x1000.
2002-04-01. Be different: conform.
Changed Target::infection and writeInfection.
Started Doing it in C.
2002-04-06. Deliver yesterday, code today, think tomorrow.
Reworked Introduction and Worm vs. virus.
Progress and lots of fixes on Doing it in C. Had to change writeInfection again.
2002-04-09. Sinners can repent, but stupid is forever.
Added alignment to One step closer to the edge and Additional code segments.
Rewrote Dressing up binary code to emit numbers instead of a string literal. The terminating 0 would have complicated The stub.
Added A section called .text and The stub.
2002-04-13. A doomed ship should sail under a courageous flag.
Renamed document back to original title.
Output is generated through slightly modified ldp.dsl. I like <formalpara> to run the title in the paragraph.
Using <simpara> instead of <para> where possible. Using <inlinemediaobject> instead of <inlinegraphic>.
Finished Doing it in C.
2002-04-18. When you don't know what you are doing, do it neatly.
Using <citerefentry> instead of <command>.
Created A closer look by splitting stuff from The entry point and adding a second scanner.
Started Suspicious code.
2002-04-23. Questionable day. Ask somebody something.
Significantly extended abstract.
The scanners in Turn the pages and Second scan now test the same set of files. This provides a time-warp effect for sequential readers, but makes development easier for me.
Added more links to Paranoid android.
2002-04-25. The clash of ideas is the sound of freedom.
Extended Behind the stages and Feedback.
2002-04-28. There are two ways to write error-free programs; only the third one works.
Testing infections with strip(1). This affects One step closer to the edge, The entry point and Doing it in C. Additional code segments is not strip-safe, but who cares.
2002-05-05. A hacker does for love what others would not do for money.
Doing it in C writes more than just ELF. Modified a lot of text, especially The stub.
All implementations of writeInfection use constant ENTRY_POINT_OFS instead of plain 1.
Inserted chapter The stub revisited.
Road map. Things that might make it into the document one day.
Setting up a chroot(1) environment.
Analyzing a real virus with strace(1).
Anti-debugging techniques.
Silvio Cesare's File Virus.
Silvio Cesare's PLT Virus (procedure linkage table).
Subversive dynamic linking to libraries (based on a PDF by grugq).
Have a look on Armouring the ELF: Binary encryption on the UNIX platform by grugq.
Refute networks, heterogeneous and plausibility hosted at http://cybersoft.com/.