2002-08-15 Don't let people drive you crazy when you know it's in walking distance.
Split document in introduction and platform specific part. They are held together with relative HTML links.
Flushed revision history. Converting links in old entries is too much work.
Moved i386 development to Red Hat 7.3.
Started port to sparc-debian-linux.
Rework of document is in progress. "The magic of the Elf" and "The language of evil" are finished. All following chapters are probably broken.
2002-10-23 We had joy, we had fun, we had seasons on a Sun.
Started port to sparc-sunos5.7.
Ported all C++ code to plain C. Some hardware I'm working on is too slow.
Rewrote most of configure.pl. Package version and path detection works with rpm, dpkg, Slackware and SunOS.
Makefile does not require GNU make anymore.
Directory pre is directory src pre-processed with config.sed. In pre all program names are absolute. Magic numbers and platform specific constants are verbatim.
Lot's of changes about everywhere. Document is finished up to "Segment padding infection". All following chapters are probably broken.
2003-01-07 I'm not a nerd - I'm "socially challenged".
Rewrote segment scanner in C. Required changes to infector framework. Now supports 64-bit ELF.
Document is finished up to "Segment padding infection". All following chapters are probably broken.
2003-01-08 Quick!! Act as if nothing has happened!
Fixed embarrassing bug in table of used rpm packages.
2003-02-15 If you don't care where you are, then you ain't lost.
Systematic search for infection targets with scanner
Infecting both static and dynamic executables
Main development moved to i386-redhat8.0-linux
Document is finished up to "Additional Code Segment". All following chapters are probably broken.
Things that might make it into the document one day.
Setting up a chroot environment.
Analyzing a real virus with strace or truss.
Anti-debugging techniques
Silvio Cesare's File Virus
Silvio Cesare's PLT Virus (procedure linkage table).
Subversive dynamic linking to libraries (based on a PDF by grugq).
Have a look on "Armoring the ELF: Binary encryption on the UNIX platform" [1] by grugq.
Refute "networks", [2] "heterogeneous" [3] and "plausibility" [4] hosted at http://cybersoft.com/.
[1] | |
[2] | |
[3] | |
[4] |