The ELF Virus Writing HOWTO

sparc-sunos5.9

Alexander Bartolich

alexander.bartolich@gmx.at

This is a platform specific volume of TEVWH. See the global part for introduction, copyright, licensing and other legal issues. This part was built on an installation of "SunOS 5.9" running on sparc. This is not free software. Only the binaries of SunOS 5.9 can be downloaded at no cost. [1] And this does not include Sun's development suite. I used free GNU tools instead. [2]

SFWgbin-2.11,REV=2002.03.27.20.41SFWgcc-2.95.3,REV=2002.03.27.20.41
SFWgdb-5.0,REV=2002.03.27.20.41SFWvim-6.0,REV=2002.03.27.20.41
SUNWbash-11.9.0,REV=2002.03.02.00.35SUNWbtool-11.9.0,REV=2002.04.06.15.27
SUNWcsu-11.9.0,REV=2002.04.06.15.27SUNWdoc-11.9.0,REV=2002.04.06.15.27
SUNWesu-11.9.0,REV=2002.04.06.15.27SUNWhea-11.9.0,REV=2002.04.06.15.27
SUNWpl5u-11.9.0,REV=2002.04.06.15.27SUNWscpu-11.9.0,REV=2002.04.06.15.27
SUNWtcsh-11.9.0,REV=2002.03.02.00.35SUNWtoo-11.9.0,REV=2002.04.06.15.27
SUNWxcu4-11.9.0,REV=2002.04.06.15.27SUNWxcu4t-5.9,REV=2001.12.12.00.00


Table of Contents
1. Variables and packages
1.1. Variables prefixed with TEVWH_
1.2. Variables prefixed with TEVWH_PATH_
1.3. The name of the X
1.4. The owner of files
1.5. The source of man-pages
1.6. Verifying installed packages
2. The magic of the Elf
2.1. How it works
2.2. Strings and dumps
2.3. The address of main
2.4. Other roads to ELF
3. Magic revealed
3.1. objdump -d
3.2. GDB to the rescue
3.3. In doubt use force
3.4. Write your name
4. The language of evil
4.1. Offset of e_entry
4.2. Extracting e_entry
4.3. Devil in disguise
4.4. Infection #1
5. Segments
5.1. objdump -fp
5.2. readelf -l
5.3. elfdump
5.4. Observations
5.5. Segments of /usr/bin/csh
5.6. Self modifying code
6. Sections
6.1. objdump -h
6.2. readelf
6.3. elfdump
6.4. Observations
6.5. Sections of /usr/bin/csh
7. Scanners
7.1. Finding executables
7.2. Scan entry point
7.3. Scan segments
7.4. A kingdom for a shell
7.5. Food for segment padding
7.6. Scan file size
8. Segment padding infection
8.1. Off we go
8.2. Magnifying glass
8.3. First scan
8.4. Second scan
9. Additional code segments
9.1. Scanning for NOTE
9.2. Give me NOTE
9.3. To serve & detect
10. The entry point

Notes

[1]

http://wwws.sun.com/software/solaris/binaries/index.html

[2]

http://wwws.sun.com/software/solaris/freeware/s9download.html