Demythifying Linux Virus Engineering

Explore stamping the elf header's magic ident in a docker container lab, inspect hex dumps, modify the last seven reserved bytes, and observe kernel checks during load, highlighting security implications.

Explore how the kernel loads an executable: validate the ELF header, parse program headers, map segments, assign permissions, and apply position-independent code with randomized heap and stack, plus dynamic linking.

Extract the virus text section from the Elf binary and prepare it for injection. Automate with objdump and objcopy in the no-stdlib Bazel workflow to produce a binary for injection.

Explores the infection workflow for Linux ELF binaries, presenting three algorithms to find suitable infection points, perform eligibility checks, and modify headers while preserving the executable.

Explore ELF code cave padding at the end of an executable segment, using page boundaries to fit the virus and update the ELF and program headers through the infection algorithm.

Explore the text padding infection algorithm in action by infecting the lz tool within a dockerized environment, compare elf headers, entry point redirection, and the codecave before and after infection.

Explore the padding infector by analyzing executable ELF headers and program sections to locate padding. Patch headers and inject a virus at end of the executable segment, with alignment considerations.

Study the reverse text segment infection, extending the executable into lower memory addresses like 0x400000 in numpy arrays and shifting ELF headers, contrasted with text padding infection.

Explains the reverse text infection code walk-through, showing how the inspector analyzes and injects into ELF executables, handles ARM and x86 alignment, and updates headers to insert a virus.

Demythifying linux virus engineering explains a pt_note infection that repurposes the rt note segment into an elf executable load, appends a virus, and updates headers with go and docker risks.

Demonstrate the RT node infection algorithm that repurposes a node segment to inject the virus, patch the program and section headers, and apply an infection signature.

Compare infection techniques for executables, including text padding, reverse text, and RT node methods, highlighting trade-offs, feasibility, and detection considerations.

Explore the necessity of redirection to hijack a host executable's control flow, enabling the injected virus to run before the original code through two redirection methods.

Learn how entry point redirection injects a virus to run before the host binary, with custom startup code on ARM and restoration to the original entry point, highlighting antivirus concerns.

Patch instructions to redirect program flow by switching from branch and link to branch, and calculate targets using opcodes and 26-bit offsets in arm and x86.

Explore how viruses propagate, from bootstrapping patient zero to network spread. Analyze example code and the role of social engineering, cracked software, and survivability in infection.

Examine propagation in linux viruses, including forked processes and random infection strategies to evade detection. Learn double fork techniques to prevent zombie processes and use directory walk iterators.

Explore a modular Linux virus propagation code, focusing on the propagate function, template arguments, parasite start and end symbols, memory mapping, and the infection and redirection concepts.

Examine how a self-propagating virus propagates using the propagate function, including forked process infection, entry point redirection, and a hello world payload, with Bazel build rules and the infected tool.

Explore how a virus can collect user data from an infected machine and exfiltrate it to a remote server via UDP sockets, enabling bidirectional control and botnet formation.

Explore the fileless virus technique that runs in memory via MFD create, downloading and executing payloads from a remote server without touching the disk, evading antivirus monitoring.

Examine the linux elf format, its sections and program headers, and the loading process. Learn virus building with static linking, position independent code, startup routines, and three infection algorithms.

Explore advice, ethics, and lessons learned from Linux virus engineering, highlighting why no software is perfect, the risks of cracked software, and the role of ethical hackers.