FreeBSD.H2T3

F0g

This is very simple infector for the FreeBSD. It infects all files in current directory. The virus appends new segment to the end of file by replacing PT_PHDR entry. The code of virus consists of two parts: the head and the tail. The head (in assembler) will determine the addresses and sizes of both parts and define a wrapper for the system calls. The head invoke the tail (passing all necessary parameters) and return control to the host program. All other functions: search, read, modification, write etc embodied in tail (in C), using the system call function located in head. -- F0g. mailto:f0g.mbox@gmail.com