| ||||||||||||||||
|
Linux.Arian
by herm1t
See also the project folder
About Linux.Arian
-----------------
This is the demonstration virus for the arithmetic and LZW compression
modules. It infecting files by compressing .text section of the victim. It
does not increase victim size. This looks as follows:
*BEFORE* *AFTER*
+-----------+ +------------+
| EHDR | text segment | EHDR |
| | | |
| | | |
+ - - - - - + +- - - - - - + <--EP
| .text | text seÓion | virus |
| | <--EP | compressed |
| | | .text | 00 | <-- padding zeroes
+ - - - - - + +- - - - - -+
| | | |
+-----------+ +------------+
| | data segment | |
| | | |
+-----------+ +------------+
Configuration and compiling
---------------------------
You can specify the options by adding or removing "-D<option>" to AFLAGS
variable in Makefile
The available options are:
LZW/ARI - use either ARIthmetic or LZW compression
(*mandatory*)
ALREADY_INFECTED - check if the file is already infected by
the virus
CMP_CRC32 - use crc32 to find names in string table
ZERO_FREE_SPACE - pad the .text section with zeroes
DEBUG - print magic after start
BE_PARANOID - additional validity checks against victim
USE_BRK - use brk to allocate memory, otherwise use
mmap
SAFE_BRK - mprotect memory allocated via brk (this
is on by default on Linux 2.4)
When just type `make'
| ||||||||||||||||