Linux.Arian
by herm1t

See also the project folder

About Linux.Arian
-----------------

   This is  the demonstration virus  for the arithmetic and LZW compression
modules. It infecting files by compressing .text section of the victim.  It
does not increase victim size. This looks as follows:

  *BEFORE*                    *AFTER*
+-----------+              +------------+
| EHDR      | text segment | EHDR       |
|           |              |            |
|           |              |            |
+ - - - - - +              +- - - - - - + <--EP
| .text     | text seÓion  |   virus    | 
|           | <--EP        | compressed |
|           |              | .text | 00 | <-- padding zeroes
+ - - - - - +              +- - - - - -+
|           |              |            |
+-----------+              +------------+
|           | data segment |            |
|           |              |            |
+-----------+              +------------+

Configuration and compiling
---------------------------
   You can specify the options by adding or removing "-D<option>" to AFLAGS
variable in Makefile
The available options are:
        LZW/ARI                 - use either  ARIthmetic or LZW compression
                                  (*mandatory*)
        ALREADY_INFECTED        - check if  the file is already infected by
                                  the virus
        CMP_CRC32               - use crc32  to find  names in string table
        ZERO_FREE_SPACE         - pad the .text section with zeroes
        DEBUG                   - print magic after start
        BE_PARANOID             - additional validity checks against victim
        USE_BRK                 - use brk to allocate memory, otherwise use
                                  mmap
                SAFE_BRK        - mprotect memory allocated via  brk  (this
                                  is on by default on Linux 2.4)

When just type `make'