en14c / pivirus

sample linux x86_64 ELF virus

PIvirus

PIvirus is a proof of concept for infecting linux x86_64 ELF binaries using PLT redirection technique

How it works

• the virus looks for fclose function and hijacks it with a function that writes garbage from the stack to the stdout

• the virus will infect x86_64 ELF binaries with the type [ ET_DYN || ET_EXEC ]

• parasite injection is done by extending the text segment

• PLT redirection happens at runtime and the virus is able to handle binaries which does not apply lazy binding

Usage

#./pivirus [ target directory ]

License

MIT

pivirus's Issues

wrong order?

The order of those macro calls seems wrong. To my understanding you just push zeroed registers to the stack..

PIvirus/hostile.s

Lines 63 to 64 in 9489772

	clear_regs
	save_regs

DT_JMPREL error

594 case DT_JMPREL://.rela.plt The below arithmatic is incorrect, but result is correct. quite funny. should use (target_elf->mmap + (offset of the segment that contains the .rela.plt) + (tmp_dynseg->d_un.d_ptr - (viraddr of the segment that contains the .rela.plt)))
595 target_elf->elfstructs.pltrela = (Elf64_Rela *)(target_elf->mmap + target_code_offset +
596 (tmp_dynseg->d_un.d_ptr - target_code_vaddr));
597 break;