
Learning Linux Binary Analysis
By :

This method is extremely powerful and, although easily detectable, is also relatively easy to implement and provides reliable code insertion. The idea is to convert the PT_NOTE
segment to the PT_LOAD
type and move its position to go after all of the other segments. Of course, you could also just create an entirely new segment by creating a PT_LOAD phdr
entry, but since a program will still execute without a PT_NOTE
segment, you might as well convert it to PT_LOAD
. I have not personally implemented this technique for a virus, but I have designed a feature in Quenya v0.1 that allows you to add a new segment. I also did an analysis of the Retaliation Linux virus authored by Jpanic, which uses this method for infection:
http://www.bitlackeys.org/#retaliation.
Figure 4.5: PT_LOAD infection
There are no strict rules about the PT_LOAD
infection. As mentioned here, you may convert PT_NOTE
into PT_LOAD
or create an entirely new PT_LOAD
phdr
and segment...