Tutorial: The Linux virus writing and detection HOWTO

This document describes how to write parasitic file viruses infecting ELF executables on Linux/i386. Though it contains a lot of source code, no actual virus is included.

[ . . . ]

Writing a program that inserts code into another program file is one thing. Writing that program so that it can be injected itself is a very different art. Although this document shows a lot of code and technique, it is far from being a "Construction Kit For Dummies". Instead I'll try to show how things work. Translation of infecting code to assembly is left as a (non-trivial) exercise to the reader.

An astonishing number of people think that viruses require secret black magic. Here you will find simple code that patches other executables. But since regular users can't overwrite system files (we are talking about serious operating systems here) that is not even half the journey.