This article documents the results from experimenting with binary reconstruction of an ELF executable given a core dump or snapshot of the process image. The VIT Virus is a Linux x86 parasitic virus that infects ELF executeables by using the padding of the text segment. For replication, direct infection via attemption infection of executeables in the current directory is employed. The FILE Virus is a simple UNIX virus that concatenates the host to the parasite portion of the virus. The virus then extracts the original host from itself and executes it as a seperate file.
Direct infection is used infecting executeables in the current directory.
This virus is not strip safe. The entry point of the host after infection doesnt change as the virus is chained by inserting jump code where the original entry point code once resided. Residency is maintained by infecting the PLT of the process and infecting programs called for by the 'execve' library call. Direct infection is also used by infecting executeables in the current directory.