A metamorphic Virus for Elf64 binaries
This might trigger your anti-virus, which is normal. Use at your own risk!
# clone itgit clone https://github.com/spolowy/Death.git&&cd Death# build it and run itmake&& ./death# remove installation filescd ..&& rm -rf Death
Play around with the colourful debug mode!
Experiment with different build modes:
# build with error logs and backtracemake errors# build with additional logs (+ errors)make logs
Test or benchmark the virus polymorphism with:
# infect binaries for 200 generations with compile mode "re"./scripts/test_spread.bash re 200 /bin/*
# benchmark polymorphism on 2 identical infected binaries./scripts/test_vimdiff.bash re /bin/ls
# benchmark block permutation./scripts/rainbow_spread.bash
- tiny polymorphic loader with register permutation
- random size code blocks permutated virus body
- instruction permutation for the virus body
- two entry point alternatives:
e_entry in elf header- overriding the first
jmp instruction in the infected binary's code
Section Headers: [Nr] Name Type Address Off Size ES Flg Lk Inf Al [ 0] NULL 0000000000000000 000000 000000 00 0 0 0 [ 1] .interp PROGBITS 0000000000000318 000318 00001c 00 A 0 0 1 [ 2] .note.gnu.property NOTE 0000000000000338 000338 000020 00 A 0 0 8 [ 3] .note.gnu.build-id NOTE 0000000000000358 000358 000024 00 A 0 0 4 [ 4] .note.ABI-tag NOTE 000000000000037c 00037c 000020 00 A 0 0 4 [ 5] .gnu.hash GNU_HASH 00000000000003a0 0003a0 0000e4 00 A 6 0 8 [ 6] .dynsym DYNSYM 0000000000000488 000488 000d08 18 A 7 1 8 [ 7] .dynstr STRTAB 0000000000001190 001190 00064c 00 A 0 0 1 [ 8] .gnu.version VERSYM 00000000000017dc 0017dc 000116 02 A 6 0 2 [ 9] .gnu.version_r VERNEED 00000000000018f8 0018f8 000070 00 A 7 1 8 [10] .rela.dyn RELA 0000000000001968 001968 001350 18 A 6 0 8 [11] .rela.plt RELA 0000000000002cb8 002cb8 0009f0 18 AI 6 25 8 VIRUS GOES HERE <- [12] .init PROGBITS 0000000000004000 004000 00001b 00 AX 0 0 4 [13] .plt PROGBITS 0000000000004020 004020 0006b0 10 AX 0 0 16 [14] .plt.got PROGBITS 00000000000046d0 0046d0 000030 10 AX 0 0 16 [15] .plt.sec PROGBITS 0000000000004700 004700 0006a0 10 AX 0 0 16 ...
Tested on Ubuntu 20.04.1 x86_64
This virus does not contain any malicious software (or payload), it exists only for educational purposes.
