OvO
124 lines
4.5 KiB
Plaintext
124 lines
4.5 KiB
Plaintext
STUXNET SIZE EXPLANATION
|
|
|
|
WHY STUXNET BINARY IS SO LARGE (MB RANGE VS TYPICAL KB MALWARE)
|
|
|
|
1. STATIC LINKING
|
|
|
|
Stuxnet is compiled with static linking. This means all runtime libraries,
|
|
CRT functions, system API wrappers and dependency code are embedded directly
|
|
into the final binary.
|
|
|
|
- No reliance on external DLLs
|
|
- Self-contained execution across multiple Windows versions
|
|
- Avoids dynamic linking detection vectors
|
|
- Every function implementation is physically present in the file
|
|
|
|
Result: Baseline size increases from ~50KB (dynamic) to ~500KB+ (static)
|
|
|
|
2. EXTENSIVE STRUCTURE DEFINITIONS
|
|
|
|
The code contains hundreds of typedef struct definitions. Each struct
|
|
represents:
|
|
|
|
- Attack state machines (PLC infection, frequency manipulation)
|
|
- Network protocol packets (C2 communication, P2P peer discovery)
|
|
- Rootkit kernel objects (file/process/registry hiding)
|
|
- Encryption contexts (AES, RC4, HMAC, SHA256)
|
|
- Resource headers (embedded driver, certificate, payload metadata)
|
|
- Configuration blocks (C2 servers, propagation flags, attack parameters)
|
|
|
|
These structs are not just definitions - they are instantiated, serialized,
|
|
passed between functions, and stored in memory. Each instance contributes
|
|
to the final binary size through data alignment, padding, and initialization
|
|
code.
|
|
|
|
3. MULTIPLE PAYLOAD TYPES
|
|
|
|
Stuxnet is not a single-purpose malware. It contains:
|
|
|
|
- USB propagation engine (LNK exploit, autorun.inf generation)
|
|
- Network propagation engine (SMB, RPC, print spooler exploits)
|
|
- Rootkit drivers (mrxcls.sys, mrxnet.sys, jmidebs.sys)
|
|
- Step 7 project infection module (hOmSave7, XUTILS, YDBs)
|
|
- S7 PLC attack logic (MC7 payload generation, frequency manipulation)
|
|
- C2 communication module (HTTP, encrypted callbacks)
|
|
- P2P update module (peer discovery, file sharing)
|
|
- Privilege escalation exploits (Win32k, Task Scheduler, Print Spooler)
|
|
|
|
Each module contains its own code, data structures, and string tables.
|
|
|
|
4. RESOURCE EMBEDDING
|
|
|
|
Stuxnet stores multiple files inside its resource section:
|
|
|
|
- Encrypted main DLL (498KB)
|
|
- Rootkit drivers (20KB + 17KB + 25KB)
|
|
- Step 7 project infection DLLs
|
|
- Digital certificates (Realtek, JMicron)
|
|
- MC7 payload binaries (OB1, OB35 blocks)
|
|
- Shellcode for process injection
|
|
- LNK exploit templates
|
|
- Configuration files (PNF, INF, MOF)
|
|
|
|
All resources are compiled into the final binary as raw data.
|
|
|
|
5. CODE DUPLICATION FROM STATIC LINKING
|
|
|
|
Static linking causes code duplication:
|
|
- Each source file that includes a header gets its own copy of inline functions
|
|
- Template instantiations generate multiple copies
|
|
- CRT initialization code runs once but is compiled into the binary
|
|
|
|
6. COMPILER OPTIMIZATIONS ARE LIMITED
|
|
|
|
Stuxnet was compiled with VC6/VS2005 for maximum compatibility:
|
|
- No aggressive size optimizations (/O1 or /Os may be used but limited)
|
|
- Debug symbols stripped but code remains
|
|
- Alignment padding adds extra bytes between structures
|
|
|
|
7. CROSS-PLATFORM COMPATIBILITY CODE
|
|
|
|
Stuxnet targets multiple Windows versions (XP, Vista, 7, Server 2003, Server 2008):
|
|
- Conditional code for different kernel versions
|
|
- Multiple exploit variants for different OS builds
|
|
- Version detection and runtime adaptation logic
|
|
|
|
8. OBFUSCATION AND ENCRYPTION
|
|
|
|
- String obfuscation tables (XOR encrypted strings)
|
|
- Configuration blocks stored in encrypted format
|
|
- RC4/AES routines for runtime decryption
|
|
- CRC32 checksums for integrity verification
|
|
- HMAC signing for authentication
|
|
|
|
9. RUNTIME SELF-MODIFICATION
|
|
|
|
- PE loader stub for in-memory mapping
|
|
- Section extraction logic (.stub section)
|
|
- Import resolution and relocation processing
|
|
- Export table parsing and function lookup
|
|
|
|
10. COMPARISON TABLE
|
|
|
|
CATEGORY TYPICAL MALWARE STUXNET
|
|
Linking Dynamic (DLL) Static (self-contained)
|
|
Size 20-200 K 500 KB - 1.5 MB
|
|
Number of functions 100-500 1000+
|
|
Number of structs 10-50 200+
|
|
Embedded resources None 10+ files
|
|
Exploit modules 1-2 4+
|
|
Target platforms Single OS Multiple Windows versions
|
|
Runtime dependencies High None
|
|
|
|
RESULT: The combination of static linking, extensive structure usage,
|
|
multiple payload types, and embedded resources results in a binary that
|
|
is 5-10x larger than typical malware of the same era.
|
|
|
|
KEY TAKEAWAY
|
|
|
|
Stuxnet's size is not a design flaw - it is a design requirement.
|
|
|
|
The malware was built to be independent, robust, and able to execute
|
|
across diverse industrial environments without external dependencies.
|
|
The "bloat" is the price of self-sufficiency.
|