This repository contains a strictly acquisition and research-oriented reconstruction of the infamous Stuxnet worm. It is the merchandise of countless hours of reverse engineering activity conducted by the world information investigation organization connected the original binary samples discovered successful 2010.
Disclaimer: This codification is provided solely for world study, malware study training, and protect research. It is not intended to beryllium utilized for immoderate malicious purposes, nor is it a deployable portion of malware. The authors and contributors do not condone forbidden aliases unethical activities.
Table of Contents
Overview
Core Components
Technical Architecture
Build Instructions
Usage
Legal and License
Acknowledgements
Stuxnet is wide recognized arsenic the first known cyber-weapon designed to origin beingness demolition to business power systems (ICS). It specifically targeted Siemens Step 7 package and S7-300/400 PLCs, yet manipulating wave converter drives to harm centrifuge rotors.
This repository is simply a reconstructed root codification derived from the decompiled binaries. It preserves the original logic and onslaught vectors while structuring the codebase for readability and analysis.
Key Characteristics
Target: Siemens SIMATIC WinCC, Step 7, and S7 PLCs.
Propagation: USB drives (LNK exploits), Network shares (Print Spooler), Peer-to-Peer (P2P).
Payload: Modification of PLC artifact logic (OB1/OB35) to change centrifugal frequencies.
Stealth: Advanced Rootkit capabilities (MRxCls.sys, MRxNet.sys) for file, process, and registry hiding.
The repository is organized by the superior modules identified during the study of the original malware.
Module: Loader/Dropper Filename: winsta.exe, ~WTR4141.tmp Description: Entry constituent responsible for first infection, privilege escalation, and deployment of different components.
Module: Privilege Escalation Filename: ~WTR4132.tmp Description: Exploits the Win32k.sys vulnerability to summation system-level privileges.
Module: S7 Hook Library Filename: s7otbxdx.dll Description: Malicious replacement of the original s7otbxsx.dll. Intercepts connection betwixt Step 7 and the PLC.
Module: Step7 Hook Library Filename: s7aaapix.dll Description: Intercepts AUT (Automation Tool) API calls wrong the Step 7 engineering environment.
Module: Rootkit (File System) Filename: mrxcls.sys Description: Kernel-mode driver utilized to hide Stuxnet files, processes, and registry keys via SSDT hooking.
Module: Rootkit (Network) Filename: mrxnet.sys Description: Filters record strategy requests to hide malicious files and enables P2P propagation.
Module: Payload (Attack) Filename: s7plcmain Description: The halfway logic responsible for the "Frequency Tampering" onslaught that damages the centrifuges.
The pursuing describes the high-level execution travel of the Stuxnet framework.
Stage 1: Initial Infection Vector (USB/Network) Stage 2: Dropper and Escalation Stage 3: Check Environment Stage 4a: Target Found (Siemens Software) -> Install S7 Hooks Stage 4b: Non-target -> Self-Destruct/Idle Stage 5: Monitor PLC Writes Stage 6: Detect OB1/OB35 Write -> Inject Payload Stage 7: Modify Frequency Output Stage 8: Physical Damage to Centrifuges Stage 9: Install Rootkit (MRxCls) Stage 10: Hide Files and Registry Stage 11: Load Network Module (MRxNet) Stage 12: P2P Propagation
Execution Flow
-
Environment Reconnaissance: The worm checks for the beingness of circumstantial Siemens package (WinCC, Step 7) and circumstantial target PLCs (S7-315, S7-417).
-
DLL Injection: It intercepts the s7blk_write usability call.
-
Code Injection: When a personification downloads a task to the PLC, the malicious codification is appended to the OB1/OB35 blocks.
-
Physical Impact: The PLC executes the manipulated code, causing the connected adaptable wave drives (VFDs) to rotation astatine abnormal frequencies (high/low), resulting successful mechanical damage.
Build Instructions
Important: This codebase is designed for fixed study and debugging successful a controlled virtual environment. It is not intended for unrecorded deployment connected immoderate captious infrastructure.
Requirements
Build Environment: Microsoft Visual Studio 2019/2022 (Windows) aliases mingw-w64.
Target OS: Windows XP / Windows 7 (for driver compatibility).
Driver Kit: Windows Driver Kit (WDK) 7600 (if compiling kernel drivers).
Building the User-Mode Modules
Clone the repository
git clone https://github.com/Sadpainy/Stuxnet.git cd stuxnet-analysis
Build the main dropper
cd winsta nmake /f Makefile.win
Build the S7 hook library
cd ../s7otbxdx cl /LD s7otbxdx.c user32.lib ws2_32.lib
This codification is intended for:
Malware Analysis: Understanding the circumstantial codification logic utilized successful precocious persistent threats (APTs).
Defensive Research: Developing discovery signatures for ICS information devices (e.g., YARA rules, Snort signatures).
Academic Study: Examining the intersection of cybersecurity and captious infrastructure protection.
Analysis Setup
-
Isolate Environment: Use a virtual instrumentality (VMWare/VirtualBox) pinch Host-Only networking enabled. Disable net connectivity.
-
Load Modules: Analyze the .dll and .sys files utilizing devices specified arsenic IDA Pro, Ghidra, aliases x64dbg.
-
Monitor Activity: Use Process Monitor (ProcMon), Process Hacker, and Wireshark to observe the behavior.
Legal and License
This task is licensed nether the GNU General Public License v3.0. See the LICENSE record for details.
The codification successful this repository is simply a merchandise of reverse engineering for acquisition purposes only. The original authors of the Stuxnet worm are anonymous, but the reconstruction contained herein is the activity of independent information researchers.
The authors do not declare ownership of the original malware.
The codification is provided "AS IS" without warranty of immoderate kind.
The authors are not responsible for immoderate misuse aliases harm caused by this code.
By utilizing this repository, you admit that you are solely responsible for ensuring compliance pinch each applicable laws and regulations.
This investigation and reconstruction would not person been imaginable without the extended study and threat intelligence provided by world cybersecurity vendors.
Symantec (W32.Stuxnet dossier)
Kaspersky Lab (The Stuxnet saga)
ESET (Stuxnet nether the microscope)
Amr Thabet and Christian Roggia (research-virus/stuxnet)
This is an world reconstruction. Use it to build stronger defenses, not to origin harm.
English (US) · 
Indonesian (ID) · 
