[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-96089":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},96089,"Stuxnet","Sadpainy\u002FStuxnet","Sadpainy","Stuxnet, Here reproduced by me, Only for researchs educations purposes. It set work on WindowsXP and Windows 7 only.",null,"C",420,78,1,0,274,55.69,"GNU Affero General Public License v3.0",false,"main",true,[],"2026-09-20 04:01:32","# Stuxnet\n\n[![Build Status](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fbuild-passing-brightgreen)]()\n[![License: GPL v3](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-GPLv3-blue.svg)](https:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-3.0)\n[![Platform](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatform-Windows%20%7C%20WinCE%20%7C%20SCADA-lightgrey)]()\n![Tests](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Ftests-passing-brightgreen)\n\nThis repository contains a strictly educational and research-oriented reconstruction of the infamous Stuxnet worm. It is the product of countless hours of reverse engineering work conducted by the global security research community on the original binary samples discovered in 2010.\n\nDisclaimer: This code is provided solely for academic study, malware analysis training, and defensive research. It is not intended to be used for any malicious purposes, nor is it a deployable piece of malware. The authors and contributors do not condone illegal or unethical activities.\n\n# Table of Contents\n\nOverview\n\nCore Components\n\nTechnical Architecture\n\nBuild Instructions\n\nUsage\n\nLegal and License\n\nAcknowledgements\n\n# Overview\n\nStuxnet is widely recognized as the first known cyber-weapon designed to cause physical destruction to industrial control systems (ICS). It specifically targeted Siemens Step 7 software and S7-300\u002F400 PLCs, ultimately manipulating frequency converter drives to damage centrifuge rotors.\n\nThis repository is a reconstructed source code derived from the decompiled binaries. It preserves the original logic and attack vectors while structuring the codebase for readability and analysis.\n\n**Key Characteristics**\n\nTarget: Siemens SIMATIC WinCC, Step 7, and S7 PLCs.\n\nPropagation: USB drives (LNK exploits), Network shares (Print Spooler), Peer-to-Peer (P2P).\n\nPayload: Modification of PLC block logic (OB1\u002FOB35) to alter motor frequencies.\n\nStealth: Advanced Rootkit capabilities (MRxCls.sys, MRxNet.sys) for file, process, and registry hiding.\n\n# Core Components\n\nThe repository is organized by the primary modules identified during the analysis of the original malware.\n\nModule: Loader\u002FDropper\nFilename: winsta.exe, ~WTR4141.tmp\nDescription: Entry point responsible for initial infection, privilege escalation, and deployment of other components.\n\nModule: Privilege Escalation\nFilename: ~WTR4132.tmp\nDescription: Exploits the Win32k.sys vulnerability to gain system-level privileges.\n\nModule: S7 Hook Library\nFilename: s7otbxdx.dll\nDescription: Malicious replacement of the original s7otbxsx.dll. Intercepts communication between Step 7 and the PLC.\n\nModule: Step7 Hook Library\nFilename: s7aaapix.dll\nDescription: Intercepts AUT (Automation Tool) API calls within the Step 7 engineering environment.\n\nModule: Rootkit (File System)\nFilename: mrxcls.sys\nDescription: Kernel-mode driver used to hide Stuxnet files, processes, and registry keys via SSDT hooking.\n\nModule: Rootkit (Network)\nFilename: mrxnet.sys\nDescription: Filters file system requests to hide malicious files and enables P2P propagation.\n\nModule: Payload (Attack)\nFilename: s7plcmain\nDescription: The core logic responsible for the \"Frequency Tampering\" attack that damages the centrifuges.\n\n# Technical Architecture\n\nThe following describes the high-level execution flow of the Stuxnet framework.\n\nStage 1: Initial Infection Vector (USB\u002FNetwork)\nStage 2: Dropper and Escalation\nStage 3: Check Environment\nStage 4a: Target Found (Siemens Software) -> Install S7 Hooks\nStage 4b: Non-target -> Self-Destruct\u002FIdle\nStage 5: Monitor PLC Writes\nStage 6: Detect OB1\u002FOB35 Write -> Inject Payload\nStage 7: Modify Frequency Output\nStage 8: Physical Damage to Centrifuges\nStage 9: Install Rootkit (MRxCls)\nStage 10: Hide Files and Registry\nStage 11: Load Network Module (MRxNet)\nStage 12: P2P Propagation\n\n**Execution Flow**\n\n1. Environment Reconnaissance: The worm checks for the presence of specific Siemens software (WinCC, Step 7) and specific target PLCs (S7-315, S7-417).\n\n2. DLL Injection: It intercepts the s7blk_write function call.\n\n3. Code Injection: When a user downloads a project to the PLC, the malicious code is appended to the OB1\u002FOB35 blocks.\n\n4. Physical Impact: The PLC executes the manipulated code, causing the connected variable frequency drives (VFDs) to spin at abnormal frequencies (high\u002Flow), resulting in mechanical damage.\n\n**Build Instructions**\n\nImportant: This codebase is designed for static analysis and debugging in a controlled virtual environment. It is not intended for live deployment on any critical infrastructure.\n\n**Requirements**\n\nBuild Environment: Microsoft Visual Studio 2019\u002F2022 (Windows) or mingw-w64.\n\nTarget OS: Windows XP \u002F Windows 7 (for driver compatibility).\n\nDriver Kit: Windows Driver Kit (WDK) 7600 (if compiling kernel drivers).\n\nBuilding the User-Mode Modules\n\n**Clone the repository**\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FSadpainy\u002FStuxnet.git\ncd Stuxnet\n```\n\n**Build the main dropper**\n\n```bash\ncd winsta\nnmake \u002Ff Makefile.win\n```\n\n**Build the S7 hook library**\n\n```bash\ncd ..\u002Fs7otbxdx\ncl \u002FLD s7otbxdx.c user32.lib ws2_32.lib\n```\n\n# Usage\n\nThis code is intended for:\n\nMalware Analysis: Understanding the specific code logic used in advanced persistent threats (APTs).\n\nDefensive Research: Developing detection signatures for ICS security tools (e.g., YARA rules, Snort signatures).\n\nAcademic Study: Examining the intersection of cybersecurity and critical infrastructure protection.\n\n**Analysis Setup**\n\n1. Isolate Environment: Use a virtual machine (VMWare\u002FVirtualBox) with Host-Only networking enabled. Disable internet connectivity.\n\n2. Load Modules: Analyze the .dll and .sys files using tools such as IDA Pro, Ghidra, or x64dbg.\n\n3. Monitor Activity: Use Process Monitor (ProcMon), Process Hacker, and Wireshark to observe the behavior.\n\n# Legal and License\n\n**License**\n\nThis project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.\n\n# Disclaimer\n\nThe code in this repository is a product of reverse engineering for educational purposes only. The original authors of the Stuxnet worm are anonymous, but the reconstruction contained herein is the work of independent security researchers.\n\nThe authors do not claim ownership of the original malware.\n\nThe code is provided \"AS IS\" without warranty of any kind.\n\nThe authors are not responsible for any misuse or damage caused by this code.\n\nBy using this repository, you acknowledge that you are solely responsible for ensuring compliance with all applicable laws and regulations.\n\n# Acknowledgements\n\nThis research and reconstruction would not have been possible without the extensive analysis and threat intelligence provided by global cybersecurity vendors.\n\n**Symantec (W32.Stuxnet dossier)**\n\n**Kaspersky Lab (The Stuxnet saga)**\n\n**ESET (Stuxnet under the microscope)**\n\n**Amr Thabet and Christian Roggia (research-virus\u002Fstuxnet)**\n\nThis is an academic reconstruction. Use it to build stronger defenses, not to cause harm.\n","这是一个面向安全研究与教学的Stuxnet蠕虫重构项目，严格基于2010年发现的原始样本逆向分析结果，以C语言实现其核心逻辑。项目完整复现了Stuxnet的关键技术特征：通过LNK文件、打印后台程序漏洞和P2P机制传播；利用Win32k.sys提权；通过s7otbxdx.dll和s7aaapix.dll劫持西门子Step 7与S7-300\u002F400 PLC通信；并集成MRxCls.sys\u002FMRxNet.sys内核级Rootkit实现文件、进程及注册表隐藏。仅支持Windows XP\u002F7平台，不可用于实际部署或攻击，专为工业控制系统（ICS）安全教学、恶意软件分析训练及防御技术研究设计。",2,"2026-09-09 02:30:12","CREATED_QUERY"]