Linux malware from scratch: understand the OS, write better malware.
After almost a year of teaching cyber security, I've realised how much it matters to actually make sense to beginners: to teach what they need, not waste time on trivia, and not skip the blockers that stall their progress.
I just published the first post of my "Linux C2 from Scratch" series.
Most Linux content hands you a reverse-shell one-liner and stops. The textbooks copy each other and never explain the things that actually confuse beginners. This is the opposite: plain English, from the ground up, everything you need for a solid foundation in Linux malware research.
Lesson 0 walks through the stuff people nod along to without really understanding:
• what a process is, why memory is virtual, and what a page actually is
• W^X, and the write-then-execute dance every in-memory loader does
• machine code vs bytecode, VMs vs JITs, and why your Java process has executable anonymous pages too
• syscalls: the ABI, the vDSO, and why indirect syscalls only defeat the lazy check
• libc is not the OS: glibc vs CRT, and why Go agents are 10MB+
• TLS: don't ship a stack, borrow the system's, and why that fixes your fingerprint too
• ELF, and how a stager runs code without a loader
The theme: on Windows the OS hands you a stable API for almost everything, so tiny malware is easy. Linux does not, and that is the whole challenge. Know the OS and you stop fighting it.
For anyone who wants to learn Linux internals and malware development, I hope this short course helps.
https://jm33.me/linux-c2-from-scratch-0x00-processes-syscalls-libc-and-tls.html