alt Hacker NewsRebuilding strip from clean source doesn't clear it. The copy in the bootstrap seed modifies its replacement, and the replacement carries on from there. The provenance can still look normal.
Replies
krater23 • today at 4:17 AM
Rebuilding from clean source on a infected device. Whats the point? Could be every computer virus from 30 years ago.
The paper over complicates what's needed to maintain persistence between the different stages. It's not like the machine is turned off between them. You can simply keep a process running the whole time.