Stuxnet README

The project's README from github.com/Sadpainy/Stuxnet. As one markdown file: README.md.

Stuxnet

Build Unstable Windows Siemens Tests AGPLv3

This repository contains a strictly educational and research-oriented reconstruction of the infamous Stuxnet worm. It is the product of countless hours of reverse engineering work conducted by the global security research community on the original binary samples discovered in 2010.

Disclaimer: This code is provided solely for academic study, malware analysis training, and defensive research. It is not intended to be used for any malicious purposes, nor is it a deployable piece of malware. The authors and contributors do not condone illegal or unethical activities.

Table of Contents

Overview

Core Components

Technical Architecture

Build Instructions

Usage

Legal and License

Acknowledgements

Overview

Stuxnet is widely recognized as the first known cyber-weapon designed to cause physical destruction to industrial control systems (ICS). It specifically targeted Siemens Step 7 software and S7-300/400 PLCs, ultimately manipulating frequency converter drives to damage centrifuge rotors.

This repository is a reconstructed source code derived from the decompiled binaries. It preserves the original logic and attack vectors while structuring the codebase for readability and analysis.

Key Characteristics

Target: Siemens SIMATIC WinCC, Step 7, and S7 PLCs.

Propagation: USB drives (LNK exploits), Network shares (Print Spooler), Peer-to-Peer (P2P).

Payload: Modification of PLC block logic (OB1/OB35) to alter motor frequencies.

Stealth: Advanced Rootkit capabilities (MRxCls.sys, MRxNet.sys) for file, process, and registry hiding.

Core Components

The repository is organized by the primary modules identified during the analysis of the original malware.

Module: Loader/Dropper Filename: winsta.exe, ~WTR4141.tmp Description: Entry point responsible for initial infection, privilege escalation, and deployment of other components.

Module: Privilege Escalation Filename: ~WTR4132.tmp Description: Exploits the Win32k.sys vulnerability to gain system-level privileges.

Module: S7 Hook Library Filename: s7otbxdx.dll Description: Malicious replacement of the original s7otbxsx.dll. Intercepts communication between Step 7 and the PLC.

Module: Step7 Hook Library Filename: s7aaapix.dll Description: Intercepts AUT (Automation Tool) API calls within the Step 7 engineering environment.

Module: Rootkit (File System) Filename: mrxcls.sys Description: Kernel-mode driver used to hide Stuxnet files, processes, and registry keys via SSDT hooking.

Module: Rootkit (Network) Filename: mrxnet.sys Description: Filters file system requests to hide malicious files and enables P2P propagation.

Module: Payload (Attack) Filename: s7plcmain Description: The core logic responsible for the "Frequency Tampering" attack that damages the centrifuges.

Technical Architecture

The following describes the high-level execution flow of the Stuxnet framework.

Stage 1: Initial Infection Vector (USB/Network) Stage 2: Dropper and Escalation Stage 3: Check Environment Stage 4a: Target Found (Siemens Software) -> Install S7 Hooks Stage 4b: Non-target -> Self-Destruct/Idle Stage 5: Monitor PLC Writes Stage 6: Detect OB1/OB35 Write -> Inject Payload Stage 7: Modify Frequency Output Stage 8: Physical Damage to Centrifuges Stage 9: Install Rootkit (MRxCls) Stage 10: Hide Files and Registry Stage 11: Load Network Module (MRxNet) Stage 12: P2P Propagation

Execution Flow

  1. Environment Reconnaissance: The worm checks for the presence of specific Siemens software (WinCC, Step 7) and specific target PLCs (S7-315, S7-417).

  2. DLL Injection: It intercepts the s7blk_write function call.

  3. Code Injection: When a user downloads a project to the PLC, the malicious code is appended to the OB1/OB35 blocks.

  4. Physical Impact: The PLC executes the manipulated code, causing the connected variable frequency drives (VFDs) to spin at abnormal frequencies (high/low), resulting in mechanical damage.

Build Instructions

Important: This codebase is designed for static analysis and debugging in a controlled virtual environment. It is not intended for live deployment on any critical infrastructure.

Requirements

Build Environment: Microsoft Visual Studio 2019/2022 (Windows) or mingw-w64.

Target OS: Windows XP / Windows 7 (for driver compatibility).

Driver Kit: Windows Driver Kit (WDK) 7600 (if compiling kernel drivers).

Building the User-Mode Modules

Clone the repository

git clone https://github.com/Sadpainy/Stuxnet.git
cd Stuxnet

Build the main dropper

cd winsta
nmake /f Makefile.win

Build the S7 hook library

cd ../s7otbxdx
cl /LD s7otbxdx.c user32.lib ws2_32.lib

Usage

This code is intended for:

Malware Analysis: Understanding the specific code logic used in advanced persistent threats (APTs).

Defensive Research: Developing detection signatures for ICS security tools (e.g., YARA rules, Snort signatures).

Academic Study: Examining the intersection of cybersecurity and critical infrastructure protection.

Analysis Setup

  1. Isolate Environment: Use a virtual machine (VMWare/VirtualBox) with Host-Only networking enabled. Disable internet connectivity.

  2. Load Modules: Analyze the .dll and .sys files using tools such as IDA Pro, Ghidra, or x64dbg.

  3. Monitor Activity: Use Process Monitor (ProcMon), Process Hacker, and Wireshark to observe the behavior.

Legal and License

License

This project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.

Disclaimer

The code in this repository is a product of reverse engineering for educational purposes only. The original authors of the Stuxnet worm are anonymous, but the reconstruction contained herein is the work of independent security researchers.

The authors do not claim ownership of the original malware.

The code is provided "AS IS" without warranty of any kind.

The authors are not responsible for any misuse or damage caused by this code.

By using this repository, you acknowledge that you are solely responsible for ensuring compliance with all applicable laws and regulations.

Acknowledgements

This research and reconstruction would not have been possible without the extensive analysis and threat intelligence provided by global cybersecurity vendors.

Symantec (W32.Stuxnet dossier)

Kaspersky Lab (The Stuxnet saga)

ESET (Stuxnet under the microscope)

Amr Thabet and Christian Roggia (research-virus/stuxnet)

This is an academic reconstruction. Use it to build stronger defenses, not to cause harm.

Stuxnet (Sadpainy/Stuxnet)

forensics
Searching Database…

588 ·GitHub
Stuxnet
What is this?This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.
Is this the actual Stuxnet binary or a recreation from research?It is a recreation: the C source is derived from decompiled binary samples and public threat-intel reports, reorganized into readable modules (loader, S7 hook libraries, rootkit drivers, PLC payload), not the original leaked malware.
How do I build and analyze this?Clone the repo and build the user-mode modules (dropper, S7 hook library) with Visual Studio 2019/2022 or mingw-w64; kernel drivers need the Windows Driver Kit (WDK) 7600. Analysis is meant to happen inside an isolated VM with tools like IDA Pro, Ghidra, Process Monitor and Wireshark.
What do I need besides the source itself?You need a Windows XP/Windows 7 build target for driver compatibility, plus the WDK 7600 for compiling the kernel-mode rootkit drivers (mrxcls.sys, mrxnet.sys).
Is this safe to run on a real machine?No, the author explicitly says it is designed only for static analysis and debugging in a controlled virtual environment, not for live deployment on any system, and it is scoped to legacy Windows XP/7 driver compatibility.
Who is this meant for?Malware analysts, ICS/SCADA defensive researchers, and students studying advanced persistent threats and reverse engineering, not operators of real industrial equipment.
What platforms does the target code run on?The payload and drivers are built specifically for Windows XP and Windows 7, matching the original Stuxnet's target environment.
What does the malware actually attack?It targets Siemens SIMATIC WinCC, Step 7 software and S7-300/400 PLCs, intercepting the s7blkwrite call to inject code into OB1/OB35 blocks and manipulate frequency converter drives, which physically damaged centrifuge rotors in the real-world incident.
How does it spread and hide itself?Propagation is via infected USB drives (LNK exploit), network print-spooler shares and peer-to-peer; stealth comes from kernel rootkit drivers (MRxCls.sys, MRxNet.sys) that hide files, processes and registry keys using SSDT hooking.
What modules does the repo split the worm into?Core components include the Loader/Dropper, a privilege-escalation exploit for Win32k.sys, S7/Step7 hook libraries that intercept PLC communication, two rootkit drivers, and the s7plcmain payload responsible for the frequency-tampering attack.
Where did the reconstruction get its technical details from?It's built on published threat-intel research from Symantec's W32.Stuxnet dossier, Kaspersky Lab's Stuxnet saga, ESET's analysis, and independent researchers Amr Thabet and Christian Roggia.
What are similar projects?Claude-Red, copy-fail-CVE-2026-31431, dirtyfrag, awesome-honeypots, ablation, Relapse-Exploit, exploitarium, skitter-creek-bath-salts
Which topics is it in?threat-intelligence, malware, forensics, driver, malware-analysis, security-research, infosec, vulnerability, exploit, kernel, offensive-security, agplv3
Creator
Sadpainy
Size
5.5 MB
Stars
588
Updated
CommitOct 16
Age
1mo
Commits · 90 Days