Stuxnet reconstruction (Sadpainy/Stuxnet)

A public C source tree that reconstructs the Stuxnet worm from the published decompilation work of the security-research community, presented "only for research/education purposes." 138★, AGPL-3.0, created 2026-09-06 and still moving. The spoke's first malware-artifact source and its first foothold in ICS/OT security.

The value here is not the code. It is a worked example of what a reconstruction of a historically important attack does and does not contain, and what a defender can honestly take from one.

What it actually is, per its own files

The TODO - Missing.txt is the load-bearing document, and it is a disclaimer with teeth: "No complete working malicious binary can be built from this repository source code." It then lists, module by module, what was deliberately left out, and the list is the whole attack:

• The P2P/RPC components (complnd.dll.c, agentsb.dll.c) keep the peer-table data structures, the socket/thread skeleton and the full export tables, but every RPC handler body is a stub and the original MIDL/NDR RPC layer is replaced with raw named-pipe byte I/O.
• Payload fragmentation, reassembly and encryption routines are absent. The malicious payload is a zero-byte placeholder.
• Update-installation, peer aging, deduplication and retry/timeout logic are all missing.

So the repository is a structural map, not a weapon: type definitions, module boundaries, export tables and control-flow skeletons annotated with the original binary's RVAs, with the parts that would make it run removed. That is the honest reading, and it is the one a defender needs: the shape is real, the capability is not.

The architecture it maps

Reconstructed from the same public dossiers everyone cites (Symantec, Kaspersky, ESET), the tree is organised by the modules those analyses named: a loader/dropper, a Win32k.sys privilege-escalation stage, the s7otbxdx.dll shim that impersonates Siemens' real s7otbxsx.dll to sit between the Step 7 engineering station and the PLC, and the two kernel drivers (mrxcls.sys, mrxnet.sys) that hid the files and carried P2P propagation. The described end effect is the frequency-drive tampering that damaged centrifuge rotors, the 1.x variant's attack. Note a mismatch the repo does not reconcile: the PDF it bundles is Symantec — Stuxnet 0.5 — The Missing Link, which documents the earlier valve variant, a different payload from the rotor-speed attack the README describes.

What a defender can do with it

The README's stated uses are the legitimate ones and they are all blue-team: malware-analysis training in an isolated VM, and building detection content (YARA rules, Sigma/Snort signatures) for ICS security tooling. Mapped to this spoke's vocabulary that is detection engineering, and the natural home for the behaviours is ATT&CK's ICS matrix, which the spoke references but has never populated. A structural reconstruction is enough to write and test a signature against; it is not enough, and not intended, to run the attack.

Tier — T3, and why not lower

T3: a self-published reconstruction by an anonymous handle (sadpainy), derived at second hand from other people's decompilation, with no institutional review. It is not T4 (contrast the hub's usual T4 marketing-relay cases) because it is specific, technical, internally documented about its own gaps, and traceable to named primary dossiers. It carries no independent verification that the reconstruction is faithful to the original binaries, and this wiki cannot supply one. The claim that the structure matches the 2010 samples rests entirely on the author and the dossiers they worked from.

Related

stuxnet · ics-security · sadpainy · mitre-attack · security-operations-center · coordinated-vulnerability-disclosure · defensive-security · synthesis