GitHub repo claims to reconstruct Stuxnet's source from the 2010 binaries

A newly surfaced GitHub project, posted to Hacker News as a Show HN, offers what its author calls a reconstructed source tree for Stuxnet — the 2010 worm generally regarded as the first malware built to cause physical destruction. Rather than a leaked original, the repo presents a re-derived, restructured codebase said to be pieced together from decompiled samples and the large body of public analysis by vendors like Symantec, Kaspersky, and ESET. It’s organized by the worm’s known modules: a dropper (winsta.exe), a Win32k.sys privilege-escalation stage, the s7otbxdx.dll hook that sits between Siemens Step 7 and the PLC, and the mrxcls/mrxnet kernel drivers used for rootkit hiding and P2P spread. Build notes target Visual Studio, the WDK 7600, and Windows XP/7 driver compatibility.