Post B8dGNWBHUZz1BQIJoe by thomrstrom@triangletoot.party
 (DIR) More posts by thomrstrom@triangletoot.party
 (DIR) Post #B8N4K2TJlrt2IKNWHQ by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @thomrstrom my prompt2exe synthesized this pong game, you should try to analyze it with your malware thing: https://distfiles.ariadne.space/stuff/pong.elf
       
 (DIR) Post #B8dGNWBHUZz1BQIJoe by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Sorry about the delay (I'm on holiday!) - the results are here: https://lab.atomdrift.org/file/2b5ba4f181efeec285b51e6e255280c4cd05e1979fcbef65fe761b8df637fb39Basically it didn't match much of anything in the 90,000 parsing rules we ship, but just enough that the JSON exported was interpreted by the local GPU to provide an accurate interpretation (an optional).
       
 (DIR) Post #B8scmlO5kijDr4Td7w by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @thomrstrom do you have any interest in atomdrift's analysis being included in a paper about prompt2exe?there will also be prompt2exe season 2: where the prompt2exe harness is used with Kimi to generate malware.
       
 (DIR) Post #B8uFMDQpAMGLBKR3mC by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Yes! I'd love to. Let me know if I can help in some way.Admittedly, much of atomdrift's detection assumes use of a stdlib today. There haven't been many samples of pure-ASM ELF binaries to learn from yet, but it's coming; so I guess this means I'm gonna have to embed a per-arch syscall map unless I can abuse rizin for that purpose.atomdrift was trained on ~1k worth of  Qwen-generated malware samples in various languages; but all compiled using normal tooling.
       
 (DIR) Post #B8uFrmjxwHOBfPRToO by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @thomrstrom cool, i've included it in the paper.  i thought it was interesting that atomdrift could figure out that the pong game example was in fact a pong game.from the working draft:
       
 (DIR) Post #B8uGJ6mLXpq3dLaIi0 by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne To remove some of the mystery; you can use "atomscan --format=interpret <path>" to see what context it sends to an LLM; AFAIK, it probably used the detected traits + the one error message in the ELF binary to tie the hints together.The default interpretation LLM is Qwen 3.7-27B; but you can point it at anything using the `-llm` flag. I haven't done a ton of comparative testing, but the Qwen results are reasonable enough & cheap to run locally.
       
 (DIR) Post #B8uGOmJ6ZRbHsabv04 by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @thomrstrom fascinating.  i have GLM 5.2 running using colibri on my dual RTX 6000 blackwell server.  want me to try with GLM 5.2?
       
 (DIR) Post #B8uGWSB5IM11lYWEaG by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @thomrstrom also in this case, it is not even pure ASM, but literally machine code fragments generated using GPT 5.6-sol's shellcode generator stapled togetherso i suspect this is probably a good 'malware of the future' oracle
       
 (DIR) Post #B8uLn7T62rOyELi5yq by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Sure, I'd be curious if the results are any different. I imagine both should say benign though. If you started adding socket/execve syscalls, it should start heading toward suspicious; but admittedly that will depend on what architecture your targetting.The only time I've seen similar techniques used for ELF binaries is for IoT malware that used more obscure architectures like MIPS, so that's where most of the raw syscall training has been so far.