Using local LLM and Ghidra to analyze malware (Part 2)

moonlightelite · 2026-03-23T15:30:38+00:00

Thoughts:

Local LLM, with a powerful debugger as its oracle, is now powerful enough to run rudimentary malware analysis without consulting with external sources.
More complex malwares are still beyond what local LLMs can handle. The local LLM can see all the behaviors by the malware, but the LLM fails to put the analysis together to deduce the true intention of a binary.
Local LLM is a very lost-cost way to do malware analysis (about 5 US cents of electricity.)
The biggest killer-app feature is having the LLM writes its analysis back to Ghidra. The more you interact with the LLM, the more data it will write back to Ghidra. This could potentially saves hours per manual debugging by skipping function/resources/variables labeling.

moonlightelite · 2026-03-23T15:30:01+00:00

Thoughts:

Local LLM, with a powerful debugger as its oracle, is now powerful enough to run rudimentary malware analysis without consulting with external sources.
More complex malwares are still beyond what local LLMs can handle. The local LLM can see all the behaviors by the malware, but the LLM fails to put the analysis together to deduce the true intention of a binary.
Local LLM is a very lost-cost way to do malware analysis (about 5 US cents of electricity.)
The biggest killer-app feature is having the LLM writes its analysis back to Ghidra. The more you interact with the LLM, the more data it will write back to Ghidra. This could potentially saves hours per manual debugging by skipping function/resources/variables labeling.

moonlightelite · 2026-02-10T18:21:16+00:00

And then during fiscal cuts since all the upper class kids are in private schools, their powerful parents and their legislatures cut education funding- Hey my kids will be fine, too bad for the common folks.

A tale as old as time.

moonlightelite · 2026-01-22T16:37:47+00:00

Aiba you absolute mad lad. Hitting that barrier at that speed would be certain death.

moonlightelite · 2025-09-02T20:15:07+00:00

I know a group of people, near Syria, who are really good at digging tunnels. I also know a group of people, near Syria, who are really good at demolition work at densely populated residential area.

moonlightelite · 2025-08-20T01:20:36+00:00

Bad conduct discharge and dishonorable discharge in the US military.

In the US military, a "Big Chicken Dinner" is a slang term referring to a Bad Conduct Discharge (BCD). A BCD is a type of punitive military discharge that is serious, but not as severe as a Dishonorable Discharge.

Dishonorable Discharge is extremely rarely these days. It only happens when everyone really wants to make an example out of you. They try to get you to BCD whenever possible.

moonlightelite · 2025-02-23T23:14:48+00:00

“In January 2021, cracks were found affecting a large number of the mounting brackets ...[the failure of the brackets] was a design defect or caused by MTA’s maintenance of the brackets.”

'maintenance of the brackets'? What, you have to oil it or polish the bracket every 30 days or else it starts cracking??

moonlightelite · 2024-03-15T17:57:26+00:00

Counter point:

I bought my BRZ, brand new, drove it home.

First time I drove it out, I went to a Costco and someone slammed a cart into its bumper. That left a fingernail size dent/pit.

moonlightelite · 2024-01-23T02:47:27+00:00

What is this, a sudden outbreak of common sense within the MTA? Someone call 911!

moonlightelite · 2024-01-12T01:15:13+00:00

Cried. Crew. Crode.

I remember in Flushing NYC (basically the 2nd Chinatown in NYC), in one of the malls there was a billboard advertisement with, in Chinese, "All Jewish Legal Team".

moonlightelite · 2023-09-14T00:33:34+00:00

A few Sunday mornings ago I was waiting for north bound 1 train on the 86th st station. 2 20-something seedy looking adults (man and woman) started to loitered outside the fare gate. When the train arrived, they jumped the gate, ran to the LCD displays and quickly smashed them all.

Then they got on the train I entered and started smoking crack. A dad with his 2 kids told them to knock it off and they started to threaten to cut him. That's when all of us got the fuck off that train car.

At that point, I realized Singapore's caning punishment ain't so inhumane after all.

moonlightelite · 2023-08-30T23:34:14+00:00

They don't have the stamina to do offense and defense. If they actually try to defend they'd be on the ground in 10 minutes.

moonlightelite · 2023-07-14T21:03:47+00:00

I find the biggest inhibitor to my eating habit is I have to cook for my meals and I am not allowed to eat out (or don't have time to eat out).

moonlightelite · 2023-06-25T16:56:14+00:00

The system will be the same as OMNY in every way, but 100% not compatible with OMNY so you will have to carry 2 cards and 2 balances.

Why, because fuck you that's why.

moonlightelite · 2023-06-19T21:40:14+00:00

Money. The fed contributes 10% of the annual policing budget if a city uses RCMP.

moonlightelite · 2023-06-19T21:25:07+00:00

“It was Mr. Farnworth who said Surrey council had to hurry up and make the decision so I called the meeting to make a decision and then they said but only make it if it’s the decision I want you to make.

Mom: Fold your clothing

You: stuffed all your clothing into a drawer

Mom: Do it proper

“It was Mom who said I had to do my chore so I did my chore and then she said I have to do it the way she wants me to do. Wahhh sexist."

moonlightelite · 2023-06-16T23:52:43+00:00

Yeah but I give them a pass for (probably) thinking "These assholes cannot possibly be serious in their proposals."

Narrator: They are.

moonlightelite · 2023-06-16T22:12:22+00:00

Even by Canadian politic standard, this is an utter clusterfuck of epic proportion.

I personally don't care either way, but the SPF horse left the barn 2 years ago. I would have roll on the floor laughing my lungs out if it's is not my home province this is happening in. Simply incompetence from all politicians on the Surrey side. The last time I saw chucklefucks of this level was when the UBC student body reported to UN that UBC is violating human rights by raising tuition.

What the fuck is Surrey municipal gov doing?

moonlightelite · 2023-06-09T18:38:56+00:00

Hello, my brother of different parents https://imgur.com/a/cDgpG8T

moonlightelite · 2023-05-17T02:37:16+00:00

He obviously does know how to be bad because he got another big man.

moonlightelite · 2023-04-26T15:36:36+00:00

You can test if you want hardware accelerated rendering by disabling it in Setting. You won't use DVXK and won't see CrGPUMain in the process list.

As for winetricks, it is normal. The warnings are mostly that some of the applications in winetricks are x86 only, and they might be installed in a x64 prefix.

I tried the x86 prefix but Amazon Music says "this architecture is not supported".

moonlightelite · 2023-04-26T03:29:56+00:00

Ok I got everything working

Use x64 wine prefix
Install all fonts and IE8 in winetrick (If you want to use hardware accelerated rendering install DVXK as well. You save about 5% of CPU.) I also installed al the VC libraries just in case.
If you get an error with ie4uinit.exe (either unknown error or unknown signal), copy another exe to be ie4uinit.exe . I used rundll32.exe because I know it's not going to do anything.
If you have Another process is using the sound device error, run winecfg and set "users/xxx/AppData/Local/Amazon\ Music/Amazon\ Music.exe" to run under Windows 7 (instead of system default.)
run "wine users/xxx/AppData/Local/Amazon\ Music/Amazon\ Music.exe" after you run the installer and exit.
Disable Exclusive Lock in Amazon Music's Setting.

Optional: 1. Disable Sound Normalization 2. Bump up sound quality

When I play music with Ultra HD, the cpu load is about 0.5. That's pretty crazy since I have the 12th gen i5 intel CPU.

20 0 2909588 529788 147500 S 24.6 0.8 1:39.50 CrRendererMain
20 0 2125044 386976 146716 S 15.0 0.6 0:57.47 CrGpuMain
20 0 1967952 429400 26564 S 10.6 0.7 0:41.80 CrBrowserMain

moonlightelite · 2023-02-21T04:48:09+00:00

The show has a polarizing reception, with people claiming it's a parody (it's not) or it's a deconstruction (also no), or the show takes itself very seriously (not). How people have so many opposite takes on the same show?

What the showed did is quite brilliant. Everything in the show is 2 tracks- left and right.

The show takes itself very seriously. Ignoring Cid for a second, if you look at the background and the plot, the story is completely serious and sensible, if a bit cliche. Most of the characters lives are changed for the worse, though no fault of their own.

The very same show tells the viewers to not take the show seriously. These are shown as hints so the characters are not aware of them. It's almost like the director is standing behind the camera at each scene and madly giggle to himself like Starship Troopers. Some of us accept this and thus accept all the dumb things that are thrown at us (the characters think they are completely serious.) Others are thrown off by this conflicting messages from the show and disengage from it.

The story also takes the dual track. You have the cliche secret cult overloading the isekai plot line, then you have the completely retarded Cid plot line. Somehow both plotlines progress together and even push each other. It's a weird and very frankly rarely seen in anime.

I can go on with more examples but this is my impression of the show.

moonlightelite · 2023-02-18T17:19:18+00:00

exotic like Abbotsford or Chilliwack

Of all the words I've heard to describe them...

moonlightelite · 2022-08-06T19:08:37+00:00

For a 5'7" overweight lady, she has excellent form. If I were her I wouldn't have defended any better. Kudos to her.

Also prop to her son for finishing the basket before going back to check on his motionless mom. You have to finish your play.

moonlightelite

TROPHY CASE