This game is a single 13 KiB file that runs on Windows, Linux and in the Browser. (iczelia.net)
from cm0002@suppo.fi to programming@programming.dev on 12 Jan 2026 00:26
https://suppo.fi/post/9965538

#programming

threaded - newest

diemartin@sh.itjust.works on 12 Jan 2026 01:14 next collapse

This is pretty cool. Reminds me of .kkrieger, but this beats it in small size and that it’s a polyglot (though .kkrieger wins in visuals)

I didn’t see a link to source code for the snake tho

01189998819991197253@infosec.pub on 12 Jan 2026 03:36 collapse

I’ve been looking for this game for so long! Thank you!

Edit. Here’s the source.

diemartin@sh.itjust.works on 12 Jan 2026 04:12 collapse

Oh, I meant the polyglot snake sources, but thanks

01189998819991197253@infosec.pub on 12 Jan 2026 16:49 collapse

Ah whoops. Sorry about the misunderstanding

diemartin@sh.itjust.works on 13 Jan 2026 01:39 collapse

No problem :)

Upon reading my comment again, it’s a bit ambiguous. Clarified a bit

jokro@feddit.org on 12 Jan 2026 07:19 next collapse

Wow, in case it’s not clear, it really is the same file for all three platforms.

FishFace@piefed.social on 12 Jan 2026 09:32 next collapse

Ok but is it good

Hirom@beehaw.org on 12 Jan 2026 11:23 next collapse

VirusTotal doesn’t like it virustotal.com/…/ede115f31fb3fcc3c27bad1b6da5cfee…

Either it’s because it’s using the same technique as malware, or because it’s malware.

TeamAssimilation@infosec.pub on 12 Jan 2026 22:10 collapse

I’d guess the former, given it’s tiny compared to normal droppers, but you can never be sure these days.

This sample is a multi-platform ‘polyglot’ binary acting as a dropper and potentially a browser-based exploit. It functions as a Windows PE (with no standard imports, suggesting custom shellcode or manual API resolution), a Linux shell script, and an HTML/JavaScript file. The Linux component contains a command (‘tail -c+4294 $0 | lzma -dc > /tmp/a’) that extracts and executes a hidden payload from its own body. The embedded JavaScript is obfuscated and uses ‘eval’ to execute dynamically generated code. This structure is typical of sophisticated malware or cross-platform exploit delivery kits.

[deleted] on 13 Jan 2026 11:30 collapse
.