The malware's body is a 64-byte genome G laid out as a flat 8×8 grid. A fixed core payload of 12 bytes (the amber disc in the middle of the grid) never changes — it is what actually does the damage, so it can't mutate without breaking the exploit. The other 52 bytes are the polymorphic shell: junk instructions and an XOR encryption key that a real polymorphic engine rewrites on every copy.
Each generation, each shell byte flips independently
with probability p (Mutation rate):
G[i]_(t+1) = random byte, if rand() < p
= G[i]_t, otherwise
Hamming distance to the original signature:
d(t) = Σ [ G[i]_t ≠ G[i]_0 ] over all 64 bytes (max 52, core excluded)
Signature-based AV flags a match when:
d(t) ≤ T (Signature threshold)
Heuristic engine flags the sample independently each
generation with a fixed probability h (Heuristic
sensitivity), because it watches what the core payload
*does* at runtime rather than what the file *looks like*.
This 2D companion runs the identical detection model as the 3D sim — same 8×8 genome, same core-disc geometry (12 fixed bytes, radius² = 2.56 grid units, verified by direct count), same Hamming-distance and threshold logic. The only real difference is presentation: instead of a rotating 3D block grid, the genome is drawn flat, and a second panel beneath it plots the Hamming-distance value against the threshold line generation-by-generation, with colour-coded dots for every detection event — a timeline the 3D sim's camera view has no room for.
- Mutation rate — how aggressively the shell rewrites itself each generation. Higher rate pushes the Hamming distance past the threshold faster, so the sample "goes dark" to signature scanning sooner — watch the timeline's slope steepen.
- Signature threshold — how loose the antivirus's fingerprint match is. Dragging it redraws the threshold line on the timeline instantly; a high threshold catches more mutated variants but also risks false positives on unrelated files, a low threshold is precise but blind after just a few generations.
- Heuristic sensitivity — the chance a behavior-based engine flags the sample this generation regardless of its byte pattern, because the invariant core payload still has to execute the same way to work. Shown as orange dots on the timeline even while the distance line sits safely above the threshold.
- Step / Auto-Mutate — advance one generation at a time or let it run; Reset Sample returns to generation 0 with d = 0 and clears the timeline.
Real-world relevance: this is the core reason antivirus vendors moved from pure signature matching (fast, but blind to polymorphic and metamorphic malware) toward heuristic and behavioral detection — the payload's behavior is much harder to disguise than its bytes.