reverse-skills-max/vendor-new/analyst-ai-pack/skills/reverse-engineering-nim-and-other-exotic-binaries/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
reverse-engineering-nim-and-other-exotic-binaries	Reverse engineers malware written in less-common compiled languages (Nim, Crystal, V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings to orient analysis. Activates for requests to reverse Nim malware, identify the source language of an exotic binary, or analyze Crystal/V/Zig/D compiled samples.	cybersecurity	reverse-engineering	reverse-engineering nim exotic-languages language-detection runtime	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1587.001 T1059	D3-SDA D3-DA	Nim language manual (name mangling, runtime) — https://nim-lang.org/docs/manual.html MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/

Reverse Engineering Nim and Other Exotic Binaries

When to Use

• You have a compiled binary that is not C/C++/Go/Rust/.NET and need to identify its source language (Nim, Crystal, V, Zig, D) to orient analysis.
• Symbol/runtime patterns are unfamiliar and you want language-specific landmarks.

Do not use this for already-supported languages (Go/Rust have dedicated skills). This skill reads the binary statically and executes nothing.

Prerequisites

• The binary (read inertly).

Safety & Handling

• Read bytes statically; treat strings as untrusted.

Workflow

Step 1: Detect the source language

python scripts/analyst.py detect sample.bin

Scans for language runtime signatures: Nim (@m..nim, nimrtl, fatal.nim, stack trace, @ /nim), Crystal (Crystal::, crystal-lang), V (vlib/, _vinit), Zig (zig, panic: , std.builtin), and D (_Dmain, core.runtime, TypeInfo_).

Step 2: Locate runtime landmarks

Use the detected language's panic/exception and module strings to find main/init and error paths.

Step 3: Handle name mangling

Apply the language's mangling convention (e.g., Nim's proc__module_NNN) to recover readable names.

Step 4: Proceed with analysis

With the language identified, analyze logic; many exotic-language samples wrap the same C2/loader behavior.

Validation

• Language detection is based on multiple corroborating runtime strings, not one weak hit.
• Identified landmarks (panic/init) are consistent with the language.
• Name demangling matches the language's documented scheme.

Pitfalls

• Statically linked C runtime strings causing misclassification — weight language-specific markers.
• Stripped binaries with few runtime strings.
• Stagers in exotic languages that quickly hand off to shellcode.

References

• See references/api-reference.md for the detector.
• Nim manual and ATT&CK T1027 references (linked in frontmatter).