91 lines
2.9 KiB
Markdown
91 lines
2.9 KiB
Markdown
---
|
|
name: reverse-engineering-nim-and-other-exotic-binaries
|
|
description: 'Reverse engineers malware written in less-common compiled languages (Nim, Crystal,
|
|
V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings
|
|
to orient analysis. Activates for requests to reverse Nim malware, identify the source language of
|
|
an exotic binary, or analyze Crystal/V/Zig/D compiled samples.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- nim
|
|
- exotic-languages
|
|
- language-detection
|
|
- runtime
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
- T1587.001
|
|
- T1059
|
|
d3fend:
|
|
- D3-SDA
|
|
- D3-DA
|
|
references:
|
|
- 'Nim language manual (name mangling, runtime) — https://nim-lang.org/docs/manual.html'
|
|
- 'MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/'
|
|
---
|
|
|
|
# Reverse Engineering Nim and Other Exotic Binaries
|
|
|
|
## When to Use
|
|
|
|
- You have a compiled binary that is not C/C++/Go/Rust/.NET and need to identify its source
|
|
language (Nim, Crystal, V, Zig, D) to orient analysis.
|
|
- Symbol/runtime patterns are unfamiliar and you want language-specific landmarks.
|
|
|
|
**Do not use** this for already-supported languages (Go/Rust have dedicated skills). This skill
|
|
reads the binary statically and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- The binary (read inertly).
|
|
|
|
## Safety & Handling
|
|
|
|
- Read bytes statically; treat strings as untrusted.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Detect the source language
|
|
|
|
```bash
|
|
python scripts/analyst.py detect sample.bin
|
|
```
|
|
|
|
Scans for language runtime signatures: Nim (`@m..nim`, `nimrtl`, `fatal.nim`, `stack trace`,
|
|
`@ /nim`), Crystal (`Crystal::`, `crystal-lang`), V (`vlib/`, `_vinit`), Zig (`zig`, `panic: `,
|
|
`std.builtin`), and D (`_Dmain`, `core.runtime`, `TypeInfo_`).
|
|
|
|
### Step 2: Locate runtime landmarks
|
|
|
|
Use the detected language's panic/exception and module strings to find `main`/init and error paths.
|
|
|
|
### Step 3: Handle name mangling
|
|
|
|
Apply the language's mangling convention (e.g., Nim's `proc__module_NNN`) to recover readable
|
|
names.
|
|
|
|
### Step 4: Proceed with analysis
|
|
|
|
With the language identified, analyze logic; many exotic-language samples wrap the same C2/loader
|
|
behavior.
|
|
|
|
## Validation
|
|
|
|
- Language detection is based on multiple corroborating runtime strings, not one weak hit.
|
|
- Identified landmarks (panic/init) are consistent with the language.
|
|
- Name demangling matches the language's documented scheme.
|
|
|
|
## Pitfalls
|
|
|
|
- Statically linked C runtime strings causing misclassification — weight language-specific markers.
|
|
- Stripped binaries with few runtime strings.
|
|
- Stagers in exotic languages that quickly hand off to shellcode.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the detector.
|
|
- Nim manual and ATT&CK T1027 references (linked in frontmatter).
|