SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
reverse-engineering-nim-and-other-exotic-binaries
0
Reverse engineers malware written in less-common compiled languages (Nim, Crystal, V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings to orient analysis. Activates for requests to reverse Nim malware, identify the source language of an exotic binary, or analyze Crystal/V/Zig/D compiled samples.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Reverse Engineering Nim and Other Exotic Binaries ## When to Use - You have a compiled binary that is not C/C++/Go/Rust/.NET and need to identify its source language (Nim, Crystal, V, Zig, D) to orient analysis. - Symbol/runtime patterns are unfamiliar and you want language-specific landmarks. **Do not use** this for already-supported languages (Go/Rust have dedicated skills). This skill reads the binary statically and executes nothing. ## Prerequisites - The binary (read inertly). ## Safety & Handling - Read bytes statically; treat strings as untrusted. ## Workflow ### Step 1: Detect the source language ```bash python scripts/analyst.py detect sample.bin ``` Scans for language runtime signatures: Nim (`@m..nim`, `nimrtl`, `fatal.nim`, `stack trace`, `@ /nim`), Crystal (`Crystal::`, `crystal-lang`), V (`vlib/`, `_vinit`), Zig (`zig`, `panic: `, `std.builtin`), and D (`_Dmain`, `core.runtime`, `TypeInfo_`). ### Step 2: Locate runtime landmarks Use the detected language's panic/exception and module strings to find `main`/init and error paths. ### Step 3: Handle name mangling Apply the language's mangling convention (e.g., Nim's `proc__module_NNN`) to recover readable names. ### Step 4: Proceed with analysis With the language identified, analyze logic; many exotic-language samples wrap the same C2/loader behavior. ## Validation - Language detection is based on multiple corroborating runtime strings, not one weak hit. - Identified landmarks (panic/init) are consistent with the language. - Name demangling matches the language's documented scheme. ## Pitfalls - Statically linked C runtime strings causing misclassification — weight language-specific markers. - Stripped binaries with few runtime strings. - Stagers in exotic languages that quickly hand off to shellcode. ## References - See [`references/api-reference.md`](references/api-reference.md) for the detector. - Nim manual and ATT&CK T1027 references (linked in frontmatter).