s3cur3th1ssh1t/nimsyscallpackerPacks C# assemblies, PE files, or shellcode into encrypted Nim binaries with advanced evasion features including AMSI/ETW bypass, sandbox detection, and multiple injection techniques for red team operations.
This tool was made public after a talk at x33fcon. It was my private main coding project from 2021 - 2024 and is now considered deprecated and is not maintained anymore. Dont expect bug fixes or feature updates here from my side. Instead, RustPack is maintained now as a commercial and controlled version for vetted Red Teams and Pentesters which is even more feature rich but also much more OPSec save.
This Packer can be used to pack any C# Assembly, PE-File or Shellcode into a Nim binary. It will encrypt the target payload, build the corresponding Nim source code according to the given arguments and compiles it to an Nim binary.
A Video - if you prefer that - can be found here: https://youtu.be/0PwIn3Nxmgo
Git needs to be installed for Nim/Nimble to work properly.
Tested with Nim 2.2.10 and the MinGW-w64 GCC 11.1.0 bundle linked from the Nim Windows download page. Newer Nim releases default to a high PE image base on Windows, which breaks -static links with relocation truncated to fit: R_X86_64_32S against .bss; the packer now forces -Wl,--image-base=0x10000 to keep static builds working, so any MinGW-w64 11.x build should be fine. Only x64 is supported here — x86/--x86/--wow64 is not maintained.
Download Nim and MinGW (x86_64):
nim-2.2.10_x64.zipmingw64.7z (linked from the Nim Windows install page)Extract Nim with 7-Zip (not Windows' built-in Expand-Archive — it silently drops lib\system.nim because of the case-collision with the lib\system\ directory). The Nim zip ships bin\7zG.exe which you can use to extract MinGW.
Add <nim>\bin and <mingw64>\bin to your %PATH%. Logoff/logon (or restart your shell) for the change to take effect.
Install nimble dependencies:
nimble install [email protected] docopt ptr_math winim https://github.com/S3cur3Th1sSh1t/nim-strenc/
Versions known to work (as of Nim 2.2.10): nimcrypto 0.6.0, docopt 0.7.1, ptr_math 0.3.0, winim 3.9.4, nim-strenc (HEAD — the repo has no tagged releases).
Disable Windows Defender Sample Submission (the Packer refuses to run otherwise):
Set-MpPreference -SubmitSamplesConsent 2
Compile the Packer:
nim c NimSyscallLoader.nim
If you want to use the LLVM obfuscator on Windows, use the embedded modified denim version from denim. Install it via denim\denim.exe setup.
E.g. on Kali / Debian. The packer historically required nim 1.6.8 + mingw-64 8.0.0-1; with the static-link --image-base=0x10000 workaround now baked in, newer toolchains should work too. The Windows build is what's actively tested — Linux is best-effort.
apt-get install nim mingw-w64
nimble install [email protected] docopt ptr_math winim https://github.com/S3cur3Th1sSh1t/nim-strenc/
If --hellsgate fails to assemble on a newer mingw-w64, downgrade to mingw-64=8.0.0-1.
Install donut via pip3 install donut-shellcode. denim cannot be used from Unix so obfuscation via LLVM is not possible here. Same for Callobfuscator.
Compile the Packer via nim c -d:noRES NimSyscallLoader.nim. Ready to go. If you don't use -d:noRES you might get the following error:
/username/.nimble/pkgs/winim-3.7.1/winim/lib/winim64.res:(.rsrc+0x48): dangerous relocation: collect2: fatal error: ld terminated with signal 11 [Speicherzugriffsfehler]
compilation terminated.
Needs to be built once (takes some time the first time, subsequent builds will be cached).
sudo docker build . -t nimsyscallloader
Then run the packer with:
sudo docker run -v $(pwd):/shared nimsyscallloader <ARGUMENTS> --output=/shared/packed.exe
where $(pwd) is the directory on the host system that is shared with the container, i.e. the directory where the files to encrypt should be and where the output will be saved to.
If you want to make use of Code Signing certificates via LimeLighter you'll also need the following things installed and in your %PATH%: openssl - (for Windows) for example from here osslsigncode - for example from here
I will not give Support for issues in the third party tools which are used here. So please open up an issue in the corresponsing repositories if you're facing problems with them. Third party tools in use:
You can either use my precompiled binaries or of course compile them your own from the above links.
A Video - if you prefer that - can be found here: https://youtu.be/UHaIgdzqHDA
I also added short videos for some features as this was requested:
Caro-Kann:
ThreadlessInject Feature:
Module Stomping Feature:
shellcodeURL Feature:
stegoFile Feature:
shellcodeFile Feature:
Ruy Lopez for local processes
Shellcode output format
Assembly output feature
And I made a public Video showcasing how to customize ThreadlessInject technique to other processes than the default one:
NimSyscall_Loader v 2.2
Usage:
NimSyscall_Loader [--file=file_to_encrypt --key=<key> --keyfile=<keyFile> --dnsKey --dnsdomain=<sub.example.com> --environmentalKey=<domain,username> --output=<output> --large --metadata --shellcodeFile=<shellcodeFile> --shellcodeURL=<shellcodeURL> --dll --dllexportfunc=<exportfuncname> --dllhijack --noNimMain --clone=<dllToClone> --dllProxy --cpl --xll --service --arguments=<Hardcoded_Arguments> --csharp --noAMSI --noETW --noOneShot --PatchAMSI --PatchETW --AMSIProviderPatch --AMSINtCreateSectionHook --sleep=<10> --sleep-in-between=<10> --shellcode --RWX --CallbackExecute --localCreateThread --QueueApc --noWait --COMVARETW --remoteinject --customprocess=<processname> --blockDLLs --spoofArgs=<ArgumentstoSpoof> --parentProcess=<parentName> --remoteprocess=<processnames> --remotepatchAMSI --remotepatchETW --mapSection --unhook=<dllname1,dllname2> --reflective --obfuscate --macPayload --hide --APIhide --noArgs --peinject --peload --hellsgate --syswhispers --jump --sgn --replace --self-delete --sandbox=<check1,check2> --domain=<targetdomain> --pump=<words,size> --obfuscatefunctions --debug --verbose --noDInvoke --x86 --wow64 --llvm --sign --signdomain=<exampledomain> --noAntidebug --noDefaultSandBox --noAntiEmulate --sleepycrypt --fluctuate --interactivePS --psout --psobfs --pslyrics --csout --scout --sourceonly --jmpEntry --jmpEntryDLL=<example.dll> --jmpEntryFunc=<exampleFunc> --dripallocate --dripsleep=<sleeptime-ms> --stegofile=<filepath> --ruy-lopez --threadless --threadlessDll=<dllname.dll> --threadlessFunc=<dllfunc> --poolparty=<number> --Caro-Kann --Caro-Kann-Thread --stomb --stombDll=<dllname.dll> --stombFunc=<dllfunc> --stombFunc2=<dllfunc2> --restore]
NimSyscall_Loader (-h | --help)
NimSyscall_Loader --version
Options:
[general]