nimble install winim ptr_math nimprotect supersnappy argparse

Usage:
   [options] exe_file injection_method

Arguments:
  exe_file         Exe file to load
  injection_method Injection method

        1 - Simple hollowing
        2 - Direct syscalls hollowing
        3 - Indirect syscalls hollowing
        4 - Split hollowing using multiple processes
        5 - Split hollowing using multiple processes and direct syscalls
        6 - Split hollowing using multiple processes and indirect syscalls

Options:
  -h, --help
  -s, --sponsor=SPONSOR      Sponsor path to hollow (default: self hollowing)
  -a, --args=ARGS            Command line arguments to append to the hollowed process
  -f, --format=FORMAT        PE hollower format Possible values: [exe, dll] (default: exe)
  -e, --export=EXPORT        DLL export name (relevant only for Dll format) (default: DllRegisterServer)
  -b, --block                Block unsigned Microsoft Dlls in the hollowed process
  -p, --split                Split and hide the payload blob in hollower (takes long to compile!)
  -t, --sleep=SLEEP          Number of seconds to sleep before hollowing (default: 0)
  -g, --anti-debug=ANTI_DEBUG
                             Action to perform upon debugger detection Possible values: [none, die, troll] (default: none)
  -k, --key=KEY              RC4 key to [en/de]crypt the payload (supplied as a command line argument to the hollower)
  -v, --veh                  Hollow will occur within VEH
  -d, --debug                Compile as debug instead of release (loader is verbose)