frkngksl/nimicstackNimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs
NimicStack 是使用纯 Nim 实现的调用栈欺骗（Call Stack Spoofing）技术，用于模仿合法程序。整个项目基于 WithSecure Labs 分享的 PoC
你可以使用以下命令直接编译源代码：
nim c -d=mingw --app=console --cpu=amd64 -o:NimicStack.exe .\Main.nim
如果遇到 "cannot open file" 错误，你还需要安装所需的依赖：
nimble install ptr_math winim
与参考项目一样，NimicStack 可以在打开 LSASS 进程时模拟三种示例调用栈：WMI、RPC 和 Svchost。
.\NimicStack.exe <--wmi, --rpc, --svchost>
模拟 WMI 调用栈的示例输出：
███╗ ██╗██╗███╗ ███╗██╗ ██████╗███████╗████████╗ █████╗ ██████╗██╗ ██╗
████╗ ██║██║████╗ ████║██║██╔════╝██╔════╝╚══██╔══╝██╔══██╗██╔════╝██║ ██╔╝
██╔██╗ ██║██║██╔████╔██║██║██║ ███████╗ ██║ ███████║██║ █████╔╝
██║╚██╗██║██║██║╚██╔╝██║██║██║ ╚════██║ ██║ ██╔══██║██║ ██╔═██╗
██║ ╚████║██║██║ ╚═╝ ██║██║╚██████╗███████║ ██║ ██║ ██║╚██████╗██║ ██╗
╚═╝ ╚═══╝╚═╝╚═╝ ╚═╝╚═╝ ╚═════╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝
@R0h1rr1m
[+] wmi frame is selected!
[+] Required libraries were imported for return address calculation!
[+] SeDebugPrivilege is enabled!
[+] Fake Call Stack was created!
[+] Trying to find LSASS pid...
[+] LSASS pid found!: 756
[+] Registers were set for NtOpenProcess call!
[+] VEH callback was set for the suspended thread!
[+] Thread is resuming...
[+] VEH callback was called!
[+] Redirecting thread to RtlExitUserThread...
[+] Spoof is successful! Handle is 356
[+] You can check the spoofed call stack from Sysmon!
以及本次调用的 Sysmon 输出：
仅限经授权的安全测试使用。未经明确许可，将本工具用于他人系统属违法行为。