--== 仅限PE的Nim编写的进程空心化加载器 ==--
我构建PichichiH0ll0wer是为了学习并做出贡献，当然。但也因为我非常厌倦到处都是shellcode。加载PE可能不那么隐蔽，我知道，但它仍然高效，并且比每次将PE有效载荷转换为shellcode（并不总是顺利）更方便。此外，PichichiH0ll0wer有一些功能来保护你的有效载荷。仅支持x64 EXE。
使用cmd.exe孵化了whoami.exe的cscript.exe分割空心化示例：
使用Nim 1.6.12构建，应仅在Windows上运行。
nimble install winim ptr_math nimprotect supersnappy argparse
Usage:
[options] exe_file injection_method
Arguments:
exe_file Exe file to load
injection_method Injection method
1 - Simple hollowing
2 - Direct syscalls hollowing
3 - Indirect syscalls hollowing
4 - Split hollowing using multiple processes
5 - Split hollowing using multiple processes and direct syscalls
6 - Split hollowing using multiple processes and indirect syscalls
Options:
-h, --help
-s, --sponsor=SPONSOR Sponsor path to hollow (default: self hollowing)
-a, --args=ARGS Command line arguments to append to the hollowed process
-f, --format=FORMAT PE hollower format Possible values: [exe, dll] (default: exe)
-e, --export=EXPORT DLL export name (relevant only for Dll format) (default: DllRegisterServer)
-b, --block Block unsigned Microsoft Dlls in the hollowed process
-p, --split Split and hide the payload blob in hollower (takes long to compile!)
-t, --sleep=SLEEP Number of seconds to sleep before hollowing (default: 0)
-g, --anti-debug=ANTI_DEBUG
Action to perform upon debugger detection Possible values: [none, die, troll] (default: none)
-k, --key=KEY RC4 key to [en/de]crypt the payload (supplied as a command line argument to the hollower)
-v, --veh Hollow will occur within VEH
-d, --debug Compile as debug instead of release (loader is verbose)
另外，请查看示例。