agentsclimarketplace
Sign in

Reverse engineering nim and other exotic binaries

Skill meltedinhex/analyst-ai-pack/skills/reverse-engineering-nim-and-other-exotic-binaries

Reverse engineers malware written in less-common compiled languages (Nim, Crystal, V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings to orient analysis. Activates for requests to reverse Nim malware, identify the source language of an exotic binary, or analyze Crystal/V/Zig/D compiled samples.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill reverse-engineering-nim-and-other-exotic-binaries

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 464 tokens by cl100k_base, as published. Nobody here has run it

Reverse Engineering Nim and Other Exotic Binaries

When to Use

  • You have a compiled binary that is not C/C++/Go/Rust/.NET and need to identify its source language (Nim, Crystal, V, Zig, D) to orient analysis.
  • Symbol/runtime patterns are unfamiliar and you want language-specific landmarks.

Do not use this for already-supported languages (Go/Rust have dedicated skills). This skill reads the binary statically and executes nothing.

Prerequisites

  • The binary (read inertly).

Safety & Handling

  • Read bytes statically; treat strings as untrusted.

Workflow

Step 1: Detect the source language

python scripts/analyst.py detect sample.bin

Scans for language runtime signatures: Nim (@m..nim, nimrtl, fatal.nim, stack trace, @ /nim), Crystal (Crystal::, crystal-lang), V (vlib/, _vinit), Zig (zig, panic: , std.builtin), and D (_Dmain, core.runtime, TypeInfo_).

Step 2: Locate runtime landmarks

Use the detected language's panic/exception and module strings to find main/init and error paths.

Step 3: Handle name mangling

Apply the language's mangling convention (e.g., Nim's proc__module_NNN) to recover readable names.

Step 4: Proceed with analysis

With the language identified, analyze logic; many exotic-language samples wrap the same C2/loader behavior.

Validation

  • Language detection is based on multiple corroborating runtime strings, not one weak hit.
  • Identified landmarks (panic/init) are consistent with the language.
  • Name demangling matches the language's documented scheme.

Pitfalls

  • Statically linked C runtime strings causing misclassification — weight language-specific markers.
  • Stripped binaries with few runtime strings.
  • Stagers in exotic languages that quickly hand off to shellcode.

References

What ships with it: 3 files

3.4 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.