Nimfilt – Unraveling The Secrets Of Nim Binaries With Advanced Analysis Tools

Nimfilt is a collection of modules and scripts to help with analyzing Nim binaries. It started out as a CLI demangling tool inspired by c++filt.

It evolved into a larger set of tools for analyzing Nim, but the original name stuck.

• nimfilt.py: a Python module that implements demangling for Nim. It can also be run as basic CLI tool.
• id_nim_binary.yar: a set of YARA rules to identify Nim ELF and PE binaries.
• nimimfilt_ida.py: Nimfilt for IDA, an IDApython script to help reverse-engineers handle Nim binaries.

Context

Nim is compiled to another language (usually C/C++) before being compiled to a native executable. It also doesn’t include a large runtime.

However, the process still leaves some Nim-specific artefacts and specificites in in the produced binary.

For one, method and module names are mangled using, Nim’s own name scheme which is distinct from C++’s.

This scheme isn’t documented so I relied on the source code of the Nim compiler.

Most of this name mangling in implemented in compiler/msgs.nim and compiler/ccgtypes.nim.

Nimfilt For IDA

The IDAPython script can be run as a one-off or installed as a plugin.

If running as a script, simply launch it from the Nimfilt project directory. It is recommended to do so after auto-analysis has completed and you’ve loaded any additional FLIRT signatures.

Plugin Setup Using Sark‘s Plugin Loader

Add <nimfilt_project_dir>/nimfilt_ida.py to your your plugins.list as per their instruction on installing plugins.

Manual Plugin Setup

1. Copy nimfilt.py to a directory that is included in your IDAPython’s PYTHONPATH (commonly <IDA_install_dir>/python/ or %APPDATA%/Hex-Rays/IDA Pro/python/3/).
2. Copy nimfilt_ida.py to your IDAPython plugin directory (usually <IDA_install_dir>/plugins/)

Usage

*Note: The current version of Nimfilt for IDA only supports one command which runs all analyses. *

Navigate to Edit -> Plugins -> Nimfilt and click on it.

You can set Nimfilt to automatically execute when a loaded file is recognized as a Nim binary. To do so, set the AUTO_RUN global variable to True in nimfilt_ida.py

Features

Current features include:

• Identifying if a loaded file is a Nim binary.
• Demangling Nim function and package names.
• Demangling Nim package init function names.
• Organizing functions into directories by package.
• Identifying, typing and renaming Nim strings.