# Nim-RunPE | A Nim Implementation Of Reflective PE-Loading From Memory

**URL:** <https://onehack.st/t/nim-runpe-a-nim-implementation-of-reflective-pe-loading-from-memory/223959>\
**Category:** Tools & Scripts\
**Tags:** tools, tips-tricks, windows\
**Created:** [September 16, 2022, 3:31pm UTC](https://onehack.st/t/nim-runpe-a-nim-implementation-of-reflective-pe-loading-from-memory/223959 "2022-09-16T15:31:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [September 16, 2022, 3:31pm UTC](https://onehack.st/t/nim-runpe-a-nim-implementation-of-reflective-pe-loading-from-memory/223959/1 "2022-09-16T15:31:19Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/c/6c665cbb11e53f7b24e724cf64d0d04babc8ed0c.jpeg)

A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from [RunPE-In-Memory](https://github.com/aaaddress1/RunPE-In-Memory) - which I ported to Nim.

You’ll need to install the following dependencies:

`nimble install ptr_math winim`

I did test this with Nim Version 1.6.2 only, so use that version for testing or I cannot guarantee no errors when using another version.

## Compile

If you want to pass arguments on runtime or don’t want to pass arguments at all compile via:

`nim c NimRunPE.nim`

If you want to hardcode custom arguments modify `const exeArgs` to your needs and compile with:

`nim c -d:args NimRunPE.nim` - this was contributed by [@glynx](https://github.com/glynx), thanks! 😎

## More Information

The technique itself it pretty old, but I didn’t find a Nim implementation yet. So this has changed now. 🙂

[![alt text](https://github.com/S3cur3Th1sSh1t/Nim-RunPE/raw/main/Nim-RunPE.PNG)](https://github.com/S3cur3Th1sSh1t/Nim-RunPE/raw/main/Nim-RunPE.PNG)

If you plan to load e.g. Mimikatz with this technique - make sure to compile a version from source on your own, as the release binaries don’t accept arguments after being loaded reflectively by this loader. Why? I really don’t know it’s strange but a fact. If you compile on your own it will still work:

[![alt text](https://github.com/S3cur3Th1sSh1t/Nim-RunPE/raw/main/Mimiload.PNG)](https://github.com/S3cur3Th1sSh1t/Nim-RunPE/raw/main/Mimiload.PNG)

My private [Packer](https://twitter.com/ShitSecure/status/1482428360500383755) is also weaponized with this technique - but all Win32 functions are replaced with Syscalls there. That makes the technique stealthier.

## GitHub:

> **[GitHub - S3cur3Th1sSh1t/Nim-RunPE: A Nim implementation of reflective PE-Loading from...](https://github.com/S3cur3Th1sSh1t/Nim-RunPE)**
>
> A Nim implementation of reflective PE-Loading from memory