> For the complete documentation index, see [llms.txt](https://blog.drngd0tter.red/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.drngd0tter.red/malware-development/crystal/what-is-crystal.md).

# What is Crystal?

Could Crystal be the next go-to language for malware development?

## Introduction

Most of the programs I write, whether that be malware or a tool, is usually written in Go. However, I recently came across [this blog post](https://rastamouse.me/crystal-malware/) from RastaMouse about a Crystal, a language I hadn't heard of before. Crystal has some really cool features that make it a prime candidate for writing malware. C-bindings, LLVM, inline assembly, cross-platform, the list of features this language has goes on and on. So lets explore and learn Crystal for malware development.

## Getting Started

The obvious first step when starting with a new language, is to do the classic hello world. Crystal is pretty simple.

First you initialize a new Crystal app with the  `crystal init app` command:

```sh
crystal init app hello-world
```

Next, in the generated `src` directory, you can print hello world with the following line of code:

```crystal
puts("Hello, World!")
```

Finally you can run this with:

```
> crystal run hello-world.cr
Hello, World!
```

## C-Bindings

One of the coolest features of Crystal is its ability for C-Bindings. By using `@[Link("dll")]` we can pass a library name to the linker.

Example:

```crystal
@[Link("kernel32")]
lib Kernel32
    fun ExitProcess(exitCode : LibC::UInt) : NoReturn
end

Kernel32.ExitProcess 1337
```

We can than run the above:

```
PS C:\> crystal run c.cr
PS C:\> $LASTEXITCODE
1337
```

## Running Assembly From Crystal

Crystal has the capability to run inline assembly with the `asm` keyword. An example from the documentation is:

```crystal
dst = 0
asm("mov $$1234, $0" : "=r"(dst))
puts(dst)
```

Running this code outputs the following:

```
> crystal run asm.cr
1234
```

## Conclusion

In conclusion, I think Crystal will be a very fun language to try and learn and utilize for malware and maybe some cool tools as well. If you want to read more about Crystal, you can find their documentation [here](https://crystal-lang.org/reference/1.13/guides/index.html).

## References

[RastaMouse's Blog Post](https://rastamouse.me/crystal-malware/)

[RastaMouse's Twitter](https://x.com/_RastaMouse)

[Crystal's Website](https://crystal-lang.org/reference/1.13/index.html)