cannot execute the output file

[gfctam]

I have run the command "nimcrypt -f mimikatz.exe -t pe -o mimi-pe.exe -u -e -g, and sucessfully output the exe.

But when I run mimi-pe.exe on the machine, it got the message "SIGSEGV: Illegal storage access. (Attempt to read from nil?)

May I get some insight on how to resolve this issue?

Thanks

[icyguider]

Hello! I've tested Mimikatz with the arguments you are using on a few different Windows 10/Server 2019 systems and can't seem to replicate the issue.

To help figure out what's going on, could you please provide the following information?

1. What version of Nim are you using for the tool?
2. What build of Windows are you testing the output file on?
3. Where did you get the Mimikatz binary you're using?

I'm hoping that with this information I can potentially replicate your error and then start to investigate why it's happening. Here's my answers to the above questions if you'd like to try and replicate my steps and see if that works for you:

1. Nim 1.6.4
2. Tested on Windows 10 21H2 (10.0.19044), 21H1 (10.0.19043), and Windows Server 2019 (10.0.17763)
3. Downloaded latest Mimikatz source code from the official GitHub repo, compiled x64 release version using Visual Studio 2019.

Might also be worth testing another simple pe program like calc.exe to see if that works for you... that would help determine if the problem is Mimikatz specific or if it's a larger issue stemming from Nim/Windows compatibility with the compiled stub.

[Fankaren]

Hi @icyguider . I have the same problem.

Nim version 1.6.4:

build of Windows:

and also my laptop on winows10.

Thanks.

[Fankaren]

Later I try to use the -l parameter. The output file can execute currectly.

But I get the same issue when I obfuscate my CS_executable file using the same way :(

I thought the 0x00 byte is the matter.

Thank you.

[gfctam]

Hi Guys,

My problem has resolved. The executable I was running trying to run is mimikatz, and the problem is 32bit/64 bit capabillity.

It means to run mimikatz in 64bit computer, the mimikatz must compile in 64bit to obfuscate with nimcrypto2.

[icyguider]

@gfctam That's great to hear. I'm glad you figured out the issue!

@Fankaren Thanks for your all the information and proactive debugging. Glad you got at least calc working. For the CS executable, are you using the x64 version? That seemed to fix the error for @gfctam, so hopefully it will do the same for you!

[tbaker57]

I also had the same problem ("SIGSEGV: Illegal storage access. (Attempt to read from nil?)") with a 64-bit CobaltStrike beacon (beacon.exe), but compiled with the Obfuscator LLVM option and '-t pe' [Defender seems to stomp on NimCrypt2 (produced without -l) binaries now even with a benign calc.exe payload]

Switching to the 'raw' CS beacon (beacon.bin) and using '-l -t raw' gave me a nice CS .exe which gets past Defender (at least it did today :-)