2

Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails:

C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe

 -------------------------------
| Stage 1: Analyzing input file |
 -------------------------------

Opening mimikatz.exe
Copied file to memory location: 0x5a0020
Found valid MZ signature
Found pointer to PE Header: 0x118
Found valid PE signature
Error: File is PE64, aborting...

https://github.com/Veil-Framework/Veil-Evasion/tree/master/tools/hyperion
https://github.com/Veil-Framework/Veil-Evasion/archive/hyperion.zip
https://github.com/Veil-Framework/Veil-Evasion/archive/Veil-Evasion.zip
https://github.com/Veil-Framework/hyperion/archive/hyperion.zip

How can I obfuscate 64-bit executables?

I don't mind to use Linux or Windows for the job. This question is not restricted to Hyperion software. Any method to achieve executable windows files obfuscation is allowed as a possible answer.

Improve this question
6
  • I don't agree about the off-topic, as long as the question is not limited to Hyperion, but any obfuscating method. I have edited the original question to reflect.
    – Sopalajo de Arrierez
    Commented Oct 10, 2019 at 17:43
  • The two additional sentences make it even more clear that you're asking for product recommendations. Would you like to understand how polymorphism of executables works, to tinker around with that method yourself and protect an executable you have? Great! However, we'll only give you an overview here -- specifics are off topic either because software development details are better asked on StackOverflow, or because specific software used to obfuscate executables can (and does) change over time.
    – Ghedipunk
    Commented Oct 10, 2019 at 17:54
  • Well, @Ghedipunk , maybe SoftwareRecs is the proper way to transfer this question, then. But I am referring obfuscation meaning something like "hide from antivirus or IDS". Isn't that a proper topic for a security forum?
    – Sopalajo de Arrierez
    Commented Oct 10, 2019 at 18:17
  • Asking about the concepts around obfuscating binaries to avoid AV or IDS detection is on topic. Asking for a tool to do that isn't.
    – Ghedipunk
    Commented Oct 10, 2019 at 18:20
  • No problem then, @Ghedipunk , about transferring the question to the proper site... wherever that site could be.
    – Sopalajo de Arrierez
    Commented Oct 10, 2019 at 18:24

1 Answer 1

Reset to default
4

Since you explicitly mention Hyperion...

It looks like whatever project your using has an outdated version of the Hyperion codebase that can't do 64-bit. If you look at nullsecs repos they have a version that claims to work with 64-bit code, they are the original authors of Hyperion it appears.

You can find their codebase for Hyperion here along with prebuilt releases (in the releases folder)

Improve this answer
3
  • I can not find any prebuilt release there. Only the source code, and some "helloworld.exe" files on the examples folder.
    – Sopalajo de Arrierez
    Commented Oct 10, 2019 at 11:48
  • For those arriving here, and as long as the binaries seem not to be available for direct download: I have compiled from Ubuntu with apt install mingw-w64 && apt install wine1.6-dev && i686-w64-mingw32-gcc Src/Crypter/*.c -o hyperion.exe . I am not sure if the wine packet is mandatory; I just needed the installed packages to add support for some missing headers, like windows.h.
    – Sopalajo de Arrierez
    Commented Oct 10, 2019 at 17:45
  • how to compile this on windows ?
    – C.Unbay
    Commented Jan 18, 2020 at 23:09

Not the answer you're looking for? Browse other questions tagged .