Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Altering Compiled Scripts

Started by w0uter , Jun 28 2006 03:42 PM

Next

This topic is locked

45 replies to this topic

#1 w0uter

resreveR nA

Active Members
2,262 posts

Posted 28 June 2006 - 03:42 PM

I AM NOT AN AUTOIT DEVELOPER
I DONT KNOW HOW AUTOIT WORKS
IT CAN BE UNSTABLE
IT CAN CRASH
I AM NOT RESPONSIBLE FOR ANYTHING THAT HAPENS TO YOUR SCRIPT OR OTHER DATA
THIS IS FOR LEARNING PURPOSE ONLY
USE IT AT YOUR OWN RISK

There ... now for the people that still want to listen after i shouted at them

Well i had some fun and made binaries undecompilable by exe2aut.

HOW:

<Removed>

NOTES:

<Removed>

also you might need to change RegRead('HKEY_LOCAL_MACHINE\SOFTWARE\AutoIt v3\AutoIt', 'InstallDir')
i dont use a seperate beta and dont know where the beta autoit goes. (i remember something about \beta\)

PS.

If someone still has trouble with this code after that huge disclaimer
and "Dont click here" feel free to send me a pm and ill remove it.

<Removed>

[edit] removed an U in Browse [/edit]

Edited by Valik, 08 April 2009 - 09:25 PM.

My UDF's:;mem stuff_Mem;ftp stuff_FTP ( OLD );inet stuff_INetGetSource ( OLD )_INetGetImage _INetBrowse ( Collection )_EncodeUrl _NetStat _Google;random stuff_iPixelSearch _DiceRoll

Back to top

#2 SmOke_N

It's not what you know ... It's what you can prove!

Moderators
15,729 posts

Posted 28 June 2006 - 03:51 PM

Edit:
After some trial and error, no more decompile... very nice job w0uter! Hope this sticks around for a while... with this and EnCodeIt mixed ... would pi** most reverse engineers completely off

Edited by SmOke_N, 28 June 2006 - 05:09 PM.

Common sense plays a role in the basics of understanding AutoIt... If you're lacking in that, do us all a favor, and step away from the computer.

Back to top

#3 Skrip

Psychonaut

Active Members
2,340 posts

Posted 28 June 2006 - 08:16 PM

I changed them all to 0 in that first collum, then in the next one I used 30 then I repeated, and it worked! Thanks wouter!

Edited by Firestorm, 28 June 2006 - 08:17 PM.

_{We're trapped in the belly of this horrible machine.}^{And the machine is bleeding to death...}

Back to top

#4 Jos

oh joy ...

Developers
21,067 posts

Posted 28 June 2006 - 08:44 PM

Believe the line of thinking here was:

When you can identify the true "Script" section and the "Runtime" section its easier for the AV companies to detect Virusses written in AU3 without qualifying ALL AU3 scripts as a virus.

Edited by JdeB, 28 June 2006 - 08:45 PM.

Visit the SciTE4AutoIt3 Download page for the latest versions Forum Rules

Live for the present,
Dream of the future,
Learn from the past.

Back to top

#5 jftuga

Universalist

Active Members
315 posts

Posted 29 June 2006 - 12:18 AM

If you actually try to click on 'Don't click here', nothing happens.

Seriously, nice work!

-John

Admin_Popup, show computer info or launch shell Remote Manager, facilitates connecting to RDP / VNC Proc_Watch, reprioritize cpu intensive processes UDF: _ini_to_dict, transforms ini file entries into variables UDF: monitor_resolutions, returns resolutions of multiple monitors Report Computer Problem, for your IT help desk Profile Fixer, fixes a 'missing' AD user profile

Back to top

#6 RazerM

cowinkeedenky - coincidence?

Active Members
1,246 posts

Posted 29 June 2006 - 07:59 AM

This works well w0uter. I just had to be careful with what bytes i changed.

Edited by RazerM, 26 June 2007 - 03:23 PM.

My Programs:AInstall - Create a standalone installer for your programUnit Converter - Converts Length, Area, Volume, Weight, Temperature and Pressure to different unitsBinary Clock - Hours, minutes and seconds have 10 columns each to display timeAutoIt Editor - Code Editor with Syntax Highlighting.Laserix Editor & Player - Create, Edit and Play Laserix LevelsLyric Syncer - Create and use Synchronised Lyrics.Connect 4 - 2 Player Connect 4 Game (Local or Online!, Formatted Chat!!)MD5, SHA-1, SHA-256, Tiger and Whirlpool Hash Finder - Dictionary and Brute Force FindCool Text Client - Create Rendered ImageMy UDF's:GUI Enhance - Enhance your GUIs visually.IDEA File Encryption - Encrypt and decrypt files easily! File Rename - Rename files easilyRC4 Text Encryption - Encrypt text using the RC4 AlgorithmPrime Number - Check if a number is primeString Remove - remove lots of strings at onceProgress Bar - made easySound UDF - Play, Pause, Resume, Seek and Stop.

Back to top

#7 PartyPooper

Universalist

Active Members
676 posts

Posted 29 June 2006 - 01:47 PM

GUICtrlCreateButton('Browse', 263, 175, 59, 18)

Back to top

#8 JSThePatriot

carpe diem. vita brevis.

MVPs
3,686 posts

Posted 29 June 2006 - 03:17 PM

As always w0uter love your work!

JS

AutoIt LinksFile-String Hash Plugin Updated! 04-02-08ComputerGetInfo UDF's Updated! 11-23-06External LinksVortex Revolutions Engineer / Inventor (Web, Desktop, and Mobile Applications, Hardware Gizmos, Consulting, and more)

Back to top

#9 Busti

Universalist

Active Members
337 posts

Posted 29 June 2006 - 05:26 PM

its really nice work, but what does this do, i dont get the point

My UDF's : Startet on : 06.06.2006_CaseSearchOrReplaceStr();~> Searches OR Replaces a String,;~> With or Without Casesensivity

Back to top

#10 JSThePatriot

carpe diem. vita brevis.

MVPs
3,686 posts

Posted 29 June 2006 - 06:24 PM

its really nice work, but what does this do, i dont get the point

It is for those that dont want someone to be able to decompile their script without some troubles. Just like using EnCodeIt.

Just an extra precaution. It wont "prevent" any of the malitious attempts, but it would slow the determined down and stop the kiddies.

JS

AutoIt LinksFile-String Hash Plugin Updated! 04-02-08ComputerGetInfo UDF's Updated! 11-23-06External LinksVortex Revolutions Engineer / Inventor (Web, Desktop, and Mobile Applications, Hardware Gizmos, Consulting, and more)

Back to top

#11 Busti

Universalist

Active Members
337 posts

Posted 29 June 2006 - 06:38 PM

oh wow thats really nice !!! thx wouter

My UDF's : Startet on : 06.06.2006_CaseSearchOrReplaceStr();~> Searches OR Replaces a String,;~> With or Without Casesensivity

Back to top

#12 YoseMite

Prodigy

Active Members
168 posts

Posted 29 June 2006 - 08:04 PM

Respect!

Back to top

#13 Spanky

Seeker

New Members
7 posts

Posted 30 June 2006 - 01:00 PM

Edited by Valik, 08 April 2009 - 09:27 PM.

_________________

Back to top

#14 w0uter

resreveR nA

Active Members
2,262 posts

Posted 30 June 2006 - 02:39 PM

Always fun to have another reverser here :wacko:

This was only ment to stop decompiling for the masses.

Also this was the only method in my head for wich i could create a patcher.
I have other POC code laying around here. Ill post a sample for you later.

Edited by w0uter, 01 July 2006 - 11:08 AM.

My UDF's:;mem stuff_Mem;ftp stuff_FTP ( OLD );inet stuff_INetGetSource ( OLD )_INetGetImage _INetBrowse ( Collection )_EncodeUrl _NetStat _Google;random stuff_iPixelSearch _DiceRoll

Back to top

#15 Spanky

Seeker

New Members
7 posts

Posted 30 June 2006 - 03:30 PM

Always fun to have another reverser here

This was only ment to stop decompiling for the masses.

Why I can't ride of the feeling most ppl considering RE as some kinda 'Black Art' or 'computer heretic stuff' when I reading this.

Also this was the only method in my head for wich i could create a patcher.
I have other POC code laying around here. Ill post a sample for you later.

Yeh I felt that there's more potential.
Indeep this methode is really usefull to keep the noobs off or amaze them.
But in my eyes some other really nasty stuff is obfucation(as for ex. EncodeIt does). To me this can be more bitching than a 'nonstandard' AutoIT file.
:wacko:

Anyway there is nothing against putting those two together.

_________________

Back to top

#16 jftuga

Universalist

Active Members
315 posts

Posted 30 June 2006 - 03:31 PM

Would it be possible to use EncodeIt, and then the script Wouter mentions in the first post, and then manually compress with UPX? But then use something similar to Wouter did, but do it to the UPX header so that it could not be decompressed by UPX?

I hope this makes sense. :-)

-John

Admin_Popup, show computer info or launch shell Remote Manager, facilitates connecting to RDP / VNC Proc_Watch, reprioritize cpu intensive processes UDF: _ini_to_dict, transforms ini file entries into variables UDF: monitor_resolutions, returns resolutions of multiple monitors Report Computer Problem, for your IT help desk Profile Fixer, fixes a 'missing' AD user profile

Back to top

#17 JSThePatriot

carpe diem. vita brevis.

MVPs
3,686 posts

Posted 30 June 2006 - 04:04 PM

@jftuga
Using EnCodeIt is already possible with w0uter's script to modify the header.

What you are asking is possible if I am not mistaken. The question would be how rough it would be to get that accomplished.

IMHO,
JS

AutoIt LinksFile-String Hash Plugin Updated! 04-02-08ComputerGetInfo UDF's Updated! 11-23-06External LinksVortex Revolutions Engineer / Inventor (Web, Desktop, and Mobile Applications, Hardware Gizmos, Consulting, and more)