Sign in to follow this  
Followers 0
DarkGUNMAN

VBS based File Decoder, Help convert to AU3?

1 post in this topic

#1 ·  Posted (edited)

I've attempted to port a vbs script to AutoIT which decodes files using Scripting.Encoder

http://www.interclasse.com/scripts/decovbe.php

Here is the derived version that works:

option explicit
Dim F1
F1= "c:\program files\decrypt\target.vbe"

    Dim fso
    Set fso=WScript.CreateObject("Scripting.FileSystemObject")
    If fso.FileExists(F1) Then
        Dim fic,contenu
        Set fic = fso.OpenTextFile(F1, 1)
        Contenu=fic.readAll
        fic.close
        Set fic=Nothing

        Const TagInit="#@~^" '#@~^awQAAA==
        Const TagFin="==^#~@" '& chr(0)
        Dim DebutCode, FinCode
        Do
            FinCode=0
            DebutCode=Instr(Contenu,TagInit)
            If DebutCode>0 Then
                If (Instr(DebutCode,Contenu,"==")-DebutCode)=10 Then 'If "==" follows the tag
                    FinCode=Instr(DebutCode,Contenu,TagFin)
                    If FinCode>0 Then
                        Contenu=Left(Contenu,DebutCode-1) & _
                        Decode(Mid(Contenu,DebutCode+12,FinCode-DebutCode-12-6)) & _
                        Mid(Contenu,FinCode+6)
                    End If
                End If
            End If
        Loop Until FinCode=0
        
        WScript.Echo Contenu
    End If
    Set fso=Nothing
    
Function Decode(Chaine)
    Dim se,i,c,j,index,ChaineTemp
    Dim tDecode(127)
    Const Combinaison="1231232332321323132311233213233211323231311231321323112331123132"

    Set se=WSCript.CreateObject("Scripting.Encoder")
    If IsObject(se) then
        For i=9 to 127
            tDecode(i)="JLA"
        Next
        For i=9 to 127
            ChaineTemp=Mid(se.EncodeScriptFile(".vbs",string(3,i),0,""),13,3)
            For j=1 to 3
                c=Asc(Mid(ChaineTemp,j,1))
                tDecode(c)=Left(tDecode(c),j-1) & chr(i) & Mid(tDecode(c),j+1)
            Next
        Next
        tDecode(42)=Left(tDecode(42),1) & ")" & Right(tDecode(42),1)
        Set se=Nothing

        Chaine=Replace(Replace(Chaine,"@&",chr(10)),"@#",chr(13))
        Chaine=Replace(Replace(Chaine,"@*",">"),"@!","<")
        Chaine=Replace(Chaine,"@$","@")
        index=-1
        For i=1 to Len(Chaine)
            c=asc(Mid(Chaine,i,1))
            If c<128 Then index=index+1
            If (c=9) or ((c>31) and (c<128)) Then
                If (c<>60) and (c<>62) and (c<>64) Then
                    Chaine=Left(Chaine,i-1) & Mid(tDecode(c),Mid(Combinaison,(index mod 64)+1,1),1) & Mid(Chaine,i+1)
                End If
            End If
        Next
        
        Decode=Chaine
    End If
End Function

I converted the variables and functions to AutoIT comparable format:

#Include <string.au3>
$F1= "C:\Program Files\decrypt\target.vbe"
DIM $Contenu

    Dim $fso
    $fso=ObjCreate("Scripting.FileSystemObject")
    If $fso.FileExists($F1) Then
        Dim $fic, $contenu
        $fic = $fso.OpenTextFile($F1, 1)
        $Contenu = $fic.ReadAll
        $fic.close
        $fic=""

        Const $TagInit="#@~^" ;'#@~^awQAAA==
        Const $TagFin="==^#~@" ;'& chr(0)
        Dim $DebutCode, $FinCode
        Do
            $FinCode=0
            $DebutCode=StringInstr($Contenu,$TagInit)
            If $DebutCode > 0 Then
                If (StringInstr($Contenu,"==",0,1,$DebutCode)-$DebutCode)=10 Then ;If "==" follows the tag
                    $FinCode=StringInstr($Contenu,$TagFin,0,1,$DebutCode)
                    If $FinCode>0 Then
                        $Contenu=StringLeft($Contenu,$DebutCode-1) & _
                        _Decode(StringMid($Contenu,$DebutCode+12,$FinCode-$DebutCode-12-6)) & _
                        StringMid($Contenu,$FinCode+6)
                    EndIf
                EndIf
            EndIf
        Until $FinCode=0

        ConsoleWrite("Contenu: "&$Contenu&@CRLF)
    EndIf
    $fso=""
    
Func _Decode($Chaine)
    Dim $se,$i,$c,$j,$index,$ChaineTemp
    Dim $tDecode[128];~             Dim $tDecode(127)
    Const $Combinaison="1231232332321323132311233213233211323231311231321323112331123132"
    
    $se=ObjCreate("Scripting.Encoder")
    If IsObj($se) then
        For $i=9 to 127
            $tDecode[$i]="JLA"
        Next
        For $i=9 to 127
            $ChaineTemp=StringMid($se.EncodeScriptFile(".vbs", _StringRepeat(3,$i),0,""),13,3)
            For $j=1 to 3
                $c=Asc(StringMid($ChaineTemp,$j,1))
                $tDecode[$c]=StringLeft($tDecode[$c],$j-1) & chr($i) & StringMid($tDecode[$c],$j+1)
            Next
        Next
        $tDecode[42]=StringLeft($tDecode[42],1) & ")" & StringRight($tDecode[42],1)
        $se=""

        $Chaine=StringReplace(StringReplace($Chaine,"@&",chr(10)),"@#",chr(13))
        $Chaine=StringReplace(StringReplace($Chaine,"@*",">"),"@!","<")
        $Chaine=StringReplace($Chaine,"@$","@")
        $index=-1
        For $i=1 to StringLen($Chaine)
            $c=asc(StringMid($Chaine,$i,1))
            If $c<128 Then $index=$index+1
            If ($c=9) or (($c>31) and ($c<128)) Then
                If ($c<>60) and ($c<>62) and ($c<>64) Then
                    $Chaine=StringLeft($Chaine,$i-1) & StringMid($tDecode[$c], StringMid($Combinaison, Mod($index,64)+1,1), 1) & StringMid($Chaine,$i+1)
                EndIf
            EndIf
        Next
        
        Return $Chaine
    Endif
EndFunc

Obviously I cannot show the decoded text from the vbs version, but for some reason I don't understand, the output of the AutoIT version comes out as JLA throughout, replacing all the text. It does match the number of characters per line though.

Could anyone help shed light on where it it going wrong?

Edited by DarkGUNMAN

Share this post


Link to post
Share on other sites



Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0