DarkGUNMAN Posted September 24, 2010 Share Posted September 24, 2010 (edited) I've attempted to port a vbs script to AutoIT which decodes files using Scripting.Encoder http://www.interclasse.com/scripts/decovbe.php Here is the derived version that works: expandcollapse popupoption explicit Dim F1 F1= "c:\program files\decrypt\target.vbe" Dim fso Set fso=WScript.CreateObject("Scripting.FileSystemObject") If fso.FileExists(F1) Then Dim fic,contenu Set fic = fso.OpenTextFile(F1, 1) Contenu=fic.readAll fic.close Set fic=Nothing Const TagInit="#@~^" '#@~^awQAAA== Const TagFin="==^#~@" '& chr(0) Dim DebutCode, FinCode Do FinCode=0 DebutCode=Instr(Contenu,TagInit) If DebutCode>0 Then If (Instr(DebutCode,Contenu,"==")-DebutCode)=10 Then 'If "==" follows the tag FinCode=Instr(DebutCode,Contenu,TagFin) If FinCode>0 Then Contenu=Left(Contenu,DebutCode-1) & _ Decode(Mid(Contenu,DebutCode+12,FinCode-DebutCode-12-6)) & _ Mid(Contenu,FinCode+6) End If End If End If Loop Until FinCode=0 WScript.Echo Contenu End If Set fso=Nothing Function Decode(Chaine) Dim se,i,c,j,index,ChaineTemp Dim tDecode(127) Const Combinaison="1231232332321323132311233213233211323231311231321323112331123132" Set se=WSCript.CreateObject("Scripting.Encoder") If IsObject(se) then For i=9 to 127 tDecode(i)="JLA" Next For i=9 to 127 ChaineTemp=Mid(se.EncodeScriptFile(".vbs",string(3,i),0,""),13,3) For j=1 to 3 c=Asc(Mid(ChaineTemp,j,1)) tDecode(c)=Left(tDecode(c),j-1) & chr(i) & Mid(tDecode(c),j+1) Next Next tDecode(42)=Left(tDecode(42),1) & ")" & Right(tDecode(42),1) Set se=Nothing Chaine=Replace(Replace(Chaine,"@&",chr(10)),"@#",chr(13)) Chaine=Replace(Replace(Chaine,"@*",">"),"@!","<") Chaine=Replace(Chaine,"@$","@") index=-1 For i=1 to Len(Chaine) c=asc(Mid(Chaine,i,1)) If c<128 Then index=index+1 If (c=9) or ((c>31) and (c<128)) Then If (c<>60) and (c<>62) and (c<>64) Then Chaine=Left(Chaine,i-1) & Mid(tDecode(c),Mid(Combinaison,(index mod 64)+1,1),1) & Mid(Chaine,i+1) End If End If Next Decode=Chaine End If End Function I converted the variables and functions to AutoIT comparable format: expandcollapse popup#Include <string.au3> $F1= "C:\Program Files\decrypt\target.vbe" DIM $Contenu Dim $fso $fso=ObjCreate("Scripting.FileSystemObject") If $fso.FileExists($F1) Then Dim $fic, $contenu $fic = $fso.OpenTextFile($F1, 1) $Contenu = $fic.ReadAll $fic.close $fic="" Const $TagInit="#@~^" ;'#@~^awQAAA== Const $TagFin="==^#~@" ;'& chr(0) Dim $DebutCode, $FinCode Do $FinCode=0 $DebutCode=StringInstr($Contenu,$TagInit) If $DebutCode > 0 Then If (StringInstr($Contenu,"==",0,1,$DebutCode)-$DebutCode)=10 Then ;If "==" follows the tag $FinCode=StringInstr($Contenu,$TagFin,0,1,$DebutCode) If $FinCode>0 Then $Contenu=StringLeft($Contenu,$DebutCode-1) & _ _Decode(StringMid($Contenu,$DebutCode+12,$FinCode-$DebutCode-12-6)) & _ StringMid($Contenu,$FinCode+6) EndIf EndIf EndIf Until $FinCode=0 ConsoleWrite("Contenu: "&$Contenu&@CRLF) EndIf $fso="" Func _Decode($Chaine) Dim $se,$i,$c,$j,$index,$ChaineTemp Dim $tDecode[128];~ Dim $tDecode(127) Const $Combinaison="1231232332321323132311233213233211323231311231321323112331123132" $se=ObjCreate("Scripting.Encoder") If IsObj($se) then For $i=9 to 127 $tDecode[$i]="JLA" Next For $i=9 to 127 $ChaineTemp=StringMid($se.EncodeScriptFile(".vbs", _StringRepeat(3,$i),0,""),13,3) For $j=1 to 3 $c=Asc(StringMid($ChaineTemp,$j,1)) $tDecode[$c]=StringLeft($tDecode[$c],$j-1) & chr($i) & StringMid($tDecode[$c],$j+1) Next Next $tDecode[42]=StringLeft($tDecode[42],1) & ")" & StringRight($tDecode[42],1) $se="" $Chaine=StringReplace(StringReplace($Chaine,"@&",chr(10)),"@#",chr(13)) $Chaine=StringReplace(StringReplace($Chaine,"@*",">"),"@!","<") $Chaine=StringReplace($Chaine,"@$","@") $index=-1 For $i=1 to StringLen($Chaine) $c=asc(StringMid($Chaine,$i,1)) If $c<128 Then $index=$index+1 If ($c=9) or (($c>31) and ($c<128)) Then If ($c<>60) and ($c<>62) and ($c<>64) Then $Chaine=StringLeft($Chaine,$i-1) & StringMid($tDecode[$c], StringMid($Combinaison, Mod($index,64)+1,1), 1) & StringMid($Chaine,$i+1) EndIf EndIf Next Return $Chaine Endif EndFunc Obviously I cannot show the decoded text from the vbs version, but for some reason I don't understand, the output of the AutoIT version comes out as JLA throughout, replacing all the text. It does match the number of characters per line though. Could anyone help shed light on where it it going wrong? Edited September 24, 2010 by DarkGUNMAN Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now