Obfuscator and ConsoleWrite()

[4Eyes]

Folks,

Is it possible to have the obfuscator remove ConsoleWrite statements? I ask this as I'm concerned that if somebody unscrupulous decompiled a compiled script that had debugging ConsoleWrite()'s in it they may get a significant insight into the workings of that program.

Yes, I'm aware that they should probably be removed from the release version, but that could be a big job and really hinder development.

4Eyes

[SmOke_N]

1. If some runs your code and checks stdout, all your consolewrite data would show to them without decompiling your executable.

2. One method used by people I've worked with is to use a Global debug statement.

Example:

Global $gf_debug = False

_myDebug("You won't see this until you set $gf_debug to True" & @CRLF)


Func _myDebug($s_text)
    If $gf_debug Then
        ConsoleWrite($s_text)
    EndIf
EndFunc

This way you only have to set one var.

Now, I'm not sure if obfuscator can remove them, but I'm sure you could come up with a simple solution using regex-replace if it doesn't.

[Jos]

Obfuscator will not remove ConsoleWrite() debug statement, but there are LUA scripts in SciTE available to Add/Comment and remove all Debug ConsoleWrites.

Jos

[MHz]

Yes, I'm aware that they should probably be removed from the release version, but that could be a big job and really hinder development.

That depends on what you want as a compilation.

You are aware that CUI compiled scripts rely on ConsoleWrite() and ConsoleWriteError() for output? So stripping them adds complexity of possible error or meaningful output to such scripts if obfuscator removes them. ConsoleWrites can be used in a middle of a line so removal is differcult there so stripping runtime code like that could be a bad idea. Just more awareness to consider. Your problem seems not to be of a known security breach so giving a solution is perhaps not wise until it is actually needed. You could be cryptic with your consolewrites if that is your concern but I doubt people would know the inner workings unless you used actual passwords or such in the consolewrites which is asking for trouble as you may guess.

[4Eyes]

Thanks guys.

SmOke_N,

I'll run with your suggestion as I'm sick of adding the & @CRLF to each line anyway, so might as well use a $var (like $gf_debug) and a func to test for it, do the ConsoleWrite() and add the '& @CRLF' which is generally required. Thanks.

Jos,

Thanks for your input.

MHz,

I've written a couple little apps meant to run under DOS, but in those cases I'm not concerned about the script being read. Thanks for your input too.

Regards,

4Eyes

[4Eyes]

SmOke_N,

Having thought about it I'm now using this:

Func MyConsoleWrite($String)

If Not @Compiled Then ConsoleWrite($String & @CRLF)

EndFunc ; End of Func MyConsoleWrite()

No need for a global flag.

Regards,

Mike H