Jump to content

Recommended Posts

A little later than planned but AutoIt3Camo Updated to 0.16.2.0

Works great! Icon inclusion works, and I only have to check "Strip default interpreter resources" to get past the antivirus. (I submitted a false positive report with Symantec, but we all know how wonderfully responsive they are.)

Link to post
Share on other sites
  • Replies 221
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Last updated 9/10/21 Features Simple Integrated countermeasures against file and memory analysis based decompilers. Add basic types of resources into the interpreter or other t

98.18b Represents the last time we touched this product before doing other things. Although recently compiled and tested on windows 10 from a repaired archive it's still bloody old, and the

I suspect you suddenly stop using AutoIt when it gives av false positives without having any modifications? I am not wasting my time contacting the fools that write antivirus programs, purely because

Posted Images

Works great! Icon inclusion works, and I only have to check "Strip default interpreter resources" to get past the antivirus. (I submitted a false positive report with Symantec, but we all know how wonderfully responsive they are.)

Thanks willichan,

I don't think you need me to tell you to be careful when stripping all the interpreter resources. :>, I would do this by default were there not so many possible implications.

I would not hold my breath on that Symantic FP report but It is worth a try. :unsure:

A3C now strips the tail bytes from the a3x by default unless you disable the build (or camouflage) or enable post build camouflage. I was toying with this idea before but your earlier report cemented the decision.

Ed: arg spelling

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites

i like it, i like it alot,

5 * 4 it

Only one request, try `not` to provide alot of info about what and how exactly do it do the things it do, less info the safer itl b :unsure:

TCP server and client - Learning about TCP servers and clients connection
Au3 oIrrlicht - Irrlicht project
Au3impact - Another 3D DLL game engine for autoit. (3impact 3Drad related)



460px-Thief-4-temp-banner.jpg
There are those that believe that the perfect heist lies in the preparation.
Some say that it’s all in the timing, seizing the right opportunity. Others even say it’s the ability to leave no trace behind, be a ghost.

 
Link to post
Share on other sites

Only one request, try `not` to provide alot of info about what and how exactly do it do the things it do, less info the safer itl b :unsure:

Understood :> Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites

:unsure: Besides most people don't use packers (like upx - mpress ...) for security reasons dude because it is futile, they merely want to reduce the overall size of the output binary which is something that bloaters like armadillo or themida certainly cannot do.

Im sorry but you are wrong. Obfuscate and packing a executable is the only thing that stands between them, and your source code. Would I rather have a executable 900kb in size that is quite difficult to unpack, or one thats 300kb that people can easily reverse. Giving the size of todays hard drives, and network speed. I see no gain in the file size being a tad bit smaller. Edited by Warmonger
Link to post
Share on other sites

Im sorry but you are wrong. Obfuscate and packing a executable is the only thing that stands between them, and your source code.

I'm not sorry that you are wrong, the only thing stalling a would be interrogator is Obfuscation and AutoIt3Camo, and maybe the use of a bloater of some kind.

An exception to this would be a packer or crypter that can also intercept the interpreters overlay (a3x) detection and reading api and thus allow them to include an overlay in their packing / crypting process.

Would I rather have a executable 900kb in size that is quite difficult to unpack, or one thats 300kb that people can easily reverse. Giving the size of todays hard drives, and network speed. I see no gain in the file size being a tad bit smaller.

Quite difficult to reverse if your search engine is broken perhaps.

You are of course not wrong to embrace your own opinion concerning what should be deemed an acceptable size of an executable.

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites
  • 4 weeks later...

What this? :ph34r:

Did I miss anything good during my absent. :mad2:

The camo name remind me of another project of yours,Mobius. :)

Does it perform the same protection on autoit too? ;)

Sorry, to drop in like this, but I thought the regulations regarding... amending the autoit files...etc. :alien: Or did the rules change, and Mobius back in business, doing the protection stuff. :huh2:

Link to post
Share on other sites

Yo MyDream, good to see you dude.

The camo name remind me of another project of yours,Mobius. :ph34r:

Imaginative yes? :)

Seriously though A3C is twice the program HkC currently is.(I'll update it one day or just merge the two)

Does it perform the same protection on autoit too? ;)

Aye, my own special brand of n00bfuscation. :mad2:

Sorry, to drop in like this, but I thought the regulations regarding... amending the autoit files...etc. :alien: Or did the rules change, and Mobius back in business, doing the protection stuff. :huh2:

The rules of engagement have not changed, I guess it was our interpretation of them that was jaunty. Only time will tell.

Same as before tho dude, don't put too much faith in these lightweight methods, is still an essential deterrent in my opinion.

Respect

Vlad

wtfpl-badge-1.png

Link to post
Share on other sites
  • 2 weeks later...

Updated to 17.3

Reasonably happy with this revision hence the lack of beta, those of you familiar with A3XPE's (something I gabbled tangentially about a couple of years ago) will find that they are back and use / creation of them has been made even easier through AutoIt3Camo.

As always bug reports and ideas are most welcome.

Thankyou all for your support thus far.

Respect

Ed: :huh2:

The download just had to be changed after a quick update that was necessary after trying to use A3C in a full recent install of AutoIt3 (for the first time) told me that the Compiler directory is no longer used, A3C now supports the compiler directory or the Aut2Exe directory when searching for build files. Glad I found that in time ;)

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites

Updated the shell integration script again to compensate for .cfg & .a3c extensions as well as .au3, It also adds start menu entrances for AutoIt3Camo in the AutoIt v3 section.

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites
  • 2 weeks later...

amazing work!

still a little buggy:

after I protected my files I got this problems:

- the GUI looked like the old style on XP with no rounded corners and so (its like the screenshot of 1st post/AutoIt3Camo) ... okey its not nice but I could life with that.

- on "GUICtrlCreateCombo" I couldn´t see more than the first line (no selection of the other items possible) .. (I am sure this it a real bug caused by AutoIt3Camo)

- for some reasons "ShellExecute" is not executed after your wrapper. (may be related to another reason... I ll check that out)

I used a protector AFTER your tool so I am unsure if the bugs are rly caused by your tool, but I ll continue testing. (btw: in helpfile you wrote to protect by command-line before AutoIt3Camo will do its work ? or did I got that wrong ? - maybe you can tell me how to protect before AutoIt3Camo will do his work, cause most protectors wouldnt support command-line. Is it okey to use a protector after AutoIt3Camo or will this cause errors ? )

thx - whitelion

EDIT: The bugs still appear if I leave the app unprotected.

Edited by WhiteLion
Link to post
Share on other sites

@whitelion

I think that you have checked the Resource checkbox on the Options tab. This disable all autoit resoures including the gui style, the bug of the combobox and much more.

I suggest you this config :

[A3C_RES]
MANIFEST=24}1}1033}#@BIN>

And remove this line from your config :

A3C_NO_RESOURCES=1

Mobius will explain your problem better than me :)

Br, FireFox.

Edited by FireFox

 

OS : Win XP SP2 (32 bits) / Win 7 SP1 (64 bits) / Win 8 (64 bits) | Autoit version: latest stable / beta.
Hardware : Intel(R) Core(TM) i5-2400 CPU @ 3.10Ghz / 8 GiB RAM DDR3.

My UDFs : Skype UDF | TrayIconEx UDF | GUI Panel UDF | Excel XML UDF | Is_Pressed_UDF

My Projects : YouTube Multi-downloader | FTP Easy-UP | Lock'n | WinKill | AVICapture | Skype TM | Tap Maker | ShellNew | Scriptner | Const Replacer | FT_Pocket | Chrome theme maker

My Examples : Capture toolIP Camera | Crosshair | Draw Captured Region | Picture Screensaver | Jscreenfix | Drivetemp | Picture viewer

My Snippets : Basic TCP | Systray_GetIconIndex | Intercept End task | Winpcap various | Advanced HotKeySet | Transparent Edit control

 

Link to post
Share on other sites

@firefox thanx for your fast reply!

I didnt checked the resources checkbox. I didnt change anything on the options tab. I let it by default. :)

I tested if its the fault of the protector, but the problems are still the same without protector (if I just use AutoIt3Camo)

any other ideas ?

What I still not got is if I should use the protector after AutoIt3Camo or if there is a way to use before/while AutoIt3Camo.

the help file confused me a little about that.

Link to post
Share on other sites

amazing work!

still a little buggy:

after I protected my files I got this problems:

- the GUI looked like the old style on XP with no rounded corners and so (its like the screenshot of 1st post/AutoIt3Camo) ... okey its not nice but I could life with that.

- on "GUICtrlCreateCombo" I couldn´t see more than the first line (no selection of the other items possible) .. (I am sure this it a real bug caused by AutoIt3Camo)

- for some reasons "ShellExecute" is not executed after your wrapper. (may be related to another reason... I ll check that out)

Yo WhiteLion,

First of all post (or pm me if sensitive) the config file options you are using.

AutoIt3Camo strips the default resource table of the interpreter by default, so just like a real build of a product the user needs to add certain resources that are required by the interpreter and thier product respectively.

In your case (as FireFox has already mentioned) the problem lies with the xml manifest, which among other things tells windows that your product can use enhanced visual styles. A lack of one will mean that your products graphic interface will look a bit ghetto and even certain udf's and AutoIt3 internals that depend on the visual styles expansion will not work as expected.

There are two similar solutions to your problem:

(1)

You could either save the xml manifest to a file local to your script or AutoIt3Camo with a tool such as resource hacker. Or create it from scratch after googling what one is and what it is for.

Then add an A3C resource config item for its inclusion similar to this (assuming manifest is in the directory of your script):

;
[A3C_RES]
My Manifest=24}1}1033}mymanifest.xml

During construction the local manifest file will be added and if the xml is correctly formatted your gui woes should be resolved.

(2)

You could tell AutoIt3Camo to preserve the manifest that exists in the interpreter with a similar resource config item:

;
[A3C_RES]
Snag Manifest=24}1}1033}#@BIN>

In the above for the file parameter you will see #@BIN>

  • # token tells A3C that the target file is a pe file you want to grab the resource item from.
  • @BIN> Internal macro that points the path of the temporary interpreter currently being used
This is the easy method which would also resolve your gui woes, plus no extra separate resource file. The downside is that you cannot change this default Au3 manifest to suit the needs of your product.

In the ETC directory of AutoIt3Camo you will fiind a file called ORGRES.cfg, this has a couple of resource config references relevant to AutoIt 3.3.6.1 that you can use in a similar manner to the above to preserve other default interpreter resource items, it looks like this:

;
[A3C_RES]
TRAY_MNU=4}166}2057}#@BIN>
INPUTBOX_DLG=5}1000}2057}#@BIN>
STR_TBL=6}7}2057}#@BIN>
STR_TBL=6}8}2057}#@BIN>
STR_TBL=6}9}2057}#@BIN>
STR_TBL=6}10}2057}#@BIN>
STR_TBL=6}11}2057}#@BIN>
STR_TBL=6}12}2057}#@BIN>
STR_TBL=6}313}2057}#@BIN>
MANIFEST=24}1}1033}#@BIN>

(3)

Alternatively and only for debugging because of serious problems with the icons you could add this config option to the top of your main config to tell A3C not to delete the default resources. (there is no gui option for this anymore)

A3C_KOR=1

I used a protector AFTER your tool so I am unsure if the bugs are rly caused by your tool, but I ll continue testing. (btw: in helpfile you wrote to protect by command-line before AutoIt3Camo will do its work ? or did I got that wrong ? - maybe you can tell me how to protect before AutoIt3Camo will do his work, cause most protectors wouldnt support command-line. Is it okey to use a protector after AutoIt3Camo or will this cause errors ? )

thx - whitelion

EDIT: The bugs still appear if I leave the app unprotected.

What protector are you using? (again pm if sensitive)

It does not matter if your chosen software armoring tool does not have any commandline parameters (just a shame) you can use most tools that support the a3x overlay after AutoIt3Camo has finished if you want to. (your tool obviously works with Au3 binaries otherwise you would not be seeing a ghetto gui)

You cannot armor the interpreter before using AutoIt3Camo because resource interaction and fuzzing (camo) would fail.

I will probably start a commonly asked questions section in the second post of this thread because the deletion of the interpreter resources has caused much confusion (manifest and error message box components most of all).

Vlad

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites

A3C_NO_RESOURCES=1

Mobius will explain your problem better than me :)

Br, FireFox.

Thanks FireFox you are doing a perfect job ;)

Only one thing is that the A3C_NO_RESOURCES=1 option (top of the options tab) tells AutoIt3Camo to ignore any entrances in A3C_RES group or in gui list box, only a main icon and version info will be added if they are specified.

Respect

Vlad

wtfpl-badge-1.png

Link to post
Share on other sites

amazing fast and understandable answer!!! 1000 thanx !

this is my batch-file:

@ECHO off
START C:\Programme\AutoIt3\Aut2Exe\A3C.exe %0%
EXIT
::AutoIt3Camo
A3C_IN=C:\Programme\AutoIt3\AutoIT-eigenerkrams\multitool\IniEditor\mainTool.au3
A3C_OUT=C:\Programme\AutoIt3\AutoIT-eigenerkrams\multitool\IniEditor\Pk-em-Editor.exe
A3C_ICO=C:\Programme\AutoIt3\AutoIT-eigenerkrams\multitool\IniEditor\pk-em-editor.ico
A3C_IRI=99
A3C_SUB=win
A3C_A2E=C:\Programme\AutoIt3\Aut2Exe\Aut2exe.exe
A3C_BIN=C:\Programme\AutoIt3\Aut2Exe\AutoItSC.bin
A3C_VRL=2057
[A3C_VER]
ProductName=Pk em Editor
FileVersion=1.00

:: ----------------------------------
::adding this solved the GUI problems:
[A3C_RES]
TRAY_MNU=4}166}2057}#@BIN>
INPUTBOX_DLG=5}1000}2057}#@BIN>
STR_TBL=6}7}2057}#@BIN>
STR_TBL=6}8}2057}#@BIN>
STR_TBL=6}9}2057}#@BIN>
STR_TBL=6}10}2057}#@BIN>
STR_TBL=6}11}2057}#@BIN>
STR_TBL=6}12}2057}#@BIN>
STR_TBL=6}313}2057}#@BIN>
MANIFEST=24}1}1033}#@BIN>

I am using VM-protect and own a legit pro license ... and it does support command-line, sorry for wrong information. (I always used GUI)

Keep up that work with amazing tool!

Greetings WhiteLion

Link to post
Share on other sites

Thankyou for the config file WhiteLion (quicklaunch batch no less :)), everything seems in order except one question, did you specifically select a path to the build files Aut2Exe and AutoItSC ? or were the A3C_A2E & A3C_BIN config options added by AutoIt3Camo ? (which should not have happened)

If you decide to try and automate the VM-Protect procedure via the commandline using AutoIt3Camo's execution tab / config and run into problems give me a shout.

For your particular problem with the gui you could have just added this line mentioned by FireFox and myself:

;
[A3C_RES]
MANIFEST=24}1}1033}#@BIN>

Respect

Vlad

Edited by Mobius

wtfpl-badge-1.png

Link to post
Share on other sites

did you specifically select a path to the build files Aut2Exe and AutoItSC ? or were the A3C_A2E & A3C_BIN config options added by AutoIt3Camo ? (which should not have happened)

I selected the path to aut2exe and a3c setted path to autotsc by self (GUI). after that I made exported as batch-file.

If you decide to try and automate the VM-Protect procedure via the commandline using AutoIt3Camo's execution tab / config and run into problems give me a shout.

thank you! - its easy to use cause it needs project-files configurated by GUI/expert mode in its commandline.

For your particular problem with the gui you could have just added this line mentioned by FireFox and myself:

;
[A3C_RES]
MANIFEST=24}1}1033}#@BIN>

Respect

Vlad

thanx again !
Link to post
Share on other sites

I selected the path to aut2exe and a3c setted path to autotsc by self (GUI). after that I made exported as batch-file.

Phew that is alright then A3C is doing what it is supposed to, Just thought I would mention that the way you have A3C installed (in the directory of the compiler) you do not have to specify the path to the compiler or interpreter. :)

thank you! - its easy to use cause it needs project-files configurated by GUI/expert mode in its commandline.

No I meant some are having trouble with A3C's execution tab / config when trying to get tools they know how to use to run, not that I felt you would have difficulty with VM-Protect. ;)

wtfpl-badge-1.png

Link to post
Share on other sites
  • Mobius changed the title to AutoCamo - 98.18b

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By SonJoe
      Hi all,
      I have compiled a script to exe (using aut2exe) and delivered it to another machine, which does not have AutoIt installed. There, it does not run, but tells me that an undefined variable is used.
      I assume that the files referred to by #include are not embedded in the exe.
      How can I make sure the included files are available, when I deploy the exe to another machine?
      Thanks in advance for your helpful hints!
    • By mLipok
      A new quick/small UDF.
      #include-once #include <AutoItConstants.au3> #include <MsgBoxConstants.au3> Global $RUN_WRAPPER_PID Global Enum _ $RUNWRAPPER_ERR_SUCCESS, _ $RUNWRAPPER_ERR_GENERAL, _ $RUNWRAPPER_ERR_COUNTER Global Enum _ $RUNWRAPPER_EXT_DEFAULT, _ $RUNWRAPPER_EXT_NOT_FINISHED_YET, _ $RUNWRAPPER_EXT_COUNTER If Not @Compiled And @ScriptName = 'Run_Wrapper.au3' Then _Example_for_Run_Wrapper() Func _Example_for_Run_Wrapper() _Run_Wrapper('ping 8.8.8.8') If @error then Return SetError(@error, @extended, 0) While $RUN_WRAPPER_PID Sleep(10) _Run_Wrapper_GetStdout() If @error Then _Run_Wrapper_GetStderr() If @error Then ExitLoop EndIf WEnd MsgBox($MB_OK + $MB_TOPMOST + $MB_ICONINFORMATION, 'Information #' & @ScriptLineNumber, _ _Run_Wrapper_GetStdout() & @CRLF & _ _Run_Wrapper_GetStderr() _ ) EndFunc ;==>_Example_for_Run_Wrapper Func _Run_Wrapper($sCommand) _Run_Wrapper_GetStdout(Null) _Run_Wrapper_GetStderr(Null) $RUN_WRAPPER_PID = Run(@ComSpec & " /c " & $sCommand, @SystemDir, @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD) If @error Then Return SetError($RUNWRAPPER_ERR_GENERAL, $RUNWRAPPER_EXT_DEFAULT, 0) Return $RUN_WRAPPER_PID EndFunc ;==>_Run_Wrapper Func _Run_Wrapper_GetStdout($v_Reset = Default) Local Static $s_StdOut = "" If IsKeyword($v_Reset) And $v_Reset = Null Then $s_StdOut = '' $s_StdOut &= StdoutRead($RUN_WRAPPER_PID) If @error Then Return SetError(@error, $RUNWRAPPER_EXT_DEFAULT, $s_StdOut) Return SetExtended($RUNWRAPPER_EXT_NOT_FINISHED_YET, $s_StdOut) EndFunc ;==>_Run_Wrapper_GetStdout Func _Run_Wrapper_GetStderr($v_Reset = Default) Local Static $s_StdErr = '' If IsKeyword($v_Reset) And $v_Reset = Null Then $s_StdErr = '' $s_StdErr &= StderrRead($RUN_WRAPPER_PID) If @error Then Return SetError(@error, $RUNWRAPPER_EXT_DEFAULT, $s_StdErr) Return SetExtended($RUNWRAPPER_EXT_NOT_FINISHED_YET, $s_StdErr) EndFunc ;==>_Run_Wrapper_GetStderr  
       
    • By HenryJiu
      Hello!
      I have a question , about Mac and Autoit3.
      I want to convert my script to Mac App,but Aut2Exe just convert to EXE!
      So I asked if there was a way to convert scripts to MAC App
      My English isn't very good,so don't laugh please😃
    • By matwachich
      AutoIt3 Lua Wrapper
      This is an AutoIt3 wrapper for the Lua scripting language. Consider it beta software, but since I will be using it in commercial product, expect it to evolve.
      It has been developped with Lua 5.3.5. Updates will come for new Lua version.
      Everything works just fine, except one (big) limitation: Anything that throws a Lua error (using C setjmp/longjmp functionality) will crash your AutoIt program. That means that it is impossible to use throw errors from an AutoIt function called by Lua (luaL_check*, lua_error...).
      It is hosted in Github: https://github.com/matwachich/au3lua
      Simple example
      #include <lua.au3> #include <lua_dlls.au3> ; Initialize library _lua_Startup(_lua_ExtractDll()) OnAutoItExitRegister(_lua_Shutdown) ; create new execution state $pState = _luaL_newState() _luaopen_base($pState) ; needed for the lua's print function $iRet = _luaL_doString($pState, 'print("Hello, world!")') If $iRet <> $LUA_OK Then ; read the error description on top of the stack ConsoleWrite("!> Error: " & _lua_toString($pState, -1) & @CRLF) Exit EndIf ; close the state to free memory (you MUST call this function, this is not AutoIt's automatic memory management, it's a C library) _lua_close($pState)
    • By MarkIT
      Hi AutoIT Masters,
      Sorry again but Just want to know if you have any idea why the AutoIT scripts converted into 32-bit.exe files are being deleted by AV but not 64-bit.exe. If we raise it to the AV whitelisting, they come back saying it is false positive.
      I disabled AV and everything goes well.
      OS: Windows 10 - 64 bit
      AV: Symantec
      Thanks for the help.

×
×
  • Create New...