Decompile AutoIT

[gerwim]

Hi there,

When using the obfuscator, my project is marked by 13 AV's as a virus (according to VirusTotal). When I'm not using it, it's only marked by 3 (which is OK, those AV's are not popular at all).

However, using this my project can be decompiled quite easily (although -snipped- failed todo so, for some reason -- I don't know why though - something about detokenising).

So, what are the alternatives? Are AutoIT scripts that easily decoded?

Thanks in advance

Edited September 21, 2011 by SmOke_N

[Melba23]

gerwim,

You are treading on very dangerous ground here.

Please read these 2 entries in the FAQ and then the Forum Rules.

If you search the forum these very questions have been asked and answered many, many, many times.

M23

[gerwim]

Well I'm not asking on how-to decompile. I'm just having issues why obfuscating my code will mark it as a virus. I don't want to use that obfuscator, since I don't want my users to think it might possibly be a virus.

Are there any other obfuscators (not the one in scite).?

[Melba23]

gerwin,

I say again:

If you search the forum these very questions have been asked and answered many, many, many times

The Search box is at top right.

M23

[gerwim]

Thank you for pointing me out where the search box is, however, there is still no post which says how this can be done, except the fact that that guy didn't obfuscate but saved his data in a encrypted dat file.

[Melba23]

gerwim,

there is still no post which says how this can be done

Then you have your answer.

M23

[jvanegmond]

gerwim, the obfuscator has a few options. If you "tone it down" to use more simple obfuscation (only variable and function names changed), stripping comments, and compacting your code (removing double newlines), then I think you'll have less of a problem with AV marking your script.

[water]

Or you might try to not use UPX to compress the code. In SciTE press Ctrl+F7 and then uncheck "Use UPX" on the AutoIt3 / Aut2Exe tab.

[GEOSoft]

Or you could go the prefered route and just notify the AV companies that it's a false positive.

That can be a pain in the arse to keep up with but eventually the companies involved do start to pay attention to the method they use to detect a virus in a compiled AI script.

I should look at the next update to see what has been changed but the last time I looked they had 40 new AutoIt scripts within 2 months that were definitely a virus so I don't blame them for being a bit cautious nor do I want to see them relax the rules. Just checking a bit deeper is a better alternative although we will still be plagued with the occasional file being improperly flagged.