AutoIt v3.3.9.9 Beta

[wraithdu]

  On 7/20/2013 at 4:37 PM, Jon said:

Actually that does make a little sense. Remember if the NoAutoItExecute line is not present, then you can run the exe in singleline mode and that single line could be an InputBox. So unless NoAutoItExecute is present then the resource isn't safe to strip.

 

I agree. I hadn't thought about that when I posted that originally, until you mentioned it.

[FaridAgl]

Guys (Jon) now that you are changing lots of things would be nice if you put some attention on the source code's security.

You have changed how script is stored within the exe, it will break down lot's of decompilers for now, it's quite enough for a while, would be even better if you change the encrypting method, script signatures and ... so we will have more "secure" time for a long time.

Let me know what you think.

[Mat]

  On 7/20/2013 at 5:20 PM, D4RKON3 said:

Guys (Jon) now that you are changing lots of things would be nice if you put some attention on the source code's security.

You have changed how script is stored within the exe, it will break down lot's of decompilers for now, it's quite enough for a while, would be even better if you change the encrypting method, script signatures and ... so we will have more "secure" time for a long time.

Let me know what you think.

Or we just accept that AutoIt scripts could be decompiled, as can any other program given enough time and effort, and get on with it.

[Starg]

  On 7/20/2013 at 10:43 PM, Mat said:

Or we just accept that AutoIt scripts could be decompiled, as can any other program given enough time and effort, and get on with it.

Or always distribute EXE with source codes!

[FireFox]

  On 7/21/2013 at 12:51 AM, Starg said:

Or always distribute EXE with source codes!

Sometimes you cannot afford to distribute it as it will compromise the utility of the program itself.

[FaridAgl]

y, but if it can be more secure why not? we can do our best.

do you want to simply give up?

changing some signatures, encryption and other things will not hurt, but it can buy lots of time until someone make another decompiler.

i think you can't understand me because you never need to keep yout sources secure as i want.

you are ignoring because you think "hey, don't talk about decompilers, we will ban you", but they exist, and we always loose.

[Melba23]

D4RKON3,

Please drop this subject - we are not "ignoring" it, it is just that it is impossible and so a complete waste of time. I would much rather the Devs developed new features (as has been the case) than working on the lost cause of (false) security for executables. After all, major games and OSs are hacked pretty quickly - so what chance do we have?

 

  Quote

buy lots of time until someone make another decompiler

Wrong! The last time Jon changed the internal workings of AutoIt compilation it only took hours before a new decompiler was out there.

M23

[guinness]

AWESOME! (It deserves to be big.)

 

Compile the following code:

#AutoIt3Wrapper_Outfile=myAThreeX.a3x
#AutoIt3Wrapper_Outfile_Type=a3x

#include <GUIConstantsEx.au3>

Func ThisFunctionIsInTheA3XScriptWouldYouBelieve($sText = 'This is a GUI in the compressed script.')
    Local $hGUI = GUICreate('SomeGUI')
    GUICtrlCreateLabel($sText, 5, 5)
    GUISetState(@SW_SHOW, $hGUI)

    While 1
        Switch GUIGetMsg()
            Case $GUI_EVENT_CLOSE
                ExitLoop
        EndSwitch
    WEnd
    GUIDelete($hGUI)
    Return True
EndFunc   ;==>ThisFunctionIsInTheA3XScriptWouldYouBelieve

Run this code making sure myAThreeX.a3x is in the same directory as this script:

#include 'myAThreeX.a3x'

Example()

Func Example()
    ; Create a first class object of ThisFunctionIsInTheA3XScriptWouldYouBelieve and assign to a Local variable.
    Local $hA3XFunction = ThisFunctionIsInTheA3XScriptWouldYouBelieve
    $hA3XFunction('I''m overriding the default parameter with this text.')
EndFunc   ;==>Example

..or this..

#include 'myAThreeX.a3x'

Example()

Func Example()
    ; Access the user function as you normally would.
    ThisFunctionIsInTheA3XScriptWouldYouBelieve('I''m overriding the default parameter with this text.')
EndFunc   ;==>Example

Edited July 21, 2013 by guinness

[trancexx]

I normally don't use AV software on my PC, but depending where I am, machines I work with have them installed. I tried latest available compiler on computer with installed AV called Zone Alarm or something, and every time I hit "beta compile" I got some attention dialog from the AV popping up saying: "Potentially harmfull file with executable signature... something, something... in anonymous ..something... location, ...something!".

Then I have to allow things and then compilation continues. If I don't allow nothing happens, compilation fails.

I also checked temp dir afterwards and it's kind of flooded with .tmp files. If I delete all temp files there and try again and this time allow everything I still got .tmp leftover(s).

If I say I know why this happens somebody (politically correct asses) will again say I'm britney bitching, so I won't. I just wanted to let you know 

Edited July 21, 2013 by trancexx

[Jos]

  On 7/21/2013 at 8:06 AM, trancexx said:

If I say I know why this happens somebody (politically correct asses) will again say I'm britney bitching, so I won't. I just wanted to let you know 

 

Why don't you simply play along and really help or simply STFU?

So much with Political correctness.

Edited July 21, 2013 by Jos

[trancexx]

  On 7/21/2013 at 8:22 AM, Jos said:

Why don't you simply play along and really help or simply STFU?

So much with Political correctness.

Charmed I'm sure.

[Jon]

Did this happen on the previous beta version? I moved the temporary exe creation into %temp% from %appdata% - shouldn't make a difference but maybe the AV is more sensitive to that location. %appdata% wasn't the best location because it gets put in a network user's roaming profile and/or be redirected to a network location. But %localappdata% might work. Or I might rejig it so that the output .exe is created in place like it was in 3.3.8.1

[mLipok]

Why this cannot be just @scriptdir & 'Temp' 

I think this location can be the best solution , any body can add an exclusion to AV to this location.

but maybe I'm wrong ?

[trancexx]

  On 7/21/2013 at 9:06 AM, Jon said:

Did this happen on the previous beta version? I moved the temporary exe creation into %temp% from %appdata% - shouldn't make a difference but maybe the AV is more sensitive to that location. %appdata% wasn't the best location because it gets put in a network user's roaming profile and/or be redirected to a network location. But %localappdata% might work. Or I might rejig it so that the output .exe is created in place like it was in 3.3.8.1

I don't know about previous betas, but dev version we shared worked fine.

Avoid using temp dir for temporary executables somehow because (this) AV really looks nervous with them.

If you switch to in-place executable you will break everything for most of the users.

[Jon]

I'll try local appdata first then and we'll see if goes away.

[Terenz]

  On 7/20/2013 at 5:20 PM, D4RKON3 said:

Guys (Jon) now that you are changing lots of things would be nice if you put some attention on the source code's security...

 

Stay in topic, this is for bug of the beta, not for feature request. Anyway i have posted the same question ( topic locked, the rules are rules ) and then a feature request, here:

http://www.autoitscript.com/trac/autoit/ticket/2355

[Trong]

I Love It !