Sign in to follow this  
Followers 0
coreng

AutoIt Grammar

15 posts in this topic

Hello everyone.

As many of you already know, AutoIt comes with somewhat of a downside, as mentioned here. I am currently working for an antivirus company and trust me when I say that we really go the extra mile to avoid false positives.

There is however one thing that's been slowing down our progress considerably -- we're missing the official grammar for AutoIt (i.e. we are trying to reconstruct the grammar from the documentation but the documentation is not sufficient to determinately define the language). This has the considerable impact that parsing AutoIt scripts for malware is not as reliable as it could and should be. It's not unlikely that there will be a wave of new false-positives in AutoIt scripts if there are errors in the grammar definition file.

I was wondering whether or not we could get a copy of AutoIt's grammar definition. Lex, YACC, Bison, whatever AutoIt uses will work.

Best regards

P.S. I tried emailing avsupport as suggested in compiled AutoIt binary files, but I have yet to receive a response.

Share this post


Link to post
Share on other sites



#2 ·  Posted (edited)

Perhaps Jon can give you a copy of what is used in Au3Check as AutoIt is not based of stuff as Lex, YACC, bison ...

Edited by jpm

Share this post


Link to post
Share on other sites

#3 ·  Posted (edited)

Perhaps Jon can give you a copy of what is used in Au3Check as AutoIt is not based of stuff as Lex, YACC, bison ...

 

That would be fantastic. As I mentioned earlier right now we're trying to base the grammar entirely on the documentation, so any official definition will allow us to create a 'proper' grammar file.

Edit/side question: Is Au3check capable of detecting syntax errors within EXECUTE? i.e. Execute(binarytostring("0x" & hex("In valid assignment = bla bla bla")))

Edited by coreng

Share this post


Link to post
Share on other sites

Just try for execute(...) but I don't think so if it is a valid expression

Use the Scite editor to exercise the Au3check if you watto visualize easily the output

Share this post


Link to post
Share on other sites

#5 ·  Posted (edited)

For Au3Check to determine validity of executed strings in the general case, it would require nothing less than executing the script since the argument can be any dynamically built expression, including function calls or return from external programs.

Validity check on only literal strings is probably beyond Au3Check goal and not worth the pain since:

1) fixed strings could be simple AutoIt expressions on their own: $a = Execute("$i+1") is equivalent to $a = $i+1

2) it could be circumvented very easily.

Edited by jchd

This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Hey guys, any chance for an update on this? Is there an easy way to get in touch with Jon regarding the grammar files?

Share this post


Link to post
Share on other sites

I thank you for taking this initiative and hope that something positive comes from it. If you don't mind me asking, which AV company do you work for?

Share this post


Link to post
Share on other sites

#9 ·  Posted (edited)

You could leave your official company email address here.

Throestur.Thorarensen (x) CYREN.com -- please be in touch.

(This should also address czardas' question).

Edited by coreng

Share this post


Link to post
Share on other sites

Jon's usually pretty busy so give him a few business days.

It's nice to see an AV willing to process scripts instead of blindly locking all of them though.

Share this post


Link to post
Share on other sites

Hey guys, any chance for an update on this? Is there an easy way to get in touch with Jon regarding the grammar files?

email him to support@autoitscript.com

Share this post


Link to post
Share on other sites

Does he ever check any of his emails?

Share this post


Link to post
Share on other sites

coreng,

It can often take a while to contact him - and I know he is very busy at the moment. Please be patient - I will try and see if I can do anything. :)

M23


Any of my own code posted anywhere on the forum is available for use by others without any restriction of any kind._______My UDFs:

Spoiler

ArrayMultiColSort ---- Sort arrays on multiple columns
ChooseFileFolder ---- Single and multiple selections from specified path treeview listing
Date_Time_Convert -- Easily convert date/time formats, including the language used
ExtMsgBox --------- A highly customisable replacement for MsgBox
GUIExtender -------- Extend and retract multiple sections within a GUI
GUIFrame ---------- Subdivide GUIs into many adjustable frames
GUIListViewEx ------- Insert, delete, move, drag, sort, edit and colour ListView items
GUITreeViewEx ------ Check/clear parent and child checkboxes in a TreeView
Marquee ----------- Scrolling tickertape GUIs
NoFocusLines ------- Remove the dotted focus lines from buttons, sliders, radios and checkboxes
Notify ------------- Small notifications on the edge of the display
Scrollbars ----------Automatically sized scrollbars with a single command
StringSize ---------- Automatically size controls to fit text
Toast -------------- Small GUIs which pop out of the notification area

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0