giangnguyen

EOF data

27 posts in this topic

So I am looking to make an anti-decompiling tool, and as a measure to secure it, I want it to use EOF data.

My script for the builder is something like:

$Stub = FileRead(@ScriptDir & "\base.exe")

$crypted is simply the encrypted code

$key is the encryption key
FileWrite(FileSaveDialog("Where to save your protected file ?", @ScriptDir, "Exe(*.exe)"), $Stub & "R3V3Z3^3b3f3j3n3r3v3R3V3Z3^3b3f3j3n3r3v3aa" & $key & "R3V3Z3^3b3f3j3n3r3v3R3V3Z3^3b3f3j3n3r3v3aa" & $crypted & "R3V3Z3^3b3f3j3n3r3v3R3V3Z3^3b3f3j3n3r3v3aa")

In the base.exe, it reads itself, and StringSplit is used to get the options. The protection uses AES encryption

However, after creating the custom app, it shows This App Can't Run on your PC.

 

Any ideas?

Share this post


Link to post
Share on other sites



Codecrypter is for encrypting an AutoIt source, what I am looking for is to use AutoIt to encrypt any native windows app.

If this does not work out I will just print the source out and compile.

Share this post


Link to post
Share on other sites

Still looking for some help with this.

Share this post


Link to post
Share on other sites

That's whishful thinking.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites
3 hours ago, jchd said:

That's whishful thinking.

Currently I am using printing script out, but as I have seen other languages storing EOF data, I don't see why not.

Share this post


Link to post
Share on other sites
8 minutes ago, giangnguyen said:

Currently I am using printing script out, but as I have seen other languages storing EOF data, I don't see why not.

Perhaps if you link to code you've seen that does this, you might get a bit of help implementing it in AutoIt.


AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt   ipify 

Monkey's are, like, natures humans.

Share this post


Link to post
Share on other sites
1 minute ago, JohnOne said:

Perhaps if you link to code you've seen that does this, you might get a bit of help implementing it in AutoIt.

I don't have those scripts, these techniques are taught by a friend of mine, and he works in C and C++.

I guess I will add some codes in AutoIt and some more infos here:
The base of the protected exe will use FileRead on itself, and store that into a variable that is called $raw. Base will StringSplit to seperate the base from the encrypted file and the encryption key. It will then proceed to decrypt the data and execute it.

Share this post


Link to post
Share on other sites

Fair enough.

I cannot remember the thread, but I'm fairly certain I've seen something regarding this issue here in the past.

You should note though, before you spend time on this, that some decompilers do not need to rip your code directly from file, and instead rip it from memory when it is loaded, which has to occur at some point.


AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt   ipify 

Monkey's are, like, natures humans.

Share this post


Link to post
Share on other sites

#10 ·  Posted (edited)

Protecting file(s) storing there own encryption key is unsafe and for 'Hello Word' apps a protection isn't needed.

Edited by AutoBert

Share this post


Link to post
Share on other sites
3 hours ago, JohnOne said:

Fair enough.

I cannot remember the thread, but I'm fairly certain I've seen something regarding this issue here in the past.

You should note though, before you spend time on this, that some decompilers do not need to rip your code directly from file, and instead rip it from memory when it is loaded, which has to occur at some point.

Yeah, I know about that. However, you also need to protect the base, and this especially helps since for those decompilers you need to find certain bytes to see what language it was coded in first.

3 hours ago, AutoBert said:

Protecting file(s) storing there own encryption key is unsafe and for 'Hello Word' apps a protection isn't needed.

The encryption key is encrypted with a hard coded key that will change in every version. And this can be a solution for higher grade applications as well.

Share this post


Link to post
Share on other sites

#12 ·  Posted (edited)

@0p Methods such as the utilization of PE overlay data are pretty much dead, anti productivity (security) software has done its work there.

With a bit of searching however you will find some examples that contain code that will help you understand how to parse the PE's section table information to calculate the correct offset in which the executable ends an overlay data begins.

Edited by Mobius

Share this post


Link to post
Share on other sites
13 minutes ago, Mobius said:

@0p Methods such as the utilization of PE overlay data are pretty much dead, anti productivity (security) software has done its work there.

With a bit of searching however you will find some examples that contains code that will help you understand how to parse the PE's section table information to calculate the correct offset in which the executable ends an overlay data begins.

Link me please, I am currently searching around but haven't found it yet.

Share this post


Link to post
Share on other sites

I think the depths of this thread contains most of what you need:

 

Of course it doesn't contain exactly what you need, and with a bit of searching and reading you will likely find much better or closer examples.

 

Share this post


Link to post
Share on other sites

Hi. A better reference about PE. 

 

Saludos

 

 

Share this post


Link to post
Share on other sites
7 minutes ago, Danyfirex said:

 

 

Saludos

 

 

Agreed, was kinda hoping the op would find this popular thread themselves if they actually were searching ;)

Pertin

 

Share this post


Link to post
Share on other sites
19 minutes ago, Mobius said:

Agreed, was kinda hoping the op would find this popular thread themselves if they actually were searching ;)

Pertin

 

lol I was, but mostly about EOF data and how to add data without recompiling. I will look on it, but have to go to sleep now.

Bye!

Share this post


Link to post
Share on other sites

EOF data isn't reliable and mostly useless in practice.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now