Jump to content
Exit

Au3toCmd -- Avoid false positives

Recommended Posts

 

Au3toCmd  ---  Avoid false positives

Since many virus scanners sometimes prevent a "compiled autoit EXE" from being executed as "false positive", the "*.A3X" format is a suitable format to avoid this problem.
In order to simplify this procedure, I wrote the Au3toCmd script. Here a *.Cmd file is generated from a *.Au3 file. The necessary files Autoit3.exe and *.A3x are added to the "*.Cmd" file as "alternate data streams".
Now the Autoit Script can be called by clicking on the cmd file and the anti-virus scanners do not recognize the "false positive".
If the short-term flashing of the CMD window bothers you, you can create a link that runs in a minimized window.

Unfortunately, because of the "alternate data streams", this CMD file cannot be distributed via FTP or email.
Only a USB stick or removable disk formatted with NTFS can be used.
To solve this problem, Au3toCmd can be used to create a ZIP file that is email and FTP compatible.  Only possible on Win10 due to Powershell 5.0
Expand this ZIP file on the target system and execute the "*.ADS.Run-me-first.cmd" script. The original CMD file is created again and the auxiliary files are deleted.

Edit;

The new version also accepts A3X and EXE files. This means that A3X and EXE files that have been compiled with special options can be used.

As a side effect, other EXE files can also be included in the CMD file and therefore not detectable by virus scanners.

 

Here the source of Au3toCmd.au3 

;==============================================================================================================
; Script Name:      Au3toCmd.au3
; Description:      Creates a CMD file from any AU3/A3X/EXE file.
;                   The CMD file will contain the compiled version (A3X) of the AU3 input file
;                   and the AUTOIT3.EXE file as alternate data streams.
;                   Alternativly it will contain any EXE file.
;                   This avoids the problem with the false positives of the virus scanners.
;                   If the short-term flashing of the CMD window bothers you,
;                   create the shortcut on the desktop that runs in a minimized window.
;
; Syntax:           Au3toCmd (input-file)
;                   Default:  none
; Parameter:        Name of an AU3/A3X/EXE file (optional)
; Requirement(s):   When using Zip feature: Powershell 5.0 or higher (Windows 10 is ok)
; Example:          Au3toCmd testfile.au3
;
; Author:           Exit   ( http://www.autoitscript.com/forum/user/45639-exit )
; SourceCode:       http://www.autoitscript.com/forum/index.php?showtopic=201562  Version: 2020.02.25
; COPYLEFT:         © 2020 Freeware by "Exit"
;                   ALL WRONGS RESERVED
;==============================================================================================================

#AutoIt3Wrapper_Au3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7
#include <File.au3>

Global $rc, $sSourcepath, $sTargetpath, $sA3Dir, $aPathSplit, $sDrive, $sDir, $sFileName, $sExtension, $sIconPath, $iIconNumber = 0
Exit _Main()

Func _Main()
    $sA3Dir = RegRead("HKLM\SOFTWARE\AutoIt V3\AutoIt", "InstallDir")
    If Not (FileExists($sA3Dir & "\autoit3.exe") And FileExists($sA3Dir & "\au3check.exe") And FileExists($sA3Dir & "\Aut2Exe\Aut2exe.exe")) Then Exit MsgBox(16 + 262144, Default, "Error: Autoit not installed on this system.", 0)
    _Sourcepath()
    $sTargetpath = $sDrive & $sDir & $sFileName & ".cmd"
    FileDelete($sTargetpath)
    FileDelete($sTargetpath & ".ADS.*")
    FileDelete($sTargetpath & ".ADS")
    FileWriteLine($sTargetpath, _
            "@echo off & cls" & @CRLF & _
            "rem @echo on & dir /R  %~nx0 & pause" & @CRLF & _
            "for /f ""delims="" %%F in ('dir /R  %~nx0 ^| find  /C ""$DATA"" ') do set mycount=%%F" & @CRLF & _
            "if .%mycount% == .0 echo Invalid copy of %~nx0. No ADS found. & pause  & goto :eof " & @CRLF & _
            "if .%mycount% == .1 wmic process call create ""%~f0:prog %*"" " & @CRLF & _
            "if .%mycount% == .2 wmic process call create ""%~f0:prog %~f0:a3x %*"" " & @CRLF & _
            "rem End of script" & @CRLF)
    Switch $sExtension
        Case ".au3"
            If ShellExecuteWait($sA3Dir & "\au3check.exe", ' -q "' & $sSourcepath & '"') Then _
                    Exit MsgBox(16 + 262144, Default, "Error: Input file """ & $sSourcepath & """ has Errors.", 0)
            ShellExecuteWait($sA3Dir & "\Aut2Exe\Aut2exe.exe", "/In " & $sSourcepath & " /out " & $sTargetpath & ":a3x")
            FileCopy($sA3Dir & "\Autoit3.exe", $sTargetpath & ":prog")
        Case ".a3x"
            FileCopy($sSourcepath, $sTargetpath & ":a3x")
            FileCopy($sA3Dir & "\Autoit3.exe", $sTargetpath & ":prog")
        Case ".exe"
            FileCopy($sSourcepath, $sTargetpath & ":prog")
    EndSwitch
    If MsgBox(4 + 32 + 256 + 262144, Default, $sTargetpath & "  created." & @LF & @LF & "Create a shortcut on the desktop?", 0) = 6 Then FileCreateShortcut($sTargetpath, @DesktopDir & "\" & $sFileName & ".lnk", $sDrive & $sDir, "", "", $sIconPath, "", $iIconNumber, 7)
    If MsgBox(4 + 32 + 256 + 262144, Default, $sTargetpath & "  created." & @LF & @LF & "Create a portable ZIP file ?" & @LF & $sTargetpath & ".ADS.zip", 0) = 6 Then _CreateZip($sTargetpath)
    If MsgBox(4 + 32 + 256 + 262144, Default, "Run " & $sTargetpath & " ?", 0) = 6 Then ShellExecute($sTargetpath)
EndFunc   ;==>_Main

Func _CreateZip($sTargetpath)
    Local $sRem = (StringRight($sSourcepath, 4) = ".exe") ? "rem " : ""
    FileDelete($sTargetpath & ".ADS.*")
    FileWriteLine($sTargetpath & ".ADS.Run-me-first.cmd", _
            "%~d0 & cd %~dp0" & @CRLF & _
            "set name1=%~n0" & @CRLF & _
            "set name1=%name1:~0,-21%" & @CRLF & _
            "set compare1=%cd% " & @CRLF & _
            "set compare2=%compare1:AppData\Local\Temp=other% " & @CRLF & _
            "if .%compare1%==.%compare2% goto :skip" & @CRLF & _
            "echo off & cls " & @CRLF & _
            "echo Please extract ALL files from ZIP file first and then run this CMD again. " & @CRLF & _
            "Pause & goto :eof" & @CRLF & _
            ":skip " & @CRLF & _
            "ren %name1%.cmd.ADS.cmd %name1%.cmd" & @CRLF & _
            $sRem & "type %name1%.cmd.ADS.a3x > %name1%.cmd:a3x" & @CRLF & _
            $sRem & "del %name1%.cmd.ADS.a3x" & @CRLF & _
            "type %name1%.cmd.ADS.prog > %name1%.cmd:prog" & @CRLF & _
            "del %name1%.cmd.ADS.prog" & @CRLF & _
            "move /Y %name1%.cmd .." & @CRLF & _
            "cd .. " & @CRLF & _
            "echo off & cls " & @CRLF & _
            "echo  ""%cd%\%name1%.cmd""  created. " & @CRLF & _
            "pause " & @CRLF & _
            "del .\%name1%.cmd.ADS.zip" & @CRLF & _
            "rd /S /Q %name1%.cmd.ADS " & @CRLF & _
            "rem End of script" & @CRLF)
    If Not $sRem Then FileWrite($sTargetpath & ".ADS.a3x", FileRead($sTargetpath & ":a3x"))
    FileWrite($sTargetpath & ".ADS.cmd", FileRead($sTargetpath))
    FileWrite($sTargetpath & ".ADS.prog", FileRead($sTargetpath & ":prog"))
    ShellExecuteWait("Powershell", "Compress-Archive -Path " & $sTargetpath & ".ADS.* -Update -DestinationPath " & $sTargetpath & ".ADS.zip")
    If Not FileExists($sTargetpath & ".ADS.zip") Then MsgBox(64 + 262144, Default, "Zip file cannot be created because the software ""Powershell 5.0"" is not available." & @CRLF & "Install Powershell 5.0 or higher and try again.", 0)
    FileDelete($sTargetpath & ".ADS.a3x")
    FileDelete($sTargetpath & ".ADS.cmd")
    FileDelete($sTargetpath & ".ADS.prog")
    FileDelete($sTargetpath & ".ADS.Run-me-first.cmd")
EndFunc   ;==>_CreateZip

Func _Sourcepath()
    If $cmdline[0] > 0 Then $sSourcepath = $cmdline[1]
    Select
        Case FileExists($sSourcepath)
        Case FileExists($sSourcepath & ".au3")
            $sSourcepath = $sSourcepath & ".au3"
        Case FileExists($sSourcepath & ".a3x")
            $sSourcepath = $sSourcepath & ".a3x"
        Case FileExists($sSourcepath & ".exe")
            $sSourcepath = $sSourcepath & ".exe"
        Case Else
            $sSourcepath = FileOpenDialog("Enter AU3/A3X/EXE Inputfile ", "", "Autoit Files(*.au3;*.a3x;*.exe)", 3)
            If @error Then Exit MsgBox(16 + 262144, Default, "Error: No Inputfile given", 0)
    EndSelect
    $sSourcepath = _PathFull($sSourcepath)
    $aPathSplit = _PathSplit($sSourcepath, $sDrive, $sDir, $sFileName, $sExtension)
    If DriveGetFileSystem($sDrive) <> "NTFS" Then Exit MsgBox(16 + 262144, Default, "Error: Input filesystem must be 'NTFS'", 0)
    If FileExists($sDrive & $sDir & $sFileName & ".exe") Then $sIconPath = $sDrive & $sDir & $sFileName & ".exe"
    If FileExists($sDrive & $sDir & $sFileName & ".ico") Then $sIconPath = $sDrive & $sDir & $sFileName & ".ico"
EndFunc   ;==>_Sourcepath

; End of Au3toCmd.au3 script

The script can be called with a file name of an AU3 script as a parameter.
If no name is entered, a query is made.

Suggestions for improvement and bug reports are welcome.

Edited by Exit
New Version: 2020.02.25

App: Au3toCmd              UDF: _SingleScript()                             

Share this post


Link to post
Share on other sites

As can be seen in the first post, the functionality has been extended to A3X and EXE files.
It would be great if you would test the script and give feedback here. At least a 💚 in the first post.

Thanks 


App: Au3toCmd              UDF: _SingleScript()                             

Share this post


Link to post
Share on other sites

Hi all members when i run the au3tocmd program everything works fine but I have a question: if you select an exe file with icon you can somehow get the icon from the exe file that was previously selected and then when you will create shortcut so the exe file icon appears in the cmd shortcut?

Share this post


Link to post
Share on other sites

I just uploaded a new version that takes @Borje's request into account.
If there is an associated * .ico file or an icon in the * .exe source file, this icon is used in the link.
Furthermore, a ZIP file can now also be created in Windows 7, provided that at least Powershell 5.0 was additionally installed.

@Borje: Can you please test the new features 😀


App: Au3toCmd              UDF: _SingleScript()                             

Share this post


Link to post
Share on other sites

Exit fixed it and all works perfect now  thank you Exit you so much you are a super man.

Share this post


Link to post
Share on other sites

Sorry for the rookie confusion here, but here goes...

In my current test project using Java Selenium, when I run it locally from Eclipse, I start the browser by providing my application URL, and then run auth.exe in order to respond to a Windows NTLM login prompt.  Everything works fine so far, but based on what I am reading and hearing, it sounds like I can anticipate running into this "false positive" antivirus issue when I go to operationalize my test with Github, Bamboo/Azure, and Saucelabs.

I copied the script text from these posts into my Au3toCmd.au3 file.  I now have the following files in my project folder and I just now installed Autoit3 to my computer.  Where do I navigate to, and which command(s) do I issue to, generate the .cmd file?  And then in my test, what file do I run in place of the current auth.exe to respond the Windows login?

Thanks very much.  This script From Exit looks like a winner !

 

Directory of C:\Users\my-user-info\git\my-test-folder\src\main\resources\autoit

06/15/2020  03:02 PM    <DIR>          .
06/15/2020  03:02 PM    <DIR>          ..
06/15/2020  03:05 PM             7,519    Au3toCmd.au3
02/21/2020  03:04 PM               190     auth.au3
02/21/2020  03:04 PM           866,304 auth.exe
02/21/2020  03:04 PM                48      setvalue.au3
02/21/2020  03:04 PM           865,792 setvalue.exe
               5 File(s)      1,739,853 bytes
               2 Dir(s)  19,080,040,448 bytes free

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By MarkIT
      Hi AutoIT masters,
      Good day! Sorry to have bothered this forum but we really need help. We are working on an automation project that is running on VDI server. The BOTS are in .exe are running fine until AV detected them and deleted the files. The files were re-compiled and AV kept on deleting them. The copy of the .exe BOT deleted were sent to Symantec for whitelisting. After whitelisting, it is no longer deleted but no longer working as designed (showing Line script error). We checked the scripts and there were no issues since we run it using SciTE editor and it performed the desired task. Good thing we found on this thread the solution using .a3x and the BOTS worked fine and no longer deleted. Now, the problem is they are asking why the BOTS won't run in .EXE and what is the reason behind Symantec AV deleting them. We raised a case with Symantec but they cannot provide further information as they are always seeing the file as "False Positive". We even tested with Symantec turned off and those .EXE files are working fine, however, after re-enabling, it got deleted.
      Just seeking help on how to better convince them that it is really Symantec causing the issue and the .a3x file.
    • By ambad4u
      Greetings to all,
      This may relate in regards to
      My question:
      If I have 2 different au3 scripts compiled individually as a standalone executable(s) (compilation settings are the same)
      OR
      If I have one au3 script compiled as a standalone executable(s) with different compilation settings.
      Does an Anti Virus see them as one signature for all? or treated as unique signatures?
       
      My reason behind this is that I am trying to plan ahead on how to deal with these false positives.
      I am a part of a small IT admin team that would like to automate some repeatable tasks using Autoit.
      Our AV is Sophos if one is curious.
      Any insights are highly appreciated!, many thanks in advance!
    • By BigDaddyO
      I've recently been getting hammered by Symantec SEP deleting all of my compiled scripts so I'm trying to figure out how I could run my scripts uncompiled.
      Problem is, these scripts are typically launched from inside Citrix sessions that I don't have control of so I can't install AutoIT in there to get all the #Include files that my scripts are using.
      I tried to use AU3Stripper and while, yes that did create a single file and I could run it. it put it in a state that I couldn't easily maintain going forward.
       
      Is there any existing way to pull all the functions and drop them at the end of the main script?  Not sure about the Globals and Constants though, I guess they would have to go to the top which shoves everything else down.  I also need to maintain the current script spacing and comments as I often have to update older scripts and need the comments to help with that.
    • By RichardL
      Local $sAxName Local $oMSComm $sAxName = "MSCOMMLib.MSComm.1" $oMSComm = ObjCreate($sAxName) MsgBox(0, Default, StringFormat("Name: %s, Obj %d, Err %d", $sAxName, IsObj($oMSComm), @error)) I'm talking to serial ports (for Arduino) using the MSComm object.  It all runs fine from SciTE or .exe.  If I compile to .a3x the object is not created.  I could manage without .a3x but I like it because it compiles faster.
       
       
    • By Anteaus
      Think this has been discussed before, but is there any way of signing a compiled script with a certificate?
      Reason I ask is that some AV products keep on producing 'Generic Trojan' false positives on compiled scripts. I'm told that signing with a certificate from a trusted source might reduce this problem.
×
×
  • Create New...