Jump to content

rant: Windows Defender refuses to execute compiled autoit apps


Recommended Posts

  • Developers

... or simply do as I do for years now: Run your script source with AutoIt3.exe...  never had any issues since then. :) 

SciTE4AutoIt3 Full installer Download page   - Beta files       Read before posting     How to post scriptsource   Forum etiquette  Forum Rules 
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Link to post
Share on other sites

@Jos Just curious, what are your thoughts on distributing the interpreter (AutoIt3.exe) along with the script to avoid virus detection? I think the signed interpreter executable is whitelisted by many AVs...

EasyCodeIt - A cross-platform AutoIt implementation

DcodingTheWeb Forum - Follow for updates and Join for discussion

Link to post
Share on other sites
39 minutes ago, TheDcoder said:

Just curious, what are your thoughts on distributing the interpreter (AutoIt3.exe) along with the script to avoid virus detection? I think the signed interpreter executable is whitelisted by many AVs...

We are distributing tools created with AutoIt (.a3x, but .au3 would work just the same) since years to various customers. The launch is done via the interpreter AutoIt3.exe or AutoIt3_x64.exe and, with very very few exceptions, have never observed any problems with AV scanners.

Musashi-C64.png

"In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move."

Link to post
Share on other sites
  • Developers
52 minutes ago, TheDcoder said:

@Jos Just curious, what are your thoughts on distributing the interpreter (AutoIt3.exe) along with the script to avoid virus detection?

That is what I would do when running in an corporate environment to avoid a tsunami  of virus issues on all computers when the AV company messes up. 

The added benefit is that the "compiled" a3x files are much smaller to distribute and you only need to distribute the exe one time.
Disadvantage obviously is that all scripts need to be able to run on the same version interpreter. 

Edited by Jos

SciTE4AutoIt3 Full installer Download page   - Beta files       Read before posting     How to post scriptsource   Forum etiquette  Forum Rules 
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Link to post
Share on other sites
3 hours ago, Jos said:

Disadvantage obviously is that all scripts need to be able to run on the same version interpreter. 

Not necessarily. One can manage scripts (.a3x), that need a certain interpreter version, together with the matching interpreter in separate folders.

The interpreters AutoIt3.exe / AutoIt3_64.exe do not have to be installed or associated with the extension .a3x. They are called (stand-alone) from the respective folder. This way one can run e.g. scripts of version 3.3.12.0 and 3.3.14.5. separately, no matter which AutoIt version is installed.

Edited by Musashi

Musashi-C64.png

"In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move."

Link to post
Share on other sites
1 hour ago, Exit said:

Au3toCmd

Cool script, maybe you can adapt it to also work without ADS as an optional feature? Relying on ADS is bound to create issues, it only takes one person to move the file once to a non-NTFS location and the script would suddenly stop working and they would have no idea why.

EasyCodeIt - A cross-platform AutoIt implementation

DcodingTheWeb Forum - Follow for updates and Join for discussion

Link to post
Share on other sites
14 hours ago, Jos said:

... or simply do as I do for years now: Run your script source with AutoIt3.exe...  never had any issues since then. :) 

... until someone uninstalled autoit3 from said machine, then the script wont work

13 hours ago, Exit said:

This was exactly what I thought and then I made Au3toCmd. See the link in my Signature.

I totally forgot this.. checking again.

Link to post
Share on other sites
5 hours ago, Burgaud said:

... until someone uninstalled autoit3 from said machine, then the script wont work

You bundle the EXE with your application, no need for installation, it's portable and has no other dependencies. That's one of the cool features of AutoIt :)

EasyCodeIt - A cross-platform AutoIt implementation

DcodingTheWeb Forum - Follow for updates and Join for discussion

Link to post
Share on other sites
6 hours ago, Burgaud said:

... until someone uninstalled autoit3 from said machine, then the script wont work

It works, like @TheDcoder already wrote :

1 hour ago, TheDcoder said:

You bundle the EXE with your application, no need for installation, it's portable and has no other dependencies. That's one of the cool features of AutoIt :)

@Burgaud :

If you 'compile' your application as .a3x , then it will still work (since all required #Include 's are integrated), even if someone completely removes the AutoIt installation.

You only have to provide the corresponding (standalone) Version of the Interpreter (AutoIt3.exe/AutoIt3_64.exe) to execute the .a3x-File.

Musashi-C64.png

"In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move."

Link to post
Share on other sites
  • Developers
8 hours ago, Burgaud said:

.. until someone uninstalled autoit3 from said machine, then the script wont work

I would not install AutoIt3, but just redistribute autoit3.exe to the computers. This isn't different from distributing a compiled script!

 

SciTE4AutoIt3 Full installer Download page   - Beta files       Read before posting     How to post scriptsource   Forum etiquette  Forum Rules 
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Link to post
Share on other sites

 

7 hours ago, Musashi said:

It works, like @TheDcoder already wrote :

@Burgaud :

If you 'compile' your application as .a3x , then it will still work (since all required #Include 's are integrated), even if someone completely removes the AutoIt installation.

You only have to provide the corresponding (standalone) Version of the Interpreter (AutoIt3.exe/AutoIt3_64.exe) to execute the .a3x-File.

Run the stripper and then distribute the generated stripped au3 with Autoit3.exe, a3x files are also picked up as false positives. Although avoiding AV detection in this method can be used for good as well as evil :whistle:

Edited by rcmaehl

My UDFs are generally for me. If they aren't updated for a while, it means I'm not using them myself. As soon as I start using them again, they'll get updated.

My Projects

WhyNotWin11
Cisco FinesseGithubIRC UDFWindowEx UDF

 

Link to post
Share on other sites
2 hours ago, rcmaehl said:

Run the stripper and then distribute the generated stripped au3 with Autoit3.exe, a3x files are also picked up as false positives.

First of all, to prevent misunderstandings and unnecessary disputes : There is nothing wrong with distributing a generated stripped au3 with Autoit3.exe :). Let's just hope, that the AutoIt Interpreter itself does not appear on the 'false positive' list in future AV updates :sweating:.

2 hours ago, rcmaehl said:

... a3x files are also picked up as false positives.

According to my experience, this happens very rarely up to now. If they do, then from the lesser-known AV scanners named by Virustotal.

3 hours ago, rcmaehl said:

... avoiding AV detection in this method can be used for good as well as evil :whistle:

To a certain extent, I agree with you. In reality, however, very few users will bother to analyze a lengthy .au3 script (with various #includes) to see if it might contain malicious code.

Musashi-C64.png

"In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move."

Link to post
Share on other sites

Here is an example : The script (self created , > 2500 lines - without the Includes) installs PostgreSQL directly from the binaries. It writes registry entries, sets user rights and much more :).

Result :

VTotal.jpg.e2c9f78df41a87206e90981ebab7cd82.jpg

I don't want to exclude the possibility that .a3x files will get into the focus of AV-Vendors in the future. However, this cannot be ruled out for .au3 files either ;).

Musashi-C64.png

"In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move."

Link to post
Share on other sites

You can also use a tool like 7zSFXConstructor to pack the Au3 and AutoIT3.exe into a single SFX exe.. With that tool you can create a cmd script and during sfx exe creation point to that as the file to execute when the sfx is run.. The tool allows you to pick where you want the file to extract to e.g. %temp% and will self delete the extracted files on process close.. If you do use a cmd script to execute everything inside you can hide the console window completely and use the Start "" ????.cmd to keep the process going until you are finished (for self removal), you can lock running the exe down with a password etc..

An added benefit to the sfx method is that you are executing from removable media, the media can be disconnected after launch while the program is running..

Very simple easy way to package a "compiled" EXE from au3 scripts with AutoIT3.exe without too many headaches...

Tool located here: https://github.com/CryptoNickSoft/7z-SFX-Constructor

 

Screenshot 2021-12-18 142515.png

Edited by bobomb
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...