Project Presentation: au3Mythos - Static Code & Scoping Analysis for AutoIt 3

[Blowcake]

Hi everyone,

I'd like to present an new open-source project I've created that complements static code and scoping analysis in AutoIt 3: au3Mythos.

Motivation & Background

Inspired by recent discussions regarding static analysis and vulnerability scanning in software, I wanted to explore how far we can push classical static and heuristic diagnostics for AutoIt 3 to catch typical scoping issues and runtime defects before execution.

The result is au3Mythos—a powerful debug and analysis utility designed for developers looking to increase code safety, reliability, and hygiene in their AutoIt codebases.

---

What is au3Mythos?

au3Mythos is a static diagnostics engine and compiler wrapper. It acts as a drop-in replacement for the standard Au3Check.exe and integrates seamlessly into editor environments like SciTE, ISN AutoIt Studio, or VS Code, provided they already support the original au3check.exe.

When a syntax check is triggered (e.g., Ctrl+F5 in SciTE), the wrapper intercepts the call. Using custom routing rules, it determines whether the file should be analyzed by the scoping engine (mythos) or passed through directly to the original check (original).

---

Additional Warnings and Detections

While the standard Au3Check performs great basic syntax validation, au3Mythos extends check capabilities with an additional in-depth focus on logical scoping anomalies and potential runtime crashes:

• Variable Block-Scoping Violations: Warns when variables are declared inside conditional blocks (If, For, Select) but referenced outside of them (which causes runtime crashes if the conditional branch is bypassed).
• Unsafe Return Dereferencing: Accessing array/map indexes directly from a function call result (e.g. _MyFunc()[0]) without type-checking the return value (via IsArray(), IsObj(), etc.) or checking @error.
• @error & @extended Overwrites: Detects variable assignments or intervening function calls that silences/overwrites the @error register before it is validated.
• Array Bounds & Dimension Plausibility: Warns on out-of-bounds index access for statically declared array dimensions.
• Unused Variables & Redundant Declarations within nested local/global scopes.

---

Toolchain Components

• Settings Manager GUI: A Win32 graphical utility to manage routing rules, profiles, and warning configuration (-w 1 through -w 7). The key highlight of this flexible configuration capability is that the diagnostic run can be executed with your own custom parameters, regardless of what hardcoded parameters the calling editor/program (like SciTE) enforces – all without having to modify a single line of code or editor configurations.
• Installer & Uninstaller: Safely integrates the wrapper into C:\Program Files (x86)\AutoIt3 (backing up the original compiler tool as Au3Check_Original.exe) and offers clean restoration on removal.
• Precise Line-Mapping: Ever faced the issue where a compiler or preprocessed error prints a line number of the merged/preprocessed file, leaving you with no idea which line in which of your many include files that actually corresponds to? au3Mythos solves this by translating these line numbers back to their exact original source files and actual line numbers.

---

GitHub & Open Source

The suite is 100% open source under the MIT License:

• GitHub Repository: Blowcake/mythos-secure-static-and-code-analyzer (If you find this project useful, I would be thrilled if you could drop a star ⭐ on GitHub!)

Downloads & Changelog

• Version 1.1.0 (Includes precompiled standalone binaries – no Python installation required!)
  • Download compiled ZIP Package
  • View Changelog / Release Notes

Disclaimer: This project is an independent, standalone open-source software suite. It is in no way affiliated with, associated with, sponsored by, or endorsed by the original author(s) of the AutoIt 3 Au3Check utility or the AutoIt team.

Since I have developed and tested this project completely on my own in my quiet study so far, I would be thrilled to receive your feedback! Any reports on undiscovered bugs, incompatibilities, or suggestions for improvement are highly welcome. I am also more than happy to assist anyone looking to integrate the powerful JSON interface into their own projects to extract the maximum benefit from this tool.

Best regards,

Harald Frank