How know if an .EXE is an autoitscript (Comment savoir si un .EXE est un script AutoIt )

[ECHAIGNE]

Hi,

I must seek the whole of scripts which we have but of which we do not lay out any more the sources of some.

How then I to know if a file .EXE is a AutoIt script?

Thanks you

Eric

Je dois rechercher l'ensemble des scripts que nous possédons mais dont nous ne disposons plus les sources de certains.

Comment puis-je savoir si un fichier .EXE est un script AutoIt ?

Merci par avance

Eric

[SmOke_N]

Why?

[ECHAIGNE]

Why?

Because much script uses runasset and that the passwords will change

Parce que beaucoup de script utilisent du runasset et que les mots de passe vont changer

[SmOke_N]

Because much script uses runasset and that the passwords will change

Parce que beaucoup de script utilisent du runasset et que les mots de passe vont changer

So?

[ECHAIGNE]

So?

to give up to date scripts while décompilant those whose we do not have any more the sources. We thus should count the whole of the .EXE resulting from AutoIt scripts

remettre les scripts à jour en décompilant ceux dont nous ne possédons plus les sources. Il nous faut donc recenser l'ensemble des .EXE issu de scripts AutoIt

[MHz]

You could perhaps use FileGetVerson() to get the AutoIt version used when they were compiled to find them. That would narrow down the exes that maybe compiled autoit scripts.

[jpm]

I think the idea of decompilation is the one that will be the most fruitfull as there is no specific information in the version header specific to a compiled script .exe.

I will propose to add a new field in the exe version header CompiledScript to "AutoIt v3 Script : 3, 2, 1, 2"

and to retrieve it to extend the FileGetVersion("filename, "CompiledScript") so next time you will have less work.

[ECHAIGNE]

I think the idea of decompilation is the one that will be the most fruitfull as there is no specific information in the version header specific to a compiled script .exe.

I will propose to add a new field in the exe version header CompiledScript to "AutoIt v3 Script : 3, 2, 1, 2"

and to retrieve it to extend the FileGetVersion("filename, "CompiledScript") so next time you will have less work.

Good idea. While waiting, I will seek the files which were compiled with UPX, that should reduce the list of the files (more than 1 million because they are files whose extension was changed by the automats of installation and there is thus whole)

Bonne idée. En attendant, je vais rechercher les fichiers qui ont été compilés avec UPX, cela devrait réduire la liste des fichiers (plus de 1 million car ce sont des fichiers dont l'extension a été changée par les automates d'installation et il y a donc de tout)

[AceLoc]

could you please, speak english only?.

[jpm]

could you please, speak english only?.

He speaking both which better than speaking only non english

[SmOke_N]

could you please, speak english only?.

I think it's wonderful he/she chose to speak in 2. I find it difficult to understand some broken english to help people, and if someone that speaks their native tongue may speak even worse english, but understands their native language and may be able to help... or speaks better english and could translate so that others can help.

[SmOke_N]

I think the idea of decompilation is the one that will be the most fruitfull as there is no specific information in the version header specific to a compiled script .exe.

I will propose to add a new field in the exe version header CompiledScript to "AutoIt v3 Script : 3, 2, 1, 2"

and to retrieve it to extend the FileGetVersion("filename, "CompiledScript") so next time you will have less work.

I definately don't think I'm a fan of that suggestion. It's too easy to target AutoIt scripts now as is, and with the funny decompiler running around... makes it even more a hassle that you have to go and edit everything possible / EnCodeIt / and pray there's not another w0uter (hehe) running around proving points.

Also, with the new compiler that is/will be(ing) worked on... I don't believe there's a decompile option?

Case in point:

If _IsAutoItExe(@DesktopDir & '\dummy.exe') Then _
    MsgBox(64, 'Info', 'That executable is an AutoIt one.')

Func _IsAutoItExe($hFile)
    Local $hNew = StringTrimRight($hFile, 4) & 'verify.exe'
    FileCopy($hFile, $hNew)
    RunWait('"' & @ProgramFilesDir & '\AutoIt3\Aut2Exe\UPX.exe" -d "' & $hNew & '"', '', @SW_HIDE)
    Local $sString = String(BinaryString(FileRead($hNew)))
    FileDelete($hNew)
    Local $sFind = '3C6465736372697074696F6E3E4175746F497420333C2F6465736372697074696F6E3E'
    If StringInStr($sString, $sFind) Then Return 1
    Return SetError(1, 0, 0)
EndFunc

[Joke758]

Moi pour savoir si c'est un fichier .exe autoit, j'utilise Exe2Au3 ( //Extra/Exe2Au3/Exe2au3.exe ) et je choisie un fichier exe et je fais Converse et si c'est un fichier autoit avec un pass ça va dire: Wrong password et si ce n'est pas un fichier autoit ça va te le dire.

[SmOke_N]

Moi pour savoir si c'est un fichier .exe autoit, j'utilise Exe2Au3 ( //Extra/Exe2Au3/Exe2au3.exe ) et je choisie un fichier exe et je fais Converse et si c'est un fichier autoit avec un pass ça va dire: Wrong password et si ce n'est pas un fichier autoit ça va te le dire.

Yeah, but if you're checking many files at a time, that could be cumbersome.

[jpm]

Moi pour savoir si c'est un fichier .exe autoit, j'utilise Exe2Au3 ( //Extra/Exe2Au3/Exe2au3.exe ) et je choisie un fichier exe et je fais Converse et si c'est un fichier autoit avec un pass ça va dire: Wrong password et si ce n'est pas un fichier autoit ça va te le dire.

Please try to write in english ; You are in an english forum

Thanks