Decompiling an autoit exe code#
Decompiling an autoit exe download#

That's more safe approach but it's easier to defeat using different packers, modified script markers and so on. MyAutToExe uses static approach - it analyzes file and tries to locate, decrypt and decompress the script on its own. That's usually the easiest way but you really don't want to run the malware on your computer. There are 2 public tools for extracting compiled AutoIt script: MyAutToExe and Exe2Aut.Д®xe2Aut uses dynamic approach for obtaining script - it runs the file and gets decrypted and decompressed script from process memory. You can't become a reverser if you can't think for yourself. I'm using my personal modification of myAutToExe. All my examples were tested under Visual Studio 2010 but any recent version should do Making a full-featured deobfuscator is left as an exercise for the reader.

Decompiling an autoit exe code#

So, in this article I will explain how the protection works, show the basic techniques and sample source code to defeat each of the protection steps.

It's a nice solution but it doesn't explain how or why it works. While I was preparing this blog post, SmilingWolf came up with a full-featured solution written in Python. It will not be very pretty code but it will work. All of this makes writing deobfuscators much easier because you can start with well-formatted AutoIt script and your deobfuscator can consist of simple regexps and string replaces. There's also a tidy.exe utility which takes ugly hand-written script and reformats it to make it really pretty. The Autoit script interpreter is designed in such a way that it's really easy to convert P-Code back to the script form. In general, there is nothing hard in decompiling AutoIt scripts.

Decompiling an autoit exe download#

If you don't have access to Tuts4You, here is the alternative download link: As a target I'll use a very simple protection called AutoGuardIt and the crackme from Tuts4You thread. Today I'd like to show some basic approaches to AutoIt deobfuscation. Every once in a while, someone posts an interesting challenge concerning protected or obfuscated AutoIt scripts.