Software Armoring Tools Verses AutoIt3

[Mobius]

Official S.A.T.V.A site link

satva.chm.zip

Sorry cannot restore this thread to its former state due to technical difficulties.

Information contained is to be considered ancient, results vary greatly in todays climate.

Also distributed with AutoCamo for the hell of it.

Edited July 12, 2013 by Mobius

[FuryCell]

Nice you took the time to make this list. Thanks For Sharing >_

[Mobius]

Thanks P5ych0Gigabyte, >_

Edited November 20, 2009 by Mobius

[AdmiralAlkex]

Interesting thread, but what do "Old binaries" mean?

[Mobius]

Interesting thread, but what do "Old binaries" mean?

Hey AdmiralAlkex,

I shall amend that to something better now, a tool marked with this is very old, the Win32 PE format is not supported by it.

Ed: simply removed it, it is enough to know that the tool does not work with the Au3 Interpreter.

Edited August 16, 2009 by Mobius

[AdmiralAlkex]

@Mobius

Cool, that was actually my guess but I just had to ask to make sure >_<

[Mobius]

Thanks for pointing that out for me AdmiralAlkex, it was kind of lacking in clarity. >_<

Vlad

[trancexx]

Thanks for pointing that out for me AdmiralAlkex, it was kind of lacking in clarity. >_<

Vlad

So I'm a complete noob. Could you explain to me what's the point of using any of those tools if I write AutoIt scripts (and compile them)?

Please use more than one sentence and explain even if you think things are obvious.

Question is actually serious and I would like that you answer in that manner.

Btw, here's what confuses me. Why was Valik's permission needed? Because of the usage of the word concatenate?

edit: eng.

Edited August 17, 2009 by trancexx

[Melba23]

Mobius,

Thank you for taking the time to do this research. Facinating to see the different abilities and (where applicable) varying size reduction of the various utilities.

M23

[Mobius]

Mobius,

Thank you for taking the time to do this research. Facinating to see the different abilities and (where applicable) varying size reduction of the various utilities.

M23

Hiya Melba23,

I am glad you found some of this information useful, there is much more to come though, as well as a chm document once I have all the data collated and confirmed.

Each of these programs (and the many I have not yet added) differ from one another in both complexity and functionality, Much more so than I can effectively fit into that crappy table format. >_<

Thank you for the positive comments dude.

Respect

Vlad

Edited August 17, 2009 by Mobius

[Mobius]

So I'm a comlete noob. Could you explain to me what's the point of using any of those tools if I write AutoIt scripts (and compile them)?

Please use more than one sentence and explain even if you think things are obvious.

Question is actually serious and I would like that you answer in that manner.

Btw, here's what confuses me. Why was Valik's permission needed? Because of the ussage of the word concatenate?

Sometimes Trancy me old mucka you just gotta have the balls to say....

What the Funk! >_<

Ed: why did I respond the way I did?

The arrogance of your post insulted both our intelligence.

To answer your last question....

Given the nature of the subject and some of my other work, I decided it might be wise to ask this time.

It was recommended to me to put something in here to stop people chiming about it being in the wrong forum.

Any genuine n00bs out there reading this? Why would you want to use such tools on your exe?

The answer to that question can only come from you the end user.

• Perhaps you wish to decrease the size of your final executable.
• Or you wish to deny easy access to the Resources you embed in your exe.
• You might want to take advantage of the Licensing / Trialware abilities some tools provide.
• Or countermeasures against malicious modification and unwanted attention.

To name a few of the legitimate ones. Edited August 20, 2009 by Mobius

[bluerein]

hey Mobius..

I have obsidium and never could get it to work..

what settings are you using??

cheers

[Mobius]

hey Mobius..

I have obsidium and never could get it to work..

what settings are you using??

cheers

Hi bluerein,

In obsidiums advanced tab make sure that the checkbox 'keep overlays' is checked,

and uncheck 'Control overlay access' and 'Encrypt overlays', just to test your current settings with it. >_<

if you are still having trouble then I could send you the obsidium.opf project file used in the test.

Vlad

Edited August 17, 2009 by Mobius

[bluerein]

could you pm me the opf as I cant get it to work..

Thanks >_<

[trancexx]

Any genuine n00bs out there reading this? Why would you want to use such tools on your exe?

The answer to that question can only come from you the end user.

• Perhaps you wish to decrease the size of your final executable.
• Or you wish to deny easy access to the Resources you embed in your exe.
• You might want to take advantage of the Licensing / Trialware abilities some tools provide.
• Or countermeasures against malicious modification and unwanted attention.

To name a few of the legitimate ones.

Thanks for the serious answer.

Btw, no arrogance was intended. You are projecting.

[Mobius]

Thanks for the serious answer.

Btw, no arrogance was intended. You are projecting.

trancexx,

You are not a n00b I have seen your work,

perhaps I misinterpreted your post somewhat...

or perhaps you should try and act like an adult sometimes, no matter how painful.

*Projects into trashcan*

Edited September 29, 2009 by Mobius

[Mobius]

To those interested, I finally got the Virus Total data checked and have amended it to the original list.

I would not put much faith in these online multi engine av scanners, they are part of the problem not the solution.

It is highly likely that results would vary greatly from site to site.

I have to say there were only a few surprises, but bare in mind that Av flags can mean anything per tool.

The standard unaltered Au3 binary gave 3 flags, two of those were by nobody Antivirus utils,

one of which had the cheek to spit out this terribly generic and overtly frightening flag::

High Risk Cloaked Malware

Someone pass em a packet of Heuristics... I mean Biscuits.

Last of the 3 was 'McAfee-GW-Edition' which I have to say turned up in nearly 80% of all other tests.

So what does this information mean? Nothing, not diddly shit. just a *wuff* guidepoint.

Vlad

Edited September 25, 2009 by Mobius

[Armand]

Awesome work man !!!

Will be useful !!!

[trancexx]

trancexx,

You are not a n00b I have seen your work,

perhaps I misinterpreted your post somewhat...

or perhaps you should try and act like an adult sometimes, no matter how painful.

*Projects into trashcan*

So you replied to my post - I read that. Then you edited - I read that too. Then you edited more - I read again. Then more than a month later you edited again - that I missed.

But, what's really interesting is the change of your thoughts. WOW!

If you have something to tell me next time, feel free to do it delay-free.

[Fire]

Cool Research Mobius.

Thank you very much.

Greatly appreciated.

Thanks