Possible Way to secure Au3 Exes

[Grayhat]

I was just thinking, and even tried to do but unsuccessful.

I compiled and au3 sctipt into exe.

Then, I got the a3x part (real encrypted script appended to autoItSC.bin file) and encrypted it.

Then, I Injected a DLL into the AutoItSc.bin to hook the "ReadFile" function, and don't just read the file, but Read, Decrypt and run script.

It didn't work with big scripts, but, for my own surprise, did with a simple "MsgBox()" that wouldn't be decompiled!

This fact gives me hope, for, maybe onde day, we can possibly secure the autoIt Compiled exe files

Best regards,

busTer

[Valik]

If the code has to be decrypted to be run then it's insecure, period.

Encryption is not the solution.

[Grayhat]

If the code has to be decrypted to be run then it's insecure, period.

Encryption is not the solution.

Yes, it isn't but, is so harder to get the pass from a CPP Dll than an au3 script that you just drag into a 3rd party decompiler and get all source in a sec.

[Valik]

Yes, it isn't but, is so harder to get the pass from a CPP Dll than an au3 script that you just drag into a 3rd party decompiler and get all source in a sec.

No it isn't. It only appears harder because somebody hasn't taken 5 minutes to write a tool to do it.

[John]

Valik is right. That dll you injected would be the key to pull out and redirect the output to a standard AutoIt decompiler. It would not even require having to figure out the encryption scheme used by the dll.

[jvanegmond]

Rather than trying to work around the problem, attack the problem at its root.

[Grayhat]

Rather than trying to work around the problem, attack the problem at its root.

And it's root is?

[jvanegmond]

And it's root is?

[.. try to realize the truth ..] There is no compiler.

[Richard Robertson]

[.. try to realize the truth ..] There is no compiler.

Your movie quotes won't save you now.

[GEOSoft]

Does anyone besides me ever get tired of "SECURITY" comments/percieved issues?

Give it to a dedicated hacker long enough for him to put it through a hex editor and your security went right out the door anyway; it makes no difference what method you used. The best that can happen is you can make yourself feel your code is safer.

[Valik]

I grow weary. I especially grow weary of everything trying to tell us how to secure our software or telling us our software is insecure.

[GEOSoft]

H**l, it's no more insecure than any other software.