Jump to content

AutoCamo - 98.18b

Mobius

By Mobius,
in AutoIt Example Scripts

 Share

Recommended Posts

4Eyes Universalist

4Eyes

Posted
Posted

Mobuis,

Thanks again for helping me with this.

I updated the A3C.pref file. I also created 'XXX_camo.cfg' where XXX is the name of the script, in the @ScriptDir. In that file I spec'ed 1 image file as shown below:

A3C_IN = XXX_obfuscated.au3

A3C_KOR = 0

[A3C_RES]

BG.jpg = 10 } BG_JPG } 0 } #@BIN>

;Image2 = 10 } Jpeg_2 } 0 } #@BIN>

;Image3 = 10 } Jpeg_3 } 0 } #@BIN>

On the resources tab of A3C.exe I specified XXX_camo.cfg, hit construct but I don't see the graphic in the resultant exe file.

This is the line from the script that specifies the graphic:

#AutoIt3Wrapper_Res_File_Add=BG.jpg, rt_rcdata, BG_JPG

I assume I'm still doing something wrong.

Regards,

4Eyes

Link to comment
Share on other sites
  • Replies 227
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Mobius
Mobius

Last updated 9/10/21 * Image may not represent current product Features Simple Integrated countermeasures against file and memory analysis based decompilers. Add basic typ

Mobius
Mobius

98.18b Represents the last time we touched this product before doing other things. Although recently compiled and tested on windows 10 from a repaired archive it's still bloody old, and the

Mobius
Mobius

I suspect you suddenly stop using AutoIt when it gives av false positives without having any modifications? I am not wasting my time contacting the fools that write antivirus programs, purely because

Posted Images

Mobius Universalist

Mobius

Posted
  • Author
Posted

Mobuis,

Thanks again for helping me with this.

I updated the A3C.pref file. I also created 'XXX_camo.cfg' where XXX is the name of the script, in the @ScriptDir. In that file I spec'ed 1 image file as shown below:

A3C_IN = XXX_obfuscated.au3

A3C_KOR = 0

[A3C_RES]

BG.jpg = 10 } BG_JPG } 0 } #@BIN>

;Image2 = 10 } Jpeg_2 } 0 } #@BIN>

;Image3 = 10 } Jpeg_3 } 0 } #@BIN>

On the resources tab of A3C.exe I specified XXX_camo.cfg, hit construct but I don't see the graphic in the resultant exe file.

This is the line from the script that specifies the graphic:

#AutoIt3Wrapper_Res_File_Add=BG.jpg, rt_rcdata, BG_JPG

I assume I'm still doing something wrong.

Regards,

4Eyes

So you weren't using an already modified AutoItSC.bin file that contained your jpeg resource, you were using an AutoIt3Wrapper directive.

The example I posted was to preserve the image resource when using an already modified interpreter file that already contained that resource, but if you just wanted to add your image from a file the same as the wrapper directive you can just put:

;
[A3C_RES]
= 10 } BG_JPG } 0 } BG.jpg

The file should now be added to your output.

If you are still failing to see the image in your script, then we are going to need to see the line in your script that you are using to reference this resource.

wtfpl-badge-1.png

Link to comment
Share on other sites
4Eyes Universalist

4Eyes

Posted
Posted

Mobius,

That did it! Thanks. However, can't add a 2nd graphic. Tried:

[A3C_RES]

; Resource instructions to add to all other configs go here

= 10 } BG_JPG } 0 } BG.jpg

= 10 } BG2_JPG } 0 } BG2.jpg

and

[A3C_RES]

; Resource instructions to add to all other configs go here

= 10 } BG_JPG } 0 } BG.jpg

= 10 } BG2_JPG } 1 } BG2.jpg

Just took a stab at changing the 0 parameter to 1 for next image.

2 more things that I haven't had a real good look at yet...

1) using an input control with $ES_PASSWORD parameter and arial font, shows * characters not the expected solid dots when entering text

2) using the included graphic as a gui background where the window is NOT the size of the graphic (gui is smaller) really distorts the image with random-ish horizontal lines etc.

Both of the above points work fine when compiled without camo.

Really appreciate your help on this.

Regards,

4Eyes

Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted

Mobius,

That did it! Thanks. However, can't add a 2nd graphic. Tried:

[A3C_RES]

; Resource instructions to add to all other configs go here

= 10 } BG_JPG } 0 } BG.jpg

= 10 } BG2_JPG } 0 } BG2.jpg

I just did a crash test dummy build with those very resource instructions and found no errors reported in AutoIt3Camo's log and no errors evident when viewing the output executable with resource hacker.

Does AutoIt3Camo report anything in your log output? (If you don't want to post your log then pm it to me)

Does the image exist when you view your output with resource hacker?

Does the second image file size exceed 1 megabyte? (Internal size limit for any single resource item in AutoIt3Camo)

and

[A3C_RES]

; Resource instructions to add to all other configs go here

= 10 } BG_JPG } 0 } BG.jpg

= 10 } BG2_JPG } 1 } BG2.jpg

Just took a stab at changing the 0 parameter to 1 for next image.

Unfortunately what you are doing there is simply adding the resource with a sub language value of 1.

Here is what a resource instruction means. (reference info also embedded into executable)

[Description] = Type } Index|Name } Lang } [[#]File]

Description : Completely optional information displayed in the log when resource is added, if omitted the file parameter will be displayed.

Type : A numerical value depicting the resource type being added/deleted. In your case 10 = RCData

Index|Name : A numerical index value or a string name used when referencing your resource.

Lang : A numerical value indicating the resources 'sub language' which is unimportant in your case since you are adding images.

File : Target file to add, or target pe file to import from, or empty to delete a particular resource.

I am just curious but I notice this line in both your examples

; Resource instructions to add to all other configs go here

You are not adding those images via A3C.pref are you? or did you just copy the config section from it into your separate config file.

2 more things that I haven't had a real good look at yet...

1) using an input control with $ES_PASSWORD parameter and arial font, shows * characters not the expected solid dots when entering text

2) using the included graphic as a gui background where the window is NOT the size of the graphic (gui is smaller) really distorts the image with random-ish horizontal lines etc.

Both of the above points work fine when compiled without camo.

Really appreciate your help on this.

Regards,

4Eyes

1) Fail to see what that might have to do with AutoIt3Camo other than the possibility that you did not add the line to A3C.pref (or your config file) to preserve the xml manifest. (Total guess)

2) See 1, although what you describe sounds like image corruption due to downscaling. (Another total guess, pretties are not my thing)

I am sorry I could not be of more help to you on this, but other than the resource table elements, AutoIt3Camo does not mess with anything within the interpreter that would account for your problems.

Post or pm me a dummy executable and I might be able to figure out what is going wrong here.

Vlad

wtfpl-badge-1.png

Link to comment
Share on other sites
WinniK Seeker

WinniK

Posted
Posted (edited)

Hi Mobius,

I have a problem with your new version 20.4.

If I compile my script, the GUI hasn't a modern style like windows xp, vista or win7.

It looks like an old win95 app. And it's not possible to open a dropdown list.

If I'm using your version 17.3 all works fine.

That are the includes I'm using:

#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <StaticConstants.au3>
#include <ProgressConstants.au3>
#include <String.au3>
#include <Array.au3>
Edited by WinniK
Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted

Hi Mobius,

I have a problem with your new version 20.4.

If I compile my script, the GUI hasn't a modern style like windows xp, vista or win7.

It looks like an old win95 app. And it's not possible to open a dropdown list.

If I'm using your version 17.3 all works fine.

That are the includes I'm using:

#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <StaticConstants.au3>
#include <ProgressConstants.au3>
#include <String.au3>
#include <Array.au3>

Put the following either inside your config file or inside the correct config location within the file A3C.pref (exists in AutoIt3Camo's directory).

[A3C_RES]
Manifest=24}1}1033}#@BIN>

Or add your own xml manifest from a separate file to the interpreter. And then rebuild. That should fix everything you have mentioned.

wtfpl-badge-1.png

Link to comment
Share on other sites
WinniK Seeker

WinniK

Posted
Posted

Thank you for your help.

But the problem still persists :mellow:

I added your lines to the A3C.pref file.

And I can see it in AutoIt3Camo.

I noticed that the "bad" compiled file are ~30kb smaler than the good file from 17.3.

In the log aren't errors.

Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted

Thank you for your help.

But the problem still persists :mellow:

I added your lines to the A3C.pref file.

And I can see it in AutoIt3Camo.

I noticed that the "bad" compiled file are ~30kb smaler than the good file from 17.3.

In the log aren't errors.

Would you be willing to pm the good and bad file of which you speak?

The 30 kb difference is likely to be because of the resources that are stripped.

wtfpl-badge-1.png

Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted (edited)

AutoIt3Camo update 26.5 beta

> 64 bit compatible <

Although not tested to normal standards, compatibility is confirmed

A3C_X64 config option and related gui option '64 bit interpreter'

> Drag and drop improvements <

Up to 2 files can be dragged to the main gui icon or input edit box

with the options of all files accumilated in a similar fashion to

specifying 2 files via the commandline.

List icon fields in Resources - Execute - Version info and patches

tabs can now have a file dragged to them to load only the config

options within them that are related to that particular tab / list

icon.

> Build file path finding improved <

Less buggy (rewritten) with more default locations added, including

default program files directory.

> Unrestricted install / usage location <

The temporary compiler and interpreter files are now created in the

directory that they are found in instead of being created locally

to AutoIt3Camo.

This means that AutoIt3Camo no longer needs to be installed in a

location that is relative to the include subdirectory of AutoIt3.

> Input popup menu updated on the fly <

The menu invoked by clicking the Input button on the Main gui tab

or left/Right clicking the main gui icon is now updated as you

use the interface. So recent files and templates added will be

displayed properly.

> Resource ' Type' parameter improved <

Supports a user defined string type name.

Supports a string abbreviation instead of winapi resource type id

values. Example BMP instead of 2 or ICO instead of 14. (See help)

> Keep original resources option fixed/improved <

Previous icon and other resource problems that occured when using

this option have now been countered.

It is no longer a debugging only option and can now be used on

programs you wish to distribute.

> Delete individual resource instruction now supports icons <

When deleting an icon group resource the full icon data is now

properly removed.

> Alternate preferences file <

The file 'USR.pref' has been introduced to the package, this file

if it exists in AutoIt3Camo's directory will be searched for config

options related to the build instead of A3C.pref.

Vlad

Edited by Mobius

wtfpl-badge-1.png

Link to comment
Share on other sites
  • 2 weeks later...
Mobius Universalist

Mobius

Posted
  • Author
Posted (edited)

Thx MariusN,

Antivirus flags are always troublesome, but thier lazy asses can be fooled, here are a couple of VirusTotal scans:

A standard construct with all but a few of the default interpreter resources stripped

http://www.virustotal.com/file-scan/report.html?id=4c5fdc718dd37754962fa6825f2abce42bda9fd9daa9a367b253f7e436049405-1316256251
AhnLab-V3   2011.09.16.00   2011.09.16  -
AntiVir 7.11.14.223 2011.09.16  TR/Dropper.Gen
Antiy-AVL   2.0.3.7 2011.09.17  -
Avast   4.8.1351.0  2011.09.17  -
Avast5  5.0.677.0   2011.09.17  -
AVG 10.0.0.1190 2011.09.16  -
BitDefender 7.2 2011.09.17  -
ByteHero    1.0.0.1 2011.09.13  -
CAT-QuickHeal   11.00   2011.09.16  -
ClamAV  0.97.0.0    2011.09.17  -
Commtouch   5.3.2.6 2011.09.16  -
Comodo  10141   2011.09.17  -
DrWeb   5.0.2.03300 2011.09.17  -
Emsisoft    5.1.0.11    2011.09.17  -
eSafe   7.0.17.0    2011.09.15  -
eTrust-Vet  36.1.8566   2011.09.17  -
F-Prot  4.6.2.117   2011.09.16  -
F-Secure    9.0.16440.0 2011.09.17  -
Fortinet    4.3.370.0   2011.09.17  -
GData   22  2011.09.17  -
Ikarus  T3.1.1.107.0    2011.09.17  -
Jiangmin    13.0.900    2011.09.16  -
K7AntiVirus 9.113.5146  2011.09.16  Trojan
Kaspersky   9.0.0.837   2011.09.17  -
McAfee  5.400.0.1158    2011.09.17  -
McAfee-GW-Edition   2010.1D 2011.09.16  -
Microsoft   1.7604  2011.09.17  -
NOD32   6470    2011.09.17  -
Norman  6.07.11 2011.09.17  -
nProtect    2011-09-17.01   2011.09.17  -
Panda   10.0.3.5    2011.09.17  -
PCTools 8.0.0.5 2011.09.17  -
Prevx   3.0 2011.09.17  -
Rising  23.75.04.02 2011.09.16  -
Sophos  4.69.0  2011.09.17  -
SUPERAntiSpyware    4.40.0.1006 2011.09.17  -
Symantec    20111.2.0.82    2011.09.17  -
TheHacker   6.7.0.1.297 2011.09.15  -
TrendMicro  9.500.0.1008    2011.09.17  -
TrendMicro-HouseCall    9.500.0.1008    2011.09.17  -
VBA32   3.12.16.4   2011.09.16  -
VIPRE   10502   2011.09.17  -
ViRobot 2011.9.17.4674  2011.09.17  -
VirusBuster 14.0.217.0  2011.09.16  -

A construct with the 'keep original resources' enabled

http://www.virustotal.com/file-scan/report.html?id=6285936e216f45afccc8f92ed9d9f5de7fa508a3a5545f2e43f9b68ee909962c-1316256481
Antivirus    Version     Last Update     Result
AhnLab-V3   2011.09.16.00   2011.09.16  -
AntiVir 7.11.14.223 2011.09.16  TR/Dropper.Gen
Antiy-AVL   2.0.3.7 2011.09.17  -
Avast   4.8.1351.0  2011.09.17  -
Avast5  5.0.677.0   2011.09.17  -
AVG 10.0.0.1190 2011.09.16  -
BitDefender 7.2 2011.09.17  -
ByteHero    1.0.0.1 2011.09.13  -
CAT-QuickHeal   None    2011.09.16  -
ClamAV  0.97.0.0    2011.09.17  -
Commtouch   5.3.2.6 2011.09.16  -
Comodo  10141   2011.09.17  -
DrWeb   5.0.2.03300 2011.09.17  -
Emsisoft    5.1.0.11    2011.09.17  -
eSafe   7.0.17.0    2011.09.15  -
eTrust-Vet  36.1.8566   2011.09.17  -
F-Prot  4.6.2.117   2011.09.16  -
F-Secure    9.0.16440.0 2011.09.17  -
Fortinet    4.3.370.0   2011.09.17  -
GData   22  2011.09.17  -
Ikarus  T3.1.1.107.0    2011.09.17  -
Jiangmin    13.0.900    2011.09.16  -
K7AntiVirus 9.113.5146  2011.09.16  Trojan
Kaspersky   9.0.0.837   2011.09.17  -
McAfee  5.400.0.1158    2011.09.17  -
McAfee-GW-Edition   2010.1D 2011.09.16  -
Microsoft   1.7604  2011.09.17  -
NOD32   6470    2011.09.17  -
nProtect    2011-09-17.01   2011.09.17  -
Panda   10.0.3.5    2011.09.17  -
PCTools 8.0.0.5 2011.09.17  HeurEngine.Malautoit
Prevx   3.0 2011.09.17  -
Rising  23.75.04.02 2011.09.16  -
Sophos  4.69.0  2011.09.17  -
SUPERAntiSpyware    4.40.0.1006 2011.09.17  -
Symantec    20111.2.0.82    2011.09.17  Bloodhound.Malautoit
TheHacker   6.7.0.1.297 2011.09.15  -
TrendMicro  9.500.0.1008    2011.09.17  -
TrendMicro-HouseCall    9.500.0.1008    2011.09.17  -
VBA32   3.12.16.4   2011.09.16  -
VIPRE   10502   2011.09.17  -
ViRobot 2011.9.17.4674  2011.09.17  -
VirusBuster 14.0.217.0  2011.09.16  -

A standard construct with resources deleted plus the A3x component has been embedded into the resource table instead of attached to the tail of the interpreter. :graduated:

http://www.virustotal.com/file-scan/report.html?id=a6a0f39dcbfd62e7fef747032e5cfb30e7942403fcfb5d149fb610fc20fee77d-1316257870
Antivirus    Version     Last Update     Result
AhnLab-V3   2011.09.16.00   2011.09.16  -
AntiVir 7.11.14.223 2011.09.16  -
Antiy-AVL   2.0.3.7 2011.09.17  -
Avast   4.8.1351.0  2011.09.17  -
Avast5  5.0.677.0   2011.09.17  -
AVG 10.0.0.1190 2011.09.17  -
BitDefender 7.2 2011.09.17  -
ByteHero    1.0.0.1 2011.09.13  -
CAT-QuickHeal   11.00   2011.09.16  -
ClamAV  0.97.0.0    2011.09.17  -
Commtouch   5.3.2.6 2011.09.16  -
Comodo  10141   2011.09.17  -
DrWeb   5.0.2.03300 2011.09.17  -
Emsisoft    5.1.0.11    2011.09.17  -
eSafe   7.0.17.0    2011.09.15  -
eTrust-Vet  36.1.8566   2011.09.17  -
F-Prot  4.6.2.117   2011.09.16  -
F-Secure    9.0.16440.0 2011.09.17  -
Fortinet    4.3.370.0   2011.09.17  -
GData   22  2011.09.17  -
Ikarus  T3.1.1.107.0    2011.09.17  -
Jiangmin    13.0.900    2011.09.16  -
K7AntiVirus 9.113.5146  2011.09.16  Trojan
Kaspersky   9.0.0.837   2011.09.17  -
McAfee  5.400.0.1158    2011.09.17  -
McAfee-GW-Edition   2010.1D 2011.09.16  -
Microsoft   1.7604  2011.09.17  -
NOD32   6470    2011.09.17  -
Norman  6.07.11 2011.09.17  -
nProtect    2011-09-17.01   2011.09.17  -
Panda   10.0.3.5    2011.09.17  -
PCTools 8.0.0.5 2011.09.17  -
Prevx   3.0 2011.09.17  -
Rising  23.75.04.02 2011.09.16  -
Sophos  4.69.0  2011.09.17  -
SUPERAntiSpyware    4.40.0.1006 2011.09.17  -
Symantec    20111.2.0.82    2011.09.17  -
TheHacker   6.7.0.1.297 2011.09.15  -
TrendMicro  9.500.0.1008    2011.09.17  -
TrendMicro-HouseCall    9.500.0.1008    2011.09.17  -
VBA32   3.12.16.4   2011.09.16  -
VIPRE   10502   2011.09.17  -
ViRobot 2011.9.17.4674  2011.09.17  -
VirusBuster 14.0.217.0  2011.09.16  -
Edited by Mobius

wtfpl-badge-1.png

Link to comment
Share on other sites
  • 2 weeks later...
WhiteLion Seeker

WhiteLion

Posted
Posted (edited)

hi again mobius....

I ve a short question:

is there a way to use a3c for 64bit scripts ?

would be great to support that.

EDIT: oh I saw the post on top of this page about 64bit.

but I am unsure if that means full support of 64 (I am using 64bit api calls and pointer calcuation done by script).

is that supported ?

Edited by WhiteLion
Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted

hi again mobius....

I ve a short question:

is there a way to use a3c for 64bit scripts ?

would be great to support that.

EDIT: oh I saw the post on top of this page about 64bit.

but I am unsure if that means full support of 64 (I am using 64bit api calls and pointer calcuation done by script).

is that supported ?

Hello again WhiteLion,

It is supported in that A3C does nothing (that I am aware of) that would prevent or mess up 64 bit specific instructions.

To build a 64 bit AutoIt3 Executable:

  • Tick the '64 bit Interpreter' option under the construction group in the options tab.
or
  • Add 'A3C_X64=1' to the main (ungrouped) options segment within your config/script
During construction A3c will attempt to use the 64 bit interpreter file instead of 32 bit.

Vlad

wtfpl-badge-1.png

Link to comment
Share on other sites
Mobius Universalist

Mobius

Posted
  • Author
Posted

oh thanx again for your fast answer :graduated:

everything worked will with 64bit wrapping ;)

but I think I found a bug ... when I used the batch to load my settings on 64bit

I got a loop with the cmd/batchwindow ... I can send you the batch-settings by pm

if you want it...

Hmmm, a loop you say? That does not sound good, sure I would like to take a look at your batch config via pm.

I am just curious why you use the quicklaunch batch option instead of a config file or embedded options inside a script file?

I never could justify to myself why I added those quicklaunch thingies in the save settings options, The au3 file variant was okay since you could save directly to them once opened without choosing 'Quicklaunch -> AutoIt3 Script' to save, but the batch files cannot be saved to without choosing 'Quicklaunch -> Batch file' every time.

Plus they are flawed in other ways such as entering a relative input script file path meant that the quicklaunch bat/au3 needed to be relative to the product you are building, which really defies the point of them. (Having a full (static or macroed) input file path means they can be saved anywhere)

I was actually considering removing them when next I worked on A3C.

Vlad

wtfpl-badge-1.png

Link to comment
Share on other sites
  • Mobius changed the title to AutoCamo - 98.18b

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...