I found a security hole in the compiler

[iamtheky]

even if i will do the trick with NotePad++ ?

 

 

but if you're already in notepad++ you can just scroll to the bottom and read, no need for the 'trick'

Edited August 15, 2013 by boththose

[Guest]

Because everyone enjoys doing this.

Try with another application and this one will also have an unexpected behavior.

but there is no way to change this root error massge to something like "my script Error" ?

[Edano]

i tell you the story of a car navigation software i wrote in several languages, and an australian mailed me that the exe failed with an autoit error. i don't remember the exact error anymore, but it was because of a different keyboard layout and the code page, i could have never ever forseen that.

[Guest]

i tell you the story of a car navigation software i wrote in several languages, and an australian mailed me that the exe failed with an autoit error. i don't remember the exact error anymore, but it was because of a different keyboard layout and the code page, i could have never ever forseen that.

In addition to what Edano said, I think there is another way to get this root autoit error massage.

Imagine a case that a user downloaded the exe file but the exe file didn't fully downloaded.

in this case i think that this error massage will also show to the user.

Edited August 15, 2013 by Guest

[jchd]

This thread is a joke.

[Edano]

hmm - no ... ?

[jchd]

Then noone here has a clue about what a security hole is.

[Guest]

Then noone here has a clue about what a security hole is.

 

ok so it is not security hole if you say but it is still can be a problem..

 

[jchd]

Which problem exactly?

[Guest]

Which problem exactly?

 

reed for example Edano posts.

But maybe that's not a problem ..

Anyway, i do not really care about it.

Edited August 15, 2013 by Guest

[Gianni]

if you want to know if an exe was made with autoit, there is not need to modify the executable, you can use this:

or this:

[Blue_Drache]

So ... there was this Oozlum bird?  In this one thread?

[jchd]

It's obvious that you (or someone else savvy enough) can detect which language was used as source, which version of which compiler and a large number of pointless such details.

Can this help in reverse-engineering software? Clearly.

What can be done against that? Zilch, nada, nothing useful.

Do you care? You say not at all.

Is this a problem? No.

Is this thread a joke? Yes.

Edited August 16, 2013 by jchd

[BrewManNH]

Every single compiled AU3 script has this at the end of it "AU3!EA06" (or a minor variation of it depending upon version of the Au2Exe compiler). The only ones that don't have been compressed with UPX, and that's no protection at all.

[Bert]

I read the entire thread and this seems to me this "problem" is on the same level as this:

There is a person who has got a great big lawn and somebody who walks down the street (doesn't even live in the neighborhood) is complaining to anyone who will listen MONTHS LATER about one blade of grass that is not turned the right direction when they look at the lawn in the afternoon on a Tuesday (May 14th) @ exactly 3:42Pm.

[orbs]

what i read from the OP means a slightly different story then YogiBear suggests:

a guy walks into a cafe, orders some coffee with brown sugar. the waiter goes away, then suddenly an unfamiliar person is shouting at the guy: "HEY! GET LOST! THERE IS NO BROWN SUGAR!". the guy's girlfriend panics, the guy gets mad and punches the cafe owner in the nose.

now, if the shouting person would wear the cafe waiters uniform, and avoid shouting...

the cafe uniform = the uniform of the place the guy knows he entered = the name of the application the user knows he launched.

the cafe owner who gets punched in the nose = the developer who gets users feedback

none of us wants to be in the cafe owner side; so i second the suggestion to replace "AutoIt" with the application name in such msgbox's.

now, that Oozlum bird is getting really really out of sight...

[FireFox]

now, that Oozlum bird is getting really really out of sight...

It was really predictable.

Edit: I was it going away from the first post.

Edited August 16, 2013 by FireFox

[JohnOne]

If the error message were to appear to come from user script name, It would be less than accurate.

I have no strong opinions about it really,  but I have not seen a single reason I would consider valid to make such a change.

Also think about this, if autoit interpreter cannot open user script, how exactly would it know the title of it?

[orbs]

if autoit interpreter cannot open user script, how exactly would it know the title of it?

 

au3 script has no "title", the intention is to use the exe file name.

 

I have not seen a single reason I would consider valid to make such a change.

 

reason 1: so the user knows from which application the error message is coming. if you have several exe's running, then providing the exe name is a good start for troubleshooting. and even more so if you have several compiled AutoIt exe's running.

reason 2: although this is far from being AutoIt fault, or relevant in anyway, and happily in decrease, the name resembles the autoit worm which swarmed the web few years back. you don't want to scare your users, do you?

[Mobius]

Jeez op just modify the 'AutoIt Error' and 'unable to open the script' references that are stored in the STRINGTABLE resources of the interpreter if you are really that concerned.

Security hole, what a joke.