coreng Posted June 25, 2014 Share Posted June 25, 2014 Hello everyone. As many of you already know, AutoIt comes with somewhat of a downside, as mentioned here. I am currently working for an antivirus company and trust me when I say that we really go the extra mile to avoid false positives. There is however one thing that's been slowing down our progress considerably -- we're missing the official grammar for AutoIt (i.e. we are trying to reconstruct the grammar from the documentation but the documentation is not sufficient to determinately define the language). This has the considerable impact that parsing AutoIt scripts for malware is not as reliable as it could and should be. It's not unlikely that there will be a wave of new false-positives in AutoIt scripts if there are errors in the grammar definition file. I was wondering whether or not we could get a copy of AutoIt's grammar definition. Lex, YACC, Bison, whatever AutoIt uses will work. Best regards P.S. I tried emailing avsupport as suggested in compiled AutoIt binary files, but I have yet to receive a response. Link to comment Share on other sites More sharing options...
jpm Posted June 25, 2014 Share Posted June 25, 2014 (edited) Perhaps Jon can give you a copy of what is used in Au3Check as AutoIt is not based of stuff as Lex, YACC, bison ... Edited June 25, 2014 by jpm Link to comment Share on other sites More sharing options...
coreng Posted June 25, 2014 Author Share Posted June 25, 2014 (edited) Perhaps Jon can give you a copy of what is used in Au3Check as AutoIt is not based of stuff as Lex, YACC, bison ... That would be fantastic. As I mentioned earlier right now we're trying to base the grammar entirely on the documentation, so any official definition will allow us to create a 'proper' grammar file. Edit/side question: Is Au3check capable of detecting syntax errors within EXECUTE? i.e. Execute(binarytostring("0x" & hex("In valid assignment = bla bla bla"))) Edited June 25, 2014 by coreng Link to comment Share on other sites More sharing options...
jpm Posted June 25, 2014 Share Posted June 25, 2014 Just try for execute(...) but I don't think so if it is a valid expression Use the Scite editor to exercise the Au3check if you watto visualize easily the output Link to comment Share on other sites More sharing options...
jchd Posted June 25, 2014 Share Posted June 25, 2014 (edited) For Au3Check to determine validity of executed strings in the general case, it would require nothing less than executing the script since the argument can be any dynamically built expression, including function calls or return from external programs. Validity check on only literal strings is probably beyond Au3Check goal and not worth the pain since: 1) fixed strings could be simple AutoIt expressions on their own: $a = Execute("$i+1") is equivalent to $a = $i+1 2) it could be circumvented very easily. Edited June 25, 2014 by jchd This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe hereRegExp tutorial: enough to get startedPCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta. SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt) Link to comment Share on other sites More sharing options...
coreng Posted June 26, 2014 Author Share Posted June 26, 2014 Hey guys, any chance for an update on this? Is there an easy way to get in touch with Jon regarding the grammar files? Link to comment Share on other sites More sharing options...
JohnOne Posted June 26, 2014 Share Posted June 26, 2014 You could leave your official company email address here. AutoIt Absolute Beginners Require a serial Pause Script Video Tutorials by Morthawt ipify Monkey's are, like, natures humans. Link to comment Share on other sites More sharing options...
czardas Posted June 26, 2014 Share Posted June 26, 2014 I thank you for taking this initiative and hope that something positive comes from it. If you don't mind me asking, which AV company do you work for? operator64 ArrayWorkshop Link to comment Share on other sites More sharing options...
coreng Posted June 26, 2014 Author Share Posted June 26, 2014 (edited) You could leave your official company email address here. Throestur.Thorarensen (x) CYREN.com -- please be in touch. (This should also address czardas' question). Edited June 26, 2014 by coreng Link to comment Share on other sites More sharing options...
Richard Robertson Posted June 26, 2014 Share Posted June 26, 2014 Jon's usually pretty busy so give him a few business days. It's nice to see an AV willing to process scripts instead of blindly locking all of them though. Link to comment Share on other sites More sharing options...
JohnOne Posted June 26, 2014 Share Posted June 26, 2014 Agreed. AutoIt Absolute Beginners Require a serial Pause Script Video Tutorials by Morthawt ipify Monkey's are, like, natures humans. Link to comment Share on other sites More sharing options...
jpm Posted June 26, 2014 Share Posted June 26, 2014 Hey guys, any chance for an update on this? Is there an easy way to get in touch with Jon regarding the grammar files? email him to support@autoitscript.com Link to comment Share on other sites More sharing options...
coreng Posted July 7, 2014 Author Share Posted July 7, 2014 Does he ever check any of his emails? Link to comment Share on other sites More sharing options...
Moderators Melba23 Posted July 7, 2014 Moderators Share Posted July 7, 2014 coreng,It can often take a while to contact him - and I know he is very busy at the moment. Please be patient - I will try and see if I can do anything. M23 Any of my own code posted anywhere on the forum is available for use by others without any restriction of any kind Open spoiler to see my UDFs: Spoiler ArrayMultiColSort ---- Sort arrays on multiple columnsChooseFileFolder ---- Single and multiple selections from specified path treeview listingDate_Time_Convert -- Easily convert date/time formats, including the language usedExtMsgBox --------- A highly customisable replacement for MsgBoxGUIExtender -------- Extend and retract multiple sections within a GUIGUIFrame ---------- Subdivide GUIs into many adjustable framesGUIListViewEx ------- Insert, delete, move, drag, sort, edit and colour ListView itemsGUITreeViewEx ------ Check/clear parent and child checkboxes in a TreeViewMarquee ----------- Scrolling tickertape GUIsNoFocusLines ------- Remove the dotted focus lines from buttons, sliders, radios and checkboxesNotify ------------- Small notifications on the edge of the displayScrollbars ----------Automatically sized scrollbars with a single commandStringSize ---------- Automatically size controls to fit textToast -------------- Small GUIs which pop out of the notification area Link to comment Share on other sites More sharing options...
Administrators Jon Posted July 7, 2014 Administrators Share Posted July 7, 2014 Emailed. coreng 1 Deployment Blog: https://www.autoitconsulting.com/site/blog/ SCCM SDK Programming: https://www.autoitconsulting.com/site/sccm-sdk/ Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now