.a3x Demo

[Skysnake]

Several questions around the forum get asked repeatedly:

1. How to avoid false-positive Anti-Virus detection? Answered by AutoIt god himself
2. How to make AutoIt software safe from hacking?
3. How to prevent AutoIt software being de-compiled?
4. How to prevent exposure of native AutoIt code?

The general answers all go in the direction of (a) can't be done or (b) make it an .a3x script.

The Wiki contains a single entry under "compiler directives" and the Help File  contains mainly compiler info, with this note

Quote

Note: Scripts can be compiled with .a3x extension. They should be run with AutoIt.exe filename.a3x. The .a3x contains the script itself with all referred #include plus the FileInstall files. This format allows you to distribute smaller files as they don't include the AutoIt3.exe in each compiled script. You still need to have it accessible on the target machine but just AutoIt3.exe.

 

 

Also see this thread.

 

So I thought I would make a little demo to actually show how it works.

Here are the 2 scripts.  The a3x_demo.zip file contains these 2, plus the compiled .a3x file and the .EXE

 

The body

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Outfile_type=a3x
#AutoIt3Wrapper_Outfile=a3x_demo.a3x
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#cs ----------------------------------------------------------------------------

    AutoIt Version: 3.3.14.2
    Author:         Skysnake

    Script Function:
    Demonstates working of a3x

    Instructions

    Code as normal
    Set Compiler option to .a3x as per Help File
    Compile
    Note output is (a) .a3x file,
    (b) now compile wrapper to make .exe file

    The compiled .a3x is included inside the .exe.

    To demonstrate, copy .exe to any new location and run. :)



#ce ----------------------------------------------------------------------------


; Script Start
#include <MsgBoxConstants.au3>

MsgBox($MB_SYSTEMMODAL, "a3x demo", "This message box is called from an a3x pre-compiled script " & @CRLF & "will timeout after 10 seconds or select the OK button.", 10)

; code ends

 

The wrapper

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Outfile=a3x_wrapper.exe
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#cs ----------------------------------------------------------------------------

    AutoIt Version: 3.3.14.2
    Author:         Skysnake

    Script Function:
    Wrapper for .a3x demo

    the INCLUDE line below forces the .a3x to be included in the new .EXE

    other option is to use FileIsntall and then run the a3x_demo.a3x as an
    external file

    NOTE: required in order are the following steps
    1. body .au3 script
    2. compile body .au3 as .a3x file, include in wrapper
    3. wrapper .au3 script, to become the .exe -> compile as .EXE


#ce ----------------------------------------------------------------------------

; Script Start -

#include "a3x_demo.a3x"

; code ends

DOWNLOAD: The ax3_demo.zip file

 

EDIT:

2016.07.08 Fixed typos

Edited July 8, 2016 by Skysnake
added a link

[argumentum]

I've done some malicious testing  and this technique does not do much, I was hoping it did  

[Skysnake]

Dear @argumentum I am not sure how to interpret your response.  

This little demo was so supposed to show exactly how an .au3 file becomes an .a3x file and gets included in an .EXE.

AFAIK this is the only complete example in the Forum.  Thank you for reading.

 

Edited July 8, 2016 by Skysnake
Typo

[nend]

I've tryed it because I has a program made in Autoit wich is use by a lot of people and I get a lot "False Positive".

It takes with every update about 3 weeks to report it to al virusscan company, because a lot of them reply very slow on these reports.

What I've discovered is that a lot of scanners stil mark it as virus when I use a3x file packed in a exe file but it are less then usally.

But I think it's a matter of time before viruscan company marks this way as virus as well.

 

Thanks for showing how to do this.

[Skysnake]

@nend thank you kindly

[orbs]

@Skysnake,

it is understood that what this topic is all about is a demonstration of how to make a3x file distributable.

however, as for the reasons for doing so, i side with @argumentum here. in respect to the reasons you mention - it works, but does not do much. here's how:

On 7/7/2016 at 1:27 PM, Skysnake said:

How to avoid false-positive Anti-Virus detection?

working with your demo, i compiled it to exe directly (commented-out the wrapper directives). then i uploaded the directly-compiled exe to VirusTotal, as well as your pre-compiled wrapper using a3x.

links:     directly compiled     compiled using a3x

results:

directly compiled:

Antivirus	Result	Update
Antiy-AVL	Trojan/Generic.ASVCS3S.1E5	20160719
McAfee-GW-Edition	BehavesLike.Win32.Downloader.ch	20160719
Qihoo-360	QVM10.1.Malware.Gen	20160719

compiled using a3x:

Antivirus	Result	Update
Antiy-AVL	Trojan/Generic.ASVCS3S.1E5	20160719
McAfee-GW-Edition	BehavesLike.Win32.Downloader.ch	20160719

so there is some improvement. more interestingly, in addition to current observation (above), i think it should prove interesting to follow those links and re-scan from time to time.

 

as for the other 3 reasons you gave -

1) is it just me, or these are all rephrasing the same concept? 

2) the wrapped a3x and directly-compiled exe are both equally unprotected.

[Skysnake]

Dear @orbs, I could not find a complete example, so I made one and demonstrated it.

As to all your other comments, I did not intend, nor suggest that I could solve these.  The point was to show how it works.  The reasons why these problems remain fall beyond the scope of this demo.  I will admit that these appear valid, but are inherently part of the package we use, and beyond the scope of this example.

What is mentioned in some posts is to (a) install AutoIt, and then (b) run the .a3x as a stand-alone file using the AutoIt interpreter.  In this way the .a3x file escapes detection.  This is suggested to be the preferred option. Perhaps you want to run your virus scan like this?

Thank you.

 

Edited July 20, 2016 by Skysnake
typo

[Skysnake]

I was thinking about all of this.

Somewhere @Melba23 uses the term "the .a3x file is tokenised" and I was wondering how far that tokenised file is form being binary?  If we can get the tokenised file converted to binary, would that solve the problems mentioned above?  

 

[Graeme]

This is good as far as it goes, but I'm wondering if you can give an example of running an A3x script with another compiled script?

Run(@ScriptDir & "BasicRunProgram.exe" ,"FileToruna3x.a3x")

I don't want to insert the a3x file, but run different a3x files in different places with the same compiled script... Is that possible? It sounds like it from the help file but I can't find, after quite a bit of searching, an example.

Thanks for reading.

[Melba23]

Graeme,

Look in the Help file under <Using AutoIt - Running Scripts - AutoIt specific command Line Switches - Run a script using another compiled script>. You run the .a3x files just as you would an standard .au3 file - the "Important Notes" section at the end of the page even suggests that this is the preferred method (and also explains why), as well as what you need to do to the master executable to ensure that it is permitted to run external scripts.

M23

 

[Graeme]

Dear Melba,

Thanks for your comments but sadly I had already seen that help file and not been able to make anything work. As well I was surprised that you said, just as you would a standard .au3 file. I've never run a standard au3 file other than by compiling it and running the exe file or from within the editor. This is why I was hoping for an example.

[Melba23]

Graeme,

Here are 3 files:

Example.exe is this script compiled to exe:

#pragma compile(AutoItExecuteAllowed, True)

Run("Example.exe /AutoIt3ExecuteScript Script.au3")

Run ("Example.exe /AutoIt3ExecuteScript Script.a3x")

Script.a3x is this script compiled to a3x:

#include <MsgBoxConstants.au3>

MsgBox($MB_SYSTEMMODAL, "Example", "Compiled a3x script")

Script.au3 is this script left as text:

; Note no include file n the au3 script as it will not necessarily be available

MsgBox(4096, "Example", "au3 script") ; So we need magic numbers instead

Run Example.exe and you will see the 2 MsgBoxes appear. Note that the .a3x file automatically includes the required MsgBoxConstants file when compiled - if you try running the same script as an .au3 file you are likely to get an error.

M23

Edited January 24, 2017 by Melba23
Added more detail

[Graeme]

Thanks so much!!

Graeme

[Melba23]

Graeme,

My pleasure as always.

M23

[Graeme]

So now I'm using a3x files to get around the AV problem... I'm doing this by compiling my au3 files as a3x files and running them with

Run("C:\Program Files (x86)\QA\AutoIT3.exe" Example.a3x)

This works fine. The only problem I have is that whereas before I could use

if processexists("example.exe") do stuff

now I have several instances of autoit3.exe in the process lists and I can't find out how to distinguish between them... Is there a way?

Blessings

[Jos]

Sure, I see 2 options:

1. Use the _Singleton function with a unique name for each script
2. Use the hidden window of each AutoIt3 session and set it to a unique name, which you then can test with WinExist()

Jos

[Graeme]

Thanks Jos!

Blessings

[Graeme]

Sorry, I think I'm a bit simple.

I tried to use the Singleton idea. I looked at the help and couldn't see how to set the string to identify the occurrence. I tried the name of the script and the name of the script without the extension but neither worked.

Blessings

[Jos]

Not sure what you have done so give me a example of the script how you coded the _Singleton() logic.

Jos

[argumentum]

12 hours ago, Graeme said:

Sorry, I think I'm a bit simple.

#include <Array.au3>
Global $sTitle = "let's call this a title, identifier, whatnot"
AutoItWinSetTitle($sTitle & Chr(1) & @AutoItPID)
Local $b, $n, $aMyScripts = WinList("[TITLE:" & $sTitle & ";CLASS:AutoIt v3;]")
ReDim $aMyScripts[UBound($aMyScripts)][3]
$aMyScripts[0][1] = "$hWindow"
$aMyScripts[0][2] = "@AutoItPID"
For $n = 1 To $aMyScripts[0][0]
    $b = StringSplit($aMyScripts[$n][0], Chr(1))
    $aMyScripts[$n][0] = $b[1]
    $aMyScripts[$n][2] = $b[2]
Next
_ArrayDisplay($aMyScripts, "this way you can ProcessClose(@AutoItPID) or WinKill($hWindow)")

; also
If WinExists($sTitle) Then Exit 123

That's it   =)

Edited April 21, 2017 by argumentum
more ideas :)