Dump Source Code of Compiled Script (VIA Design)

[ViciousXUSMC]

Every mod just rushed in here to lock the thread

Not talking about breaking the rules, I have a honest question.

 

I am guilty in the past of creating something that became a big part of the organization, and while I try to keep track of all my source code .au3 files and for the most part key the .exe and .au3 together.  Sometimes the .exe ends up all by itself somewhere and it needs to be updated.

I was curious if there is a way to write the entire .exe or a specific line in the .exe to a file via code, so that I can have a specific parameter  that can turn on that feature and have the .exe dump a new .au3 source code file.

I mean I suppose worst case I can literally have a copy of the entire .au3 at the bottom as a string with a variable but that seems very crude.  I was looking for something more streamline.

 

Looking to really get two features out of this.

 

1.) Dump a new .au3 out of a .exe as mentioned above

2.) If a .exe starts to hang or fail for some reason if it can be writing to a file line by line as it runs, the "log file" will show the last line of code before it hung/crashed to help with debugging.

 

Feel free to chime in with ideas or concepts.

 

I am currently looking to start putting more debug type features in what I write (very much along the lines of my last thread asking about coding best practices)

[BrewManNH]

If StringInStr($CmdLineRaw, "/extract") Then
    FileInstall(@ScriptFullPath, @ScriptDir & "\Source.au3")
EndIf

This is one way that I do it.

If you want the whole script including the #includes, run AU3Stripper with the /SO or /MO options. Then you can FileInstall the stripped file with the relevant functions included.

Edited May 17, 2019 by BrewManNH
function name typo

[Exit]

Or use 

#AutoIt3Wrapper_Res_SaveSource=                 ;(Y/N) Save a copy of the Script_source in the EXE resources. Default=N
; If _Res_SaveSource=Y the content of Script_source depends on the _Run_Au3Stripper and #Au3Stripper_parameters directives:
;    If _Run_Au3Stripper=Y then
;        If #Au3Stripper_parameters=/STRIPONLY then Script_source is stripped script & stripped includes
;        If #Au3Stripper_parameters=/STRIPONLYINCLUDES then Script_source is original script & stripped includes
;       With any other parameters, the SaveSource directive is ignored as obfuscation is intended to protect the source
;   If _Run_Au3Stripper=N or is not set then
;       Scriptsource is original script only
; AutoIt3Wrapper indicates the SaveSource action taken in the SciTE console during compilation
; See SciTE4AutoIt3 Helpfile for more detail on Au3Stripper parameters
;

 

[BrewManNH]

I'd forgotten that one.

[ViciousXUSMC]

Thanks guys, both look like perfect viable solutions.

Also learned that I should use $CMDLineRaw I was looping through the array of the other parameters not even knowing there was a string with all the values.

[rudi]

Hi,

I think it's allowed to jump in with a additional question on this topic:

 

I regularly make use of saving the script sources to the EXE file and currently <snip>

 

I was also wondering, if it might be possible to make the Autoit Script itself to "extract" the source AU3 file from RCData/999/1031 to e.g. @scriptfullpath.au3-dump

 

 

Edited May 20, 2019 by JLogan3o13

[JLogan3o13]

@rudi First off, use of third party tools to reach source code is not something we are going to discuss (should be common sense).

As for whether it is possible to make the script itself extract the source, did you not read the suggestions given??

[rudi]

@JLogan3o13 please note, that I'm asking to get hold of the source code, that intentionally and explicitely was included in the EXE file.

 

I definitely did not and will never ask for *DECOMPILING* an autoit script, which does *NOT* include the souce code by using this Feature "Save a copy of the Scriptsource in the Output program resources".

 

Of course I did read the methods mentioned above, I use them already, but IMHO they are not really convenient to use.

 

Rudi.

[Jos]

32 minutes ago, rudi said:

IMHO they are not really convenient to use.

Why is that? It is pretty straightforward I would think and gives you the original master script.

17 hours ago, rudi said:

I was also wondering, if it might be possible to make the Autoit Script itself to "extract" the source AU3 file from RCData/999/1031 to e.g. @scriptfullpath.au3-dump

Of course you can do that. Include something like I shared here and make it execute with a parameter. 

Jos

[rudi]

@Jos thanks for poining out this post that's exactly what I was looking for!

[ViciousXUSMC]

Well good solutions here. 

Not one working well for me, and it's not the solutions fault so much as the environment.

 

if I try the FileInstall() method AV immediately deletes the .exe and the file that would have been extracted.

If I try the ResSaveSource wrapper and the ResExtractSource function I found to use with it, the file is not as expected, I also do not see a RCDATA 999.  I must imagine this is due to how its being compiled and maybe I need to change some of the compile directives.

 

I'll probably just use the FileInstall() method and if we ever really need it, extract it on a machine that does not have the enterprise AV software on it.

[Jos]

 

2 minutes ago, ViciousXUSMC said:

If I try the ResSaveSource wrapper and the ResExtractSource function I found to use with it, the file is not as expected, I also do not see a RCDATA 999.  I must imagine this is due to how its being compiled and maybe I need to change some of the compile directives.

Show me the total SciTE output when compiling the script as that should give information about including the source in  the PE header.
Also show me the used directive.

Jos

[BrewManNH]

28 minutes ago, ViciousXUSMC said:

if I try the FileInstall() method AV immediately deletes the .exe and the file that would have been extracted.

You must have the world's worst AV then.

Does your AV delete other exes that use FileInstall? If not, then you're doing something different with this one. I've never had any AV flag a file because I FileInstalled the source script in it.

[Exit]

To extract the source code from an exe file with stored source code.
A small script for easy use:

; To extract the source code from a EXE file with saved source code.

#AutoIt3Wrapper_Au3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7
#AutoIt3Wrapper_Res_SaveSource=y
#include <ResourcesEx.au3>
#include <WinAPISysWin.au3>
Global $InputEXE = FileOpenDialog("Select file to extract source from", @ScriptDir, "EXE (*.EXE)", $FD_FILEMUSTEXIST, StringTrimRight(@ScriptName, 3) & "exe")
If @error Then Exit MsgBox($MB_ICONINFORMATION + $MB_TOPMOST, Default, " No source file selected.", 0)
If Not (StringRight($InputEXE, 4) = ".exe") Then Exit MsgBox($MB_ICONINFORMATION + $MB_TOPMOST, Default, " The selected source file" & @LF & @LF & $InputEXE & @LF & @LF & "is NO *.EXE file.", 0)
Global $sFilePath = $InputEXE & ".extracted_source.au3"
_Resource_SaveToFile($sFilePath, 999, $RT_RCDATA, Default, Default, $InputEXE)
If Not @error Then
    ShellExecute("NotePad.exe", $sFilePath)
    MsgBox($MB_ICONINFORMATION + $MB_TOPMOST, Default, $sFilePath & @LF & @LF & " created." & @LF & @LF & "A NotePad window with the code has been opened.", 0)
Else
    MsgBox($MB_ICONINFORMATION + $MB_TOPMOST, Default, $InputEXE & @LF & @LF & " has NO included source." & @LF & @LF & "Add the following line to the source code:" & @LF & @LF & "#AutoIt3Wrapper_Res_SaveSource=y", 0)
EndIf

 

Edited May 22, 2019 by Exit
Added Notepad if code found. Better error checking.

[ViciousXUSMC]

19 hours ago, BrewManNH said:

You must have the world's worst AV then.

Does your AV delete other exes that use FileInstall? If not, then you're doing something different with this one. I've never had any AV flag a file because I FileInstalled the source script in it.

New job, so not a lot of experience with the AV here but its Symantec, we used it at the last place.

I do not think normally fileinstall() is flagged but this script was literally a 2 line, just a file install, a msgbox, or the directive so nothing crazy.

 

It's being caught with the heuristic engine not as a definition of a virus.

Edited May 22, 2019 by ViciousXUSMC