AutoIt v3.3.15.4 Beta

[argumentum]

1 hour ago, Jos said:

First part is there ....the rest is still missing

F5: AutoIt3.exe ended.rc:1
Ctrl-F5: AU3Check ended.rc:0

No need for longer code. The example is sufficient.

[argumentum]

#AutoIt3Wrapper_Au3Check_Parameters= -d does work.

;;;https://www.autoitscript.com/forum/topic/206047-autoit-v33154-beta/?do=findComment&comment=1486095
;~ #AutoIt3Wrapper_Au3Check_Parameters= -d ; works
Opt("MustDeclareVars", 1) ; don't work
AutoItSetOption("MustDeclareVars", 1)  ; don't work
$Var1 = 0

 

Edited July 21, 2021 by argumentum

[Jos]

I didn't ask for longer code but rather all output. I have given up guessing version numbers for quit a while so simply want exact info before even start looking at any issue.

[argumentum]

Ok, I replaced the v3.3.15.4 ( failing ) with v3.3.14.5 ( ok ) and even 1.54.22.0 ( ok ).
So the issue started with this new version.
 

>"C:\PortableAU3\autoit-v3.3.15.4\SciTE\..\AutoIt3.exe" "C:\PortableAU3\autoit-v3.3.15.4\SciTE\AutoIt3Wrapper\AutoIt3Wrapper.au3" /Prod /AU3check /in "C:\PortableAU3\autoit-v3.3.15.4\Examples\GUI\SampleControls.au3"
+>13:28:54 Starting AutoIt3Wrapper (21.316.1639.1) from:SciTE.exe (4.4.6.0)  Keyboard:00000409  OS:WIN_10/2004  CPU:X64 OS:X64  Environment(Language:0409)  CodePage:0  utf8.auto.check:4
+>         SciTEDir => C:\PortableAU3\autoit-v3.3.15.4\SciTE   UserDir => C:\PortableAU3\autoit-v3.3.15.4\SciTE\AutoIt3Wrapper   SCITE_USERHOME => C:\PortableAU3\autoit-v3.3.15.4\SciTE\SCITE_USERHOME 
>Running AU3Check (3.3.15.4)  from:C:\PortableAU3\autoit-v3.3.15.4  input:C:\PortableAU3\autoit-v3.3.15.4\Examples\GUI\SampleControls.au3
+>13:28:54 AU3Check ended.rc:0
+>13:28:54 AutoIt3Wrapper Finished.
>Exit code: 0    Time: 0.6618

I edited and added the code to "SampleControls.au3" for this test. 

Edited July 21, 2021 by argumentum
more info.

[Jos]

Ok thanks ....  I will see which change I/we've made that is the reason for this one.....

Edited July 21, 2021 by Jos

[Jos]

Think I've found the regression which was introduced by the changes I've made for 

Quote

the check for MAX 9223372036854775807 and MIN -9223372036854775808 values for INTEGER

Please check this Beta v3.3.15.5 of au3check to see what other things I've broken.  

[argumentum]

That did it  
@VIP feel free to jump in and make sure is all good.

Edited July 21, 2021 by argumentum
=)

[Trong]

17 hours ago, Jos said:

Think I've found the regression which was introduced by the changes I've made for 

Please check this Beta v3.3.15.5 of au3check to see what other things I've broken.  

It worked ! No new errors found.

[SzymonN]

Hi John , could you make changes to the compiler so that the binary files look different than the previous versions of autoit - so now, after compiling, most anti-viruses detect programs as false positive. Now autoit refers to the PSAPI.dll library which makes decompilation easier for people who want to steal the source of the program. If you had added a function that would randomly reference psapi.dll it would be much safer. Check it out here: https://github.com/mrexodia/SimpleAutoItCrypter

[Jos]

1 hour ago, SzymonN said:

so now, after compiling, most anti-viruses detect programs as false positive.

That battle is lost many moons ago and doing that won;t help other than a couple of days.

1 hour ago, SzymonN said:

Now autoit refers to the PSAPI.dll library which makes decompilation easier for people who want to steal the source of the program. If you had added a function that would randomly reference psapi.dll it would be much safer.

Another battle that was lost and done with as this is an interpreter language so it will always be in a sort of readable form unless somebody is able to write a real compiler. (Just my humble opinion  ) 

Jos

ps: its is Jon you wanted to address I guess   

[jchd]

1 hour ago, Jos said:

unless somebody is able to write a real compiler.

Even then, a little play with Ghidra will ruin the hope of a software secret.

[Musashi]

53 minutes ago, jchd said:

Even then, a little play with Ghidra will ruin the hope of a software secret.

I would even go one step further. 99.9% of all scripts created with AutoIt accomplish ordinary (daily) tasks. No one would ever think of using AutoIt to develop the control software for a Warp Drive, and so there is no serious motivation to decompile scripts at all .

[jchd]

My remark was more generic, but you're correct in the AutoIt case.

[mLipok]

4 hours ago, Musashi said:

I would even go one step further. 99.9% of all scripts created with AutoIt accomplish ordinary (daily) tasks. No one would ever think of using AutoIt to develop the control software for a Warp Drive, and so there is no serious motivation to decompile scripts at all .

if I rember well, decompilation of C# is also so easy.... but this wont stop the BIG CORP to develop BIG PROJECTS in this language.
Am I right or am I wrong?
 

[jchd]

Reverse engineering is possible as soon as you can get your hands on the software and have enough knowledge of the hardware platform it's intended to run on. Limited knowledge of the hardware can be compensated by educated guesswork.

Tamper-resistant hardware is expensive but many (if not most, given sufficient money) attempts have failed and have been successfully tampered with.
Look: you're powerful and want to develop a proprietary CPU to resist reverse-engineering. You must have a team of fully trusted specialized CPU/peripherals design engineers, have your own silicon foundry again with fully trusted specialized engineers and have a team of fully trusted system/application programmers. That's a very large number of people that you've to trust long-term for not leaking any internal secrets until they die or till when reverse engineering the thing has no remnant value. Moreover you need to avoid huge mistakes in the design in the first place (remember the Clipper chip!)

As an elementary example of how easy a non-trivial device can be reverse-engineered, look at how fast *one* resourceless retired hobbist is doing with a low-end (~120 US$) oscilloscope tablet: today about 85% of the thing is back to fixed running C source. https://www.eevblog.com/forum/testgear/fnirsi-1013d-100mhz-tablet-oscilloscope/1000/

This effort (only one guy actually working on that) arose with this guy receiving a DOA device and he decided to fix it. The device uses an oldish ARM CPU without available datasheet so you don't know its architecture nor its instruction set, a large FPGA and a handful of unmarked chips. He started rev-engineering hardware around mid-February (circa page 26 of the thread) and he's now almost done with most of the software functions, thanks to Ghidra. He's even writen his own emulator for this particular ARM processor to "speed up his understanding of how things work". I'm following the thread as I own such a device and I expect we have a fixed and enhanced open-source version by the end of the year. Give this task to a dozen hungry motivated young engineers working 18h/day with some good resources and you get the whole thing wide open in 1 - 2 weeks.

White-, grey-, black-hat conferences regularly show the power of teams fully involved and knowledgeable in rev-engineering of potentially "anything with software inside".

Edited September 22, 2021 by jchd

[SzymonN]

On 9/21/2021 at 6:00 PM, Jos said:

That battle is lost many moons ago and doing that won;t help other than a couple of days.

Another battle that was lost and done with as this is an interpreter language so it will always be in a sort of readable form unless somebody is able to write a real compiler. (Just my humble opinion  ) 

Jos

ps: its is Jon you wanted to address I guess   

Maybe two versions of the compiler, one that requires signing the program with a qualified signature. ?

[mLipok]

21 minutes ago, SzymonN said:

Maybe two versions of the compiler, one that requires signing the program with a qualified signature. ?

I do not see any problem that you can't sign your compiled code.
I've been doing this with my programs for almost two years.

[SzymonN]

On 9/23/2021 at 12:28 PM, mLipok said:

I do not see any problem that you can't sign your compiled code.
I've been doing this with my programs for almost two years.

Of course, but there might have to be a dedicated compiler that requires signing at compile time to verify that the certificate is valid

[mLipok]

7 minutes ago, SzymonN said:

Of course, but there might have to be a dedicated compiler that requires signing at compile time to verify that the certificate is valid

This was exactly what I was saying....  Almostly... I mean first compile then use your own signing tool.

On 9/23/2021 at 12:28 PM, mLipok said:

I do not see any problem that you can't sign your compiled code.
I've been doing this with my programs for almost two years.

So you must sign it with your own cert and password.
Because I doubt there is NO WAY! that  @Jon or anybody give you their own cert and password.

Edited September 24, 2021 by mLipok

[Jos]

Just now, mLipok said:

Because I doubt @Jon or anybody give you their own cert and password.

Scratch doubt and replace that with a definite NO WAY!