AutoIt v3.3.15.4 Beta

[jchd]

Do you mean that signing an executable prevents its reverse-engineering?

[mLipok]

3 minutes ago, Jos said:

Scratch doubt and replace that with a definite NO WAY!

Fixed.

[mLipok]

On 9/22/2021 at 2:43 AM, jchd said:

Reverse engineering is......

Yes.
But do my comparion of decompiling problem in AutoIt in relation to C# is comparable ?

[jchd]

The tooling required to do the job may not be comparable but the tooling is only made once.

[mLipok]

7 minutes ago, jchd said:

Do you mean that signing an executable prevents its reverse-engineering?

I thought that the question about signing was related to:  

On 9/21/2021 at 6:00 PM, Jos said:

On 9/21/2021 at 4:40 PM, SzymonN said:

so now, after compiling, most anti-viruses detect programs as false positive.

That battle is lost many moons ago and doing that won;t help other than a couple of days.

 

[mLipok]

2 minutes ago, jchd said:

The tooling required to do the job may not be comparable but the tooling is only made once.

And for C# such kind of tool was made years ago ?
And of course in fact using such tool is easy and nothing to do has the fact if the code was signed or not ?

Edited September 24, 2021 by mLipok

[argumentum]

2 hours ago, SzymonN said:

signing at compile time

I self sign but you can use this for your certificate. This code does verify the certificate.

[jchd]

Of course signing with a signature issued by a reputable trusted organization may help false positives detection, but it's far from free.

About reverse-engineering, nothing can stop them if there's enough incentives to do so!

[SzymonN]

On 24.09.2021 at 16:00, Jos said:

Zdrap wątpliwości i zastąp je zdecydowanie NIE MA MOWY!

My point is that there should be a compiler version that requires a signature at compile time and checks it at compile time if the signature is up to date and is confirmed by any of the well-known and reputable certification authorization organizations

[mLipok]

31 minutes ago, SzymonN said:

My point is that there should be a compiler version that requires a signature at compile time and checks it at compile time if the signature is up to date and is confirmed by any of the well-known and reputable certification authorization organizations

@SzymonN  as I said

  

On 9/24/2021 at 3:58 PM, mLipok said:

This was exactly what I was saying....  Almostly... I mean first compile then use your own signing tool.

On 9/23/2021 at 12:28 PM, mLipok said:

I do not see any problem that you can't sign your compiled code.
I've been doing this with my programs for almost two years.

So you must sign it with your own cert and password.
Because I doubt there is NO WAY! that  @Jon or anybody give you their own cert and password.

What do you not understand in my statement ?

btw.
If you want you can answer to me in Polish via PrivateMessage.
Jeżeli chcesz możesz mi odpowiedzieć po Polsku przez WiadomośćPrywatną.

 

Edited September 26, 2021 by mLipok

[Jos]

....  And my point was that that is something you can arrange yourself as explained  by @mLipok and never will be a Certificate supplied by the AutpIt3 project.  

[argumentum]

5 hours ago, SzymonN said:

there should be a compiler version that requires a signature at compile time

Is there any compiler that forces you to such ?.

As far as I know, all compilers compile and signing a file is another thing altogether, not forced, nor enforced by any compiler, as is not compiler related. Unless an IDE gives you an interface with settings/options to enforce it.
Now, if I'm right ( and often am  ), what you like is an interface/GUI/wrapper with settings to enforce such. And that, could be coded if needed. By you if you have a clear understanding of how it would function. And shared here in the forum for the rest of us  

[JockoDundee]

2 hours ago, argumentum said:

And that, could be coded if needed.

Yes, please make it so.

Quote

By you…

wot

[SzymonN]

Out of curiosity, I checked the Chinese version of Autoit. Their compiler from the AccAu3Inst package protects the exe files so that they cannot be easily decompiled with any available tool. I also noticed that it adds references to system libraries depending on whether the script uses a function or not, this effectively limits the number of false positives.

Regarding the certificate requirement, I also imagine there is a compiler version that requires the file to be signed with a certificate right after compilation. If the process fails or the certificate is invalid, the file is automatically deleted.

Autoit is a good and powerful tool, I am sad that Autoit loses so much by being used by stupid people writing viruses etc

[TheDcoder]

On 10/6/2021 at 4:15 PM, SzymonN said:

I checked the Chinese version of Autoit.

The WHAT

I'd recommend staying away from that version for various reasons

On 10/6/2021 at 4:15 PM, SzymonN said:

Their compiler from the AccAu3Inst package protects the exe files so that they cannot be easily decompiled with any available tool.

At the end of the day, if one is determined enough, they can de-compile your script. No amount of obfuscation is going to stop that, there is only so much you can do before even the computer can't de-obfuscate your script

The only way to protect secrets in your code is to remove them before compiling.

[SzymonN]

15 hours ago, TheDcoder said:

The WHAT

I'd recommend staying away from that version for various reasons

At the end of the day, if one is determined enough, they can de-compile your script. No amount of obfuscation is going to stop that, there is only so much you can do before even the computer can't de-obfuscate your script

The only way to protect secrets in your code is to remove them before compiling.

Thanks for the answer, yes I also thought it was not quite a good solution. You're right that everything can be decompiled. However, there is a difference between "at the end of the day" and one click.

[Melba23]

Hi,

A word to the wise - enough talk of decompilers.

M23

[auto-it-tous]

Thanks for this job about this new.

[SzymonN]

I noticed that Function _FileWriteToLine does not work at all. 

expandcollapse popup

Func _FileWriteToLine($sFilePath, $iLine, $sText, $bOverWrite = False, $bFill = False)
    If $bOverWrite = Default Then $bOverWrite = False
    If $bFill = Default Then $bFill = False
    If Not FileExists($sFilePath) Then Return SetError(2, 0, 0)
    If $iLine <= 0 Then Return SetError(4, 0, 0)
    If Not (IsBool($bOverWrite) Or $bOverWrite = 0 Or $bOverWrite = 1) Then Return SetError(5, 0, 0)
    If Not IsString($sText) Then
        $sText = String($sText)
        If $sText = "" Then Return SetError(6, 0, 0)
    EndIf
    If Not IsBool($bFill) Then Return SetError(7, 0, 0)
    ; Read current file into array
    Local $aArray = FileReadToArray($sFilePath)
    ; Create empty array if empty file
    If @error Then Local $aArray[0]
    Local $iUBound = UBound($aArray) - 1
    ; If Fill option set
    If $bFill Then
        ; If required resize array to allow line to be written
        If $iUBound < $iLine Then
            ReDim $aArray[$iLine]
            $iUBound = $iLine - 1
        EndIf
    Else
        If ($iUBound + 1) < $iLine Then Return SetError(1, 0, 0)
    EndIf
    ; Write specific line - array is 0-based so reduce by 1 - and either replace or insert
    $aArray[$iLine - 1] = ($bOverWrite ? $sText : $sText & @CRLF & $aArray[$iLine - 1])
    ; Concatenate array elements
    Local $sData = ""
    For $i = 0 To $iUBound
        $sData &= $aArray[$i] & @CRLF
    Next
    $sData = StringTrimRight($sData, StringLen(@CRLF)) ; Required to strip trailing EOL
    ; Write data to file
    Local $hFileOpen = FileOpen($sFilePath, FileGetEncoding($sFilePath) + $FO_OVERWRITE)
    If $hFileOpen = -1 Then Return SetError(3, 0, 0)
    FileWrite($hFileOpen, $sData)
    FileClose($hFileOpen)
    Return 1
EndFunc   ;==>_Fi

 

This version ( from 3.3.8.1 ) work ok .

Func _FileWriteToLine($sFile, $iLine, $sText, $fOverWrite = 0)
    If $iLine <= 0 Then Return SetError(4, 0, 0)
    If Not IsString($sText) Then
        $sText = String($sText)
        If $sText = "" Then Return SetError(6, 0, 0)
    EndIf
    If $fOverWrite <> 0 And $fOverWrite <> 1 Then Return SetError(5, 0, 0)
    If Not FileExists($sFile) Then Return SetError(2, 0, 0)

    Local $sRead_File = FileRead($sFile)
    Local $aSplit_File = StringSplit(StringStripCR($sRead_File), @LF)
    If UBound($aSplit_File) < $iLine Then Return SetError(1, 0, 0)
    Local $hFile = FileOpen($sFile, $FO_OVERWRITE)
    If $hFile = -1 Then Return SetError(3, 0, 0)

    $sRead_File = ""

    For $i = 1 To $aSplit_File[0]
        If $i = $iLine Then
            If $fOverWrite = 1 Then
                If $sText <> '' Then $sRead_File &= $sText & @CRLF
            Else
                $sRead_File &= $sText & @CRLF & $aSplit_File[$i] & @CRLF
            EndIf
        ElseIf $i < $aSplit_File[0] Then
            $sRead_File &= $aSplit_File[$i] & @CRLF
        ElseIf $i = $aSplit_File[0] Then
            $sRead_File &= $aSplit_File[$i]
        EndIf
    Next

    FileWrite($hFile, $sRead_File)
    FileClose($hFile)

    Return 1
EndFunc

example

$data="test123"
_FileWriteToLine(@UserProfileDir &"\Desktop\file.txt", 1,$data, 0)

[Danp2]

@SzymonNCheck the value of @error. Chances are it's 2, which indicates that the file doesn't exist.

Edit: I took a closer look at this. It is returning @error = 2, even when the file exists on the desktop. I'm guessing that this is a security / rights issue, but running with #RequireAdmin didn't have any affect. Maybe someone else will know more about this.

Edited November 3, 2021 by Danp2