Obfuscator (discontinued)

[Jos]

Ahh, I was working with an earlier version, I didn't know there was a new version, thought it'd be listed on the first post in this thread. Is there a new place the History of changes is placed?

Also, what is the new directive '#ignorefunc' - I didn't see it in the online help.

(*edit: found #OnAutoItStartRegister (part of the new beta changes)

Thanks!

Yea, I guess I should update the first post with each update but tend to forget it most of the time

Too many places to make updates .....

Jos

[nguyenbason]

Hi Jos,

Does this support UTF-8? 'Coz i tried and all unicode text become unreadable and also script cannot run. Am i wrong?

Thanks,

[Jos]

Hi Jos,

Does this support UTF-8? 'Coz i tried and all unicode text become unreadable and also script cannot run. Am i wrong?

Thanks,

Correct, there is no support for Unicode files in Obfuscator/Tidy and au3check at this moment and I have no plans yet to start that due to time constraints.

When any of the Files with BOM is used you should get a clear warning about this and Obfuscator and Tidy will stop processing.

Jos

Edited July 3, 2009 by Jos

[trinitrotoluen]

Oh, Opt("OnExitFunc","OnAutoItExit") is on the not working list.

I need it >_< Any solution ?

[Jos]

Oh, Opt("OnExitFunc","OnAutoItExit") is on the not working list.

Below script Obfuscated works fine for me.

Opt("OnExitFunc","OnAutoItExit")
Sleep(2000)

Func OnAutoItExit()
    MsgBox(0,"test","test")
EndFunc

I need it >_< Any solution ?

When you need it this badly I am surprised by the minimal info you supplied.

Jos

Edited August 17, 2009 by Jos

[trinitrotoluen]

Hi, Jos

Thank you for your reply ...

I got it now because I changed the OnAutoItExit func name. I will try again thank !

ps : When we change the OnAutoItExit func name it will not work.

e.g:

Opt("OnExitFunc","MyExit")

Sleep(2000)

Func MyExit()

MsgBox(0,"test","test")

EndFunc

not work.

Edited August 17, 2009 by trinitrotoluen

[Jos]

Found a bug and solved that in the Current Beta v1.0.26.18.

Jos

[KaFu]

Hi Jos,

two topics today ...

1) Test of /Obfuscate_minimum

Obfuscator already has an undocumented option called /om or /Obfuscate_minimum. Try obfuscation with:

#Obfuscator_Parameters=/sf /sv /om /cs=0 /cn=0

That should rename all Variables and Funcs to a shorter version and strip the unused Funcs and Global variables, but doesn't do any other obfuscation tasks.

Curious if anybody have any test results with this option.

Tried it and ran into an error... a function of mine was renamed to ABS(), which is an AutoIt native function as well ...

Additionally this function

expandcollapse popup

Func _Timer_SetTimer($hWnd, $iElapse = 250, $sTimerFunc = "", $iTimerID = -1)
    Local $iResult[1], $pTimerFunc = 0, $hCallBack = 0, $iIndex = $_Timers_aTimerIDs[0][0] + 1
    If $iTimerID = -1 Then ; create a new timer
        ReDim $_Timers_aTimerIDs[$iIndex + 1][3]
        $_Timers_aTimerIDs[0][0] = $iIndex
        $iTimerID = $iIndex + 1000
        For $x = 1 To $iIndex
            If $_Timers_aTimerIDs[$x][0] = $iTimerID Then
                $iTimerID = $iTimerID + 1
                $x = 0
            EndIf
        Next
        If $sTimerFunc <> "" Then ; using callbacks, if $sTimerFunc = "" then using WM_TIMER events
            $hCallBack = DllCallbackRegister($sTimerFunc, "none", "hwnd;int;int;dword")
            If $hCallBack = 0 Then Return SetError(-1, -1, 0)
            $pTimerFunc = DllCallbackGetPtr($hCallBack)
            If $pTimerFunc = 0 Then Return SetError(-1, -1, 0)
        EndIf
        $iResult = DllCall("user32.dll", "int", "SetTimer", "hwnd", $hWnd, "int", $iTimerID, "int", $iElapse, "ptr", $pTimerFunc)
        If @error Then Return SetError(-1, -1, 0)
        If $iResult[0] = 0 Then Return SetError(-1, -1, 0)
        $_Timers_aTimerIDs[$iIndex][0] = $iResult[0] ; integer identifier
        $_Timers_aTimerIDs[$iIndex][1] = $iTimerID ; timer id
        $_Timers_aTimerIDs[$iIndex][2] = $hCallBack ; callback identifier, need this for the Kill Timer
    Else ; reuse timer
        For $x = 1 To $iIndex - 1
            If $_Timers_aTimerIDs[$x][0] = $iTimerID Then
                If IsHWnd($hWnd) Then $iTimerID = $_Timers_aTimerIDs[$x][1]
                $hCallBack = $_Timers_aTimerIDs[$x][2]
                If $hCallBack <> 0 Then ; call back was used to create the timer
                    $pTimerFunc = DllCallbackGetPtr($hCallBack)
                    If $pTimerFunc = 0 Then Return SetError(-1, -1, 0)
                EndIf
                $iResult = DllCall("user32.dll", "int", "SetTimer", "hwnd", $hWnd, "int", $iTimerID, "int", $iElapse, "ptr", $pTimerFunc)
                If @error Then Return SetError(-1, -1, 0)
                If $iResult[0] = 0 Then Return SetError(-1, -1, 0)
                ExitLoop
            EndIf
        Next
    EndIf
    Return $iResult[0]
EndFunc   ;==>_Timer_SetTimer

was translated to this

expandcollapse popup

Func a68($an7, $a13m = 250, $a13n = "", $a13k = -1)
    Local $aoe[1], $a13o = 0, $a13i = 0, $apg = $a13g[0][0] + 1
    If $a13k = -1 Then
        ReDim $a13g[$apg + 1][3]
        $a13g[0][0] = $apg
        $a13k = $apg + 1000
        For $aq4 = 1 To $apg
            If $a13g[$aq4][0] = $a13k Then
                $a13k = $a13k + 1
                $aq4 = 0
            EndIf
        Next
        If $a13n <> "" Then
            $a13i = DllCallbackRegister($a13n, "none", "hwnd;int;int;dword")
            If $a13i = 0 Then Return SetError(-1, -1, 0)
            $a13o = DllCallbackGetPtr($a13i)
            If $a13o = 0 Then Return SetError(-1, -1, 0)
        EndIf
        $aoe = DllCall("user32.dll", "int", "SetTimer", "hwnd", $an7, "int", $a13k, "int", $a13m, "ptr", $a13o)
        If @error Then Return SetError(-1, -1, 0)
        If $aoe[0] = 0 Then Return SetError(-1, -1, 0)
        $a13g[$apg][0] = $aoe[0]
        $a13g[$apg][1] = $a13k
        $a13g[$apg][2] = $a13i
    Else
        For $aq4 = 1 To $apg - 1
            If $a13g[$aq4][0] = $a13k Then
                If IsHWnd($an7) Then $a13k = $a13g[$aq4][1]
                $a13i = $a13g[$aq4][2]
                If $a13i <> 0 Then
                    $a13o = DllCallbackGetPtr($a13i)
                    If $a13o = 0 Then Return SetError(-1, -1, 0)
                EndIf
                $aoe = DllCall("user32.dll", "int", "SetTimer", "hwnd", $an7, "int", $a13k, "int", $a13m, "ptr", $a13o)
                If @error Then Return SetError(-1, -1, 0)
                If $aoe[0] = 0 Then Return SetError(-1, -1, 0)
                ExitLoop
            EndIf
        Next
    EndIf
    Return $aoe[0]
EndFunc   ;==>a68

resulting in this error message:

C:\temp\smf\SMF__Main_v0_5_0_8_3_Obfuscated.au3 (4802) : ==> Badly formatted "Func" statement.:

$a13i = DllCallbackRegister($a13n, "none", "hwnd;int;int;dword")

which i currently can not interpret ...

2) Stripping of includes in #cs & #ce

This

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Run_Obfuscator=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

#cs
    #include <IncludeDoesNotExist.au3>
#ce

Opt('MustDeclareVars', 1)

Local $msg

GUICreate("My GUI") ; will create a dialog box that when displayed is centered
GUISetState(@SW_SHOW) ; will display an empty dialog box

; Run the GUI until the dialog is closed
While 1
    $msg = GUIGetMsg()

    If $msg = $GUI_EVENT_CLOSE Then ExitLoop
WEnd
GUIDelete()

results in "Can't open file c:\scriptdir\" for me... which it shouldn't ...

Keep up your great work >_<

[Jos]

Items 1 and 3 should be fixed in the current Beta v 1.0.26.21.

The DllCallbackRegister() statement triggers this warning in Ofuscator because the Variable contains a Function name which it doesn't know at Obfuscation time so there isn't much I can do with that as far as I can see.

-### Obfuscation Error: Found DllCallbackRegister() statement using unsolvable Func, which will/could lead to problems running your obfuscated script.
>### current Func: _Timer_SetTimer
C:\Development\winutil\AutoIt3\programs\OpenInSciTE\CapturedScripts\testx.au3(45,1) Warning for line:$hCallBack = DllCallbackRegister($sTimerFunc, "none", "hwnd;int;int;dword") 

-#############################################################################################
-#### Obfuscator Found   1 Error(s)!!!!    This means your script could have problems running properly.  ####
-#############################################################################################

Jos

[Melba23]

Jos,

I am trying to use your "new" /om directive and I am running into a problem with forward referenced function names.

For example, I am using AdlibRegister/Unregister("Display_Times") in my script. After Obfustication, Au3Check is throwing an error stating it cannot find the "Display_Times" function:

>Running AU3Check for obfuscated file(1.54.16.0)  from:C:\Program Files\AutoIt3\beta
M:\Program\Au3 Scripts\BMP\BMP_Obfuscated.au3(3702,32) : ERROR: Display_Times(): undefined function.
AdlibUnRegister("Display_Times")
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^

I have checked in the Obfuscated script and it seems that all cases of the function BEFORE the function has been declared have the function replaced with the "new" function name ("a4t" in the script) but any instances AFTER the function declaration do not. The following snippet illustrates what happened:

Func a4s()
Local $aqe = a5x($an0)
GUICtrlSetData($ao4, $aqe)
$ane = 1
AdlibRegister("a4t", 2000)  ;<<<<<<<<<<<<< Function name changed
EndFunc
Func a4t()   ;<<<<<<<<<<<<<<<<< Function declared
Local $aqe
Switch $ane
Case 1
$aqe = a5x($am_)
GUICtrlSetData($ao4, $aqe)
$ane = 2
Case 2
GUICtrlSetData($ao4, "")
$ane = 0
ContinueCase
Case 0
AdlibUnRegister("Display_Times")  ;<<<<<<<<<<< Function name unchanged - this is line 3702 referred to above
EndSwitch
EndFunc

When I replace the function name manually and compile, all works as it should.

I managed to solve the immediate problem by telling AutoIt3Wrapper not to obfuscate this function using:

#Obfuscator_Ignore_Funcs=Display_Times

BEFORE setting the Obfuscator parameters to /om and all worked as it should. But it would be nicer if Obfuscator could do the work itself.

I presume that the same problem will affect GUIRegisterMsg and HotKeySet (and any other lines using "function" syntax) as well, if there are instances of the quoted function AFTER its declaration.

Sorry to have found fault so quickly with your new toy - but if you give us these little treats, you cannot blame us for trying them out! >_< Please ask if I have not been clear enough.

M23

Edit:

I have been experimenting a bit more and these code sections show the problem is a little different.

Here is the basic script (I know it is gobbledegook, but it is designed to show the problem, not to run!):

#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/sf /sv /om /cs=0 /cn=0

AdlibRegister("fred", 1000)

AdlibUnRegister("fred")

Func fred()
    ConsoleWrite("fred" & @CRLF)
EndFunc

Sleep(2000)

AdlibUnRegister("fred")

While 1
    Sleep(10)
WEnd

and here is the Obfuscated version:

AdlibRegister("_3_", 1000)
AdlibUnRegister("fred")
Func _3_()
ConsoleWrite("fred" & @CRLF)
EndFunc
Sleep(2000)
AdlibUnRegister("fred")
While 1
Sleep(10)
WEnd

So it look as if Obfuscator is only altering the first use of the function and the function declaration itself - all other quoted instances of the function name remain unchanged.

I hope this helps - as usual happy to run any other tests you might want.

M23

Edited August 27, 2009 by Melba23

[Jos]

Its easy to resolve: Just add this line to Obfuscator.dat:

adlibunregister,1,0

I updated the Obfuscator.dat in the Beta download directory as well.

Jos >_<

(note to self: This teach you to tell the rest of the world about these little internal options!)

Edited August 27, 2009 by Jos

[Melba23]

Jos,

That was simple! I was afraid I had unearthed something horrible!

Dank u wel as always.

M23

P.S. By the way, using /om reduces my .exe size from 356613 to 337149 - with /SO, max compression and upx in both cases - which seems a useful saving.

[KaFu]

Items 1 and 3 should be fixed in the current Beta v 1.0.26.21.

Item 3 "Stripping of includes in #cs & #ce" partially solved . It works if the include in #cs & #ce is in the main script, but not if the include in #cs & #ce itself is in an include.

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Run_Obfuscator=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <test.au3>

#cs


    #include <IncludeDoesNotExist.au3>


#ce

Opt('MustDeclareVars', 1)

Local $msg

GUICreate("My GUI") ; will create a dialog box that when displayed is centered
GUISetState(@SW_SHOW) ; will display an empty dialog box

; Run the GUI until the dialog is closed
While 1
    $msg = GUIGetMsg()

    If $msg = $GUI_EVENT_CLOSE Then ExitLoop
WEnd
GUIDelete()

by itself works fine, but if the included test.au3 looks like this

#cs ----------------------------------------------------------------------------

 AutoIt Version: 3.3.0.0
 Author:         myName

 Script Function:
    Template AutoIt script.

#ce ----------------------------------------------------------------------------

; Script Start - Add your code below here


#cs


    #include <IncludeDoesNotExist2.au3>


#ce


global $test = 12

the same error occurs "!==> *** ERROR: include file not found : #include <IncludeDoesNotExist2.au3>".

Edit:

Would an additional parameter to only shorten vars for /om do any good? Like /om=1 => Obfuscate_minimum Vars only? I'm asking this not for true obfuscation but just for script speed purposes .

Cheers

Edited August 28, 2009 by KaFu

[wraithdu]

There was an old problem you had fixed where Obfuscator threw an error when lines were longer than 2048 characters, even when only using /striponly.

Now with the new /om parameter we have to use:

/sf=1 /sv=1 /om /cs=0 /cn=0

This brings back that old problem with the >2048 error. Can you fix this scenario as well? Or maybe add support for /om to /striponly?

EDIT:

Actually, we shouldn't be getting this error at all if string encryption is turned off (/cs=0), should we?

Edited September 1, 2009 by wraithdu

[AoRaToS]

Hello, today i tried a program called eat spaghetti 2 which uses Obfuscator also. So i downloaded all that was needed (the 2 .exe files) and tried it out with a copy of a script I'm working on... The process was interuted by ESET Smart Security (NOD32) showing that a Win32/Packed.AutoIt.Gen (Potentially unwanted application) was detected for the filename_obfuscated.au3... That was the first time I got that type of a message for something AutoIt related. I've been using Obfuscator and never got this before, anyone else got that? I guess I'll try it again later and tell ESS to let it be...

[epicfail]

hey i get errors when im using the IE include how do i fix this?

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEFormElementCheckboxSelect
D:\Program Files\AutoIt3\include\IE.au3(1706,1) Warning for line:$oItems = Execute("$o_object.elements('" & $s_Name & "')") 

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEFormElementRadioSelect
D:\Program Files\AutoIt3\include\IE.au3(1834,1) Warning for line:$oItems = Execute("$o_object.elements('" & $s_Name & "')") 

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEPropertyGet
D:\Program Files\AutoIt3\include\IE.au3(3291,1) Warning for line:$aVcard[1][$i] = Execute('$o_object.document.parentwindow.top.navigator.userProfile.getAttribute("' & $aVcard[0][$i] & '")') 

-### Obfuscation Error: Found ObjEvent() statement using unsolvable Func, which will/could lead to problems running your obfuscated script.
>### current Func: _IEErrorHandlerRegister
D:\Program Files\AutoIt3\include\IE.au3(3644,1) Warning for line:$oIEErrorHandler = ObjEvent("AutoIt.Error", $s_functionName) 

-### Obfuscation Error: Found ObjEvent() statement using unsolvable Func, which will/could lead to problems running your obfuscated script.
>### current Func: __IEInternalErrorHandlerDeRegister
D:\Program Files\AutoIt3\include\IE.au3(4334,1) Warning for line:$oIEErrorHandler = ObjEvent("AutoIt.Error", $sIEUserErrorHandler) 

-#############################################################################################
-#### Obfuscator Found   5 Error(s)!!!!    This means your script could have problems running properly.  ####
-#############################################################################################

[Jos]

There was an old problem you had fixed where Obfuscator threw an error when lines were longer than 2048 characters, even when only using /striponly.

Now with the new /om parameter we have to use:

/sf=1 /sv=1 /om /cs=0 /cn=0

This brings back that old problem with the >2048 error. Can you fix this scenario as well? Or maybe add support for /om to /striponly?

EDIT:

Actually, we shouldn't be getting this error at all if string encryption is turned off (/cs=0), should we?

I will have a look when time permits... more later.

[Jos]

Hello, today i tried a program called eat spaghetti 2 which uses Obfuscator also. So i downloaded all that was needed (the 2 .exe files) and tried it out with a copy of a script I'm working on... The process was interuted by ESET Smart Security (NOD32) showing that a Win32/Packed.AutoIt.Gen (Potentially unwanted application) was detected for the filename_obfuscated.au3... That was the first time I got that type of a message for something AutoIt related. I've been using Obfuscator and never got this before, anyone else got that? I guess I'll try it again later and tell ESS to let it be...

These are not things I will be looking at ... report it to your AV provider.

Jos

[Jos]

hey i get errors when im using the IE include how do i fix this?

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEFormElementCheckboxSelect
D:\Program Files\AutoIt3\include\IE.au3(1706,1) Warning for line:$oItems = Execute("$o_object.elements('" & $s_Name & "')") 

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEFormElementRadioSelect
D:\Program Files\AutoIt3\include\IE.au3(1834,1) Warning for line:$oItems = Execute("$o_object.elements('" & $s_Name & "')") 

-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _IEPropertyGet
D:\Program Files\AutoIt3\include\IE.au3(3291,1) Warning for line:$aVcard[1][$i] = Execute('$o_object.document.parentwindow.top.navigator.userProfile.getAttribute("' & $aVcard[0][$i] & '")') 

-### Obfuscation Error: Found ObjEvent() statement using unsolvable Func, which will/could lead to problems running your obfuscated script.
>### current Func: _IEErrorHandlerRegister
D:\Program Files\AutoIt3\include\IE.au3(3644,1) Warning for line:$oIEErrorHandler = ObjEvent("AutoIt.Error", $s_functionName) 

-### Obfuscation Error: Found ObjEvent() statement using unsolvable Func, which will/could lead to problems running your obfuscated script.
>### current Func: __IEInternalErrorHandlerDeRegister
D:\Program Files\AutoIt3\include\IE.au3(4334,1) Warning for line:$oIEErrorHandler = ObjEvent("AutoIt.Error", $sIEUserErrorHandler) 

-#############################################################################################
-#### Obfuscator Found   5 Error(s)!!!!    This means your script could have problems running properly.  ####
-#############################################################################################

Believe this was also reported somewhere else and answered?

anyways, there isn't much I can do as the error shown reports the actual issue. I know dale has done some work on this but don't remember the exact details.

Jos

[Jos]

There was an old problem you had fixed where Obfuscator threw an error when lines were longer than 2048 characters, even when only using /striponly.

Now with the new /om parameter we have to use:

/sf=1 /sv=1 /om /cs=0 /cn=0

This brings back that old problem with the >2048 error. Can you fix this scenario as well? Or maybe add support for /om to /striponly?

EDIT:

Actually, we shouldn't be getting this error at all if string encryption is turned off (/cs=0), should we?

There is indeed an issue with this "illogical" combination of parameters and it is fixed in v 1.0.26.22 but:

- Why Use /OM with /StripOnly? Striponly means: Do NOT obfuscate, just strip the unused Funcs and Global Vars.

- You were missing the /CN=0 for Strip only in the Example.

EDIT:

Actually, we shouldn't be getting this error at all if string encryption is turned off (/cs=0), should we?

Not fully true as encryption of Funcname, Varnames, Macros and Numbers will change the line length.

I am not even going to try to make all possible exceptions possible with all parameter combinations and take the approach that when anything is going to be obfusticated then the max line length supported by obfuscator will be 2048.

Jos