Obfuscator (discontinued)

[Jos]

I will put it on the list for things to look at, but not making any promises.

Jos

[Sn3akyP3t3]

This is my first time using obfuscator and I believe it is an excellent discouragement tool for reverse engineering some of my projects that are used in the wild or even in house. My latest project I'm working on I've run into a bit of a stubborn problem that I simply cannot troubleshoot on my own to overcome. The problem seems to stem from #include <SQLite.dll.au3>.

Here are my include statements and settings:

#RequireAdmin
#include <IE.au3>
#include <SQLite.au3>
#include <SQLite.dll.au3>
#include <ButtonConstants.au3>
#include <ComboConstants.au3>
#include <GUIComboBox.au3>
#include <GUIConstantsEx.au3>
#include <GuiTreeView.au3>
#include <GuiImageList.au3>
#include <WindowsConstants.au3>
#Include <Date.au3>
#include <Array.au3>
#include <Constants.au3>
#Autoit3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters= /SOI /Convert_Vars=1 /Convert_Funcs=1 /Convert_Strings=1 /Convert_Numerics=1 /SCI=9
Break(0)

Here is the error message displayed in the console:

0.19 ==> Start Add_Include:  Include_Rec$:#include <SQLite.dll.au3>
0.19 ==> Loading Include file into source Array:c:\program files\autoit3\include\sqlite.dll.au3
!File contains records longer than 2047 ..  stopping process.
!Ending Obfuscator program.
!>14:12:38 Obfuscator ended with errors, using original scriptfile.rc:999

What I cannot understand is why the parameter "/SOI" doesn't strip out the #include <SQLite.dll.au3> or any other #include statements for that matter. Perhaps I don't understand the purpose of the /SOI switch and should be using another setting. In that case then I need to be corrected.

If it cannot be corrected then to prevent a complete rewrite of the script I need to tackle the Func __SQLite_Inline_SQLite3Dll() inside SQlite.dll.au3 to reduce the line length from the current 4083 characters to <= the allowed 2047. Either that or download and install the sqlite3.dll file from the source project and include it as a referenced file, but that might lead to another problem.

[Jos]

Param /SOI will only strip the Included Files and leave the original base script as is.

The error you get is because you do not want to StripOnly, but you also want to Obfuscate code and the max record length for input records is 2095 in that case to avoid creating too long records after Obfuscation.

Something like this might work but you need to test it.

#RequireAdmin
#include <IE.au3>
#Obfuscator_Ignore_Funcs= __SQLite_Inline_Modified, __SQLite_Inline_Version, __SQLite_Inline_SQLite3Dll
#Obfuscator_Off
#include <SQLite.au3>
#include <SQLite.dll.au3>
#Obfuscator_On
#include <ButtonConstants.au3>
#include <ComboConstants.au3>
#include <GUIComboBox.au3>
#include <GUIConstantsEx.au3>
#include <GuiTreeView.au3>
#include <GuiImageList.au3>
#include <WindowsConstants.au3>
#Include <Date.au3>
#include <Array.au3>
#include <Constants.au3>
#Autoit3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters= /sf /sv /Convert_Vars=1 /Convert_Funcs=1 /Convert_Strings=1 /Convert_Numerics=1 /SCI=1

Edited December 22, 2009 by Jos

[Sn3akyP3t3]

Param /SOI will only strip the Included Files and leave the original base script as is.

The error you get is because you do not want to StripOnly, but you also want to Obfuscate code and the max record length for input records is 2095 in that case to avoid creating too long records after Obfuscation.

Something like this might work but you need to test it.

#RequireAdmin
#include <IE.au3>
#Obfuscator_Ignore_Funcs= __SQLite_Inline_Modified, __SQLite_Inline_Version, __SQLite_Inline_SQLite3Dll
#Obfuscator_Off
#include <SQLite.au3>
#include <SQLite.dll.au3>
#Obfuscator_On
#include <ButtonConstants.au3>
#include <ComboConstants.au3>
#include <GUIComboBox.au3>
#include <GUIConstantsEx.au3>
#include <GuiTreeView.au3>
#include <GuiImageList.au3>
#include <WindowsConstants.au3>
#Include <Date.au3>
#include <Array.au3>
#include <Constants.au3>
#Autoit3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters= /sf /sv /Convert_Vars=1 /Convert_Funcs=1 /Convert_Strings=1 /Convert_Numerics=1 /SCI=1

I first verified function names then added the line:

#Obfuscator_Ignore_Funcs=__SQLite_Inline_Modified,__SQLite_Inline_Version,__SQLite_Inline_SQLite3Dll

then edited the line:

#Obfuscator_Parameters= /sf /sv /Convert_Vars=1 /Convert_Funcs=1 /Convert_Strings=1 /Convert_Numerics=1 /SCI=1

and got this warning popup messagebox when trying to compile which I've never encountered before:

(PNG image of the messagebox) http://www.postimage.org/image.php?v=PqBJr40

Window info taken from the messagebox:

Title:  Invalid Compiler directive
>>>> Visible Text <<<<
OK
Keyword:#Obfuscator_Ignore_Funcs
Value:__SQLite_Inline_Modified,__SQLite_Inline_Version,__SQLite_Inline_SQLite3Dll

Apparently that means the functions are still included in the obfuscation process and the error still occurs:

"!File contains records longer than 2047 .. stopping process."

[Jos]

I didn't get the error anymore. What version of Obfuscator are you using?

[Sn3akyP3t3]

I didn't get the error anymore. What version of Obfuscator are you using?

I'm using Obfuscator version 1.0.27.0.

I noticed that I have two lines missing from my code that you posted in yours. "#Obfuscator_Off and #Obfuscator_On"

My Scite editor, which should be updated, doesn't show these two entries as valid keywords. The Scite editor shows version 1.78.

[Jos]

Don't worry about the directives not being highlighted, they work.

[Sn3akyP3t3]

Don't worry about the directives not being highlighted, they work.

I understand that the two directives, #Obfuscator_Off and #Obfuscator_On, errors are to be ignored.

However, I still get the error:

"!File contains records longer than 2047 .. stopping process."

It seems that the #Obfuscator_Ignore_Funcs= __SQLite_Inline_Modified, __SQLite_Inline_Version, __SQLite_Inline_SQLite3Dll

line is not being honored.

[Jos]

Download the latest version from the Beta directory. That contains some fixes in respect to line length check.

Using the "#obfuscator_On" and "#obfuscator_Off" is not simple and you need to understand exactly what it does.

The Code between these lines is totally ignored and left alone so this could bring on other issues.

Jos

[Sn3akyP3t3]

Download the latest version from the Beta directory. That contains some fixes in respect to line length check.

Using the "#obfuscator_On" and "#obfuscator_Off" is not simple and you need to understand exactly what it does.

The Code between these lines is totally ignored and left alone so this could bring on other issues.

Jos

Merry Christmas,

Compiling with the Beta version allowed for the Obfuscation process to begin, however, I had a slew of errors with the first error being:

Y:\...\SHOT_CamstudioUpload_Obfuscated.au3(2433,1) : WARNING: #comments-end has no matching #comments-start.

Forgive me, but I haven't had much experience with this process. I replaced all and between #CS to #CE with ; but I still get the error above so it must be in one of the #include <> declarations.

This is exactly what I'm using:

#RequireAdmin
#include <IE.au3>
#Obfuscator_Ignore_Funcs= __SQLite_Inline_Modified, __SQLite_Inline_Version, __SQLite_Inline_SQLite3Dll
#Obfuscator_Off
#include <SQLite.au3>
#include <SQLite.dll.au3>
#Obfuscator_On
#include <ButtonConstants.au3>
#include <ComboConstants.au3>
#include <GUIComboBox.au3>
#include <GUIConstantsEx.au3>
#include <GuiTreeView.au3>
#include <GuiImageList.au3>
#include <WindowsConstants.au3>
#Include <Date.au3>
;#include <Array.au3>
#include <Constants.au3>
#Autoit3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=  /sf /sv /Convert_Vars=1 /Convert_Funcs=1 /Convert_Strings=1 /Convert_Numerics=1 /SCI=1
Break(0)

[Jos]

Merry Christmas,

Compiling with the Beta version allowed for the Obfuscation process to begin, however, I had a slew of errors with the first error being:

Y:\...\SHOT_CamstudioUpload_Obfuscated.au3(2433,1) : WARNING: #comments-end has no matching #comments-start.

Forgive me, but I haven't had much experience with this process. I replaced all and between #CS to #CE with ; but I still get the error above so it must be in one of the #include <> declarations.

It is a warning so not a big issue, but I see that there must be some issue with Obfuscator as it does strip a block of code comments starting with #comments_start but leaves the ending #comments_end from _sql.au3.

Jos

[Jos]

Uploaded v 1.0.28.3 to the Beta download directory which takes care of the issue of leaving the comment-blocks when in #Obfuscator_Off mode.

Jos

[Melba23]

Jos,

I have been using Obfuscator with the following parameters to strip the code and shorten the variable names:

#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/sf /sv /om /cs=0 /cn=0

On a very simple file I get the following result:

; Source

; This is a comment

$vVariable = "Something"

; This is another comment

;===============================

; Obfuscated

$a3 = "Something"

whcich is what I expected.

However, when I tried to use:

#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/so /om

which I thought would give the same result, I got:

; Obfuscated:
$vVariable = "Something"

It looks as if the /so parameter prevents the /om parameter from being honoured. Is this the case, or (more likely) have I misunderstood something?

M23

[Jos]

Jos,

I have been using Obfuscator with the following parameters to strip the code and shorten the variable names:

#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/sf /sv /om /cs=0 /cn=0

On a very simple file I get the following result:

; Source

; This is a comment

$vVariable = "Something"

; This is another comment

;===============================

; Obfuscated

$a3 = "Something"

whcich is what I expected.

However, when I tried to use:

#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/so /om

which I thought would give the same result, I got:

; Obfuscated:
$vVariable = "Something"

It looks as if the /so parameter prevents the /om parameter from being honoured. Is this the case, or (more likely) have I misunderstood something?

M23

Your conclusion is correct. The /om (Obfuscate Minimum) does perform the Obfuscation steps and renames the Variable and Func names to a shorter name than normal Obfuscation.

The /so (Strip Only) only goes through the source multiple times and determines which UDFs (Func's) and which Global Variables are unused and strips those lines, but no other modifications are made to the source.

Jos

[Melba23]

Jos,

Thanks for the quick reply - back to #Obfuscator_Parameters=/sf /sv /om /cs=0 /cn=0 it is!

M23

[Dana]

Forgive me if this has been discussed already in the previous 27 pages of this thread, but...

I have a script, about 600 lines, that I can't obfuscate. It runs fine from SciTE, and I can compile it without obfuscating, and the compiled version works, but when I try to compile with Obfuscator I get lots of "variable possibly used before declaration" warnings and "undefined function" errors (the undefined functions identified are all in the includes, all of which are the the UDF's from the AutoIt distribution).

I tried using #Obfuscator_off/on before and after the block where I have all the #include directives, but I get "invalid compiler directive".

Edit: nevermind, putting the full path for the include files solves that problem. Is there a way to tell Obfuscator the path for the standard include files?

Edited January 8, 2010 by Dana

[Dana]

OK... with the include path that problem is gone. I now get only one Obfuscator error:

>Running Obfuscator (1.0.27.0)  from:C:\Program Files (x86)\AutoIt3\SciTE cmdline:/Beta
- Invalid Obfuscator option: 
-###2 Obfuscation Error: Found Execute() statement which will lead to problems running your obfuscated script.
>### current Func: _WinAPI_SetLayeredWindowAttributes
C:\Program Files (x86)\AutoIt3\Include\WinAPI.au3(5364,1) Warning for line:$i_transcolor = Execute('0x00' & StringMid($i_transcolor, 5, 2) & StringMid($i_transcolor, 3, 2) & StringMid($i_transcolor, 1, 2)) 

-#############################################################################################
-#### Obfuscator Found   1 Error(s)!!!!    This means your script could have problems running properly.  ####
-#############################################################################################

WinAPI is not one of my includes, so obviously it's called from one of the UDF's I do call.

The .exe is created, and as far as I can tell so far, runs properly with no problems.

[Xenobiologist]

A lot of UDF have the Winapi.au3 included. If you don't strip those functions, then the one using Execute which can lead to problems is also included in your script.

[wraithdu]

I think that one is safe to ignore. Look at the line referenced:

Execute('0x00' & StringMid($i_transcolor, 5, 2) & StringMid($i_transcolor, 3, 2) & StringMid($i_transcolor, 1, 2))

It's just creating an integer from a hex string for a color. IMO, this should be using the Number() function, not Execute().

[notsure]

1 word: Magnificent.