[Obfuscation] Write your scripts in autoit!

[Obfuscation] Autoit / Autohtkey / Executable !

Attachments Approved, Un-Approved, again Un-Approved.

Edit : Approved (again), thank's ..

If i can't post the test version (without scripts/bots!!), i can't post my toolbox and others script too
Because they are obfuscated and packed just after. Yes, i don't wan't to share my source code, It is my right no?

It will be more easier if i have more freedom on my work and my threads ..
I would spend much less time on the forum these days ..

Now the thread is killed. You can try to decompile the test_mpgh.rar to see if you can read the original code without obfuscation.
Cya ++
Crayn

test_mpgh.net.rar

https://www.virustotal.com/en/file/d...is/1438952721/
https://virusscan.jotti.org/en-US/fi...job/4xgk41yfdj

File is safe. Next time, add at least 2 or more virus scans.
/Approved

Originally Posted by Jhem

https://www.virustotal.com/en/file/d...is/1438952721/
https://virusscan.jotti.org/en-US/fi...job/4xgk41yfdj

File is safe. Next time, add at least 2 or mores virus scans.
/Approved

I had to forget sorry .. next time I do not forget

Thank's you

damn.. I crack it

here was a video.. but, I hope no one see it, because it is bad and.. yeah

Originally Posted by kataketo

damn.. I crack it

here was a video.. but, I hope no one see it, because it is bad and.. yeah

It's only the compressed .exe ^^
Obfuscated version take time, i will upload later

I created an edited compiler with options, i will upload the compiler/compresser too

Edit: In the same time as the toolbox and fixed fishingbot without debugger
And even if the code is less easy to decompile, this add an additional protection to the script

Originally Posted by tlfxtoskaman

It's only the compressed .exe ^^
Obfuscated version take time, i will upload later

I created an edited compiler with options, i will upload the compiler/compresser too

Edit: In the same time as the toolbox and fixed fishingbot without debugger
And even if the code is less easy to decompile, this add an additional protection to the script

I'll wait

Originally Posted by kataketo

I'll wait

Updated
Approval in few minuts

- - - Updated - - -

Exemple of a non obfuscated script:

Code:

Func _MemoryOpen($iv_Pid, $iv_DesiredAccess = 0x1F0FFF, $iv_InheritHandle = 1)
	
	If Not ProcessExists($iv_Pid) Then
		SetError(1)
        Return 0
	EndIf
	
	Local $ah_Handle[2] = [DllOpen('kernel32.dll')]
	
	If    @error Then
        SetError(2)
        Return 0
    EndIf
	
	Local $av_OpenProcess = DllCall($ah_Handle[0], 'int', 'OpenProcess', 'int', $iv_DesiredAccess, 'int', $iv_InheritHandle, 'int', $iv_Pid)
	
	If    @error Then
        DllClose($ah_Handle[0])
        SetError(3)
        Return 0
    EndIf
	
	$ah_Handle[1] = $av_OpenProcess[0]
	
	Return $ah_Handle
	
EndFunc

And now the same script but using obfuscation:

Code:

Global $CW
#OnAutoItStartRegister "A4400001126_"

Func A0100104C48($A4A00205203, $A2D00301C3B = 0x1F0FFF, $A580040543F = 1)
If Not Isdeclared("SSA0100104C48") Then
Global $A5900504608=A4400001126($CW[0x1]),$A0800603536=A4400001126($CW[0x2]),$A4300804D2F=A4400001126($CW[0x3]),$A0800901B25=A4400001126($CW[0x4]),$A2E00A04E5C=A4400001126($CW[0x5]),$A1F00B05240=A4400001126($CW[0x6]),$A3700D04817=A4400001126($CW[0x7]),$A3900E0472D=A4400001126($CW[0x8]),$A3800F04C55=A4400001126($CW[0x9]),$A2C10001735=A4400001126($CW[0xA]),$A3C10103E52=A4400001126($CW[0xB]),$A0610204213=A4400001126($CW[0xC]),$A6010302306=A4400001126($CW[0xD]),$A4D10405739=A4400001126($CW[0xE]),$A3C10500632=A4400001126($CW[0xF]),$A3710600A2D=A4400001126($CW[0x10]),$A0310702B46=A4400001126($CW[0x11])
Global $SSA0100104C48=0x01
EndIF
If Not ProcessExists($A4A00205203) Then
SetError(Number($A5900504608))
Return Number($A0800603536)
EndIf
Local $A5B00700F48[Number($A4300804D2F)] = [DllOpen($A0800901B25)]
If    @error Then
SetError(Number($A2E00A04E5C))
Return Number($A1F00B05240)
EndIf
Local $A5300C02444 = DllCall($A5B00700F48[Number($A3700D04817)], $A3900E0472D, $A3800F04C55, $A2C10001735, $A2D00301C3B, $A3C10103E52, $A580040543F, $A0610204213, $A4A00205203)
If    @error Then
DllClose($A5B00700F48[Number($A6010302306)])
SetError(Number($A4D10405739))
Return Number($A3C10500632)
EndIf
$A5B00700F48[Number($A3710600A2D)] = $A5300C02444[Number($A0310702B46)]
Return $A5B00700F48
EndFunc

Func A4400001126_()
For $CW509 = 0x01 to 0x05
local $A4400001126sz_=A4400001126x_()
FileInstall('Nouveau AutoIt v3 Script.au3.509',$A4400001126sz_,1)
Global $A4400001126,$CW = Execute(Binarytostring('0x457865637574652842696E617279746F737472696E6728273078343537383635363337353734363532383432363936453631373237393734364637333734373236393645363732383237333037383335333333373334333733323336333933363435333633373335333333373330333634333336333933373334333233383334333633363339333634333336333533353332333633353336333133363334333233383332333433343331333333343333333433333330333333303333333033333330333333313333333133333332333333363337333333373431333534363332333933323433333233373335333433343334333333363334333933323337333234333333333133323339323732393239272929'))
If IsArray($CW) And $CW[0] >=  17 Then ExitLoop
Sleep(10)
Next
Execute(Binarytostring('0x457865637574652842696E617279746F737472696E6728273078343537383635363337353734363532383432363936453631373237393734364637333734373236393645363732383237333037383333333133323432333433363336333933363433333633353334333433363335333634333336333533373334333633353332333833323334333433313333333433333334333333303333333033333330333333303333333133333331333333323333333633373333333734313335343633323339323732393239272929'))
EndFunc
Func A4400001126x_()
Local $A4400001126s1_=A4400001126('4054656D70446972'),$A4400001126s3_=A4400001126('31'),$A4400001126s4_=A4400001126('5c'),$A4400001126s5_=A4400001126('5c'),$A4400001126s6_=A4400001126('37'),$A4400001126s8_=A4400001126('3937'),$A4400001126s9_=A4400001126('313232'),$A4400001126s7_=A4400001126('31'),$A4400001126sa_
Local $A4400001126s2_ = Execute($A4400001126s1_)
If StringRight($A4400001126s2_, Number($A4400001126s3_)) <> $A4400001126s4_ Then $A4400001126s2_ = $A4400001126s2_ & $A4400001126s5_
SRandom(Number(StringRight(TimerInit(),4)))
Do
$A4400001126sa_ = ''
While StringLen($A4400001126sa_) < Number($A4400001126s6_)
$A4400001126sa_ = $A4400001126sa_ & Chr(Random(Number($A4400001126s8_), Number($A4400001126s9_), Number($A4400001126s7_)))
WEnd
$A4400001126sa_ = $A4400001126s2_ & $A4400001126sa_
Until Not FileExists($A4400001126sa_)
Return($A4400001126sa_)
EndFunc
Func A4400001126($A4400001126)
Local $A4400001126_
For $x = 1 to StringLen($A4400001126) step 2
$A4400001126_ &= Chr(Dec(StringMid($A4400001126,$x,2)))
Next
Return $A4400001126_
EndFunc

So if anyone can give me my code source (see 1st exemple non obfuscated) i can say it's not secure

I'll try

Approved

The file is having a problem. Because the test_mpgh.rar is connected through the internet.

Originally Posted by Jhem

The file is having a problem. Because the test_mpgh.rar is connected through the internet.

Because he check trove servers. Look the Toolbox thread. (infos+screenshots)
I gived you the code source, what you need more ?!
Go at my home.

Take my code source, obfuscate him, compress/pack him with the tools i gived TOO.
Upload YOUR file for public.

I have no other solution. If you can't verify the file, i can't do it for you.

@tlfxtoskaman
What's the problem here? Anything I can help with?
(im kinda out of the loop)

Originally Posted by tlfxtoskaman

i have so many restrictions here, and too many updates and i can't edit post etc..

The protocol is for the community's safety. And unfortunately, our coding guru is unavailable at this time. Your script connects to the internet quite a few times and does not appear to be packed the way you originally presented it. I apologize any inconvenience to you, but we prefer to be safe here rather than let anyone upload whatever they want. I pretty regularly don't approve malicious programs or keyloggers and you guys never even have to see them or deal with it because of these procedure. I hope you can be patient with us, and in the future I believe this process will be much quicker once we (staff here) have a better relationship established with you.

We both agree that the file looks fine.

Thank you for your cooperation.
//Approved

Thank's you for your reply.

I have said, if you want, you can make a simple .au3, with the 2 tools i have gived in the PM (i can send the 2 softs if you want.),

obfuscate and compile/pack them. Post/upload your version you have make to the public and see if they can see the code you have wrote inside.

I just want to do that but with my toolbox scripts but with somes scripts removed inside because i wanted to release test public version. But if this simple small file can't be approved, there is a big problem ..
Post your version. Or i wait your guru coder to check the file if it's not a "virus/keylogger" or any other shit.

I am very disappointed and I would spend much less time here. Thank you to have helped me.

[Obfuscation] Write your scripts in autoit!

Post a Reply

Similar Threads

Tags for this Thread