+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: Deobfuscate code (/showthread.php?tid=5904478)
Deobfuscate code - Ombra - Nov 6, 2018
I need to deobfuscate some .au3 source files that have been obfuscated with "AutoIt3 Source Obfuscator v1.0.30.1 Copyright © Jos van der Zande June 8, 2012".
The only thing I got looking for the author is a thread claiming the obfuscator has been discontinued and source code isn't available.. any hint?
RE: Deobfuscate code - Aura - Nov 6, 2018
Googled for 5 minutes so don't expect much but... this?
https://www.autoitscript.com/site/autoit-script-editor/
RE: Deobfuscate code - Ombra - Nov 7, 2018
(Nov 6, 2018 07:44 PM)Aurа Wrote: Googled for 5 minutes so don't expect much but... this?
https://www.autoitscript.com/site/autoit-script-editor/
Hi Aura, it has been long time since I met you last time :)
On topic: Saw it, but isn't it a simple code editor? I use Notepad++ to read sources, the problem is that they are obfuscated
Here's a portion of the code for your understanding:
![[Image: Wka7dku.png]](https://i.imgur.com/Wka7dku.png)
RE: Deobfuscate code - HFDone - Nov 7, 2018
if you really need it and you use notepad++
double click var it will highlight all of them in notepad++
copy it then search and replace it with new name
do it for all vars
RE: Deobfuscate code - Ombra - Nov 7, 2018
(Nov 7, 2018 02:45 AM)HFDone Wrote: if you really need it and you use notepad++
double click var it will highlight all of them in notepad++
copy it then search and replace it with new name
do it for all vars
Are you sure I can use a random name?
RE: Deobfuscate code - Abruptum - Nov 7, 2018
(Nov 7, 2018 03:02 AM)Ombra Wrote: Are you sure I can use a random name?
You should of course not use douplicated variables or reserved ones.
But yeah it is pretty much search and replace, after you have done that i think you should take a look at the functions to reverse them when they are obfuscated too.
RE: Deobfuscate code - Ombra - Nov 7, 2018
I've checked the source deeply and there are definitely too many variables to search and replace each one.
Any other suggestion?
RE: Deobfuscate code - HFDone - Nov 7, 2018
(Nov 7, 2018 03:39 AM)Ombra Wrote: I've checked the source deeply and there are definitely too many variables to search and replace each one.
Any other suggestion?
if you know to code write code to do it for you.
read the file find all the vars and replace them
should be easy to do
RE: Deobfuscate code - Abruptum - Nov 7, 2018
(Nov 7, 2018 03:39 AM)Ombra Wrote: I've checked the source deeply and there are definitely too many variables to search and replace each one.
Any other suggestion?
I would suggest that you upload the code so we can take a better look at it.
RE: Deobfuscate code - Ombra - Nov 7, 2018
(Nov 7, 2018 05:49 AM)Abruptum Wrote: I would suggest that you upload the code so we can take a better look at it.
I'd rater hire somebody to evaluate the source and try to work on it
RE: Deobfuscate code - Jacque Fresco - Nov 10, 2018
(Nov 7, 2018 05:52 AM)Ombra Wrote: I'd rater hire somebody to evaluate the source and try to work on it
hit me up Ombra with the source, ill check if i can deobfuscate this. Im programing in autoit for years.