Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Deobfuscate code

I need to deobfuscate some .au3 source files that have been obfuscated with "AutoIt3 Source Obfuscator v1.0.30.1 Copyright © Jos van der Zande June 8, 2012".

The only thing I got looking for the author is a thread claiming the obfuscator has been discontinued and source code isn't available.. any hint?
Googled for 5 minutes so don't expect much but... this?

https://www.autoitscript.com/site/autoit-script-editor/
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
(Nov 6, 2018 07:44 PM)Aura Wrote:  Googled for 5 minutes so don't expect much but... this?

https://www.autoitscript.com/site/autoit-script-editor/

Hi Aura, it has been long time since I met you last time :)

On topic: Saw it, but isn't it a simple code editor? I use Notepad++ to read sources, the problem is that they are obfuscated

Here's a portion of the code for your understanding:

[Image: Wka7dku.png]
if you really need it and you use notepad++
double click var it will highlight all of them in notepad++
copy it then search and replace it with new name
do it for all vars
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
(Nov 7, 2018 02:45 AM)HFDone Wrote:  if you really need it and you use notepad++
double click var it will highlight all of them in notepad++
copy it then search and replace it with new name
do it for all vars

Are you sure I can use a random name?
(Nov 7, 2018 03:02 AM)Ombra Wrote:  Are you sure I can use a random name?

You should of course not use douplicated variables or reserved ones.
But yeah it is pretty much search and replace, after you have done that i think you should take a look at the functions to reverse them when they are obfuscated too.
I've checked the source deeply and there are definitely too many variables to search and replace each one.

Any other suggestion?
(Nov 7, 2018 03:39 AM)Ombra Wrote:  I've checked the source deeply and there are definitely too many variables to search and replace each one.

Any other suggestion?

if you know to code write code to do it for you.
read the file find all the vars and replace them
should be easy to do
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
(Nov 7, 2018 03:39 AM)Ombra Wrote:  I've checked the source deeply and there are definitely too many variables to search and replace each one.

Any other suggestion?

I would suggest that you upload the code so we can take a better look at it.
(Nov 7, 2018 05:49 AM)Abruptum Wrote:  I would suggest that you upload the code so we can take a better look at it.

I'd rater hire somebody to evaluate the source and try to work on it
(Nov 7, 2018 05:52 AM)Ombra Wrote:  I'd rater hire somebody to evaluate the source and try to work on it

hit me up Ombra with the source, ill check if i can deobfuscate this. Im programing in autoit for years.
Please Read before creating a Technical Thread
CyberStrike hope to see you around somewhen again


Possibly Related Threads...
Thread / Author Replies Views Last Post
by freegamaAug 24, 2022 03:46 AM 1 238 Aug 24, 2022 03:46 AM
Last Post: PELock
[Lua] by POL4RBE4RJan 13, 2021 08:15 PM 2 388 Jan 13, 2021 08:15 PM
Last Post: alienav
[Lua] by VirtualMachinimaFeb 1, 2019 12:43 PM 5 439 Feb 1, 2019 12:43 PM
Last Post: LocalOffset