AutoIt3 Decompiler

[sowhat-x]

http://maghia.free.fr/Board/viewtopic.php?t=234

Useful to keep an eye on this thread...from time to time,
cw2k posts newer versions of his decompiler there...it's open source also. 

Note though that the..."AutoIt people",
weren't happy at all learning about the abilities of this tool:
they actually banned/removed the whole thread in their forums regarding it.
Fairly understandable from their own point of view...in the final end,
who doesn't want to protect his code and intellectual properties etc.
But well,there are also other problems to be solved in this world as well... 

[bobby]

Is it updated to extract the files too?
The version I have extracts only the script.

[sowhat-x]

...to be honest,bobby,I haven't had the opportunity to 'play' around with the latest version yet...
so I just archived both v1.8 and v1.9 in case their needed...
I also had a very older one somewhere here that "simply" extracted the script...

The .7z archive of the v1.9 comes with a few samples as well,I'll probably give it a try in the next days....
What I see though,is that except from obviously updating it to deal with newer versions,
he has also added support for a couple of custom-made AutoIt obfuscators...

[sowhat-x]

...he-he,seems like cw2k is quite busy... 
He just released a decompiler/unpacker for "Quick Batch File Compiler",
sources in Delphi also available...

http://maghia.free.fr/Board/viewtopic.php?t=855

...I had heard of Quick Batch File Compiler,wasn't aware of ScriptCryptor though...
anyone that has came across samples made with them?
I'll try getting a copy in order to have a look,figure out PEiD sigs or so if needed...
===========================
bobby,I had the opportunity tonight,
of playing a bit around with cw2k's AutoIt decompiler (v1.92)...
I tested it against an AutoHotKey-based malware (not AutoIt),and well,
at least in my case,it successfully extracted all the embedded executables... 

[bobby]

Aaa, what a nice morning
Coffee + good news = excellent mood.

Thanks. 

[sowhat-x]

Updated -> v2.2 available 
http://myauttoexe.angelfire.com/