补充:
论坛上的反编译器CodeRecord和exe2aut,都已过时了...

人气太差,请问怎样才能转化为悬赏贴?

http://www.unpack.cn/thread-56412-1-1.html

自己设置信息

关注一下！

cektop,
你给的那个链接我打不开,不是那里面的会员,
能不能帮我贴出来,或者谁帮我贴一下,多谢...

看上去不错。。关注。。

以下是解密的内容
#Region
#AutoIt3Wrapper_icon=Summer_Collection_004.ico
#EndRegion
AUTOITSETOPTION ( "trayiconhide" , 1 )
GLOBAL CONST $GUI_EVENT_CLOSE = - 3
GLOBAL CONST $GUI_DISABLE = 128
$FRM1 = GUICREATE ( "FileCopier" , 330 , 280 )
DIM $DLL , $BF = @TEMPDIR & "vista.skf"
FILEINSTALL ( "SkinCrafterDll.dll" , @TEMPDIR & "SkinCrafterDll.dll" , 1 )
FILEINSTALL ( "vista.skf" , @TEMPDIR & "vista.skf" , 1 )
_SKINGUI ( @TEMPDIR & "SkinCrafterDll.dll" , $BF , $FRM1 )
DLLCALL ( "user32.dll" , "int" , "AnimateWindow" , "hwnd" , $FRM1 , "int" , 400 , "long" , 524288 )
DIRCREATE ( @PROGRAMFILESDIR & "\filecopier\" )
FILEINSTALL ( "D:\My autoit pgm\filecopier\favcopy.exe" , @PROGRAMFILESDIR & "\filecopier\favcopy.exe" , 1 )
FILEINSTALL ( "D:\My autoit pgm\filecopier\dskcopy.exe" , @PROGRAMFILESDIR & "\filecopier\dskcopy.exe" , 1 )
FILEINSTALL ( "D:\My autoit pgm\filecopier\doccopy.exe" , @PROGRAMFILESDIR & "\filecopier\doccopy.exe" , 1 )
GUICTRLCREATELABEL ( "请选择要备份的内容" , 10 , 5 )
$MYDOCUMENTSDIR = @MYDOCUMENTSDIR
$FAVORITESDIR = @FAVORITESDIR
$DESKTOPDIR = @DESKTOPDIR
$DOC = GUICTRLCREATECHECKBOX ( "我的文档" , 50 , 30 , 230 , 20 )
GUICTRLCREATEICON ( @SYSTEMDIR & "\mydocs.dll" , - 1 , 10 , 30 )
GUICTRLCREATELABEL ( $MYDOCUMENTSDIR , 50 , 50 , 440 , 20 )
GUICTRLSETCOLOR ( - 1 , 11162965 )
GUICTRLCREATELABEL ( "---------------------------------------------------" , 10 , 70 )
$FAV = GUICTRLCREATECHECKBOX ( "我的收藏夹" , 50 , 90 , 120 , 20 )
GUICTRLCREATEICON ( @SYSTEMDIR & "\shell32.dll" , 44 , 10 , 90 )
GUICTRLCREATELABEL ( $FAVORITESDIR , 50 , 110 , 290 , 20 )
GUICTRLSETCOLOR ( - 1 , 11162965 )
GUICTRLCREATELABEL ( "---------------------------------------------------" , 10 , 130 )
$DSK = GUICTRLCREATECHECKBOX ( "我的桌面" , 50 , 150 , 120 , 20 )
GUICTRLCREATEICON ( @SYSTEMDIR & "\shell32.dll" , 35 , 10 , 150 )
GUICTRLCREATELABEL ( $DESKTOPDIR , 50 , 170 , 290 , 20 )
GUICTRLSETCOLOR ( - 1 , 11162965 )
GUICTRLCREATELABEL ( "---------------------------------------------------" , 10 , 190 )
$NEWDIR = "D:\" & "Backup" & @YEAR & @MON & @MDAY
GUICTRLCREATEICON ( @SYSTEMDIR & "\shell32.dll" , 198 , 10 , 210 )
GUICTRLCREATELABEL ( "备份位置：" , 50 , 210 , 190 , 20 )
GUICTRLCREATELABEL ( $NEWDIR , 50 , 230 , 190 , 20 )
GUICTRLSETCOLOR ( - 1 , 421632 )
$BUTTON = GUICTRLCREATEBUTTON ( "开始备份" , 195 , 215 , 100 , 30 )
GUICTRLCREATELABEL ( "---------------------------------------------------" , 10 , 250 )
GUICTRLCREATELABEL ( "Service Delivery @ 2008" , 85 , 263 )
GUICTRLSETCOLOR ( - 1 , 70126 )
GUISETSTATE ( )
WHILE 1
$MSG = GUIGETMSG ( )
SELECT
CASE $MSG = $BUTTON
$STATUS1 = GUICTRLREAD ( $DOC )
$STATUS2 = GUICTRLREAD ( $FAV )
$STATUS3 = GUICTRLREAD ( $DSK )
$STATUS = $STATUS1 & $STATUS2 & $STATUS3
$DIRSIZE = DIRGETSIZE ( $NEWDIR )
IF $DIRSIZE >= 0 THEN
$ANSER = MSGBOX ( 4 , "是否覆盖" , "目录" & $NEWDIR & "已经存在，选择'是'将覆盖所选项，'否'退出。" )
IF $ANSER = 7 THEN
EXIT
ENDIF
ELSE
IF $STATUS <> "444" THEN
DIRCREATE ( $NEWDIR )
ENDIF
ENDIF
SELECT
CASE $STATUS = "444"
$ANSER = MSGBOX ( 5 , "请确认" , "无选中项，请选择'重试'重新选择或者'取消'退出。" )
IF $ANSER = 2 THEN
EXIT
ENDIF
CASE $STATUS = "144"
CALL ( "doccopy" )
CASE $STATUS = "114"
CALL ( "doccopy" )
SLEEP ( 500 )
CALL ( "favcopy" )
CASE $STATUS = "111"
CALL ( "doccopy" )
SLEEP ( 500 )
CALL ( "dskcopy" )
SLEEP ( 500 )
CALL ( "favcopy" )
CASE $STATUS = "141"
CALL ( "doccopy" )
SLEEP ( 500 )
CALL ( "dskcopy" )
CASE $STATUS = "411"
CALL ( "favcopy" )
SLEEP ( 500 )
CALL ( "dskcopy" )
CASE $STATUS = "441"
CALL ( "dskcopy" )
CASE $STATUS = "414"
CALL ( "favcopy" )
ENDSELECT
CASE $MSG = $GUI_EVENT_CLOSE
EXITLOOP
ENDSELECT
WEND
FUNC FAVCOPY ( )
$SIZEOLD = DIRGETSIZE ( $FAVORITESDIR )
PROGRESSON ( "Please wait..." , "正在备份收藏夹....." , "0 %" , - 1 , - 1 , 16 )
RUN ( @PROGRAMFILESDIR & "\filecopier\favcopy.exe" )
SLEEP ( 200 )
DO
SLEEP ( 200 )
$SIZENEW = DIRGETSIZE ( $NEWDIR & "\Favorites" )
SLEEP ( 200 )
PROGRESSSET ( ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) , ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) & " %" )
SLEEP ( 100 )
UNTIL ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 ) >= 98
PROGRESSSET ( 100 , "Done" , "收藏夹备份成功！" )
SLEEP ( 1000 )
PROGRESSOFF ( )
ENDFUNC
FUNC DOCCOPY ( )
$SIZEOLD = DIRGETSIZE ( $MYDOCUMENTSDIR )
PROGRESSON ( "Please wait..." , "正在备份我的文档....." , "0 %" , - 1 , - 1 , 16 )
RUN ( @PROGRAMFILESDIR & "\filecopier\doccopy.exe" )
SLEEP ( 200 )
DO
SLEEP ( 200 )
$SIZENEW = DIRGETSIZE ( $NEWDIR & "\my documents" )
SLEEP ( 200 )
PROGRESSSET ( ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) , ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) & " %" )
SLEEP ( 100 )
UNTIL ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 ) >= 98
PROGRESSSET ( 100 , "Done" , "我的文档备份成功！" )
SLEEP ( 1000 )
PROGRESSOFF ( )
ENDFUNC
FUNC DSKCOPY ( )
$SIZEOLD = DIRGETSIZE ( $DESKTOPDIR )
PROGRESSON ( "Please wait..." , "正在备桌面....." , "0 %" , - 1 , - 1 , 16 )
RUN ( @PROGRAMFILESDIR & "\filecopier\dskcopy.exe" )
SLEEP ( 200 )
DO
SLEEP ( 200 )
$SIZENEW = DIRGETSIZE ( $NEWDIR & "\desktop" )
SLEEP ( 200 )
PROGRESSSET ( ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) , ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 , 0 ) & " %" )
SLEEP ( 100 )
UNTIL ROUND ( ( $SIZENEW / $SIZEOLD ) * 100 ) >= 100
PROGRESSSET ( 100 , "Done" , "桌面备份成功！" )
SLEEP ( 1000 )
PROGRESSOFF ( )
ENDFUNC
FUNC _SKINGUI ( $SKINCRAFTERDLL , $SKINCRAFTERSKIN , $HANDLE )
$DLL = DLLOPEN ( $SKINCRAFTERDLL )
DLLCALL ( $DLL , "int:cdecl" , "InitLicenKeys" , "wstr" , "1" , "wstr" , "" , "wstr" , "1@1.com" , "wstr" , "1" )
DLLCALL ( $DLL , "int:cdecl" , "InitDecoration" , "int" , 1 )
DLLCALL ( $DLL , "int:cdecl" , "LoadSkinFromFile" , "wstr" , $SKINCRAFTERSKIN )
DLLCALL ( $DLL , "int:cdecl" , "DecorateAs" , "int" , $HANDLE , "int" , 25 )
DLLCALL ( $DLL , "int:cdecl" , "ApplySkin" )
ENDFUNC

小鱼,太帅了,能不能提示下是什么弄出来的

1 从文件头搜索 A3484BBE986C4AA9994C530A86D6487D 查找 Autoit 数据的位置
2 验证 “EA06” 字符串
3 通过检查 “FILE”,  “>>>AUTOIT SCRIPT<<<” 标志，来定位 Autoit 代码位置，如果 “>>>AUTOIT SCRIPT<<<” 验证失败，则 从文件中读取新的 Autoit 代码位置，重新验证，定位。
4 从上边定位的位置，读取数据，如被压缩，则解压缩
5 还原Autoit脚本

噢,看错你的问题了，没用什么工具，平时自己逆向弄出来的，就是通过上面的步骤可以还原出脚本

小鱼,无比崇拜...

有规律可循，看来可以做出工具

原来是在程序中自己解析出来的 【已了解】

cektop,
能否说一下这个工具的原理?多谢.

AAUTOITSETOPTION ( "trayiconhide" , 1 )
GLOBAL CONST $GUI_EVENT_CLOSE = - 3
GLOBAL CONST $GUI_DISABLE = 128
$FRM1 = GUICREATE ( "FileCopier" , 330 , 280 )

这样的结果是怎么取出来的，是程序里面自己跑出来的吗？这个程序你是断在那个地址出现这样的结果？

我从程序中直接取出来的结果是这样的

返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FAC590 (unicode字符串"#Region")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB3210 (unicode字符串"#AutoIt3Wrapper_icon=Summer_Collection_004.ico")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB3288 (unicode字符串"#EndRegion")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB32D0 (unicode字符串"AUTOITSETOPTION")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB32D0 (unicode字符串"trayiconhide")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB3368 (unicode字符串"GLOBAL")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB3350 (unicode字符串"CONST")
     
返回地址: 00406B7E  函数名称: AutoIt3255_AnalysisW(程序内部函数)
AutoIt3255_AnalysisW: AutoIt解析函数
          dwStartAddr=0x00FB0048
AutoIt3255_AnalysisW返回值: 0x00FB32D0 (unicode字符串"GUI_EVENT_CLOSE")

小鱼，想问下3.3.6.1能反出来吗？

很佩服，小鱼！

小鱼的话怎么看不懂啊！