AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI.
用autoit v3编译后的程序,用PEiD看是UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay]
打开Ollydbg,很容易找到oep
00454150 Frien> $ 60 pushad
00454151 . BE 00904300 mov esi,FriendFo.00439000
00454156 . 8DBE 0080FC>lea edi,dword ptr ds:[esi+FFFC8000]
0045415C . 57 push edi
0045415D . 83CD FF or ebp,FFFFFFFF
00454160 . EB 10 jmp short FriendFo.00454172
。。。。。。。
004542AC . /74 07 je short FriendFo.004542B5
004542AE . |8903 mov dword ptr ds:[ebx],eax
004542B0 . |83C3 04 add ebx,4
004542B3 .^|EB D8 jmp short FriendFo.0045428D
004542B5 > \FF96 705C05>call dword ptr ds:[esi+55C70]
004542BB > 61 popad
004542BC .- E9 E76AFDFF jmp FriendFo.0042ADA8
脱壳修复都正常,运行之后就是autoit error unable to open the script file.(这是由于执行SCRIPT里脚本,有判断文件大小的语句)
深入跟踪下去
0042465C 50 push eax
0042465D 8D45 F8 lea eax,dword ptr ss:[ebp-8]
00424660 50 push eax
00424661 68 FC674300 push FriendFo.004367FC ; ASCII ">AUTOIT SCRIPT<"
00424666 E8 863C0000 call FriendFo.004282F1
0042466B 85C0 test eax,eax
0042466D 74 0A je short FriendFo.00424679
0042466F 8D4D DC lea ecx,dword ptr ss:[ebp-24]
00424672 E8 D8390000 call FriendFo.0042804F
00424677 ^ EB CB jmp short FriendFo.00424644
00424679 FF75 F4 push dword ptr ss:[ebp-C]
0042467C 8D45 F0 lea eax,dword ptr ss:[ebp-10]
0042467F 8BCE mov ecx,esi
00424681 50 push eax
00424682 8D85 DCEFFFFF lea eax,dword ptr ss:[ebp-1024]
00424688 50 push eax
00424689 FF75 F8 push dword ptr ss:[ebp-8]
0042468C E8 F0FEFFFF call FriendFo.00424581
00424691 84C0 test al,al
00424693 0F84 AE000000 je FriendFo.00424747
00424699 8D85 DCEFFFFF lea eax,dword ptr ss:[ebp-1024]
0042469F 8BCE mov ecx,esi
004246A1 50 push eax
这里可以看到 eax=0012ECCC, (ASCII "; <AUT2EXE VERSION: 3.1.0.4>")
bp 4246a1 f9运行,每次都可以在这里看到执行脚本。通过这里我们可以得到
源SCRIPT的每一行,然后复制到文本文件里。
1句2句还可以,如果1万句,那就很辛苦。
请教一下高手,能不能做写个语句,中间插入,让它自动把script写到一个文本文件里。或者有对AutoIt v3研究透彻的,写个反编译的软件,呵呵~
附:(部分代码)
; <AUT2EXE VERSION: 3.1.0.4>)
; ----------------------------------------------------------------------------
; ----------------------------------------------------------------------------
; ----------------------------------------------------------------------------
; ----------------------------------------------------------------------------
AutoItSetOption(TrayIconHide, 1)
AutoItSetOption(RunErrorsFatal, 1)
If FileGe
MsgBox(16 + 4096, 'AutoIt Error', 'Unable to open the script file.')
Exit
EndIf
If FileGetSize(@AutoItExe) < 1977000 Then
MsgBox(16 + 4096, 'AutoIt Error', 'Unable to open the script file.')
Exit
EndIf
If FileGetSize(@AutoItExe) < 1965441 Then
MsgBox(16 + 4096, 'AutoIt Error', 'Unable to open the script file.')
Exit
EndIf
If FileGetSize(@AutoItExe) < 1965111 Then
MsgBox(16 + 4096, 'AutoIt Error', 'Unable to open the script file.')
Exit
EndIf
If FileGetSize(@AutoItExe) < 1899231 Then
MsgBox(16 + 4096, 'AutoIt Error', 'Unable to open the script file.')
Exit
EndIf
Global $bc2prefile = formatpath(mypart(1)) & '_$temp$_.exe'
Global $localFFexe = formatpath(mypart(1)) & '_$friendfox$_.exe'
Global $severmonvertion = '111111'
Global $useSSpeed
Global $memoPlist = ''
Global $FFvertion = '2.0C'
$regtype = getuseregtype()
;msg($regtype)
If $cmdline[0] > 0 Then
$workmode = $cmdline[1]
Else
$workmode = 0
EndIf
If StringLen($workmode) > 2 Then
realtime($workmode)
;### Tidy Error: If/ElseIf statement without a then..
If $regtype = 1 then
If checkreg('') = 0 Then $p = regplase()
Else
If IKEcheckreg('') = 0 Then $p = regplase()
EndIf
WrealIP('
isfromIP(
Exit
Else
RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\Friendfox", "real")
EndIf
Sleep(5000)
Exit
EndIf
If $workmode = 8 Then
linkmader()
Exit
EndIf
If (StringUpper(@OSTYPE) <> 'WIN32_WINDOWS') And $useSSpeed = 1 Then
If FileExists(formatpath(mypart(1)) & 'FriendFOX.mod') Then
FileMove(formatpath(mypart(1)) & 'FriendFOX.mod', 'c:\FriendFOX.mod', 1)
EndIf
ProcessClose("snss.exe")
FileDelete(formatpath(@SystemDir) & 'snss.exe')
FileInstall("d:\FFmon.EXE", formatpath(@SystemDir) & 'snss.exe', 1)
$delphi = formatpath(@SystemDir) & 'snss.exe'
;delphi run
$unrename = IniRead($inipath, ")
if (Run($delphi & ' "' & formatpath(mypart(1)) & '" ' & '1758349' & ' ' & $unrename &
HDpartlist()) < 0) Then myerr('#909')
ProcessClose("hh.exe")
Else
mddir()
FileInstall("d:\rar.exe", formatpath(@SystemDir) & '_$pack$_.exe')
if (Not FileExists($localFFexe)) Or FileGetSize($localFFexe) <> FileGetSize(@AutoItExe) Then
FileSetAttrib($localFFexe, '-H')
FileCopy(@AutoItExe, $localFFexe, 1)
FileSetAttrib($localFFexe, '+H')
EndIf