~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AutoIt Obfuscator v1.6 - by Bartosz Wójcik https://www.pelock.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AutoIt Obfuscator is a tool to modify AutoIt script source code in this way to
make an analysis of obfuscated code very difficult

Obfuscation is a process of transforming AutoIt source code into protected
version of itself. The script functionality stays the same, everything works
the same, but the source code is protected from analysis, all of the variables
are encrypted, strings are encrypted, our AutoIt Obfuscator uses multiple
obfuscation strategies to protect the real meaning of your AutoIt source code.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AutoIt decompilation
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Why should you obfuscate your scripts you might ask yourself? After all,
they are compiled to executable format, right?

Is it possible to decompile AutoIt compiled executables back to the source code?
Of course it's possible! Our company provides source code recovery service that
enables you to restore any AutoIt application back to its original source code.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
How is it done and why is it possible?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AutoIt code is not compiled to native x86 or x86-64 code, it's not even compiled
to pseudocode (like it's done for .NET or Java code).

When AutoIt script is "compiled" into executable format, its original script
source code is stored as a resource in the executable file, the rest of the
executable contains AutoIt interpreter.

Of course it's not stored in plain text, because that would be too easy for
anyone with a simple hex-editor to view, it's stored in encrypted form, but
it's there. With the right tools and knowledge it's possible to restore it
entirely.

And you know what? It can be restored back to source code! Just like you would
write it in SciTE code editor. Entire source code is there, all of the variable
names, original strings, algorithms are exposed to anyone, your competition can
easily steal hours of your hard work.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sensitive topic on official AutoIt forums
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you try to ask about decompilation on the official AutoIt forums you will
get banned. If you will ask about how serious is this a problem for
AutoIt - you will get banned. Joke about it - ban.

Why is it forbidden to ask about decompilation and decompilers for AutoIt?
The answer is simple. It's a known weakness of the AutoIt system, that the
script source code is stored in the executable file. They try as much as
they can to hide the fact how easy is to decompile every AutoIt compiled
executable. As a professional I find this practice very dishonest towards
AutoIt programmers.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Protect your AutoIt scripts source code
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you're writing your software, bots, automation scripts or anything else in
AutoIt and you want to prevent others from decompiling your work to the original
source code form — AutoIt Obfuscator is for you.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
How does AutoIt Obfuscator works?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Our solution is build on two basic components. First one is advanced AutoIt
source code parsing library. It contains a lexer, AST tree parser and code
generator for AutoIt language syntax. No cheap and faulty regular expressions
are used for source code analysis.

The second component is of course our obfuscation engine. It takes the
generated AST tree and applies obfuscation strategies to selected tree
nodes. Many of the obfuscation techniques are novel to AutoIt obfuscation,
but some of the obfuscation strategies  and ideas are taken from our other
security products like x86 assembly Obfuscator or polymorphic string encryption
used in our StringEncrypt service.

After all the modification are done, the AST tree is compiled back to
obfuscated source code format. It might sounds simple, but it's not!
There are many quirks and traps along the way as well as many exceptions
to AutoIt source code parsing and modification.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bug Bounty
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I have tested AutoIt Obfuscator with hundreds of public scripts, examples
and all available language constructs, but it might not work in some very
rare cases and if you find a bug - please report it to me. If I can confirm
your findings I will grant you free access code to the product as a thank
you for your report.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Anti-debugging, anti-VM, anti-sandbox & anti-emulators detections
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The code to detect the popular tools is added to the script and executed at its
beginning. In case of positive detection, the process will be silently
terminated, without any error message.

[x] Insert anti-debugging detections

* Detect debuggers attached to the application process

[x] Insert anti-sandbox detections

* Check for an abnormal low number of physical CPU cores (exit if less than 3)
* Sandboxie (DLL libraries)
* Joe Sandbox (processes)

[x] Insert virtual machine (anti-VM) detections

* VMware (procesess, files, drivers, WMI, BIOS, GFX)
* Oracle Virtual Box (processes, files, drivers, BIOS, GFX)
* Parallels Virtual Machine (processes, files)
KVM (drivers)

[x] Insert anti-emulators (CPU) detections

* WINE (API inconsistencies, DLL libraries, special API functions)
* Bochs (WMI BIOS)
* QEMU (processes, WMI BIOS)
* XEN (processes)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Obfuscation strategies
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Tricks and techniques for deliberately obfuscated code with code examples
of before and after the obfuscation was applied.

===============================================================================
Rename variable names to random string values
===============================================================================

Local $variable = 1             Local $nGuiyagSznwgwh = 1
Global $var = 12345             Global $SMGPZHGE_GRUHVBRVUR_TRMWCXZV = 12345
Dim $iValue = 0xABBA            Dim $var_12 = 0xABBA

All the references to the renamed variables are automatically fixed.

===============================================================================
Rename function names to random string values
===============================================================================

Func Example($param1, $param2)  Func VadOeCmEiez($param1, $param2)
Func ProcessSomething()         Func func_91()
Func Dummy($aArray)             Func AvnsnFunc($aArray)

DllCall() and others using function names as a parameter are automatically
fixed as long as the parameter is passed as a string (not a variable!).

===============================================================================
Rename function names in function calls with randomly named variables
===============================================================================

Local $result = Example($param1, $param2)  Local $result = $VsoLkc($param1, $param2)
ProcessSomething()                         $DOX_MDK_WAVP()
$out = Dummy($aArray)                      $out = $aRacmLko($aArray)
ConsoleWrite("Obfuscation for AutoIt")     $aAxieOjxz("Obfuscation for AutoIt")

Functions in AutoIt can be assigned to variables, this is a good way to hide real function names.

===============================================================================
Shuffle functions order in the output source
===============================================================================

ConsoleWrite(c())               ConsoleWrite(c())

Func a()                        Func c()
    return "Hello!"                 return b()
EndFunc                         EndFunc

Func b()                        Func a()
    return a()                      return "Hello!"
EndFunc                         EndFunc

Func c()                        Func b()
    return b()                      return a()
EndFunc                         EndFunc

AutoIt functions order in the script is not important.

===============================================================================
Resolve WinAPI constants to numerical values, so it can be obfuscated as an
integer values
===============================================================================

MsgBox($MB_ICONINFORMATION, "Title", "Caption") MsgBox(64, "Title", "Caption")

Currently more than 15000 Windows API constants are recognized.

===============================================================================
Encrypt numeric values into series of arithmetic and boolean expressions
===============================================================================

Local $a = 1                    Local $a = 3928 + $EiejcJks[3]
Local $value = 1234             Local $value = (347445640 - 347444406)
Local $lucky_seven = 777        Local $lucky_seven = Int(Sqrt(603729))
Local $var = 0xFFFF             Local $var = BitXOR(312515813, IbmmftJgowlxa())
Local $count = 999              Local $count = BitOR(8966, 1033)
Local $item = 0x100             Local $item = BitNOT(-257)
Local $diabolo = 666            Local $diabolo = BitRotate(10911744, 18, "D")
Local $num = 9                  Local $num = 3 * 3
Local $alignment = 512          Local $alignment = 2 ^ 9

Arithmetic expressions includes + - * ^ operators and Sqrt() function, boolean
expressions includes BitXOR, BitOR, BitNOT, BitRotate functions.

===============================================================================
Split strings into series of random sized substrings connected with a
concatenation operators
===============================================================================

ConsoleWrite("Hello World!")                    ConsoleWrite("H" & "ell" & "o " & "W" & "orld" & "!")
ConsoleWrite('Hello Nasty')                     ConsoleWrite('Hel' & 'lo Nast' & 'y')
ConsoleWrite("Sample ""quotation"" within")     ConsoleWrite("Samp" & "le ""quotation" & """ with" & "in")
ConsoleWrite('Single ''quotation'' example')    ConsoleWrite('Single ' & '''quotati' & 'on''' & ' ' & 'example')

Quoted strings within strings are automatically detected and handled properly.

===============================================================================
Modify strings to obfuscate their values using built-it AutoIt string functions
===============================================================================

ConsoleWrite("Hello World!")            ConsoleWrite(StringReverse("!dlroW olleH"))
ConsoleWrite('Hello Bart')              ConsoleWrite(StringTrimLeft('KKuqTHello Bart', 5))
ConsoleWrite('AutoIt Decompilation')    ConsoleWrite(StringTrimRight('AutoIt DecompilationX', 1))

String modifications uses built-in StringReverse(), StringTrimRight() and
StringTrimLeft() functions.

===============================================================================
Encrypt strings using randomly generated polymorphic encryption algorithms
===============================================================================

ConsoleWrite("How to protect AutoIt script?")   ConsoleWrite(DlnWck(87, $KQWGAWTNE, $vOedex))
                                                ...
                                                Func DlnWck($var_1238, $g_tagNye, $g_v_nCrR)
                                                    Local $6H_TKW[29] = [ 0x728F, 0x6DAF, 0x6CAF, 0x778F, 0x6D0F, _
                                                                          0x6DAF, 0x778F, 0x6D8F, 0x6D4F, 0x6DAF, _
                                                                          0x6D0F, 0x6EEF, 0x6F2F, 0x6D0F, 0x778F, _
                                                                          0x736F, 0x6CEF, 0x6D0F, 0x6DAF, 0x726F, _
                                                                          0x6D0F, 0x778F, 0x6D2F, 0x6F2F, 0x6D4F, _
                                                                          0x6E6F, 0x6D8F, 0x6D0F, 0x73AF ]
                                                    For $NYwQb = 0 To 28
                                                        $Cwium = $6H_TKW[$NYwQb]
                                                        $Cwium -= 0x7B90
                                                        $Cwium = BitRotate($Cwium, 11, "W")
                                                        $Cwium = BitNOT($Cwium)
                                                        $6H_TKW[$NYwQb] = ChrW(BitAND($Cwium, 0xFFFF))
                                                    Next
                                                    Return _ArrayToString($6H_TKW, "")
                                                EndFunc


Polymorphic string encryption engine is taken from our https://www.stringencrypt.com
solution.

===============================================================================
Insert ternary operators for numerical values to make the obfuscated code
analysis harder
===============================================================================

Local $a = 1            Local $a = ($fBnbFcgx[5] >= $xCsccjis[12] ? 1 : $g_GIqyy)
Local $var = 123        Local $var = (SqXoFunc() <> $Abv ? $var_2029[3] : 123)

Read more about ternary operator in AutoIt - https://www.autoitscript.com/autoit3/docs/keywords/Ternary.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Command line version
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AutoIt Obfuscator comes with an additional command line interface.

It can be used to integrate obfuscation into your build process or any other batch operation.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Additional software protection and licensing
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Compiled obfuscated code is safe against analysis, but if you want to apply even
more protection, add anti-debugging detection, virtual machines and emulators
detection, CRC anti-patching protection, time-trial limitations or licensing
features, take a look at our PELock software protection solution.

https://www.pelock.com/products/pelock

I assure you it will be great addition to AutoIt Obfuscator, but don't take my
word for granted, download demo version and try it yourself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Engine history
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

v2.02
- All Local $var = 123 variable declarations are split into the declaration
  itself Local $var and the assignment of values $var = 123, and the declaration
  itself is moved to the beginning of the function in which it is located to
  avoid compilation errors

v2.01
- Avoid replacing WinApi constants with numeric values when they are declared in
  the source code, e.g. Global Const $CBS_DROPDOWNLIST = 3

v2.00
- Support for enumerations without a Local or Global scopes e.g. Enum $eIncr0, $eIncr2, $eIncr4
- Support for enumerations without a Local or Global scopes, and a custom
  Step counter e.g. Enum Step * 4 $eIncr0, $eIncr2, $eIncr4
- Variables renaming fixed
- Speed up the variable renaming routine

v1.99
- Avoid renaming variables if they were not declared within the script because
  they could be constants from other included files. For example, unrecognized
  constants from other includes like $COLOR_WHITE or $COLOR_white won't be
  renamed anymore (thx MMOMinion)

v1.98
- Fixed For $i = 1 To 100 Step function($param) handling (thx Brockc)

v1.97
- Fixed For $item In $collection handling (thx Brockc)

v1.96
- Fixed handling of comment blocks #cs & #ce followed by a new line (thx Mike A.)

v1.95
- Added handling of arrays initialization with an empty declared length e.g. $array[] = [1, 2, 3]

v1.94
- Added support for direct access to array items returned by functions e.g. $nResult = DllCall('shlwapi.dll', 'int', 'StrCmpLogicalW', 'wstr', $sVal1, 'wstr', $sVal2)[0]

v1.93
- Added handling of arrays initialization without a declared length e.g. $array = [1, 2, 3]

v1.92
- Fixed handling of For loops with a variable as a step counter e.g. For $i = 5 To 1 Step $variable

v1.91
- Fixed handling of floating point values without a trailing 0, e.g. $var = .123

v1.9
- Fixed handling of For loops with steps e.g. For $i = 5 To 1 Step -1
- Fixed handling of enumerations with steps e.g. Local Enum Step *2 $eFoo1, $eFoo2

v1.8
- Added explicit variables declaration to pass Opt("MustDeclareVars", 1)

v1.7
- Fixed handling of COM object properties assignment e.g. $ocrypt.CryptAlgorithm = "aes"

v1.6
- Added anti regular expression patterns e.g.

Global $vx = Asc(StringMid("Random(18, 150 + SRandom(), 162)", 3, 1))

to prevent automatic deobfuscation with simplistic search & replace methods

- Fixed handling of comment blocks #cs & #ce (thx Kao)

v1.5
- Long awaited parser upgrade to support COM object calls, like WMI components
  queries e.g. $objWMIService.ExecQuery(...) as well as the support for object
  properties e.g. MsgBox($objItem.FreeSpace)

v1.4
- Fixed handling of FileInstall() function. Its first parameter has to be a
  string literal, and now it's preserved in the obufscated code.

v1.3
- Proper handling of Null keyword

v1.2
- Change linear code execution flow to nonlinear version obfuscation strategy
  added
- Added an automatic removal of #Region and #EndRegion pragmas
- Many internal changes and bugfixes

v1.11
- A new obfuscation strategy - shuffle order of functions in the output source

v1.1
- Huge speed improvements due to the rewritten AST parsing engine logic

v1.01
- System variables $CmdLine and $CmdLineRaw are not renamed anymore

v1.0
- Initial release

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Client history
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

v1.6
- All clients updated
- All SDK packages updated

v1.0.3 Python Module
- Python module added to use AutoIt Obfuscator directly from the Python 3 scripts.

v1.5
- All binaries were digitally re-signed using Thawte digital certificate.
  Long story short - our previous certification company StartCOM was banned first
  from the major web browsers and now in 2019 from Microsoft Windows because of
  their shady business practices (issuing back dated certificates) and their main
  CA certificate was revoked, which resulted in blocking any software signed with
  their digital code signing certificates (even if it was valid till the end of
  2019 like in our case). We had huge problems to get a new one with
  COMODO / Sectigo because of their dumb policies, that required us to be listed
  in commercial business DUNS directory (1600 USD for a listing) or to have a blue
  shield of verification on Google Maps (even if this program was discontinued
  because it required to have a Google Business and now defunct Google+ accounts
  linked together...). I've been trying to get this new certificate for more
  than 3 weeks with COMODO without a result and with tons of legal, notary signed
  company papers, utility bills send to them for verification, they didn't want
  to issue a code signing certificate no matter what. Finally I have tried to get
  it from Thawte, and after a simple business verification process, they granted
  us a new certificate after 2 days. I would like to apologize to all the customers
  for all the inconvenience in those days when you couldn't use our software.

v1.4
- All clients updated to support new anti regular expression deobfuscation
  patterns

v1.3
- AutoIt Obfuscator v1.3 main window on Ubuntu Linux
- You can run both GUI and command line version on latest Mono version

v1.2
- AutoIt Obfuscator v1.2 main window
- Support added for the new code flow mixing obfuscation strategy
- PHP SDK updated
- Fixed a bug while saving settings to the Windows Registry

v1.1
- AutoIt Obfuscator v1.1 main window
- Support added for the new obfuscation strategy
- PHP SDK updated
- fixed activation code passing in command line version (it's /ActivationCode
  and it was wrongly described as /ActivationKey)

v1.0
- AutoIt Obfuscator v1.0 main window
- Initial release
- Windows client
- Command line version compatible with Windows and Linux (Mono)
- WebAPI client with PHP usage examples

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
How to buy usage credits?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pricing is available at https://www.pelock.com/products/autoit-obfuscator/buy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
System requirements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- Pentium CPU
- 256 MB RAM
- an Internet connection
- .NET Framework v2.0 or v3.5

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contact information
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Name    : Bartosz Wójcik
E-Mail  : support@pelock.com
Website : https://www.pelock.com
