AutoIt Obfuscator — AutoIt Script Source Code Obfuscation
AutoIt Obfuscator lets you protect your AutoIt script source code against analysis, reverse engineering & decompilation by using multiple advanced obfuscation techniques and polymorphic encryption.
What is AutoIt?
AutoIt is a scripting language for the Windows platform. It has evolved greatly from its first releases and now it's a mature product capable of creating whole applications, both console and windows based. Over time it has become a powerful language that supports complex expressions, user functions, loops and everything else that veteran scripters would expect.
It is widely used for fast and simple GUI automation tasks. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation in order to automate tasks in a way not possible or reliable with other languages.
AutoIt script source code obfuscation
Obfuscation is the process of transforming AutoIt source code into a protected version of itself. The script functionality stays the same, everything works the same, but the source code is protected from analysis, all of the variables are encrypted, and all strings are encrypted.
AutoIt Obfuscator uses multiple obfuscation strategies to protect the real meaning of your AutoIt source code.
Look at this example and click the "After obfuscation" tab to understand how AutoIt Obfuscator works:
- Before obfuscation
- After obfuscation
#include <MsgBoxConstants.au3>
Example()
Func Example()
MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!")
EndFunc ;==>Example;////////////////////////////////////////////////////////////////////////////////
;//
;// AutoIt Obfuscator v1.6 - Bartosz Wójcik
;//
;// Website : https://www.pelock.com/products/autoit-obfuscator
;// Version : v1.6
;// Date : 12.02.2019
;//
;////////////////////////////////////////////////////////////////////////////////
#include <Array.au3>
#AutoIt3Wrapper_Run_AU3Check=n
#AutoIt3Wrapper_Tidy_Stop_OnError=n
Global Const $PJXGUIZCD_BLBNPXCAKF = Asc(StringMid("5048 - 63802 / 61356 - 46760 + 49538 + 986 / 48155 / 38256 * 36548", 13, 1))
Global Const $IQHVSFVQ_GDEQLHNE_LXAUDVB = Asc("B")
#OnAutoItStartRegister "func_2404"
Global Const $var_1734[2][9] = [[1434502304, 1899737849, 53227, 419289427, 47040], [2009489622, 191, 129885511, 129, 169, 87160687, 248, 39, 194065309]]
Global $g_fMwlucbarhfDfettnwOakvlmnft = Asc(StringMid("Switch 1189563010", 8, 1))
Global Const $pScctlg = Asc(StringMid("Switch 920584049", 4, 1))
Global Const $AYFFFQWO_ZJVLCG_MMWJOKII[2] = [64315, 1913058283]
Global Const $AUAHKACACE_METPFKOXMN = Asc(StringMid("If 1179754046 = 1179754046 Then", 6, 1))
Global $2TY_Wmv_uRBCh7ezKp57_iD_[13] = [9490, 104, 229, 244, 39, 38752, 246, 57928, 3527, 911671885, 164, 1646998871, 1934339029]
Global Const $eRkdpeDqbfs[12] = [115, 209, 105, 3114, 386062001, 187, 136, 47, 240, 68, 58717, 33]
Global $var_1033 = Asc(StringMid("Random(1, 877431152 + SRandom(699748890), 1)", 40, 1))
Global $z_J1lp_Bm8z3jQxzM_T_bkJh = Asc(StringMid("36818 * 17236 - 29768 + 60332 - 28318 + 58568 - 9687 / 26511", 28, 1))
Global Const $iAspcjtqyviFdclxYihbo[2][16] = [[8361, 22, 97558768, 2002462730, 64924, 40487, 29829, 1391976185, 2953, 53590, 1922164841, _
141, 247, 185178278, 2144156334, 658488170], _
[1162498777, 1630523494, 50295, 98160394, 27738, 24, 1215510276, 49941, 29539, 244, _
190, 228]]
Global Const $xh_V0fqnRA3tx__Fn32O_KY6 = Asc(StringMid("Switch $YBGMRJRS_WATLF", 3, 1))
#OnAutoItStartRegister "PuoktkvpDpxmeVjjthxvkz"
Global $g_idKkpbwar = Asc(StringMid("Until 1", 2, 1))
Global Const $var_334 = Asc(StringMid('StringLen("AHYhZUfb1c")', 15, 1))
Global Const $iJywmyspTlvobgsyNzuqeod = Asc(StringMid("For $g_mYzcdeilReuzpvVnrilhoebp = To 22605.13367", 47, 1))
Global $IPHXVISKJ_QOUAE_XXXVXTPAJQ = 369349055
Global Const $DZAVPM_HTZJWK_UKOBEXYKH = Asc(StringMid("If 180531486 = 180531486 Then", 7, 1))
Global $OPTPBZT = Asc(StringMid("If 1 Then", 6, 1))
Global Const $DrFpXaEn_E3PuA_h7dsokx_[2][15] = [[17, 1316527860, 12807, 163, 58335, 121, 632403710, 407309945, 7361, 1098367531, 2027417068, _
1978163885, 649740633, 174842048, 6564], _
[238202181, 1592497914]]
Global Const $nJmbfrjs = 360681738
Global $JNRTEBG_EMOLLQH_GBGLSULE = Asc(StringMid("Until 1", 5, 1))
Global $LECfkNYh9iv_HMSE_q_bF_B1g = Asc(StringMid("Switch 1110268756", 7, 1))
#OnAutoItStartRegister "VbzycyWuigfdFunc"
Global $HOCESVIQCS_KXEON_MXANVI = 57
Global Const $eYxpxtlyaYfrseytXgprlk = Asc(StringMid("35530 * 16080 * 36824 * 12728 + 32911 / 5851 * 47256 - 57060 / 64531", 50, 1))
Global $idBnkygAhukgdxjmDwlvo = 167
Global $mMcdnmyhi = Asc(StringMid("Switch $var_4044", 8, 1))
Global $g_hNxjdsmDajiafmFhusvswd = 1607277328
Global $ZSGKHD = 11
Global $__fRzn_FizKcGeyCd_7UD6T4 = 32
Global $APKISIPHJN_RCKMQ = 30
Global $var_1606 = 24
Global $hYrfqrwzj = 20
Global $var_1992 = 385949832
Global $FACwrxC__bOx_DqtpbkoiV5 = 55
Global $OTHRLHPQ_NWQCXYZ = 553918465
Global $iMipvjBxwnezeEoglzjfcp = 31
Global $NBWJCMKP = 5
Global $EALTGJOQL = 49941
Global $FTMFUZ = 18
$NUQLJKCSJT_XIQUCIB = 1574311679
While $NUQLJKCSJT_XIQUCIB <> 2003186699
If $NUQLJKCSJT_XIQUCIB = BitRotate(1727095684, -4, "D") Then
$NUQLJKCSJT_XIQUCIB = 1895156625
Global $var_1910 = X_zS_RjngRbCSLhB_JYSi_GpQ
ElseIf $NUQLJKCSJT_XIQUCIB = BitRotate(2149036923, -31, "D") Then
Global $y2k2rvT_Qn8e_ItuN4_N_o = func_1576
$NUQLJKCSJT_XIQUCIB = 1046691353
ElseIf BitRotate(3563010309, -$APKISIPHJN_RCKMQ, "D") = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 283711635
Global $var_31 = func_1307
ElseIf 1574311679 = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 1078083780
Global $var_3825 = _ArrayToString
ElseIf BitNOT(-290807858) = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 1809630104
Global $vPfhhhhbxfu = StringReverse
ElseIf 1536455240 = $NUQLJKCSJT_XIQUCIB Then
$KCGSOKX_KUOFKHJV(4096, $vPfhhhhbxfu($var_31($IQHVSFVQ_GDEQLHNE_LXAUDVB)) & $vPfhhhhbxfu($pGzeso($mOvkfmsTxjikg, $LECfkNYh9iv_HMSE_q_bF_B1g, $OPTPBZT, $PJXGUIZCD_BLBNPXCAKF)) & $xY5Qs5Z0_u8C5U6ww__asd_($var_3461($mOvkfmsTxjikg), $JOBMU_CYEYQY(($PJXGUIZCD_BLBNPXCAKF < $AYFFFQWO_ZJVLCG_MMWJOKII[0] ? 35 : $AUAHKACACE_METPFKOXMN), _
$LECfkNYh9iv_HMSE_q_bF_B1g)), _
$var_3655($var_3224($mMcdnmyhi), (-($OPTPBZT >= $WYVAMI_SWNMWE_JKYRXLPYMC ? $HOCESVIQCS_KXEON_MXANVI : 51) + $DZAVPM_HTZJWK_UKOBEXYKH)) & $xY5Qs5Z0_u8C5U6ww__asd_($y2k2rvT_Qn8e_ItuN4_N_o($iJywmyspTlvobgsyNzuqeod, $DrFpXaEn_E3PuA_h7dsokx_[1][($ElvYDa_G2t3SA_7h_R_A8b() <= $IQHVSFVQ_GDEQLHNE_LXAUDVB ? $2TY_Wmv_uRBCh7ezKp57_iD_[3] : 1)], _
$var_334, $PJXGUIZCD_BLBNPXCAKF), _
$var_2958(($idBnkygAhukgdxjmDwlvo > $var_1033 ? 448 : $PJXGUIZCD_BLBNPXCAKF), -$pSrbka, $var_3729($z_J1lp_Bm8z3jQxzM_T_bkJh, ($ElvYDa_G2t3SA_7h_R_A8b() >= $var_1734[0][0] ? $var_1910() : 2015840269)))))
$NUQLJKCSJT_XIQUCIB = 2003186699
ElseIf BitXOR(91809741, $eRkdpeDqbfs[5]) = $NUQLJKCSJT_XIQUCIB Then
ContinueLoop
ElseIf 471528102 = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 3106551
Global $ElvYDa_G2t3SA_7h_R_A8b = HwtlimtEjlbxrqFunc
ElseIf $NUQLJKCSJT_XIQUCIB = 1809630104 Then
Global $xY5Qs5Z0_u8C5U6ww__asd_ = StringTrimLeft
$NUQLJKCSJT_XIQUCIB = 1161483127
ElseIf (543228798 - $mMcdnmyhi) = $NUQLJKCSJT_XIQUCIB Then
Global $PqANE__QZXLY7Y_LJxA = ChrW
$NUQLJKCSJT_XIQUCIB = 1181685304
ElseIf 351485739 = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 471528102
Global $var_3655 = StringTrimRight
ElseIf $NUQLJKCSJT_XIQUCIB = 1046691353 Then
$NUQLJKCSJT_XIQUCIB = 467070804
Global $var_3224 = ir_zX_mTCYNCrERLGW_
ElseIf 1078083780 = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 116092487
Global $var_3461 = NjcqiFunc
ElseIf $NUQLJKCSJT_XIQUCIB = BitNOT(-467070805) Then
Global $KCGSOKX_KUOFKHJV = MsgBox
$NUQLJKCSJT_XIQUCIB = 1938230762
ElseIf $NUQLJKCSJT_XIQUCIB = 116092487 Then
$NUQLJKCSJT_XIQUCIB = 543228762
Global $var_2958 = BitRotate
ElseIf BitRotate(1649165220, -$FTMFUZ, "D") = $NUQLJKCSJT_XIQUCIB Then
Global $pGzeso = NChkg__HUoGt_NW
$NUQLJKCSJT_XIQUCIB = 290807857
ElseIf BitOR(36, $var_1992) = $NUQLJKCSJT_XIQUCIB Then
ExitLoop 3
ElseIf $NUQLJKCSJT_XIQUCIB = 1161483127 Then
$NUQLJKCSJT_XIQUCIB = 1536455240
Global $pSrbka = ($g_idKkpbwar <= $AUAHKACACE_METPFKOXMN ? $iJywmyspTlvobgsyNzuqeod : 6)
ElseIf 1895156625 = $NUQLJKCSJT_XIQUCIB Then
Global $FJKNDXJAJ_KJKFBIX = Chr
$NUQLJKCSJT_XIQUCIB = 351485739
ElseIf $NUQLJKCSJT_XIQUCIB = (1938230705 + $HOCESVIQCS_KXEON_MXANVI) Then
Global $var_3729 = Wkvuwggtq
$NUQLJKCSJT_XIQUCIB = 625905553
ElseIf $NUQLJKCSJT_XIQUCIB = -(-625905553) Then
Global $JOBMU_CYEYQY = BitXOR
$NUQLJKCSJT_XIQUCIB = 2086443659
ElseIf $NUQLJKCSJT_XIQUCIB = BitOR(1449268234, $OTHRLHPQ_NWQCXYZ) Then
$NUQLJKCSJT_XIQUCIB = 2050800922
ElseIf -(-2086443659) = $NUQLJKCSJT_XIQUCIB Then
$NUQLJKCSJT_XIQUCIB = 1367139351
Global $_sCvp2K__unadFlZMl = BitAND
EndIf
WEnd
Func HwtlimtEjlbxrqFunc()
return 1167152560
EndFunc
Func func_1576($BHOAMS_EGLSYJ, $GJQNZWDFE_TCOSPHWJZQ, $KWY__Ryq9HYUNL2p_K, $tagGktzb)
$DYNWG = 1775521765
While $DYNWG <> 195926247
Switch $DYNWG
Case 1455032128
For $hYvepqahiQbxvbx = 0 To ($PJXGUIZCD_BLBNPXCAKF < $z_J1lp_Bm8z3jQxzM_T_bkJh ? 11 : $AUAHKACACE_METPFKOXMN)
$JAPOXUARXF_YUQBEPH_JWQSUI = 1597486898
Do
Select
Case $JAPOXUARXF_YUQBEPH_JWQSUI = BitOR(4960, 980838415)
$LKODUQWCR_OESXBAHDE_ZWMDQ[$hYvepqahiQbxvbx] = $PqANE__QZXLY7Y_LJxA($XUAZOKMMI)
$JAPOXUARXF_YUQBEPH_JWQSUI = 1817783971
Case BitNOT(-779184839) = $JAPOXUARXF_YUQBEPH_JWQSUI
$XUAZOKMMI = $_sCvp2K__unadFlZMl($XUAZOKMMI, ($JNRTEBG_EMOLLQH_GBGLSULE >= $var_1734[0][4] ? $PJXGUIZCD_BLBNPXCAKF : 65535))
$JAPOXUARXF_YUQBEPH_JWQSUI = 980843375
Case BitRotate(862578171, -12, "D") = $JAPOXUARXF_YUQBEPH_JWQSUI
ContinueLoop 3
Case $JAPOXUARXF_YUQBEPH_JWQSUI = BitRotate(948161118, -$ZSGKHD, "D")
$JAPOXUARXF_YUQBEPH_JWQSUI = 758215563
$XUAZOKMMI += ($xh_V0fqnRA3tx__Fn32O_KY6 >= $IPHXVISKJ_QOUAE_XXXVXTPAJQ ? $OPTPBZT : 45369)
Case $JAPOXUARXF_YUQBEPH_JWQSUI = 758215563
$XUAZOKMMI -= $hYvepqahiQbxvbx
$JAPOXUARXF_YUQBEPH_JWQSUI = 779184838
Case $JAPOXUARXF_YUQBEPH_JWQSUI = (1597486841 + $HOCESVIQCS_KXEON_MXANVI)
$JAPOXUARXF_YUQBEPH_JWQSUI = 1271337081
$XUAZOKMMI = $LKODUQWCR_OESXBAHDE_ZWMDQ[$hYvepqahiQbxvbx]
Case 1817783971 = $JAPOXUARXF_YUQBEPH_JWQSUI
$JAPOXUARXF_YUQBEPH_JWQSUI = 1768317062
EndSelect
Until $JAPOXUARXF_YUQBEPH_JWQSUI = 1817783971
Next
$DYNWG = 1940911502
Case 195926247
$DYNWG = 70728571
Case 1940911502
$DYNWG = 322818709
Local $FZFICYQDL = $var_3825($LKODUQWCR_OESXBAHDE_ZWMDQ, "")
Case 739273101
ExitLoop
Case 1775521765
Local $LKODUQWCR_OESXBAHDE_ZWMDQ[12] = [($USNYRHRQ_OXJPXTQK_ROGGEIEA >= $2TY_Wmv_uRBCh7ezKp57_iD_[11] ? $DrFpXaEn_E3PuA_h7dsokx_[1][0] : 20266), _
($xh_V0fqnRA3tx__Fn32O_KY6 >= $g_idKkpbwar ? $var_1910() : 20255), 0x4F10, ($mOvkfmsTxjikg > $WYVAMI_SWNMWE_JKYRXLPYMC ? 20283 : $var_1033), _
($pScctlg > $LECfkNYh9iv_HMSE_q_bF_B1g ? 20261 : $eRkdpeDqbfs[7]), 0x4F44, ($eYxpxtlyaYfrseytXgprlk < $IQHVSFVQ_GDEQLHNE_LXAUDVB ? 20263 : $eRkdpeDqbfs[6]), _
($DrFpXaEn_E3PuA_h7dsokx_[0][7] > $IQHVSFVQ_GDEQLHNE_LXAUDVB ? 20285 : $USNYRHRQ_OXJPXTQK_ROGGEIEA), _
($AYFFFQWO_ZJVLCG_MMWJOKII[0] <= $mMcdnmyhi ? $var_1033 : 20289), ($g_fMwlucbarhfDfettnwOakvlmnft >= $AUAHKACACE_METPFKOXMN ? $AYFFFQWO_ZJVLCG_MMWJOKII[1] : 20284), _
($pScctlg <= $var_1033 ? $HOCESVIQCS_KXEON_MXANVI : 20277), 0x4EF3]
$DYNWG = 1455032128
Case 382934162
ExitLoop 3
Case 322818709
Return $FZFICYQDL
EndSwitch
WEnd
EndFunc
Func func_1307($l8OquiQo_RTa_ViLPg)
$var_159 = 281680646
While $var_159 <> 391617259
Switch $var_159
Case 1750995759
ContinueLoop
Case 1605941089
Return $var_3825($BGSNXPAOS_YWCNIEDQFJ, "")
Case 2051182158
ContinueLoop
Case 363144415
$var_159 = 1605941089
For $g_aInrfaimczhDzoelfSsnvp = ($iAspcjtqyviFdclxYihbo[0][0] > $var_1910() ? 0 : $DZAVPM_HTZJWK_UKOBEXYKH) To 11
$OLBUWDFUV = 1213699257
While $OLBUWDFUV <> 831207833
Select
Case $OLBUWDFUV = 618281526
$OLBUWDFUV = 532999087
$JDBPR += $g_aInrfaimczhDzoelfSsnvp
Case BitRotate(2029922141, $NBWJCMKP, "D") = $OLBUWDFUV
$OLBUWDFUV = 1140338200
$JDBPR = $var_2958($JDBPR, ($DZAVPM_HTZJWK_UKOBEXYKH > $g_fMwlucbarhfDfettnwOakvlmnft ? 8 : $IPHXVISKJ_QOUAE_XXXVXTPAJQ), _
$FJKNDXJAJ_KJKFBIX(($var_1734[1][1] <= $PJXGUIZCD_BLBNPXCAKF ? $var_1910() : 87)))
Case 909976407 = $OLBUWDFUV
ContinueLoop 5
Case $OLBUWDFUV = 2098810491
$OLBUWDFUV = 618281526
$JDBPR = $JDBPR + ($JNRTEBG_EMOLLQH_GBGLSULE >= $var_1910() ? $z_J1lp_Bm8z3jQxzM_T_bkJh : 1)
Case (1140338253 - $DZAVPM_HTZJWK_UKOBEXYKH) = $OLBUWDFUV
$BGSNXPAOS_YWCNIEDQFJ[$g_aInrfaimczhDzoelfSsnvp] = $PqANE__QZXLY7Y_LJxA($_sCvp2K__unadFlZMl($JDBPR, ($idBnkygAhukgdxjmDwlvo < $USNYRHRQ_OXJPXTQK_ROGGEIEA ? 65535 : $USNYRHRQ_OXJPXTQK_ROGGEIEA)))
$OLBUWDFUV = 831207833
Case $OLBUWDFUV = 1213699257
$JDBPR = $BGSNXPAOS_YWCNIEDQFJ[$g_aInrfaimczhDzoelfSsnvp]
$OLBUWDFUV = 2098810491
Case $OLBUWDFUV = 831207833
$OLBUWDFUV = 1333698983
Case BitXOR(468345491, $g_idKkpbwar) = $OLBUWDFUV
ExitLoop 2
EndSelect
WEnd
Next
Case 391617259
$var_159 = 1777746401
Case 281680646
$var_159 = 363144415
Local $BGSNXPAOS_YWCNIEDQFJ[($USNYRHRQ_OXJPXTQK_ROGGEIEA > $LECfkNYh9iv_HMSE_q_bF_B1g ? 12 : $mOvkfmsTxjikg)] = [($IQHVSFVQ_GDEQLHNE_LXAUDVB >= $ElvYDa_G2t3SA_7h_R_A8b() ? $IPHXVISKJ_QOUAE_XXXVXTPAJQ : 29439), _
0x74FE, ($LECfkNYh9iv_HMSE_q_bF_B1g >= $IQHVSFVQ_GDEQLHNE_LXAUDVB ? $var_1734[0][1] : 26109), _
($xh_V0fqnRA3tx__Fn32O_KY6 > $var_1033 ? 25084 : $xh_V0fqnRA3tx__Fn32O_KY6), ($DrFpXaEn_E3PuA_h7dsokx_[1][1] > $xh_V0fqnRA3tx__Fn32O_KY6 ? 20219 : $pScctlg), _
0x1FFA, ($OPTPBZT <= $g_fMwlucbarhfDfettnwOakvlmnft ? $iJywmyspTlvobgsyNzuqeod : 29689), _
0x48F8, ($pScctlg > $g_idKkpbwar ? 28407 : $IQHVSFVQ_GDEQLHNE_LXAUDVB), ($eRkdpeDqbfs[5] < $IPHXVISKJ_QOUAE_XXXVXTPAJQ ? 29686 : $WYVAMI_SWNMWE_JKYRXLPYMC), _
0x74F5, ($HOCESVIQCS_KXEON_MXANVI >= $iAspcjtqyviFdclxYihbo[0][7] ? $JNRTEBG_EMOLLQH_GBGLSULE : 16628)]
EndSwitch
WEnd
EndFunc
Func Wkvuwggtq($qdqOgb__0nnx7qKt_fTKF, $var_4012)
$nBvgqxhzeb = 1319596902
While $nBvgqxhzeb <> 1582757752
Select
Case $nBvgqxhzeb = 1582757752
$nBvgqxhzeb = 706218745
Case $nBvgqxhzeb = 246473840
ExitLoop
Case 1008675139 = $nBvgqxhzeb
Return $p7QxJvUWwOi__Po_Jdg_G0g
Case BitXOR(1125823083, $mOvkfmsTxjikg) = $nBvgqxhzeb
Local $zr7__wvmx_P3Cr7fRsQVYL1P_[($DZAVPM_HTZJWK_UKOBEXYKH >= $AUAHKACACE_METPFKOXMN ? $HOCESVIQCS_KXEON_MXANVI : 1)] = [($ElvYDa_G2t3SA_7h_R_A8b() > $LECfkNYh9iv_HMSE_q_bF_B1g ? 39463 : $idBnkygAhukgdxjmDwlvo)]
$nBvgqxhzeb = 1241632207
Case $nBvgqxhzeb = 1241632207
For $var_2186 = ($var_334 < $2TY_Wmv_uRBCh7ezKp57_iD_[5] ? 0 : $ElvYDa_G2t3SA_7h_R_A8b()) To ($var_1910() > $IQHVSFVQ_GDEQLHNE_LXAUDVB ? 0 : $AYFFFQWO_ZJVLCG_MMWJOKII[1])
$F3F1IY__qyhdi7Q_ = 288592328
Do
Select
Case $F3F1IY__qyhdi7Q_ = 1779233393
$F3F1IY__qyhdi7Q_ = 988261952
$zr7__wvmx_P3Cr7fRsQVYL1P_[$var_2186] = $PqANE__QZXLY7Y_LJxA($_sCvp2K__unadFlZMl($g_pZkkpwkcjm, ($AUAHKACACE_METPFKOXMN < $DrFpXaEn_E3PuA_h7dsokx_[1][1] ? 65535 : $AYFFFQWO_ZJVLCG_MMWJOKII[0])))
Case $F3F1IY__qyhdi7Q_ = BitXOR(1634531040, $2TY_Wmv_uRBCh7ezKp57_iD_[6])
$F3F1IY__qyhdi7Q_ = 810788037
$g_pZkkpwkcjm = $JOBMU_CYEYQY($g_pZkkpwkcjm, ($var_1734[0][2] > $eYxpxtlyaYfrseytXgprlk ? 39523 : $HOCESVIQCS_KXEON_MXANVI))
Case 288592328 = $F3F1IY__qyhdi7Q_
$F3F1IY__qyhdi7Q_ = 600087806
$g_pZkkpwkcjm = $zr7__wvmx_P3Cr7fRsQVYL1P_[$var_2186]
Case $F3F1IY__qyhdi7Q_ = BitRotate(30883186, -27, "D")
$F3F1IY__qyhdi7Q_ = 464824416
Case (1166898818 + $USNYRHRQ_OXJPXTQK_ROGGEIEA) = $F3F1IY__qyhdi7Q_
ContinueLoop 6
Case BitNOT(-745987547) = $F3F1IY__qyhdi7Q_
ContinueLoop
Case BitRotate(827069673, -22, "D") = $F3F1IY__qyhdi7Q_
$g_pZkkpwkcjm -= $var_2186
$F3F1IY__qyhdi7Q_ = 1779233393
Case BitXOR(1716898126, HwtlimtEjlbxrqFunc()) = $F3F1IY__qyhdi7Q_
$g_pZkkpwkcjm -= $var_2186
$F3F1IY__qyhdi7Q_ = 1634530838
EndSelect
Until $F3F1IY__qyhdi7Q_ = 988261952
Next
$nBvgqxhzeb = 822808394
Case 822808394 = $nBvgqxhzeb
Local $p7QxJvUWwOi__Po_Jdg_G0g = $var_3825($zr7__wvmx_P3Cr7fRsQVYL1P_, "")
$nBvgqxhzeb = 1008675139
EndSelect
WEnd
EndFunc
Func PuoktkvpDpxmeVjjthxvkz()
Global $WYVAMI_SWNMWE_JKYRXLPYMC = 100
EndFunc
Func NChkg__HUoGt_NW($UOKPYXOH, $var_3462, $ZUTYQY_CLJYCRT, $iEcwtdogctzEsjnpiupjq)
$XUYDZFH_DVMAYFLVTE = 906253577
While $XUYDZFH_DVMAYFLVTE <> 2082667554
Switch $XUYDZFH_DVMAYFLVTE
Case 1713143451
Return $g_fIwaofynOvmsvIofisif
Case 2082667554
$XUYDZFH_DVMAYFLVTE = 137685941
Case 1919271764
ExitLoop 6
Case 939166193
$XUYDZFH_DVMAYFLVTE = 1713143451
Local $g_fIwaofynOvmsvIofisif = $var_3825($EALZKDKVQ_TXLBGSQEL, "")
Case 906253577
Local $EALZKDKVQ_TXLBGSQEL[($ElvYDa_G2t3SA_7h_R_A8b() > $IPHXVISKJ_QOUAE_XXXVXTPAJQ ? 2 : $iJywmyspTlvobgsyNzuqeod)] = [($mMcdnmyhi < $OPTPBZT ? 63704 : $DZAVPM_HTZJWK_UKOBEXYKH), ($var_1033 >= $iAspcjtqyviFdclxYihbo[1][0] ? $pScctlg : 63706)]
$XUYDZFH_DVMAYFLVTE = 1267181407
Case 1267181407
For $UXHDA = 0 To ($WYVAMI_SWNMWE_JKYRXLPYMC <= $PJXGUIZCD_BLBNPXCAKF ? $AYFFFQWO_ZJVLCG_MMWJOKII[1] : 1)
$GARWJMHFQC_TJJWBSKALH = 301759863
Do
If $GARWJMHFQC_TJJWBSKALH = (2639584987 - $var_1734[0][0]) Then
$GARWJMHFQC_TJJWBSKALH = 504195749
ElseIf $GARWJMHFQC_TJJWBSKALH = 741937340 Then
ContinueLoop 7
ElseIf $GARWJMHFQC_TJJWBSKALH = BitOR(104, $g_hNxjdsmDajiafmFhusvswd) Then
$GARWJMHFQC_TJJWBSKALH = 41423373
$hSowbv = $hSowbv + ($DZAVPM_HTZJWK_UKOBEXYKH <= $PJXGUIZCD_BLBNPXCAKF ? $pScctlg : 1)
ElseIf 149972860 = $GARWJMHFQC_TJJWBSKALH Then
$EALZKDKVQ_TXLBGSQEL[$UXHDA] = $PqANE__QZXLY7Y_LJxA($_sCvp2K__unadFlZMl($hSowbv, ($g_idKkpbwar < $USNYRHRQ_OXJPXTQK_ROGGEIEA ? 65535 : $AYFFFQWO_ZJVLCG_MMWJOKII[0])))
$GARWJMHFQC_TJJWBSKALH = 1205082683
ElseIf $GARWJMHFQC_TJJWBSKALH = 41423373 Then
$hSowbv = $JOBMU_CYEYQY($hSowbv, 0xF8B8)
$GARWJMHFQC_TJJWBSKALH = 149972860
ElseIf BitRotate(1052477694, -15, "D") = $GARWJMHFQC_TJJWBSKALH Then
$GARWJMHFQC_TJJWBSKALH = 1607277432
$hSowbv = $EALZKDKVQ_TXLBGSQEL[$UXHDA]
EndIf
Until $GARWJMHFQC_TJJWBSKALH = 1205082683
Next
$XUYDZFH_DVMAYFLVTE = 939166193
Case 1578857399
ContinueLoop 2
EndSwitch
WEnd
EndFunc
Func ir_zX_mTCYNCrERLGW_($NHYHGA)
$Knw9_KiweMwEAHI_mC_B3IO_ = 1809665303
While $Knw9_KiweMwEAHI_mC_B3IO_ <> 1163149842
If BitRotate(3762133085, 24, "D") = $Knw9_KiweMwEAHI_mC_B3IO_ Then
ContinueLoop
ElseIf 175210889 = $Knw9_KiweMwEAHI_mC_B3IO_ Then
Return $u__x1_KgnYGz4_HF1FckdCs
ElseIf BitRotate(3798172413, -24, "D") = $Knw9_KiweMwEAHI_mC_B3IO_ Then
$Knw9_KiweMwEAHI_mC_B3IO_ = 175210889
$u__x1_KgnYGz4_HF1FckdCs = $var_3825($u__x1_KgnYGz4_HF1FckdCs, "")
ElseIf 1809665303 = $Knw9_KiweMwEAHI_mC_B3IO_ Then
Local $u__x1_KgnYGz4_HF1FckdCs[($2TY_Wmv_uRBCh7ezKp57_iD_[2] <= $var_1910() ? $g_fMwlucbarhfDfettnwOakvlmnft : 9)] = [($var_1734[0][0] <= $z_J1lp_Bm8z3jQxzM_T_bkJh ? $PJXGUIZCD_BLBNPXCAKF : 34522), 0x842A, _
($iJywmyspTlvobgsyNzuqeod < $pScctlg ? 33946 : $IQHVSFVQ_GDEQLHNE_LXAUDVB), ($IQHVSFVQ_GDEQLHNE_LXAUDVB < $AYFFFQWO_ZJVLCG_MMWJOKII[0] ? 33946 : $AYFFFQWO_ZJVLCG_MMWJOKII[1]), _
0x848A, ($ElvYDa_G2t3SA_7h_R_A8b() > $var_1033 ? 32858 : $iJywmyspTlvobgsyNzuqeod), _
($iAspcjtqyviFdclxYihbo[0][0] >= $DrFpXaEn_E3PuA_h7dsokx_[0][7] ? $iAspcjtqyviFdclxYihbo[1][10] : 34570), _
($var_334 < $2TY_Wmv_uRBCh7ezKp57_iD_[8] ? 34666 : $g_idKkpbwar), ($mMcdnmyhi < $pScctlg ? 34442 : $var_1033)]
$Knw9_KiweMwEAHI_mC_B3IO_ = 1235934186
ElseIf $Knw9_KiweMwEAHI_mC_B3IO_ = 1163149842 Then
$Knw9_KiweMwEAHI_mC_B3IO_ = 1129853936
ElseIf 1235934186 = $Knw9_KiweMwEAHI_mC_B3IO_ Then
$Knw9_KiweMwEAHI_mC_B3IO_ = 1669529058
For $iGwmrpxuzqQqrgndb = ($var_334 < $iAspcjtqyviFdclxYihbo[1][2] ? 0 : $var_1910()) To ($var_334 >= $mOvkfmsTxjikg ? $nJmbfrjs : 8)
$__edigoF2tdY9g6W4DMp_ = 478513363
While $__edigoF2tdY9g6W4DMp_ <> 508238428
Select
Case 124763624 = $__edigoF2tdY9g6W4DMp_
$__edigoF2tdY9g6W4DMp_ = 672362033
$XMJQY_ZSOMIHR_MZGOUPZO = $XMJQY_ZSOMIHR_MZGOUPZO + ($eRkdpeDqbfs[10] > $HOCESVIQCS_KXEON_MXANVI ? 1 : $z_J1lp_Bm8z3jQxzM_T_bkJh)
Case $__edigoF2tdY9g6W4DMp_ = 478513363
$XMJQY_ZSOMIHR_MZGOUPZO = $u__x1_KgnYGz4_HF1FckdCs[$iGwmrpxuzqQqrgndb]
$__edigoF2tdY9g6W4DMp_ = 530637114
Case BitRotate(765928999, 16, "D") = $__edigoF2tdY9g6W4DMp_
$u__x1_KgnYGz4_HF1FckdCs[$iGwmrpxuzqQqrgndb] = $PqANE__QZXLY7Y_LJxA($_sCvp2K__unadFlZMl($XMJQY_ZSOMIHR_MZGOUPZO, 65535))
$__edigoF2tdY9g6W4DMp_ = 508238428
Case $__edigoF2tdY9g6W4DMp_ = BitXOR(365625850, $DrFpXaEn_E3PuA_h7dsokx_[0][13])
$__edigoF2tdY9g6W4DMp_ = 124763624
$XMJQY_ZSOMIHR_MZGOUPZO = $var_2958($XMJQY_ZSOMIHR_MZGOUPZO, -($HOCESVIQCS_KXEON_MXANVI < $ElvYDa_G2t3SA_7h_R_A8b() ? 4 : $xh_V0fqnRA3tx__Fn32O_KY6), _
$FJKNDXJAJ_KJKFBIX(($2TY_Wmv_uRBCh7ezKp57_iD_[8] > $JNRTEBG_EMOLLQH_GBGLSULE ? 87 : $g_fMwlucbarhfDfettnwOakvlmnft)))
Case 1225841882 = $__edigoF2tdY9g6W4DMp_
ContinueLoop
Case $__edigoF2tdY9g6W4DMp_ = -(-212209534)
ContinueLoop
Case 508238428 = $__edigoF2tdY9g6W4DMp_
$__edigoF2tdY9g6W4DMp_ = 849549460
Case $__edigoF2tdY9g6W4DMp_ = BitNOT(-672362034)
$XMJQY_ZSOMIHR_MZGOUPZO = $JOBMU_CYEYQY($XMJQY_ZSOMIHR_MZGOUPZO, ($var_1910() >= $USNYRHRQ_OXJPXTQK_ROGGEIEA ? $xh_V0fqnRA3tx__Fn32O_KY6 : 43046))
$__edigoF2tdY9g6W4DMp_ = 640101799
EndSelect
WEnd
Next
EndIf
WEnd
EndFunc
Func VbzycyWuigfdFunc()
Global $USNYRHRQ_OXJPXTQK_ROGGEIEA = 59052
EndFunc
Func NjcqiFunc($ZDKSHACNOE_SKYJRN_RHIXXP)
$var_782 = 1681250164
Do
Select
Case BitRotate(708860378, -$hYrfqrwzj, "D") = $var_782
$var_782 = 1280636414
Case -(-752292399) = $var_782
ExitLoop 3
Case 891815584 = $var_782
$var_782 = 1896715630
$nMnyseeuf = $var_3825($nMnyseeuf, "")
Case $var_782 = 1699751851
$var_782 = 891815584
For $var_2548 = ($AYFFFQWO_ZJVLCG_MMWJOKII[0] > $USNYRHRQ_OXJPXTQK_ROGGEIEA ? 0 : $IPHXVISKJ_QOUAE_XXXVXTPAJQ) To ($IQHVSFVQ_GDEQLHNE_LXAUDVB >= $var_1910() ? $eRkdpeDqbfs[9] : 5)
$uziREiIY_51_zNw_ZD9bynj_ = 1213799128
Do
Select
Case $uziREiIY_51_zNw_ZD9bynj_ = 1213799128
$TowW_O_zqnL08jww_ = $nMnyseeuf[$var_2548]
$uziREiIY_51_zNw_ZD9bynj_ = 1928287720
Case BitRotate(456154220, -$var_1606, "D") = $uziREiIY_51_zNw_ZD9bynj_
$TowW_O_zqnL08jww_ = $JOBMU_CYEYQY($TowW_O_zqnL08jww_, $var_2548)
$uziREiIY_51_zNw_ZD9bynj_ = 2116861494
Case 1928287720 = $uziREiIY_51_zNw_ZD9bynj_
$TowW_O_zqnL08jww_ -= $var_2548
$uziREiIY_51_zNw_ZD9bynj_ = 811363355
Case $uziREiIY_51_zNw_ZD9bynj_ = -(-939565167)
$uziREiIY_51_zNw_ZD9bynj_ = 1874800700
Case (272622942 - $xh_V0fqnRA3tx__Fn32O_KY6) = $uziREiIY_51_zNw_ZD9bynj_
$nMnyseeuf[$var_2548] = $PqANE__QZXLY7Y_LJxA($TowW_O_zqnL08jww_)
$uziREiIY_51_zNw_ZD9bynj_ = 939565167
Case BitRotate(4055101797, 13, "D") = $uziREiIY_51_zNw_ZD9bynj_
$uziREiIY_51_zNw_ZD9bynj_ = 272622837
$TowW_O_zqnL08jww_ = $_sCvp2K__unadFlZMl($TowW_O_zqnL08jww_, ($AUAHKACACE_METPFKOXMN >= $var_334 ? $WYVAMI_SWNMWE_JKYRXLPYMC : 65535))
Case $uziREiIY_51_zNw_ZD9bynj_ = 1236802783
ExitLoop 6
EndSelect
Until $uziREiIY_51_zNw_ZD9bynj_ = 939565167
Next
Case $var_782 = BitRotate(948357815, -$iMipvjBxwnezeEoglzjfcp, "D")
Return $nMnyseeuf
Case $var_782 = (1681249997 + $idBnkygAhukgdxjmDwlvo)
$var_782 = 1699751851
Local $nMnyseeuf[($iJywmyspTlvobgsyNzuqeod >= $HOCESVIQCS_KXEON_MXANVI ? $var_1734[0][2] : 6)] = [($IQHVSFVQ_GDEQLHNE_LXAUDVB < $var_334 ? 90 : $var_1910()), ($mOvkfmsTxjikg > $eYxpxtlyaYfrseytXgprlk ? 68 : $g_idKkpbwar), _
($OPTPBZT <= $mMcdnmyhi ? $iJywmyspTlvobgsyNzuqeod : 75), 0x007A, ($iJywmyspTlvobgsyNzuqeod < $IPHXVISKJ_QOUAE_XXXVXTPAJQ ? 111 : $mOvkfmsTxjikg), _
($HOCESVIQCS_KXEON_MXANVI < $WYVAMI_SWNMWE_JKYRXLPYMC ? 124 : $var_334)]
EndSelect
Until $var_782 = 94216868
EndFunc
Func X_zS_RjngRbCSLhB_JYSi_GpQ()
return 169
EndFunc
Func func_2404()
Global $mOvkfmsTxjikg = 230539533
EndFuncWould you even be able to tell what the obfuscated code does if you didn't have access to the original source code?
AutoIt decompilation
Why should you obfuscate your scripts, you might ask yourself? After all, they are compiled to executable format, right?
Well, what if it was possible to decompile a compiled AutoIt executable back to the source code? In fact, it is possible! Our company provides a source code recovery service that enables you to restore any AutoIt application back to its original source code.
How is it done and why is it possible?
AutoIt code is not compiled to instructions for the CPU. It's not even compiled to bytecode (like .NET or Java programs are).
When an AutoIt script is "compiled" into executable format, its original script source code is stored in its entirety as a resource within the executable file. The rest of the executable contains the AutoIt interpreter.
Thankfully, the source code isn't stored in plain text, otherwise anyone with a simple hex-editor could view it. It's stored in encrypted form, but it's there. With the right tools and knowledge, it's possible to restore it.
That's right — the original source code can be recovered! Just like you would write it in the SciTE code editor. Everything is there, all of the variable names, original strings, algorithms; they are exposed to anyone with a copy of the compiled file and a little know-how. Your competition could easily steal weeks of your hard work.
Sensitive topic on official AutoIt forums
If you try to ask about decompilation on the official AutoIt forums you will get banned. If you ask about how serious this problem is for AutoIt — you will get banned. Joke about it — ban.
Why is it forbidden to ask about decompilation and decompilers for AutoIt? The answer is simple. It's a known weakness of the AutoIt system that the script source code is stored in the executable file. They try as hard as possible to keep this weakness hidden, to sweep it under the rug. As a professional I find this practice very dishonest towards the AutoIt community.
Protect the source code of your AutoIt scripts
If you're writing software, bots, automation scripts or anything else in AutoIt and you want to prevent others from decompiling your work to the original source code form — AutoIt Obfuscator is for you.
How does AutoIt Obfuscator work?
Our solution is built on two basic components. The first is an advanced AutoIt source code parsing library based on work by Matt Diesel. It contains a lexer, AST parser and code generator for AutoIt language syntax. We don't use cheap and buggy regular expressions for source code analysis.
The second component is of course our actual obfuscation engine. It takes the generated AST and applies obfuscation strategies to selected tree nodes. Many of the obfuscation techniques were created specially for AutoIt Obfuscator, but some of the obfuscation strategies and ideas are taken from our other security products like our x86 assembly Obfuscator or the polymorphic string encryption used in our StringEncrypt service.
After all the modification are done, the AST tree is compiled back to obfuscated source code format. This might sound simple, but it's trickier than you would expect! There are many quirks and traps along the way as well as many corner cases in AutoIt source code parsing and modification.
Bug Bounty
I have tested AutoIt Obfuscator with hundreds of public scripts, examples and all available language constructs, but it might not work in some very rare cases and if you find a bug — please report it to me. If I can confirm your findings I will grant you a free access code to the product as a thank you for your report.
Obfuscation strategies
Tricks and techniques for deliberately obfuscating code, with examples of code before and after obfuscation:
Rename variable names to random string values
All references to the renamed variables are automatically fixed. |
||
Rename function names to random string values
DllCall() and others using function names as a parameter are automatically fixed as long as the parameter is passed as a string (not a variable!). |
||
Rename function names in function calls with randomly named variables
Functions in AutoIt can be assigned to variables; this is a good way to hide the real name of called functions. |
||
Shuffle order of functions in the output source
The order of AutoIt functions in a script is not important. |
||
Resolve WinAPI constants to numerical values, so they can be obfuscated as integer values
Currently more than 15000 Windows API constants are recognized. |
||
Encrypt numeric values into series of arithmetic and boolean expressions
Arithmetic expressions include the |
||
Split strings into series of random sized substrings connected with concatenation operators
Quoted strings within strings are automatically detected and handled properly. |
||
Modify strings to obfuscate their values using built-it AutoIt string functions
String modifications use the built-in StringReverse(), StringTrimRight() and StringTrimLeft() functions. |
||
Encrypt strings using randomly generated polymorphic encryption algorithms
The polymorphic string encryption engine is taken from our StringEncrypt solution. |
||
Insert ternary operators for numerical values to make analysis of the obfuscated code harder
Read more about the ternary operator in AutoIt. |
Command line version
AutoIt Obfuscator comes with an additional command line interface.
It can be used to integrate obfuscation into your build process or any other batch operation.
Additional software protection and licensing
Compiled obfuscated code is safe against analysis, but if you want to apply even more protection, add anti-debugging detection, virtual machines and emulators detection, CRC anti-patching protection, time-trial limitations or licensing features, take a look at our PELock software protection solution.
I assure you it will be a great addition to AutoIt Obfuscator, but don't take my word for it, download the demo version and try it for yourself.
Any questions?
If you would like to ask me about AutoIt Obfuscator, or something's not clear, mail me. I'll be happy to answer all of your questions.