Once found, it extracts and decompiles the code. When the 'automate' functionality is used, MyAut2Exe parses the executable for AutoIT magic bytecode signatures. This brute forces the decompiler settings until a script is successfully decompiled. To take the hassle out of correctly configuring it, it comes with a feature called 'automate'. Therefore, it has more settings to adjust the extraction and unpacking of the compiled script code. It supports multiple versions of AutoIT and AutoHotkey compiled scripts. Unlike Exe2Aut, MyAut2Exe extracts the bytecode resource and unpacks and decodes it without the help of the embedded interpreter - making it a full static decompiler because of this, there is no risk of accidentally executing anything. Exe2Aut injected module What About MyAut2Exe? By doing so, we can trick Exe2Aut to decompile a decoy script instead of the real script, which is executed when running the application. Due to this, it's possible to add code to detect the injection and change its behavior. This hooks the function that will execute the bytecode and decodes the bytecode back to the function names instead - making it a dynamic approach.

The target binary will write the decompiled autoIT script to the current working directory.īecause of this, you can conclude that Exe2Aut utilizes the embedded interpreter to decrypt and decompress the script bytecode and extracts this by injecting a dynamic link library (DLL) into the target binary.

tmp file is injected in the target binary.

The target binary is loaded as a child process of Exe2Aut.

tmp file is written to the %TEMP% folder. If you would dynamically analyze Exe2Aut during decompilation, you would notice the following: The decompression of the bytecode is performed by the compiled AutoIT binary before it is interpreted and executed.

The creators of AutoIT have taken some measures against easy decompilation and applied a form of compression and encryption on the bytecode.

Exe2Aut disclaimer What is a “Compiled” AutoIT Executable?Ī compiled AutoIT executable basically consists of two parts: a standalone AutoIT interpreter and the compiled script bytecode present as a resource in the PE file. In this writeup, I will explain how the two most common AutoIT decompilers (Exe2Aut and myAut2Exe) work and how they can be tricked into decompiling a decoy script instead of the real script. This triggered my interest in how this decompiler works and how AutoIt scripts are compiled in the first place. During the analysis of an AutoIT compiled malware sample, a message box popped up indicating the possible execution of the sample when using Exe2Aut decompiler.

Decompiling an autoit exe