AutoIt-Ripper - Extract AutoIt scripts embedded in PE binaries

项目说明

AutoIt-Ripper

What is this

This is a short python script that allows for extraction of "compiled" AutoIt scripts from PE executables.

References

This script is heavily based on 3 resources, definitely check them out if you want to dig a bit deeper into AutoIt stuff:
*
* Github mirror I
* Github mirror II
*
*

Supported AutoIt

Ready:

* EA05 AutoIt3.00
* EA06 AutoIt3.26
* JB01 AutoHotKey v1

Unknown:

* JB01 AutoIT2

Installation

or, if you'd like to install the from sources:

Running

From a python script:

From the commandline:

Help message:

Format documentation

#### (In progress)

AU3 header

| Field | Length | encryption (EA05) | encryption (EA06) | Notes |
|:----------------:|:-------------:|:-----------------:|:-----------------:|:---------------------------:|
| "FILE" | 4 | MT(0x16FA) | LAME(0x18EE) | static string |
| flag | 4 | xor(0x29BC) | xor(0xADBC) | |
| auto_str | flag (* 2) | MT(0xA25E + flag)|LAME(0xB33F + flag)| UTF-8/UTF-16 |
| path_len | 4 | xor(0x29AC) | xor(0xF820) | |
| path | path_len (* 2)|MT(0xF25E + path_len)|LAME(0xF479 + path_len) | Path of the compiled script |
| compressed | 1 | None | None | is the script compressed |
| data_size | 4 | xor(0x45AA) | xor(0x87BC) | compressed data size |
| code_size | 4 | xor(0x45AA) | xor(0x87BC) | uncompressed data size |
| crc | 4 | xor(0xC3D2) | xor(0xA685) | compressed data crc checksum|
| creation date | 4 | None | None | file creation date (high) |
| creation date | 4 | None | None | file creation date (low) |
| last update date | 4 | None | None | last edit date (high) |
| last update date | 4 | None | None | last edit date (low) |
| data | data_size |MT(checksum + 0x22af)|LAME(0x2477) | script data |

Differences between v3.00 and v3.26+

| | v3.00 | v3.26 |
|--------------------- |-------------------- |--------------------------------------- |
| Code storage | greped by magic | "SCRIPT" resource (/greped by magic?) |
| String encoding | UTF-8 | UTF-16 |
| Encryption | xor/custom MT19937 | xor/LAME crypt |
| Code encryption key | dynamic | static |
| Compression | yes | yes |
| Code "compilation" | no | yes |
| Magic | EA05 | EA06 |

项目信息

开发语言：Python

Star 数：243

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Extract AutoIt scripts embedded in PE binaries展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。