{"id":18579484,"url":"https://github.com/nazywam/autoit-ripper","last_synced_at":"2025-04-04T22:09:21.150Z","repository":{"id":45914310,"uuid":"248352255","full_name":"nazywam/AutoIt-Ripper","owner":"nazywam","description":"Extract AutoIt scripts embedded in PE binaries","archived":false,"fork":false,"pushed_at":"2024-07-15T10:35:26.000Z","size":118,"stargazers_count":181,"open_issues_count":9,"forks_count":36,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-03-28T21:08:19.173Z","etag":null,"topics":["autoit","extraction","malware"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nazywam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-03-18T21:59:30.000Z","updated_at":"2025-03-01T13:58:02.000Z","dependencies_parsed_at":"2022-09-26T19:30:47.840Z","dependency_job_id":"f18a4606-ad9f-4aca-b486-801cdb296e7c","html_url":"https://github.com/nazywam/AutoIt-Ripper","commit_stats":{"total_commits":37,"total_committers":4,"mean_commits":9.25,"dds":"0.45945945945945943","last_synced_commit":"eccf58bdf98befe1a6179d7704d3a1937084e427"},"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nazywam%2FAutoIt-Ripper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nazywam%2FAutoIt-Ripper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nazywam%2FAutoIt-Ripper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nazywam%2FAutoIt-Ripper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nazywam","download_url":"https://codeload.github.com/nazywam/AutoIt-Ripper/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247256115,"owners_count":20909240,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["autoit","extraction","malware"],"created_at":"2024-11-06T23:41:01.252Z","updated_at":"2025-04-04T22:09:21.124Z","avatar_url":"https://github.com/nazywam.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AutoIt-Ripper\n\n## What is this\nThis is a short python script that allows for extraction of \"compiled\" AutoIt scripts from PE executables.\n\n## References\nThis script is **heavily** based on 3 resources, definitely check them out if you want to dig a bit deeper into AutoIt stuff:\n * http://files.planet-dl.org/Cw2k/MyAutToExe/index.html\n   * [Github mirror I](https://github.com/dzzie/myaut_contrib)\n   * [Github mirror II](https://github.com/PonyPC/myaut_contrib)\n * https://github.com/sujuhu/autoit\n * https://github.com/Cisco-Talos/clamav-devel/blob/31824a659dff37ae03e3419395bb68e659c2b165/libclamav/autoit.c\n\n## Supported AutoIt versions\n\n### Ready:\n\n* `EA05` AutoIt3.00\n* `EA06` AutoIt3.26\n\n### Unknown:\n\n* `JB01` AutoHotKey\n* `JB01` AutoIT2\n\n## Installation\n```shell\npython3 -m pip install autoit-ripper\n```\n\nor, if you'd like to install the version from sources:\n\n```shell\ngit clone https://github.com/nazywam/AutoIt-Ripper.git\ncd AutoIt-Ripper\npip install .\n```\n\n## Running\n\nFrom a python script:\n```python\nfrom autoit_ripper import extract, AutoItVersion\n\nwith open(\"sample.exe\", \"rb\") as f:\n    file_content = f.read()\n\n# EA05 for v3.00+, EA06 for v3.26+\n# Omitting `version` or passing None will try both versions\ncontent_list = extract(data=file_content, version=AutoItVersion.EA06)\n```\n\nFrom the commandline:\n```shell\nautoit-ripper sample.exe out_directory\n```\n\nHelp message:\n```shell\nautoit-ripper --help\nusage: autoit-ripper [-h] [--verbose] [--ea {EA05,EA06,guess}] file output_dir\n\npositional arguments:\n  file                  input binary\n  output_dir            output directory\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --verbose, -v\n  --ea {EA05,EA06,guess}\n                        extract a specific version of AutoIt script (default: guess)\n\n```\n\n\n## Format documentation\n#### (In progress)\n\n\n### AU3 header\n\n|       Field      |    Length     | encryption (EA05) | encryption (EA06) |            Notes            |\n|:----------------:|:-------------:|:-----------------:|:-----------------:|:---------------------------:|\n|      \"FILE\"      |       4       |  MT(0x16FA)       |  LAME(0x18EE)     |        static string        |\n|       flag       |       4       |  xor(0x29BC)      |  xor(0xADBC)      |                             |\n|     auto_str     |   flag (* 2)  |  MT(0xA25E + flag)|LAME(0xB33F + flag)|        UTF-8/UTF-16         |\n|     path_len     |       4       |  xor(0x29AC)      |  xor(0xF820)      |                             |\n|       path       | path_len (* 2)|MT(0xF25E + path_len)|LAME(0xF479 + path_len) | Path of the compiled script |\n|    compressed    |       1       |  None             |  None             |   is the script compressed  |\n|     data_size    |       4       |  xor(0x45AA)      |  xor(0x87BC)      |    compressed data size     |\n|     code_size    |       4       |  xor(0x45AA)      |  xor(0x87BC)      |    uncompressed data size   |\n|       crc        |       4       |  xor(0xC3D2)      |  xor(0xA685)      | compressed data crc checksum|\n|   creation date  |       4       |  None             |  None             |  file creation date (high)  |\n|   creation date  |       4       |  None             |  None             |  file creation date (low)   |\n| last update date |       4       |  None             |  None             |      last edit date (high)  |\n| last update date |       4       |  None             |  None             |       last edit date (low)  |\n|       data       |   data_size   |MT(checksum + 0x22af)|LAME(0x2477)     |         script data         |\n\n### Differences between v3.00 and v3.26+\n\n|                     \t| v3.00              \t| v3.26                                 \t|\n|---------------------\t|--------------------\t|---------------------------------------\t|\n| Code storage        \t| greped by magic    \t| \"SCRIPT\" resource (/greped by magic?) \t|\n| String encoding     \t| UTF-8             \t| UTF-16                                \t|\n| Encryption          \t| xor/custom MT19937 \t| xor/LAME crypt                        \t|\n| Code encryption key \t| dynamic            \t| static                                \t|\n| Compression         \t| yes                \t| yes                                   \t|\n| Code \"compilation\"  \t| no                 \t| yes                                   \t|\n| Magic               \t| EA05               \t| EA06                                  \t|\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnazywam%2Fautoit-ripper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnazywam%2Fautoit-ripper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnazywam%2Fautoit-ripper/lists"}