<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title type="html"><![CDATA[Серый форум &mdash; AHK: Обфускация исходного кода]]></title>
	<link rel="self" href="https://forum.script-coding.com/extern.php?action=feed&amp;tid=13684&amp;type=atom" />
	<updated>2018-05-07T02:12:39Z</updated>
	<generator>PunBB</generator>
	<id>https://forum.script-coding.com/viewtopic.php?id=13684</id>
		<entry>
			<title type="html"><![CDATA[AHK: Обфускация исходного кода]]></title>
			<link rel="alternate" href="https://forum.script-coding.com/viewtopic.php?pid=125172#p125172" />
			<content type="html"><![CDATA[<p>Здравствуйте. Недавно наткнулся на пару интересных тем: <a href="https://autohotkey.com/board/topic/69667-are-you-just-another-autohotkey-hacker/page-1">первая</a>, <a href="http://forum.script-coding.com/viewtopic.php?id=10659">вторая</a> и решил немного копнуть в эту сторону. Знаний хватило, чтобы получилось это:<br /></p><div class="codebox"><pre><code>#9#S1F:=Object(#9#F1(&quot;6761797365726365746b657930&quot;), #9#F1(&quot;6a756e6b6a756e6b6a69756e6b2323&quot;), #9#F1(&quot;6761797365726365746b657931&quot;), #9#F1(&quot;66616b656a756e6b636f64656c32321f&quot;)),#9#SF1:=Object(#9#F1(&quot;6761797365726365746b657930&quot;), #9#F1(&quot;66616b6566616c6b6566616b654242421&quot;), #9#F1(&quot;6761797365726365746b657931&quot;), #9#F1(&quot;676164666b6e66616b65636f64654242b&quot;) , #9#F1(&quot;6761797365726365746b657932&quot;), #9#F1(&quot;6c756c69747366616b6542421bf34&quot;)),#9$#F1:=Object(#9#F1(&quot;6761797365726365746b657930&quot;), #9#F1(&quot;4d794265737450617373776f7264&quot;), #9#F1(&quot;6761797365726365746b657931&quot;), #9#F1(&quot;484c5a755958667271765a43554278397161483257413d3d&quot;), #9#F1(&quot;6761797365726365746b657932&quot;), #9#F1(&quot;6a54436d3138696937544c487a316b356462765878773d3d&quot;)),#9#SF1[#9#F1(&quot;6761797365726365746b657930&quot;)]:=#9$#F1[#9#F1(&quot;6761797365726365746b657930&quot;)],#9#SF1[#9#F1(&quot;6761797365726365746b657931&quot;)]:=#9$#F1[#9#F1(&quot;6761797365726365746b657931&quot;)],#9#SF1[#9#F1(&quot;6761797365726365746b657932&quot;)]:=#9$#F1[#9#F1(&quot;6761797365726365746b657932&quot;)],#9#S1F[#9#F1(&quot;6761797365726365746b657930&quot;)]:=S.F(#9#SF1[#9#F1(&quot;6761797365726365746b657931&quot;)], #9#SF1[#9#F1(&quot;6761797365726365746b657930&quot;)], #9#F1(323536)),#9#S1F[#9#F1(&quot;6761797365726365746b657931&quot;)]:=S.F(#9#SF1[#9#F1(&quot;6761797365726365746b657932&quot;)], #9#SF1[#9#F1(&quot;6761797365726365746b657930&quot;)], #9#F1(323536))
MsgBox % (#9#S1F[#9#F1(&quot;6761797365726365746b657930&quot;)]#9#S1F[#9#F1(&quot;6761797365726365746b657931&quot;)])

#9#F1(#2#F){
    While (#3#F := SubStr(#2#F, A_Index*2-1, 2)) != &quot;&quot;
        #5#F .= Chr(&quot;0x&quot; #3#F) 
    Return #5#F
}

Class S
{
    H(string, password, alg)
    {
        len := this.StrPutVar(string, str_buf, 0, &quot;UTF-8&quot;)
        this.Crypt(str_buf, len, password, alg, 1)
        return this.b64Encode(str_buf, len)
    }
    F(string, password, alg)
    {
        len := this.b64Decode(string, encr_Buf)
        sLen := this.Crypt(encr_Buf, len, password, alg, 0)
        sLen /= 2
        return StrGet(&amp;encr_Buf, sLen, &quot;UTF-8&quot;)
    }
   
    Crypt(ByRef encr_Buf, ByRef Buf_Len, password, ALG_ID, CryptMode := 1)
    {
        ; WinCrypt.h
        static MS_ENH_RSA_AES_PROV := &quot;Microsoft Enhanced RSA and AES Cryptographic Provider&quot;
        static PROV_RSA_AES        := 24
        static CRYPT_VERIFYCONTEXT := 0xF0000000
        static CALG_SHA1           := 0x00008004
        static CALG_SHA_256        := 0x0000800c
        static CALG_SHA_384        := 0x0000800d
        static CALG_SHA_512        := 0x0000800e
        static CALG_AES_128        := 0x0000660e ; KEY_LENGHT := 0x80  ; (128)
        static CALG_AES_192        := 0x0000660f ; KEY_LENGHT := 0xC0  ; (192)
        static CALG_AES_256        := 0x00006610 ; KEY_LENGHT := 0x100 ; (256)
        static KP_BLOCKLEN         := 8
       
        if !(DllCall(&quot;advapi32.dll\CryptAcquireContext&quot;, &quot;Ptr*&quot;, hProv, &quot;Ptr&quot;, 0, &quot;Ptr&quot;, 0, &quot;Uint&quot;, PROV_RSA_AES, &quot;UInt&quot;, CRYPT_VERIFYCONTEXT))
            MsgBox % &quot;*CryptAcquireContext (&quot; DllCall(&quot;kernel32.dll\GetLastError&quot;) &quot;)&quot;
       
        if !(DllCall(&quot;advapi32.dll\CryptCreateHash&quot;, &quot;Ptr&quot;, hProv, &quot;Uint&quot;, CALG_SHA1, &quot;Ptr&quot;, 0, &quot;Uint&quot;, 0, &quot;Ptr*&quot;, hHash))
            MsgBox % &quot;*CryptCreateHash (&quot; DllCall(&quot;kernel32.dll\GetLastError&quot;) &quot;)&quot;
       
        passLen := this.StrPutVar(password, passBuf, 0, &quot;UTF-8&quot;)
        if !(DllCall(&quot;advapi32.dll\CryptHashData&quot;, &quot;Ptr&quot;, hHash, &quot;Ptr&quot;, &amp;passBuf, &quot;Uint&quot;, passLen, &quot;Uint&quot;, 0))
            MsgBox % &quot;*CryptHashData (&quot; DllCall(&quot;kernel32.dll\GetLastError&quot;) &quot;)&quot;
       
        if !(DllCall(&quot;advapi32.dll\CryptDeriveKey&quot;, &quot;Ptr&quot;, hProv, &quot;Uint&quot;, CALG_AES_%ALG_ID%, &quot;Ptr&quot;, hHash, &quot;Uint&quot;, (ALG_ID &lt;&lt; 0x10), &quot;Ptr*&quot;, hKey)) ; KEY_LENGHT &lt;&lt; 0x10
            MsgBox % &quot;*CryptDeriveKey (&quot; DllCall(&quot;kernel32.dll\GetLastError&quot;) &quot;)&quot;
       
        if !(DllCall(&quot;advapi32.dll\CryptGetKeyParam&quot;, &quot;Ptr&quot;, hKey, &quot;Uint&quot;, KP_BLOCKLEN, &quot;Uint*&quot;, BlockLen, &quot;Uint*&quot;, 4, &quot;Uint&quot;, 0))
            MsgBox % &quot;*CryptGetKeyParam (&quot; DllCall(&quot;kernel32.dll\GetLastError&quot;) &quot;)&quot;
        BlockLen /= 8
       
        if (CryptMode)
            DllCall(&quot;advapi32.dll\CryptEncrypt&quot;, &quot;Ptr&quot;, hKey, &quot;Ptr&quot;, 0, &quot;Uint&quot;, 1, &quot;Uint&quot;, 0, &quot;Ptr&quot;, &amp;encr_Buf, &quot;Uint*&quot;, Buf_Len, &quot;Uint&quot;, Buf_Len + BlockLen)
        else
            DllCall(&quot;advapi32.dll\CryptDecrypt&quot;, &quot;Ptr&quot;, hKey, &quot;Ptr&quot;, 0, &quot;Uint&quot;, 1, &quot;Uint&quot;, 0, &quot;Ptr&quot;, &amp;encr_Buf, &quot;Uint*&quot;, Buf_Len)
       
        DllCall(&quot;advapi32.dll\CryptDestroyKey&quot;, &quot;Ptr&quot;, hKey)
        DllCall(&quot;advapi32.dll\CryptDestroyHash&quot;, &quot;Ptr&quot;, hHash)
        DllCall(&quot;advapi32.dll\CryptReleaseContext&quot;, &quot;Ptr&quot;, hProv, &quot;UInt&quot;, 0)
        return Buf_Len
    }
   
    StrPutVar(string, ByRef var, addBufLen := 0, encoding := &quot;UTF-8&quot;)
    {
        tlen := ((encoding = &quot;UTF-8&quot; || encoding = &quot;CP1200&quot;) ? 2 : 1)
        str_len := StrPut(string, encoding) * tlen
        VarSetCapacity(var, str_len + addBufLen, 0)
        StrPut(string, &amp;var, encoding)
        return str_len - tlen
    }
   
    b64Encode(ByRef VarIn, SizeIn)
    {
        static CRYPT_STRING_BASE64 := 0x00000001
        static CRYPT_STRING_NOCRLF := 0x40000000
        DllCall(&quot;crypt32.dll\CryptBinaryToStringA&quot;, &quot;Ptr&quot;, &amp;VarIn, &quot;UInt&quot;, SizeIn, &quot;Uint&quot;, (CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF), &quot;Ptr&quot;, 0, &quot;UInt*&quot;, SizeOut)
        VarSetCapacity(VarOut, SizeOut, 0)
        DllCall(&quot;crypt32.dll\CryptBinaryToStringA&quot;, &quot;Ptr&quot;, &amp;VarIn, &quot;UInt&quot;, SizeIn, &quot;Uint&quot;, (CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF), &quot;Ptr&quot;, &amp;VarOut, &quot;UInt*&quot;, SizeOut)
        return StrGet(&amp;VarOut, SizeOut, &quot;CP0&quot;)
    }
    b64Decode(ByRef VarIn, ByRef VarOut)
    {
        static CRYPT_STRING_BASE64 := 0x00000001
        static CryptStringToBinary := &quot;CryptStringToBinary&quot; (A_IsUnicode ? &quot;W&quot; : &quot;A&quot;)
        DllCall(&quot;crypt32.dll\&quot; CryptStringToBinary, &quot;Ptr&quot;, &amp;VarIn, &quot;UInt&quot;, 0, &quot;Uint&quot;, CRYPT_STRING_BASE64, &quot;Ptr&quot;, 0, &quot;UInt*&quot;, SizeOut, &quot;Ptr&quot;, 0, &quot;Ptr&quot;, 0)
        VarSetCapacity(VarOut, SizeOut, 0)
        DllCall(&quot;crypt32.dll\&quot; CryptStringToBinary, &quot;Ptr&quot;, &amp;VarIn, &quot;UInt&quot;, 0, &quot;Uint&quot;, CRYPT_STRING_BASE64, &quot;Ptr&quot;, &amp;VarOut, &quot;UInt*&quot;, SizeOut, &quot;Ptr&quot;, 0, &quot;Ptr&quot;, 0)
        return SizeOut
    }
}</code></pre></div><p>Для усложнения анализа исходного кода используются: массивы с переменными и их содержанием, наборы похожих друг на друга символов, AES-шифрование, конвертация текста в хекс формат. Хотелось бы узнать, какие еще методы обфускации есть и совместимы ли они с AHK. <br />Также хотелось бы узнать, каким образом в данном коде спрятан вызов MsgBox. Спасибо.<br /></p><div class="codebox"><pre><code>#:=&quot;chr&quot;,#@:=(#_:=(##:=($:=(#$:=(_:=!&quot;&quot;)&lt;&lt;_)&lt;&lt;_)&lt;&lt;_)&lt;&lt;_)&lt;&lt;#$,@:=#_&lt;&lt;_|#@,_#:=%#%(@|#$|_),__:=%#%(@|$|_),_@:=%#%(@|#_|#$|_),_$:=%#%(#@|_),@#:=%#%(@|_),@_:=%#%(@|##|$|#$|_),@@:=%#%(@|#_|$|_),@$:=%#%(@|#_|$),$#:=%#%(@|##|$|#$),$_:=%#%(@|#_|#$),$@:=%#%(@|##|#$|_),$$:=%#%(#@|##),###:=%#%(@|$),##_:=%#%(@|##|$),%###%%##_%%##_%%_#%%@#%%##_%%##_%(%#%(#@|##|$|_) __ _@ _@ @# %#%(@|$|#$|_) __ %#%(#@|#$) @_ %#%(@|#_|##),%#%(#@|@|##|_) $# @$,!_,_@ @$ $_,%#%(#@|##|#$) @@ _@ @$ &quot; &quot; _$ $# @_ @$ %#%(@|##) __ $_ &quot; &quot; _$ @@ @$ @_ $$ @_ @$ $@ __ %#%(@|#_|##|_) &quot; &quot; $$ @# _# $@ __ $_,_@ @$ $_,&quot;&quot;,%#%(#@|@|##|_) $# @$,!_)</code></pre></div>]]></content>
			<author>
				<name><![CDATA[powercat]]></name>
				<uri>https://forum.script-coding.com/profile.php?id=37884</uri>
			</author>
			<updated>2018-05-07T02:12:39Z</updated>
			<id>https://forum.script-coding.com/viewtopic.php?pid=125172#p125172</id>
		</entry>
</feed>
