ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
@c7aesa7r
If you can ensure that the original ScriptGuard1 code was executed at the beginning of the script, say by checking a ListLines report, and there was no error message from the included code, then you can be sure that your script got removed from memory (as documented in the first post).
I believe further discussion on this would violate the forum rules on decompilation.
Cheers
If you can ensure that the original ScriptGuard1 code was executed at the beginning of the script, say by checking a ListLines report, and there was no error message from the included code, then you can be sure that your script got removed from memory (as documented in the first post).
I believe further discussion on this would violate the forum rules on decompilation.
Cheers
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Unfortunately, this method does not allow the source code to be protected too much.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
@afe
ScripGuard can only remove the source script from memory after the script starts executing, as explained in the first post of the thread.
I have looked at enhancing ScriptGuard by using an encryption method on the embedded script but all methods suffer from the fact that the decoding algorithm plus the key used, will be present in the generated .exe, and can thus be used by a hacker to extract the original source script. (The key and algorithm must be present in the .exe to decode the script prior to being read and analysed by AutoHotkey.)
Furthermore, the encoding algorithm will also be available for inspection (as the encoding code would be published as open source, say, in BinMod.ahk) leading to another avenue for decrypting the protected script.
In my view, it is simply not possible to protect an encrypted script in an .exe from examination by a determined hacker, for the reasons given above.
ScripGuard can only remove the source script from memory after the script starts executing, as explained in the first post of the thread.
I have looked at enhancing ScriptGuard by using an encryption method on the embedded script but all methods suffer from the fact that the decoding algorithm plus the key used, will be present in the generated .exe, and can thus be used by a hacker to extract the original source script. (The key and algorithm must be present in the .exe to decode the script prior to being read and analysed by AutoHotkey.)
Furthermore, the encoding algorithm will also be available for inspection (as the encoding code would be published as open source, say, in BinMod.ahk) leading to another avenue for decrypting the protected script.
In my view, it is simply not possible to protect an encrypted script in an .exe from examination by a determined hacker, for the reasons given above.
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Firstly, I think a person has to make peace with what level of protection that they are aiming for. Just about nothing is hackerproof. Even the compiled programming languages have their programs cracked. That's just how it is when dealing with determined and skilled hackers/crackers. Those types are usually more effectively dealt with by legal means and law enforcement, rather than "uncrackable" protection. So a more realistic goal is reasonable protection from casuals and those unfamiliar with AHK.TAC109 wrote: ↑07 Oct 2020, 17:35Furthermore, the encoding algorithm will also be available for inspection (as the encoding code would be published as open source, say, in BinMod.ahk) leading to another avenue for decrypting the protected script.
In my view, it is simply not possible to protect an encrypted script in an .exe from examination by a determined hacker, for the reasons given above.
With that in mind, it does appear possible to use machine code/MCode for the encrypting and decrypting algorithm. FeiYue has already demonstrated this with Encryptor (https://www.autohotkey.com/boards/viewtopic.php?t=42494). I don't think it's unreasonable to publish the C source code either, so that people can convert it to MCode themselves as well and for peace of mind. It can be up to the user to change the encrypting password. Which by the way, is what AHK_H is doing, except at the C++ source code level.
I think ScriptGuard is a good idea, different angle to approach the issue, and something else for AHK_L users.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
My program has been decoded by others, and the account was used to sell it. I can't do anything about it. I know that this day will come sooner or later, and have been considering changing to another language. Of course, this is not the only reason. AutoHotKey does not support multi-threading, and the speed is a bit slow, not suitable for writing desktop programs. Of course, it is very convenient to write some automated scripts with it. And to use it to write a larger program, I think it is not suitable. From my experience, its function is very tricky in many aspects. From these perspectives, I think it seems a little futile to protect the source code, or since it is difficult to protect, then let him go. Open source is great. If you need to protect the source code, you should switch to a compiled language.
If protection is required, I think confusion is the direction. Although it cannot be very safe, at least it will seem a bit headache. As SOTE said, or maybe MCode (https://www.autohotkey.com/boards/viewtopic.php?t=32) might be the solution, but I don't understand it, it looks very difficult. To spend time on this, it would be better to learn another language. This is my personal opinion.
I plan to migrate my program to C#. Of course, C# is no exception, the same problem must be faced. All interpreted languages cannot get rid of this problem. However, C# can obfuscate the code. Of course, there are more powerful anti-obfuscation tools for C# obfuscation. As I said before, this is not the only reason why I want to switch to C#. I want to write desktop programs and handle Web requests. C# may be the right choice.
If protection is required, I think confusion is the direction. Although it cannot be very safe, at least it will seem a bit headache. As SOTE said, or maybe MCode (https://www.autohotkey.com/boards/viewtopic.php?t=32) might be the solution, but I don't understand it, it looks very difficult. To spend time on this, it would be better to learn another language. This is my personal opinion.
I plan to migrate my program to C#. Of course, C# is no exception, the same problem must be faced. All interpreted languages cannot get rid of this problem. However, C# can obfuscate the code. Of course, there are more powerful anti-obfuscation tools for C# obfuscation. As I said before, this is not the only reason why I want to switch to C#. I want to write desktop programs and handle Web requests. C# may be the right choice.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
afe, before making any drastic steps, you might want to look into AutoHotkey_H. And it supports multi-threading.
As for C#, it's an interpreted language too, so suffers from similar issues in terms of decompilation. In that group is also Java, JavaScript, and Python. Interpreted languages will need encryption or obfuscation to protect source code as well. But don't think compiled languages like C, C++, Pascal, Go, etc... are completely safe from hackers/crackers either. You are simply not going to stop a determined and skilled hacker/cracker who can spend weeks and months trying all sorts of ways to crack your code.
Arguably the better approach, after having reasonable protection from casuals, is to pursue the legal route. Identify the websites and individuals involved and report them to their ISP (in many countries they will take down websites with illegal copyrighted material), law enforcement, Anti-Virus companies (their cracked versions often contain malware), and/or take them to court.
As for C#, it's an interpreted language too, so suffers from similar issues in terms of decompilation. In that group is also Java, JavaScript, and Python. Interpreted languages will need encryption or obfuscation to protect source code as well. But don't think compiled languages like C, C++, Pascal, Go, etc... are completely safe from hackers/crackers either. You are simply not going to stop a determined and skilled hacker/cracker who can spend weeks and months trying all sorts of ways to crack your code.
Arguably the better approach, after having reasonable protection from casuals, is to pursue the legal route. Identify the websites and individuals involved and report them to their ISP (in many countries they will take down websites with illegal copyrighted material), law enforcement, Anti-Virus companies (their cracked versions often contain malware), and/or take them to court.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
@TAC109TAC109 wrote: ↑07 Oct 2020, 17:35...I have looked at enhancing ScriptGuard by using an encryption method on the embedded script but all methods suffer from the fact that the decoding algorithm plus the key used, will be present in the generated .exe, and can thus be used by a hacker to extract the original source script.....
Using a basic encryption could be beneficial for an mpress replacement. If mpress is not utilized in an .exe, there should be less reports of false-positives. What are your thoughts on this?
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
I have an encryption scheme for ScriptGuard in the pipeline, but it has been on pause while I’ve been updating Ahk2Exe for the new AutoHotkey v1.1.34.00 facilities. I'll need to update the existing ScriptGuard for v1.1.34+ as well.
So an encryption option could appear sometime in the future.
Cheers
So an encryption option could appear sometime in the future.
Cheers
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Update - 28 Jan 2023
- ScriptGuard2 has been enhanced to encrypt the source script.
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Update - 30 Jan 2023
Speed up script encryption/decryption.
Speed up script encryption/decryption.
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
05 Feb 2023
Added a Summary to the documentation in the first post.
Added a Summary to the documentation in the first post.
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
-
- Posts: 28
- Joined: 05 Aug 2014, 02:01
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
I found two problem using the two scripts.
1.when I use the two script and select upx or mpress options,then the compile file will be destroyed. It won't be run when I double Click it.
But if I don't use compress options,it will be work.
what I used is the latest version:Autohotkey 1.1.36.2,and scriptguard 1 and 2 are also latest.
2.I found that if Create a dump file ,then the code also can be fonud in the dump file.
so how to avoid Create a dump file?
Thx for the reply.
1.when I use the two script and select upx or mpress options,then the compile file will be destroyed. It won't be run when I double Click it.
But if I don't use compress options,it will be work.
what I used is the latest version:Autohotkey 1.1.36.2,and scriptguard 1 and 2 are also latest.
2.I found that if Create a dump file ,then the code also can be fonud in the dump file.
so how to avoid Create a dump file?
Thx for the reply.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
1. If you select an .exe as a base file, the resulting compiled program can be compressed and run successfully. (See the second restriction near the end of the first post.)
2. You may see some parts of you script in the dump file, but this comes from the AutoHotkey interpreter storing parts of the script. (All encryption methods will have this problem.) However you shouldn’t be able to see the complete script anywhere.
Cheers
2. You may see some parts of you script in the dump file, but this comes from the AutoHotkey interpreter storing parts of the script. (All encryption methods will have this problem.) However you shouldn’t be able to see the complete script anywhere.
Cheers
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
-
- Posts: 28
- Joined: 05 Aug 2014, 02:01
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
@TAC109
Thx very much for the reply!
I succeed in the end!
Cheers and Best regards!
Thx very much for the reply!
I succeed in the end!
Cheers and Best regards!
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Update - 15 Feb 2023
Added 'UPX -d' prevention line to the summary in the first post.
Added 'UPX -d' prevention line to the summary in the first post.
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Regarding the encryption, it would be nice (not for the end user though) to user server side code to release an OTP to decrypt the code. It would be an "always online licensing mechanism". As much as I hate "always online" and I cursed Blizzard when they forced me to be be always online when they released Diablo 3, it would be a nice experiment.
ABCza on the old forum.
My GitHub.
My GitHub.
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
A one time password linked to an external server would be way beyond the scope of this ScriptGuard project.
Cheers
Cheers
My scripts:-
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
XRef - Produces Cross Reference lists for scripts
ReClip - A Text Reformatting and Clip Management utility
ScriptGuard - Protects Compiled Scripts from Decompilation
I also maintain Ahk2Exe
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Yeah definitely, I just got carried out by the discussion about the encryption. It's probably something that deserves its own thread.
ABCza on the old forum.
My GitHub.
My GitHub.
- JoeWinograd
- Posts: 2213
- Joined: 10 Feb 2014, 20:00
- Location: U.S. Central Time Zone
Re: ScriptGuard: Helps Protect Compiled Scripts from Decompilation
Hi Folks,
Just a short review on my use of ScriptGuard. I've been using it in all my program development since TAC109 first released it. I've thanked him many times before for it, but would be remiss not to do it again...Thank You!
ScriptGuard has worked very well for me. I do a lot of custom program development for clients, using TAC109's enhanced Ahk2Exe compiler (thanks for that, too!) even before using ScriptGuard. I use NSIS to create installers from the code compiled by Ahk2Exe, including the utilization of ScriptGuard1 and ScriptGuard2.
In addition to using ScriptGuard in my custom program development, I'm also using it in software that I intend to be off-the-shelf products. Nothing for distribution, yet...but someday.
Regards, Joe
Just a short review on my use of ScriptGuard. I've been using it in all my program development since TAC109 first released it. I've thanked him many times before for it, but would be remiss not to do it again...Thank You!
ScriptGuard has worked very well for me. I do a lot of custom program development for clients, using TAC109's enhanced Ahk2Exe compiler (thanks for that, too!) even before using ScriptGuard. I use NSIS to create installers from the code compiled by Ahk2Exe, including the utilization of ScriptGuard1 and ScriptGuard2.
In addition to using ScriptGuard in my custom program development, I'm also using it in software that I intend to be off-the-shelf products. Nothing for distribution, yet...but someday.
Regards, Joe