Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

[release] ExeScript 2.1.1 Decompiler 1.1

- - - - -

  • Please log in to reply
7 replies to this topic

#1
#rootworm

#rootworm

    Member

  • Member
  • PipPip
  • 206 posts
  • Joined 16-July 06
.Net 2.0 required
and before i get posts saying this app doesn't do anything: it's a CONSOLE app. run it in a CMD window.

i wrote this little app because ExeScript does not include a decompiler, and I needed to retrieve one of my batch files. yes it should have been done in c++, but hey...the source is here so feel free to port it if you want.

features:

autodetects compiled filetype: javascript, vbs, or batch
finds start of batch file, end of batch file, then decrypts.
works for silent and regular batch files and the other supported filetypes.

ExeScript "encryption" is nothing more than each byte XOR 1, and they had the audacity to call it encryption!

usage:

decompile.exe example.exe
output is either example.js, example.bat, or example.vbs depending on what was compiled.

NOTE:
only tested on evaluation exes, but it should work for the purchased version too (i hope).

Edited by #rootworm, 13 November 2006 - 01:35 AM.

bpx messageboxa


How to remove advertisement from MSFN

#2
#rootworm

#rootworm

    Member

  • Member
  • PipPip
  • 206 posts
  • Joined 16-July 06
updated to version 1.1

changes:

now supports ExeScript exes which have undergone extensive resource editing, and thus have slightly modified data headers.

also added a quick little error check to see if file exists before opening, but that's the only error handling.

also attached the updated c# source.

Attached Files


Edited by #rootworm, 13 November 2006 - 01:52 AM.

bpx messageboxa

#3
Guest_ArmBoy_*

Guest_ArmBoy_*
  • Guests
  • Joined --
can you build a decompiler for this tool ? http://www.vbs2exe.com ?

Regards,

#4
#rootworm

#rootworm

    Member

  • Member
  • PipPip
  • 206 posts
  • Joined 16-July 06
i'll write an app in a bit.

Edited by #rootworm, 14 April 2008 - 01:41 AM.

bpx messageboxa

#5
#rootworm

#rootworm

    Member

  • Member
  • PipPip
  • 206 posts
  • Joined 16-July 06
VBS2EXE decompiler posted at TPB and Demonoid.

VBS2EXE seems kinda buggy... it doesn't seem to like large scripts. This first version of the decompiler isn't ideal, but it should work for most scripts. In the future if I can get VirtualProtectEx API to work properly in Vista I'll update the decompiler.

Also, updated version of ExeScript decompiler which defeats the 128 bit crypto in 3.0 and 3.01 is on TPB.
bpx messageboxa

#6
skypeaful

skypeaful
  • Member
  • 1 posts
  • Joined 18-February 11
  • OS:XP Home
  • Country: Country Flag
Thank for the program but I seem doesn't work for Exescript 3.x.

#7
qwertzuiop

qwertzuiop
  • Member
  • 1 posts
  • Joined 24-November 11
  • OS:XP Pro x64
  • Country: Country Flag
I have done it, but i found no way to decode the vbs. Can you help me? I can send you the file. Thanks.

Patrick

#8
TheExterminator

TheExterminator

    Newbie

  • Member
  • 32 posts
  • Joined 07-January 07
I get this error:

C:\Users\TheExterminator\Desktop>Decompile.exe test.exe
ExeScript 2.1.1 Decompiler 1.1
Error: Unable to locate start of batch file.
Probably not created by ExeScript 2.1.1!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users