[#rootworm]

.Net 2.0 required
and before i get posts saying this app doesn't do anything: it's a CONSOLE app. run it in a CMD window.

i wrote this little app because ExeScript does not include a decompiler, and I needed to retrieve one of my batch files. yes it should have been done in c++, but hey...the source is here so feel free to port it if you want.

features:

autodetects compiled filetype: javascript, vbs, or batch
finds start of batch file, end of batch file, then decrypts.
works for silent and regular batch files and the other supported filetypes.

ExeScript "encryption" is nothing more than each byte XOR 1, and they had the audacity to call it encryption!

usage:

decompile.exe example.exe
output is either example.js, example.bat, or example.vbs depending on what was compiled.

NOTE:
only tested on evaluation exes, but it should work for the purchased version too (i hope).

This post has been edited by #rootworm: 13 November 2006 - 01:35 AM

[#rootworm]

updated to version 1.1

changes:

now supports ExeScript exes which have undergone extensive resource editing, and thus have slightly modified data headers.

also added a quick little error check to see if file exists before opening, but that's the only error handling.

also attached the updated c# source.

Attached File(s)

•  Decompile.cs.txt (4.6K)
  Number of downloads: 277
•  Decompile.exe (16K)
  Number of downloads: 410

This post has been edited by #rootworm: 13 November 2006 - 01:52 AM

[ArmBoy]

can you build a decompiler for this tool ? http://www.vbs2exe.com ?

Regards,

[#rootworm]

i'll write an app in a bit.

This post has been edited by #rootworm: 14 April 2008 - 01:41 AM

[#rootworm]

VBS2EXE decompiler posted at TPB and Demonoid.

VBS2EXE seems kinda buggy... it doesn't seem to like large scripts. This first version of the decompiler isn't ideal, but it should work for most scripts. In the future if I can get VirtualProtectEx API to work properly in Vista I'll update the decompiler.

Also, updated version of ExeScript decompiler which defeats the 128 bit crypto in 3.0 and 3.01 is on TPB.

[skypeaful]

Thank for the program but I seem doesn't work for Exescript 3.x.

[qwertzuiop]

I have done it, but i found no way to decode the vbs. Can you help me? I can send you the file. Thanks.

Patrick