Welcome to MSFN

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.


Sign in to follow this  
Followers 0
#rootworm

[release] ExeScript 2.1.1 Decompiler 1.1

8 posts in this topic

.Net 2.0 required

and before i get posts saying this app doesn't do anything: it's a CONSOLE app. run it in a CMD window.

i wrote this little app because ExeScript does not include a decompiler, and I needed to retrieve one of my batch files. yes it should have been done in c++, but hey...the source is here so feel free to port it if you want.

features:

autodetects compiled filetype: javascript, vbs, or batch

finds start of batch file, end of batch file, then decrypts.

works for silent and regular batch files and the other supported filetypes.

ExeScript "encryption" is nothing more than each byte XOR 1, and they had the audacity to call it encryption!

usage:

decompile.exe example.exe

output is either example.js, example.bat, or example.vbs depending on what was compiled.

NOTE:

only tested on evaluation exes, but it should work for the purchased version too (i hope).

Edited by #rootworm
0

Share this post


Link to post
Share on other sites

updated to version 1.1

changes:

now supports ExeScript exes which have undergone extensive resource editing, and thus have slightly modified data headers.

also added a quick little error check to see if file exists before opening, but that's the only error handling.

also attached the updated c# source.

Decompile.cs.txt

Decompile.exe

Edited by #rootworm
0

Share this post


Link to post
Share on other sites

i'll write an app in a bit.

Edited by #rootworm
0

Share this post


Link to post
Share on other sites

VBS2EXE decompiler posted at TPB and Demonoid.

VBS2EXE seems kinda buggy... it doesn't seem to like large scripts. This first version of the decompiler isn't ideal, but it should work for most scripts. In the future if I can get VirtualProtectEx API to work properly in Vista I'll update the decompiler.

Also, updated version of ExeScript decompiler which defeats the 128 bit crypto in 3.0 and 3.01 is on TPB.

0

Share this post


Link to post
Share on other sites

Thank for the program but I seem doesn't work for Exescript 3.x.

0

Share this post


Link to post
Share on other sites

I have done it, but i found no way to decode the vbs. Can you help me? I can send you the file. Thanks.

Patrick

0

Share this post


Link to post
Share on other sites

I get this error:

C:\Users\TheExterminator\Desktop>Decompile.exe test.exe

ExeScript 2.1.1 Decompiler 1.1

Error: Unable to locate start of batch file.

Probably not created by ExeScript 2.1.1!

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.