search

nazywam / AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries
MIT License
160 stars 31 forks source link

Possible broken x64 samples #15

Closed nazywam closed 6 months ago

nazywam commented 2 years ago

sha2:

873aebfc8144b270b1f525f79080485429dc9ea9164ca46c39937bc33031f7b7 145078c3c1f0b7fbc5f760a9afad611f383b7b1ca34a7741357ce47814df9b2a

  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py", line 206, in extract
    return unpack_ea06(data)
  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py", line 190, in unpack_ea06
    parsed_data = parse_all(stream, AutoItVersion.EA06)
  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py", line 142, in parse_all
    return list(
  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py", line 123, in parse_au3_header
    yield ("script.au3", deassemble_script(dec_data).encode())
  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/opcodes.py", line 141, in deassemble_script
    line_items.append(OPCODES[opcode](stream))
  File "/usr/local/lib/python3.9/site-packages/autoit_ripper/opcodes.py", line 92, in <lambda>
    0x32: lambda x: "@" + MACROS_INVERT_CASE[x.get_xored_string()],
KeyError: 'AUTOITX6484'