nazywam / AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries
MIT License
171 stars 34 forks source link

MACROS are not supported? #23

Open snoopy-coder opened 11 months ago

snoopy-coder commented 11 months ago

A very simple code example - Drag File and Drop Example.au3 I'm trying to use AutoIt-Ripper like this:

from autoit_ripper import extract, AutoItVersion

import os 
dir = os.path.dirname(__file__)
fullname = os.path.join(dir, 'sample.exe')

with open(fullname, "rb") as f:
    file_content = f.read()

# EA05 for v3.00+, EA06 for v3.26+
# Omitting `version` or passing None will try both versions

# content_list = extract(data=file_content, version=AutoItVersion.EA05)
# content_list = extract(data=file_content, version=AutoItVersion.EA06)
content_list = extract(data=file_content)

But an error occurs:

C:\Users\1\Python>python ..\test.py
EA05 magic mismatch
Traceback (most recent call last):
  File "..\test.py", line 15, in <module>
    content_list = extract(data=file_content)
  File "C:\Users\1\pkgs\autoit_ripper\autoit_unpack.py", line 202, in extract
    return unpack_ea05(data) or unpack_ea06(data)
  File "C:\Users\1\pkgs\autoit_ripper\autoit_unpack.py", line 190, in unpack_ea06
    parsed_data = parse_all(stream, AutoItVersion.EA06)
  File "C:\Users\1\pkgs\autoit_ripper\autoit_unpack.py", line 142, in parse_all
    return list(
  File "C:\Users\1\pkgs\autoit_ripper\autoit_unpack.py", line 123, in parse_au3_header
    yield ("script.au3", deassemble_script(dec_data).encode())
  File "C:\Users\1\pkgs\autoit_ripper\opcodes.py", line 141, in deassemble_script
    line_items.append(OPCODES[opcode](stream))
  File "C:\Users\1\pkgs\autoit_ripper\opcodes.py", line 92, in <lambda>
    0x32: lambda x: "@" + MACROS_INVERT_CASE[x.get_xored_string()],
KeyError: 'GUI_DRAGID'

C:\Users\1\Python>

I suspect that the same errors will occur with other macros. Will you ever be able to fix it? Thank you very much!