nazywam / AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries
MIT License
160 stars 31 forks source link

Handle the case when there is AU06 script with magic #27

Closed msm-cert closed 6 months ago

msm-cert commented 7 months ago

Example: 632ffc57bc8ccc27bac4838575402a8794bd5a168acba012d557c10dbcadaba4.

Maybe I should refactor unpack_ea05 name to something more generic, but I didn't want to do significant changes before checking if this makes sense.