nazywam / AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries
MIT License
160 stars 31 forks source link

Refactor code to speedup the extraction process #9

Closed nazywam closed 2 years ago

nazywam commented 3 years ago

Started manually applying some of the proposed changes from #7

nazywam commented 3 years ago

Lookgs good so far! master:

$ time python -m autoit_ripper autoit.exe out
...
real    0m4,462s
user    0m4,407s
sys 0m0,024s

refactor/speedup:

$ time python -m autoit_ripper autoit.exe out
real    0m2,338s
user    0m2,245s
sys 0m0,008s
nazywam commented 3 years ago

Current status:

         2047563 function calls (2047424 primitive calls) in 2.598 seconds

   Ordered by: cumulative time
   List reduced from 516 to 50 due to restriction <50>

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
      7/1    0.000    0.000    2.598    2.598 {built-in method builtins.exec}
        1    0.000    0.000    2.598    2.598 <string>:1(<module>)
        1    0.000    0.000    2.598    2.598 __main__.py:10(main)
        2    0.000    0.000    2.577    1.289 autoit_unpack.py:194(extract)
        1    0.000    0.000    2.576    2.576 autoit_unpack.py:166(unpack_ea06)
        1    0.000    0.000    2.405    2.405 autoit_unpack.py:129(parse_all)
        4    0.000    0.000    2.405    0.601 autoit_unpack.py:64(parse_au3_header)
       16    0.000    0.000    1.555    0.097 utils.py:149(decrypt)
       16    0.000    0.000    1.555    0.097 utils.py:98(decrypt_lame)
       16    0.153    0.010    1.495    0.093 lame.py:61(get_n_next)
   196168    0.824    0.000    1.342    0.000 lame.py:23(fpusht)
        3    0.153    0.051    0.562    0.187 decompress.py:49(decompress)
   392336    0.355    0.000    0.355    0.000 lame.py:5(rolling_rol)
        1    0.021    0.021    0.288    0.288 opcodes.py:127(deassemble_script)
     4658    0.077    0.000    0.223    0.000 opcodes.py:15(get_xored_string)
   149623    0.190    0.000    0.190    0.000 utils.py:33(get_bits)
        1    0.000    0.000    0.163    0.163 pefile.py:2407(parse_data_directories)
      740    0.026    0.000    0.161    0.000 {method 'join' of 'str' objects}
        3    0.000    0.000    0.160    0.053 utils.py:29(__init__)
        3    0.000    0.000    0.160    0.053 utils.py:24(bytes_to_bitstring)
    56789    0.062    0.000    0.144    0.000 utils.py:55(_int)
        1    0.002    0.002    0.142    0.142 pefile.py:3892(parse_import_directory)
       18    0.006    0.000    0.136    0.008 pefile.py:3991(parse_imports)
    97353    0.092    0.000    0.135    0.000 utils.py:25(<genexpr>)
    41315    0.024    0.000    0.129    0.000 utils.py:72(u16)
     2212    0.002    0.000    0.103    0.000 opcodes.py:93(<lambda>)
   196168    0.089    0.000    0.089    0.000 {built-in method _struct.pack}
    24493    0.036    0.000    0.088    0.000 decompress.py:22(read_match_len)
   197480    0.075    0.000    0.075    0.000 {built-in method _struct.unpack}
       36    0.006    0.000    0.068    0.002 pefile.py:4135(get_import_table)
    56816    0.065    0.000    0.065    0.000 utils.py:47(get_bytes)
       16    0.019    0.001    0.058    0.004 utils.py:94(xor)
      721    0.001    0.000    0.049    0.000 opcodes.py:96(<lambda>)
     2870    0.004    0.000    0.044    0.000 pefile.py:4495(get_section_by_rva)
     6328    0.023    0.000    0.040    0.000 pefile.py:1089(contains_rva)
    98028    0.040    0.000    0.040    0.000 utils.py:95(<genexpr>)
     1944    0.005    0.000    0.037    0.000 pefile.py:791(__init__)
      854    0.001    0.000    0.036    0.000 opcodes.py:91(<lambda>)
    10728    0.006    0.000    0.034    0.000 utils.py:66(u8)
     1944    0.025    0.000    0.032    0.000 pefile.py:838(__set_format__)
     1180    0.002    0.000    0.028    0.000 pefile.py:4334(get_data)
      392    0.000    0.000    0.025    0.000 opcodes.py:94(<lambda>)
      710    0.002    0.000    0.025    0.000 pefile.py:1768(__unpack_data__)
    97350    0.021    0.000    0.021    0.000 {built-in method builtins.bin}
    97350    0.021    0.000    0.021    0.000 {method 'zfill' of 'str' objects}
     1161    0.001    0.000    0.021    0.000 pefile.py:4393(get_offset_from_rva)
     34/1    0.001    0.000    0.020    0.020 pefile.py:2887(parse_resources_directory)
    56810    0.016    0.000    0.016    0.000 {built-in method from_bytes}
      461    0.001    0.000    0.015    0.000 opcodes.py:74(read_keyword)
70685/70661    0.014    0.000    0.014    0.000 {built-in method builtins.len}

Not really sure how can we improve lame.py:61(get_n_next)

ITAYC0HEN commented 3 years ago

Nice!!

msm-code commented 2 years ago

Time to merge it? 🎉