This is a (semi) short python script that allows for extraction of "compiled" AutoIt scripts from PE executables.
This script heavily bases on 2 resources, definitely check them out if you want to dig a bit deeper into the whole AutoIt stuff:
EA06AutoIt3.26++
EA05AutoIt3.00
JB01AutoHotKeyJB01AutoIT2
python3 -m pip install -r requirements.txtpython3 main.py input.exe
| Field | Length | LAME seed | Notes |
|---|---|---|---|
| "FILE" | 4 | 0x18EE | static string |
| flag | 4 | 0xADBC | |
| auto_str | flag * 2 | 0xB33F + flag | UTF-16 |
| path_len | 4 | 0xF820 | |
| path | path_len * 2 | 0xF479 + path_len | Path of the compiled script |
| compressed | 1 | None | |
| data_size | 4 | 0x87BC | encoded data size |
| code_size | 4 | 0x87BC | TODO: actual use of this |
| crc | 4 | 0xA685 | uncompressed data hash |
| unknown | 16 | None | |
| data | data_size | 0x2477 | script data |