Prev: wmi monitoring files that are being modified
Next: How to "harvest" the contents of a hidden or "about blank" web
From: Tom Tyson on 5 Aug 2010 08:51

"Mayayana" <mayayana(a)invalid.nospam> wrote in message
news:i3eafb$a42$1(a)news.eternal-september.org...
> |
> | In my scenario, when I run the executable created from the HTA with
> | ExeScript, it acts just like a self-extracting archive, ie. extracting
> all
> | resources, including the HTA source, to its working directory. Once the
> app
> | is closed, it deletes all the resources it created.
> |
>
> That's all it can do. Look up "compile". Look up
> "interpreted code". Anyone who claims to "compile"
> script is either lying or doesn't know what they're
> talking about. That kind of software has to be doing
> something like an SFX. That's all the more true with
> a HTA. Mshta.exe has to be given a webpage, which
> it then loads into an IE window. You can't pass an
> EXE to mshta!! You might be able to zlib-encode the
> page. IE should recognize that. But you're really
> just using the wrong tool for the job you want to do.
>


I understand the concepts you mention and and I'm aware that mshta needs a
text input file rather than a binary file. I was just hoping for someone
having used a tool that does the trick a little less obvious than temp
extracting the files right where the exe is located. My users wouldn't
notice nor investigate if there are any temp files created in some
directory. But if they run the exe and see all these files being created,
they'd probably start looking at them..

I just downloaded a trial of the latest exescript version and it seems to be
able to use the windows temp directory as working directory. I'll see what
that setting does as its not yet documented in the help files.

Tom


From: "Dave "Crash" Dummy" on 5 Aug 2010 10:28
Tom Tyson wrote:
> Hi again,
>
> I'm looking for a way to hide the HTA / vbscript code I've written
> from users. I basically want to compile my HTA to an exectable,
> pulling in all the resouces (vbs files, graphics etc.) and distribute
> the .exe file.
>
> The best thing I found was ExeScript - but it would still create and
> leave a plain text file with my script code in the users temp folder.
> Is there any on-the-fly compiler that doesn't leave any source code
> behind?

Why? What do you want to hide? Anything you can put in script is hardly
proprietary code. Anyway, you ask the impossible. As Mayayana
points out, as soon as the program is rendered in a window, the code is
just two clicks away.

--
Crash

Atheism is a matter of faith, too.
From: Todd Vargo on 5 Aug 2010 18:30
Tom Tyson wrote:
> "Todd Vargo" <tlvargo(a)sbcglobal.netz> wrote in message
> news:uwqz0BDNLHA.5396(a)TK2MSFTNGP05.phx.gbl...
>> Tom Tyson wrote:
>>> Hi again,
>>>
>>> I'm looking for a way to hide the HTA / vbscript code I've written from
>>> users. I basically want to compile my HTA to an exectable, pulling in
>>> all the resouces (vbs files, graphics etc.) and distribute the .exe
>>> file.
>>>
>>> The best thing I found was ExeScript - but it would still create and
>>> leave a plain text file with my script code in the users temp folder. Is
>>> there any on-the-fly compiler that doesn't leave any source code behind?
>>
>> So the following statement is a lie?
>>
>> "Executing the script in computer memory without writing to the disk.
>> Therefore, the security of the script is enhanced since it is impossible
>> to see the contents."
>
> In my scenario, when I run the executable created from the HTA with
> ExeScript, it acts just like a self-extracting archive, ie. extracting all
> resources, including the HTA source, to its working directory. Once the
> app is closed, it deletes all the resources it created.

That is how I figured it should work. However, your previous post said the
source code was left behind. I was thinking perhaps the unregistered version
does not perform cleanup. The best place to get support is by asking the
source.

OTOH, what if you include code in the HTA code to delete itself once loaded
into the browser? Would that even work?

--
Todd Vargo

(Post questions to group only. Remove "z" to email personal messages)

From: Al Dunbar on 6 Aug 2010 01:05


"Tom Tyson" <no(a)spam.org> wrote in message
news:i3ec4v$4f1$1(a)newsreader5.netcologne.de...
>
> "Mayayana" <mayayana(a)invalid.nospam> wrote in message
> news:i3eafb$a42$1(a)news.eternal-september.org...
>> |
>> | In my scenario, when I run the executable created from the HTA with
>> | ExeScript, it acts just like a self-extracting archive, ie. extracting
>> all
>> | resources, including the HTA source, to its working directory. Once the
>> app
>> | is closed, it deletes all the resources it created.
>> |
>>
>> That's all it can do. Look up "compile". Look up
>> "interpreted code". Anyone who claims to "compile"
>> script is either lying or doesn't know what they're
>> talking about. That kind of software has to be doing
>> something like an SFX. That's all the more true with
>> a HTA. Mshta.exe has to be given a webpage, which
>> it then loads into an IE window. You can't pass an
>> EXE to mshta!! You might be able to zlib-encode the
>> page. IE should recognize that. But you're really
>> just using the wrong tool for the job you want to do.
>>
>
>
> I understand the concepts you mention and and I'm aware that mshta needs
> a text input file rather than a binary file. I was just hoping for someone
> having used a tool that does the trick a little less obvious than temp
> extracting the files right where the exe is located. My users wouldn't
> notice nor investigate if there are any temp files created in some
> directory.

If that is actually true, then screnc might provide sufficient security. But
what is the risk and what will it cost you if your code becomes known by
others?

> But if they run the exe and see all these files being created, they'd
> probably start looking at them..

Perhaps, so it appears you may not know the level of trust you can place in
your users.

> I just downloaded a trial of the latest exescript version and it seems to
> be able to use the windows temp directory as working directory. I'll see
> what that setting does as its not yet documented in the help files.

Regardless, if there is someone there with sufficient reason to put some
effort into reverse engineering your script, you are basically hooped if you
leave your security up to SFX tools or screnc.

/Al


From: Al Dunbar on 6 Aug 2010 01:07


"Todd Vargo" <tlvargo(a)sbcglobal.netz> wrote in message
news:u7zjL3ONLHA.1624(a)TK2MSFTNGP06.phx.gbl...
> Tom Tyson wrote:
>> "Todd Vargo" <tlvargo(a)sbcglobal.netz> wrote in message
>> news:uwqz0BDNLHA.5396(a)TK2MSFTNGP05.phx.gbl...
>>> Tom Tyson wrote:
>>>> Hi again,
>>>>
>>>> I'm looking for a way to hide the HTA / vbscript code I've written from
>>>> users. I basically want to compile my HTA to an exectable, pulling in
>>>> all the resouces (vbs files, graphics etc.) and distribute the .exe
>>>> file.
>>>>
>>>> The best thing I found was ExeScript - but it would still create and
>>>> leave a plain text file with my script code in the users temp folder.
>>>> Is there any on-the-fly compiler that doesn't leave any source code
>>>> behind?
>>>
>>> So the following statement is a lie?
>>>
>>> "Executing the script in computer memory without writing to the disk.
>>> Therefore, the security of the script is enhanced since it is impossible
>>> to see the contents."
>>
>> In my scenario, when I run the executable created from the HTA with
>> ExeScript, it acts just like a self-extracting archive, ie. extracting
>> all resources, including the HTA source, to its working directory. Once
>> the app is closed, it deletes all the resources it created.
>
> That is how I figured it should work. However, your previous post said the
> source code was left behind. I was thinking perhaps the unregistered
> version does not perform cleanup. The best place to get support is by
> asking the source.
>
> OTOH, what if you include code in the HTA code to delete itself once
> loaded into the browser? Would that even work?

If a file is ever committed to a disk somewhere, it will be retrievable,
whether by looking for the files while the app is still running, or using an
undelete utility.

/Al


First  |  Prev  |  Next  |  Last
Pages: 1 2 3
Prev: wmi monitoring files that are being modified
Next: How to "harvest" the contents of a hidden or "about blank" web