5

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support.

I have tried looking for 3rd party de-compilers but none of them worked for me. I've read somewhere that the .exe generated by AutoIT is just an embedded interpreter for AutoIT and the script source code but obfuscated.

Does anyone know how it is compiled so I can use OllyDBG to try and de-obfuscate the script?

Of-course the .exe is packed with UPX but can easily be unpacked. So the only problem is script obfuscation. (If my understanding is correct)

I've tried dumping the application memory but didn't find any readable script there. I've also used OllyDBG to run the application but it gave me the error This is a third-party compiled AutoIt script. Bit confused why but attaching to the running application works okay.

Improve this question
3
  • wow autoit decompiling faq has a very aggressive stance block block ban ban just for even pronouncing dexxxxxxx. if they are actively preventing the action then i think your luck is your only hope ( sorry i havent used autoit just googled why you cant use an old version and read the tidbits )
    – blabb
    Jul 5, 2017 at 3:04
  • You should know that preventing cheats on client side is nearly impossible. everything you can do, they can simply not run, patch out, evade and so on
    – user22970
    Nov 2, 2018 at 23:42
  • 1
    @Amirag I’m not trying to prevent cheats from the client side. I’m trying to understand how they are doing it so I can fix it on the server side. To understand it properly I need to see how the cheating prog works.
    – majidarif
    Nov 3, 2018 at 1:02

1 Answer 1

Reset to default
-1

It may call IsDebuggerPresent to check if you're debugging it, so you can't just create that process by OD, maybe Attach could work. There's another way, find the condition and set clear eax to make it use the other branch.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.