An example file can be, for example, Russian software (malware?) claiming to be a Photoshop installer. These files are created using 'Publish -> Hard drive folder' in AutoPlay Media Studio.

you have a folder with application.exe and application.cdd in a subfolder AutoPlay.

Then check the appropriate folder for extracted data files and _proj.dat for the installation script. Example file would be CardRecovery vĦ.10 Build 1210 AIO Installer -nelly-.exeĭrop the exe file on unpacker, it will unpack everything automatically. Such files can be generated using 'Publish -> Web/Email executable' feature in AutoPlay Media Studio.

you have just a single application.exe.

Since there are several options how you can distribute files built by AutoPlay Media Studio, here's a quick reference: And since it's that simple, I will use AutoPlay Media Studio as a target for a separate blogpost explaining how to write a static unpacker from scratch. If there's a cdd file, unzip that one too. Unpacker needs to analyze EXE file, generate correct password and unzip files. They are using ZIP files protected with randomly generated passwords and obviously have no clue how generic attacks work.

As the authors of AutoPlay Media Studio wrote in changelog:Īs we all know, anyone determined enough can break any protection system given enough time and resources, but the use of rolling codes renders generic attacks ineffective. So, let's see what we need to do to unpack it all properly. And, of course, it didn't work for Reverzor.

And it's not really a decompiler, it just extracts _proj.dat file from the cdd file. Unfortunately, it only works for some files (supposedly - v8.1, v8.2) and shows weird messages in Persian language.

I should fix that - and have some fun in process! Existing tools and researchįirst, I found a great blogpost by Xiaopang - I wholeheartedly recommend that you read it. I quickly found out that it's written in AutoPlay Media Studio, and that there is no working unpacker for that.

smile Soon enough, li0n posted a link to the trial executable and I started looking into it. Wow, a magic tool that does everything! Sounds too good to be true. It all started with a topic on BlackStorm forums where whoknows posted a link to Reverzor - The first cloud based software that decompiles everything!.

Autoplay media studio button scripts