Crate autoit 

Extract and inspect compiled AutoIt payloads.

This crate is intended to recover information from AutoIt2Exe and .a3x inputs: container details, compiled resource records, scripts, token streams, timestamps, checksums, and embedded file payloads.

It does not execute AutoIt code, emulate expressions, or classify script behavior. Decoded source text and token streams are exposed as recovered information for downstream consumers.

Extraction Model

AutoItBinary::try_parse performs container discovery first, then parses the AU3 record stream when an encoding and stream offset are available. The high-level object keeps every recovered view additive:

• ContainerInfo summarizes PE, .a3x, raw stream, offset, and resource facts.
• ObservationLog records concrete recognition observations.
• Record exposes raw record metadata plus encrypted, decrypted, and best available payload bytes.
• Script exposes script bytes, decoded source text when available, and token streams for tokenized EA06 scripts.
• Artifact preserves non-script record payloads.
• StringFinding reports raw strings found in recovered payload bytes.

Record parsing is tolerant at the high level: records recovered before a later malformed record remain available, while AutoItBinary::record_diagnostics reports the failing record index, offset, and reason. Lower-level au3::parse_records remains strict for callers that need all-or-nothing parsing.

Common Failure Modes

• Packed or protected PE stubs may hide the AutoIt resource until an external unpacking step has been performed.
• Legacy encodings outside the implemented EA05/EA06 record profiles are reported as unsupported rather than guessed.
• Tokenized source rendering is source-like reconstruction, not guaranteed to be byte-for-byte identical to the original script text.
• Decompression failures preserve decrypted bytes and attach structured decompression status to the source record.

Quick Start

use autoit::{AutoItBinary, RecognitionFailure};

let data = std::fs::read("sample.exe")?;
match AutoItBinary::try_parse(&data) {
    Ok(binary) => {
        println!("{:?}", binary.input_kind());
        println!("{:?}", binary.encoding());
    }
    Err(err) if err.recognition_failure() == Some(RecognitionFailure::NotRecognized) => {
        println!("not an AutoIt payload");
    }
    Err(err) => return Err(Box::<dyn std::error::Error>::from(err)),
}

Re-exports

pub use au3::CompressionProfile;

pub use au3::DecompressionStatus;

pub use au3::EncryptionProfile;

pub use au3::Record;

pub use au3::RecordParseDiagnostic;

pub use au3::RecordParseReport;

pub use au3::RecordProfile;

pub use error::Error;

pub use error::RecognitionFailure;

pub use format::ContainerInfo;

pub use format::KnownSubtype;

pub use format::Observation;

pub use format::ObservationLog;

pub use format::PackedMarkerInfo;

pub use format::PeScriptResourceInfo;

pub use format::VersionMarkerInfo;

pub use script::Script;

pub use script::ScriptDecodeError;

pub use script::ScriptKind;

pub use script::ScriptText;

pub use script::ScriptTextEncoding;

pub use strings::StringEncoding;

pub use strings::StringFinding;

pub use token::Token;

pub use token::TokenError;

pub use token::TokenStream;

Modules

au3

AU3 compiled payload record parsing.

decompress

AutoIt compressed payload decompression.

error

Error types for AutoIt extraction.

format

Format metadata and analysis observations.

script

Script recovery from AU3 records.

strings

Raw string extraction over recovered payload bytes.

token

EA06 tokenized script parsing.

Structs

Artifact

Recovered non-script artifact view.

AutoItBinary

High-level view of an AutoIt payload.

Enums

Encoding

Recognized AutoIt payload encoding family.

InputKind

Recognized outer input kind.