Script Encoder<\/B><\/A> – that can \u201cobfuscate\u201d your script code. For example, suppose you have a script that looks like this:<\/P>strComputer = “.”<\/p>\nSet objWMIService = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\cimv2”)<\/p>\n
Set colOperatingSystems = objWMIService.ExecQuery(“Select * from Win32_OperatingSystem”)<\/p>\n
For Each objOperatingSystem in colOperatingSystems\n Msgbox objOperatingSystem.Caption & ” ” & objOperatingSystem.Version\nNext\n<\/PRE>\n
Let\u2019s say that, for some reason, you\u2019d prefer that people not be able to read the script code. That\u2019s a problem: after all, anyone who has permission to run a script is going to have permission to open the script up in Notepad and gawk at the code all they want. But here\u2019s what that same script looks like after the Script Encoder gets done with it:<\/P>
#@~^8AEAAA==@#@&@#@&@#@&,PP,?!8PV+OrU.n.kkW@#@&,PP,~~PkYMZG:2;D+.P{~JcJ@#@&,PP~~,P~P,~U+O,W(Ltq\nUnD7k^+,’~!Yr(%+1Y`rArxsosYd)wwrP’PkOD;Wh2!Y+.~LP~J’.KWO’mb:\\yJ*@#@&@#@&~P,P~~,PP,~?YP1Gsra+MlOkULUXdYh\/,’~G(\nL\\(U+.\\b^R3X+1pEDH~{@#@&~P,P~~,PP,~P,PPvEj+^+1Y~e~W\nMWhPqrx2 m6a+DCObxL?HdD+hr#@#@&@#@&P,~P,P~P,P~oKDPACm4PW(%6wDmYr\nxLjH\/O+s~kP^G^rwn.mYrxTjH\/O:k@#@&,P,~P,P~P,P~~,PHkL4K6PK8%ra+M\nlOkULUXdYhR;l2ObWx~’,J~J,’,{@#@&P,PP,P,~P,P~P,P~~,PW(%ra+DmOrxT?H\/O+h \nj+.\/bGx@#@&~~,PP~~,P~PgnXY@#@&P,PPAx9~?!4@#@&QYQAAA==^#~@\n<\/PRE>\nThe script still works, it\u2019s just a bit harder for anyone to glance at the code and plagiarize your work. (And you\u2019re right: even at that it does<\/I> make more sense than most of the jokes used in Hey, Scripting Guy!<\/I>)<\/P>\n
Now, the important thing to keep in mind is that the script is simply encoded (or obfuscated); it is definitely not<\/I> encrypted. What does that mean? That means the encoder will hide your script from most people; however, a truly determined hacker – armed with a knowledge of codes or armed with a utility downloaded from the Internet – could crack the code. Among other things, that means that you should never do something like \u201chide\u201d an Administrator password in a script and assume that the Script Encoder will keep it safe from prying eyes. It won\u2019t. It\u2019s an encoder, not an encrypter, and there\u2019s definitely a difference.<\/P>\n
But what about the problem with encoding scripts in an HTA? Well, let\u2019s assume you have an HTA that looks like this (we\u2019ll also assume that you\u2019ve already downloaded and installed the Script Encoder):<\/P>
<head>\n<title>Operating System Version<\/title>\n<HTA:APPLICATION \n APPLICATIONNAME=”Operating System Version”\n SCROLL=”yes”\n SINGLEINSTANCE=”yes”\n>\n<\/head><\/p>\n<script language=”VBScript”><\/p>\n
Sub GetOSVersion\n strComputer = “.”\n Set objWMIService = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\cimv2”)<\/p>\n
Set colOperatingSystems = objWMIService.ExecQuery _\n (“Select * from Win32_OperatingSystem”)<\/p>\n
For Each objOperatingSystem in colOperatingSystems\n Msgbox objOperatingSystem.Caption & ” ” & _\n objOperatingSystem.Version\n Next\n End Sub\n<\/script><\/p>\n
<body>\n<input type=”button” value=”Operating System” name=”run_button” onClick=”GetOSVersion”><\/p>\n
<\/body>\n<\/PRE>\n
If you want to encode the VBScript portion of this HTA the first thing you need to do is use the ‘**Start Encode**<\/B> tag to mark the beginning of the section to be encoded. In other words, your <Script> tag needs to look like this, with ‘**Start Encode** coming right before the very first line of VBScript code:<\/P><script language=”VBScript”><\/p>\n‘**Start Encode**<\/p>\n
Sub GetOSVersion\n strComputer = “.”\n Set objWMIService = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\cimv2”)<\/p>\n
Set colOperatingSystems = objWMIService.ExecQuery _\n (“Select * from Win32_OperatingSystem”)<\/p>\n
For Each objOperatingSystem in colOperatingSystems\n Msgbox objOperatingSystem.Caption & ” ” & _\n objOperatingSystem.Version\n Next\n End Sub\n<\/script>\n<\/PRE>\n
In theory, you should then be able to encode the script by running Screnc.exe and passing two parameters, the name of the existing HTA file (Test.hta) and the name to be given to the encoded file (Encoded.hta):<\/P>
C:\\Scripts>screnc test.hta encoded.hta\n<\/PRE>\nUnfortunately, though, this doesn\u2019t work.<\/P>\n
Update Note: You do not actually need to rename the file.<\/STRONG> <\/P>\nAll you need to do is to use the \/e flag to tell the encoder how to handle file types it doesn\u2019t recognise natively, thus:<\/FONT><\/FONT><\/SPAN><\/P>\n <\/FONT><\/SPAN><\/P>\nScrenc \/e htm test.hta test.hte<\/FONT><\/FONT><\/SPAN><\/P>\n <\/FONT><\/SPAN><\/P>\nOr to do it in place (overwriting the original):<\/FONT><\/FONT><\/SPAN><\/P>\n <\/FONT><\/SPAN><\/P>\nScrenc \/f \/e htm test.hta<\/FONT><\/FONT><\/SPAN><\/P>\n<\/FONT><\/FONT><\/SPAN> <\/P>\nThanks DL, for the update! <\/FONT><\/FONT><\/SPAN><\/P><\/FONT>\nWhy? Well, we aren\u2019t really sure. But we do know what does<\/I> work. All we have to do is change the file extension on the existing file from .hta to .htm; in other words, we simply rename the file Test.htm. The Script Encoder can\u2019t handle HTA files, but it has no problems with HTML files. Now we can start the Script Encoder using syntax like this:<\/P>C:\\Scripts>screnc test.htm encoded.hta\n<\/PRE>\nAre we sure that will work? Don\u2019t tell us you doubt the Scripting Guys! Here\u2019s what Encoded.hta looks like:<\/P>
<head>\n<title>Operating System Version<\/title>\n<HTA:APPLICATION \n APPLICATIONNAME=”Operating System Version”\n SCROLL=”yes”\n SINGLEINSTANCE=”yes”\n>\n<\/head><\/p>\n<script language=”VBScript.Encode”><\/p>\n
‘**Start Encode**#@~^8AEAAA==@#@&@#@&@#@&,PP,?!8PV+OrU.n.kkW@#@&,PP,~~PkYMZG:2;D+.P{~JcJ@#@&,PP~~,P~P,~U+O,W(Ltq\nUnD7k^+,’~!Yr(%+1Y`rArxsosYd)wwrP’PkOD;Wh2!Y+.~LP~J’.KWO’mb:\\yJ*@#@&@#@&~P,P~~,PP,~?YP1Gsra+MlOkULUXdYh\/,’~G(\nL\\(U+.\\b^R3X+1pEDH~{@#@&~P,P~~,PP,~P,PPvEj+^+1Y~e~W\nMWhPqrx2 m6a+DCObxL?HdD+hr#@#@&@#@&P,~P,P~P,P~oKDPACm4PW(%6wDmYr\nxLjH\/O+s~kP^G^rwn.mYrxTjH\/O:k@#@&,P,~P,P~P,P~~,PHkL4K6PK8%ra+M\nlOkULUXdYhR;l2ObWx~’,J~J,’,{@#@&P,PP,P,~P,P~P,P~~,PW(%ra+DmOrxT?H\/O+h \nj+.\/bGx@#@&~~,PP~~,P~PgnXY@#@&P,PPAx9~?!4@#@&QYQAAA==^#~@<\/script><\/p>\n
<body>\n<input type=”button” value=”Operating System” name=”run_button” onClick=”GetOSVersion”><\/p>\n
<\/body>\n<\/PRE>\n
It\u2019s still a valid HTA; click the button and it will report back the name and version of the operating system installed on the local machine. But to anyone who tries looking at the code it will look like pure gibberish. (Needless to say, the Scripting Guys know gibberish better than anyone!)<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I encode scripts within an HTA?— LL Hey, LL. You know, when we first read this question we thought, \u201cWhat\u2019s the big deal? Can\u2019t you encode scripts in an HTML Application (HTA) the same way you encode scripts in an HTML file?\u201d Much to our surprise, it appears as though […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[3,4,5,30],"class_list":["post-67793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-scripting-guy","tag-scripting-techniques","tag-vbscript","tag-web-pages-and-htas"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I encode scripts within an HTA?— LL Hey, LL. You know, when we first read this question we thought, \u201cWhat\u2019s the big deal? Can\u2019t you encode scripts in an HTML Application (HTA) the same way you encode scripts in an HTML file?\u201d Much to our surprise, it appears as though […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=67793"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=67793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=67793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=67793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
![\"Script](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/ad.jpg\" "\\"Script")
<\/A> \n