An interesting discussion which you can find many times on the board.

A little reaction about "how to make your script secure" and our suggestion
"how to implement it by kixtart".

We are using not only codec to make our script secure.
We are using

• kixstrip: to remove additional comment and unwanted spaces and combine
  statements to one line. One long unstructured line is hard to read.
  
• codec: to encrypt/decrypt any type of file. by using dynamic encryption
  method no encryption result looks the same. by a CRC check mechanism any
  possible modification to that file will ignore decryption.
  
• bat2exec: to convert your BAT file to an EXE file. mostly such file
  can contain passwords, special programs or special pathnames.
  the result is readable by users, but the secure21.zip package can
  encrypt the result to something unreadable.
  
• secure21.zip package: using to encrypt in 1-way your EXE files.
  

An example how to use a set of above programs you can read topic
http://kixtart.org/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=1&t=002750

The result of kixstrip for

code:

---

  IF setconsole("hide")
  ENDIF
;
;     NT/95 create description list of KiXtart errors - Kixtart 4.00
;
; (c) scripting@wanadoo.nl - 2001
;
;     vs 1.00 - program
;
;     1.00  (20010715)       original version
;
  FUNCTION SetError($error_number) EXIT $error_number ENDFUNCTION
  ;
  $tmp_directory=ExpandEnvironmentVars("%tmp%")
  IF (substr($tmp_directory,len($tmp_directory),1) <> "\")
    $tmp_directory=$tmp_directory+"\"
  ENDIF
  ;
  $info_file=$tmp_directory+"kix-code.txt"
  IF RedirectOutput($info_file,1)
  ENDIF
  ? "KiXtart "+@kix+" - Summary Error Codes"
  ?
  FOR $i=0 TO 9999
    SetError($i)
    IF (len(@serror) <> 0) AND (Instr(@serror,"Error retrieving error information for") = 0) AND (Instr(@serror,", 13D)") = 0)
      $result=@serror
      $pos=Instr($result,CHR(13)+CHR(10))
      WHILE ($pos <> 0)
        IF ($pos <> 0)
          $result=substr($result,1,$pos-1)+" "+substr($result,$pos+2,len($result)-$pos-1)
        ENDIF
        $pos=Instr($result,CHR(13)+CHR(10))
      LOOP
      IF (Substr($result,len($result),1) = CHR(10)) OR (Substr($result,len($result),1) = CHR(13))
        ? Substr("       ",1,7-len("@error"))+"@error "+Substr($result,1,len($result)-1)
      ELSE
        ? Substr("       ",1,7-len("@error"))+"@error "+$result
      ENDIF
    ENDIF
  NEXT
  IF RedirectOutput("")
  ENDIF
  ? "Informative KIX: create an actual description list of KiXtart "+@kix+" errors."
  ? "                 file created '"+LCASE($info_file)+"'."
  EXIT

---

code:

---

if setconsole("hide") endif function SetError($x1) exit $x1 endfunction $x2=ExpandEnvironmentVars("%tmp%")
 if (substr($x2,len($x2),1)<>"\") $x2=$x2+"\" endif $x3=$x2+"kix-code.txt" if RedirectOutput($x3,1) endif
 ? "KiXtart "+@kix+" - Summary Error Codes" ? for $x4=0 to 9999 SetError($x4)
 if (len(@serror)<>0) AND (Instr(@serror,"Error retrieving error information for")=0) AND (Instr(@serror,", 13D)")=0)
 $x5=@serror $x6=Instr($x5,CHR(13)+CHR(10)) while ($x6<>0) if ($x6<>0)
 $x5=substr($x5,1,$x6-1)+" "+substr($x5,$x6+2,len($x5)-$x6-1) endif
 $x6=Instr($x5,CHR(13)+CHR(10)) loop if (Substr($x5,len($x5),1)=CHR(10)) OR (Substr($x5,len($x5),1)=CHR(13))
 ? Substr("       ",1,7-len("@error"))+"@error "+Substr($x5,1,len($x5)-1) else
 ? Substr("       ",1,7-len("@error"))+"@error "+$x5 endif endif next
 if RedirectOutput("") endif ? "Informative KIX: create an actual description list of KiXtart "+@kix+" errors."
 ? "                 file created '"+LCASE($x3)+"'." exit

---

Biggest problem is for kixtart (= kix32.exe): it need an input file.

Our suggestion is:
1. create additional program which make a 1-way encryption.
2. extend kix32.exe to handle a normal and a 1-way encrypted input file.
This method is must easier for implementation.
The piping of scripts to kix32.exe will be a better solution. No temporary
readable file must be created.
Greetings.

btw: some reactions on reactions to this topic.

• NTDOC we hope you had a good weekend. With some other tools it
  is possible to get your kixtart script very secure. Only for heavy users
  it can be possible to get the code, but he will never get the original
  one after using our kixstrip and codec tools.
  Very important for us was to create an encryption method which will return
  always another result and it is independent of how many times your are running
  the program.
  Good weekend mine comment to topic
  http://kixtart.org/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=1&t=002750
  But your reaction results in new ideas.
  
• Lonkero. Of course small script can be read easily, but after removing
  your comment it can be hard to understand. Once we read a very small script
  which was rewritten for speed up by another, but it was very hard to see "both
  scripts do the same things".
  For people who are knowing the programming language Algol68 knows that
  all boldsymbols can representated by a single character. After modifying in
  such way such script - even for a short one - isn't interesting for a very great
  amount of guys.
  The compress facility (= combining to one line) in kixstrip was not for
  security reasons, but for speed. We doesn't need to transfer comment and unused
  characters.
  
• LLigetfa. By using the method specified in topic "Forum1-2750" it
  is very hard for an user to get all the information necessary for encryption.
  It isn't necesarry to use the local client for the decryption task. Any loca-
  tion can be possible.
  Possible he will never find the encrypted script files on your server, because
  you can give them any name you like and you can put them anywhere you like.
  Our netlogon directory contains only one executable (= bat2exec + secure21
  result), which activates the whole process and gets its files from 'black hole' in
  the system.
  Most important element is: user can't replace kix32.exe. After replacing
  that file it is must easier to catch your script. How: by simple reading it and
  writting it to a floppy-disk.
  
• Jeroen. we agree "never put a password in a readable piece of code".
  Your method of BAT2EXEC + encrypt that EXE to a new EXE we are using all the
  time. One simple, harmless encrypted EXE is for nobody interesting.
  
• in other topics about this issue we make following suggestion for the threat
  of
  a trojan KIX32.EXE which simply prints the script rather than running it:
  

  code:

  ---

  
  encrypt your scripts with an additional program (one-way)
  and
  make it possible that kix32.exe can handle plain text scripts or an encrypted scripts.
  possible kixtart CALL commands can also handle both script files.
  temporary files are not necessary by such method.
  

  ---

  
  Benefit: for a torjan KIX32.EXE is an one-way encryption not interesting.
  Only the released KIX32.EXE program can decrypt your encrypted file and he
  isn't using any temporary file at all.

  for complete story and other suggestions see topic
  http://kixtart.org/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=4&t=000108