Running VBScript in MS ScriptControl

There are currently 3 ways to hide your Script Code (VBScript or Javascript) if you don’t want others to access to your code easily. For example, you might want to store ‘password’ in the script when you try to connect to a SQL server using VBScript on third party DLLs.

1. Wrap the code in the EXE and hide it somewhere (for example, at the end of EXE); extract the code at runtime and run it using CScript.exe or WScript.exe.

Currently, like ‘vbsedit‘, they can wrap your code in a Win32 EXE or Win64 EXE, so the source code is not easy to obtain. The configuration dialog to make EXE from VBScript in vbsedit is below (version 5.2.4)

The disadvantage is that this EXE is easily to crack and the source code of script can be obtained. Using cscript.exe to run the script will yield a SHELL window showing.

2. The second method is similar, however, run the Script using MS ScriptControl object, which does not necessary extract the text to file, instead, the source code can be run from memory. This is safer, however, still is possible (not difficult) to be cracked. For example, the Script2EXE claims that their product compiles scripts to EXE code without relying on CScript.exe and WScript.exe.

3. The last method is the safest, however, requires the most effort. It is to compile the script directly into Win32 or 64 native code. The process normally involves syntax analysis, linking etc. The code performance will be higher than the previous two (in fact, the first two methods will most-likely slow down the script performance). Currently, no similar products are available.

4. Script32 is a free command line tool that can convert VBScript/JScript/HTA to 32/64-bit Executables. You can also configure the minimal user privileges to run the EXE. Also, you can specify how the code will be run, e.g. using CScript.exe, WScript.exe or MS Script Control.

–EOF (The Ultimate Computing & Technology Blog) —