Let me begin by saying I am not trying to steal anyones code. I need to know how to break into an Applescript application and read its code so that I can determine what it does. I was emailed what I believe to be a trojan horse (it was disguised as a simpletext file) but it is actually a Run-Only Applescript. Any tips on how to see the code would be appreciated.

[lycaon]

When an applescript is saved as run-only, the "code" portion is discarded and thus cannot be read (at least not in the applescript language). If you don't trust this run-only script then discard it. Personally, I would only run a script that could be "proof-read", where I could at least check the key commands. If someone feels the need to disguise a script, there is definitely reason for caution.

I wonder if one of the control panels like Capture AE could watch the read-only script run, and return a list of the raw events and parameters. This would give you an idea how it does what it does.

John
jxrethorst@post.com
(remove x)

[Paul Crawford]

Hi chris1234,

I tend to agree with lycaon that it would be safest to simply toss that questionable Run-Only applet… Nevertheless, if you really want to investigate the applet, here're a couple of techniques that clarify and expand on the previous posts:-

"Read" the applet [SAFE]:
----------------------
You could open up the applet in ResEdit or a similar utility, and peek at the 'scpt' resource(s). Amidst all the hexadecimal data (including the Apple Event Registry's various four-character codes for tell-targets, suites, events, parameters & attributes), you might be lucky enough to see a few meaningful handler names, variable names or text-strings.

Run the applet plus a "spy" utility [UNSAFE]:
---------------------------------------
As John suggested, free utilities such as WestCode Software's Capture AE or RavenWare Software's AETracker would allow you to "spy" on the raw Apple Events being issued by the applet.

Of course, the main catch here is that it would be necessary to actually run the applet. If you do decide to take this approach, be sure to run it on a separate "clean machine" that has no valuable data and no network connectivity of any kind.

Another issue is that, unlike the human vocabulary of AppleScript commands, raw Apple Event descriptors can be very complex and difficult to read. However, the Capture AE utility does format them into a special syntax suitable for the 'SendAE' command of WestCode Software's EasyScript language (it's based on the same friendly "AEBuild" syntax that was introduced by Apple's AEGizmos utility and that's also used by the 'SendAE' MPW tool). However, the four-character codes will usually still be there, so you'll need to know what they mean. Detailed documentation on the standard Apple Events and their four-character codes is available in a hodgepodge of formats (Apple DocViewer, AppleLink image, MS Word, PDF) from the Apple Events Registry & Suites subdirectory of Apple's FTP site.

[BTW, a more up-to-date version of the Apple Events Registry is available in FileMaker Pro format via the AppleScript 1.3.4 SDK. This SDK is a humongous 40MB download which also includes tons of AppleScript documentation, samples and utilities (there's even a slightly older version of the AETracker control panel).]

Regards,

—Paul