| <!DOCTYPE html> |
| <html lang="en"> |
| <head> |
| <meta charset="UTF-8"> |
| <meta name="viewport" content="width=device-width,initial-scale=1"> |
| <title>Converter - Script to EXE</title> |
| <style> |
| *{margin:0;padding:0;box-sizing:border-box} |
| body{background:#06090f;color:#c9d1d9;font-family:'Segoe UI',system-ui,sans-serif; |
| min-height:100vh;padding:40px 20px;display:flex;flex-direction:column;align-items:center} |
| .title{font-size:2.2rem;font-weight:800;letter-spacing:.06em; |
| background:linear-gradient(90deg,#f0883e,#ffb347); |
| -webkit-background-clip:text;-webkit-text-fill-color:transparent;margin-bottom:8px;text-align:center} |
| .sub{color:#8b949e;font-size:.95rem;margin-bottom:40px;text-align:center;max-width:600px} |
| .card{background:#0d1117;border:1px solid #30363d;border-radius:8px; |
| padding:24px;max-width:860px;width:100%;margin-bottom:20px} |
| .card h3{color:#f0883e;font-size:.82rem;letter-spacing:.1em;text-transform:uppercase;margin-bottom:12px} |
| .card p,.card li{font-size:.88rem;color:#8b949e;line-height:1.7} |
| ul{padding-left:18px} |
| code{background:#161b22;color:#e3b341;padding:2px 6px;border-radius:3px;font-size:.82rem} |
| .flow{font-family:'Cascadia Code',monospace;font-size:.8rem;color:#58a6ff; |
| background:#0d1117;border:1px solid #1e3a5f;border-radius:6px;padding:20px; |
| max-width:860px;width:100%;margin-bottom:20px} |
| pre{white-space:pre;color:#c9d1d9} |
| a{color:#58a6ff} |
| </style> |
| </head> |
| <body> |
| <div class="title">CONVERTER</div> |
| <div class="sub">Script-to-EXE compiler — reverse-engineered from Bat_To_Exe_Converter (f2ko.de) |
| using Ghidra 12 static analysis, then reimplemented in pure Python.</div> |
|
|
| <div class="card"> |
| <h3>What It Does</h3> |
| <p>Converts <code>.bat</code> <code>.ps1</code> <code>.vbs</code> <code>.js</code> <code>.py</code> |
| scripts into standalone Windows <code>.exe</code> files that run without any interpreter installed. |
| Supports invisible mode (no console window), custom icons, and UAC elevation manifest.</p> |
| </div> |
|
|
| <div class="card"> |
| <h3>How It Works — Discovered via Reverse Engineering</h3> |
| <ul> |
| <li>A precompiled stub EXE is copied to the output path</li> |
| <li>Script content is injected as <code>RT_RCDATA</code> resource (type 10, name 1) via Windows <code>UpdateResource</code> API</li> |
| <li>Launch metadata (extension + interpreter command) injected as resource name 2</li> |
| <li>At runtime the stub extracts the resource to a temp file, executes it, then self-cleans</li> |
| </ul> |
| </div> |
|
|
| <div class="flow"> |
| <div style="color:#f0883e;margin-bottom:10px;font-size:.78rem;letter-spacing:.08em">MECHANISM (from Ghidra decompilation)</div> |
| <pre> |
| input.bat |
| | |
| v |
| stub_x64.exe --copy--> output.exe |
| | |
| BeginUpdateResourceW() |
| UpdateResourceW(RT_RCDATA, 1, script_bytes) |
| UpdateResourceW(RT_RCDATA, 2, b"bat cmd.exe /c ") |
| EndUpdateResourceW() |
| | |
| [at runtime] |
| ExtractResource -> %TEMP%\~xyz.bat |
| ShellExecute("cmd.exe /c %TEMP%\~xyz.bat") |
| Sleep -> DeleteFile(%TEMP%\~xyz.bat) |
| </pre> |
| </div> |
|
|
| <div class="card"> |
| <h3>Usage</h3> |
| <p> |
| <code>python converter.py input.bat output.exe</code><br><br> |
| <code>python converter.py input.ps1 output.exe --invisible</code><br><br> |
| <code>python converter.py input.py output.exe --icon myicon.ico --uac-admin</code> |
| </p> |
| </div> |
|
|
| <div class="card"> |
| <h3>Source</h3> |
| <p>Full Python source available in <code>converter.py</code> in this Space's file browser. |
| Windows-only (requires <code>ctypes.windll</code> for resource injection).</p> |
| </div> |
|
|
| <div style="margin-top:20px;color:#484f58;font-size:.8rem"> |
| Part of the ARTEMIS ecosystem · ftrtemis |
| </div> |
| </body> |
| </html> |
