Script Encoder Error: "Expected Statement"

SCENARIO:

I have a very simple application that queries a database.
All my web pages are .ASP files.
I was able to successfully encode all the files.
Each file starts with the <% @LANGUAGE="VBScript"%> statement.


WHEN I RUN THE APPLICATION:

I get the following error:
"Expected Statement" line 2.

Line2 happens to be the first statement following the LANGUAGE
statement note above. So I tried removing this line of code and
re-encoding....SAME problem.


WHO HAS A "REAL" ANSWER?

I've seen posts in here talking about "VBS" and "VBE" files and
statements such as <script language="vbscript"
scr="file1.vbs">......but these make no sense to me? I saw a posting
from a Microsoft fellow that indicated that all encoded files had to
be "renamed" to "vbe" file extensions.

Well guess what? That doesn't work either. My host (localhost on a
Win2K SP4) doesn't interpret the .VBE file and instead prompts me with
a "download" dialog.


HELP:

What gives? My code is fine. The files are encoded correctly (from
what I can see). It just seems that the host can't interpret the
encoded files now.

?????????????????????

Bob
Tue Nov 30 15:20:34 CST 2004

John Bradley wrote:
> SCENARIO:
>
> I have a very simple application that queries a database.
> All my web pages are .ASP files.
> I was able to successfully encode all the files.
> Each file starts with the <% @LANGUAGE="VBScript"%> statement.
>
>
> WHEN I RUN THE APPLICATION:
>
> I get the following error:
> "Expected Statement" line 2.
>
> Line2 happens to be the first statement following the LANGUAGE
> statement note above. So I tried removing this line of code and
> re-encoding....SAME problem.
>
>
> WHO HAS A "REAL" ANSWER?

How can we tell without seeing line 2?


--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

Bob
Tue Nov 30 15:26:33 CST 2004

Here is an example of an asp page that works on my server. Does it work on
yours?

<% @LANGUAGE="VBScript"%>
<%
Response.Write "Hello World"
%>

See below for more comments.



John Bradley wrote:
> SCENARIO:
>
> I have a very simple application that queries a database.
> All my web pages are .ASP files.
> I was able to successfully encode all the files.
> Each file starts with the <% @LANGUAGE="VBScript"%> statement.

This simply tells the compiler what the default language on the page is
going to be. That allows you to use

<% ... %>

blocks to delineate your server-side code without specifying the language
each time.


--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

armordata
Wed Dec 01 08:32:54 CST 2004

Bob:


FYI: I'm not shouting when I use caps below.

----------------------------------
Here is my simple test.ASP page:
----------------------------------

<% @LANGUAGE="VBScript" %>

<% Response.Write "Hello World!" %>

NOTE: That's all that is in the file. NO more code. THIS works fine!

--------------------------------------------------
NOW, when I encode the file, here is the result.
Notice how there are 3 lines of code now??!!
--------------------------------------------------
<% @LANGUAGE="VBScript"%>
<%#@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@%>

<%#@~^KQAAAA==@#@&InkwKx/Rq.kD+~J_+ssKPK.V9"J@#@&@#@&bgoAAA==^#~@%>

----------------------------------------------------------
NOTE: Even when I remove the <% @LANGUAGE="VBScript" %>
from the original "test.asp" page, the results in my
encrypted page are the SAME AS THE ENCRYPTED CODE ABOVE -
still 3 lines of code.
----------------------------------------------------------

When I run the encrypted file, here's the error message I
get each time:

Expected statement
/test/encrypted/test.asp, line 2
#@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@



Ideas????

John



"Bob Barrows [MVP]" <reb01501@NOyahoo.SPAMcom> wrote in message news:<O61DCNy1EHA.4004@tk2msftngp13.phx.gbl>...
> Here is an example of an asp page that works on my server. Does it work on
> yours?
>
> <% @LANGUAGE="VBScript"%>
> <%
> Response.Write "Hello World"
> %>
>
> See below for more comments.
>
>
>
> John Bradley wrote:
> > SCENARIO:
> >
> > I have a very simple application that queries a database.
> > All my web pages are .ASP files.
> > I was able to successfully encode all the files.
> > Each file starts with the <% @LANGUAGE="VBScript"%> statement.
>
> This simply tells the compiler what the default language on the page is
> going to be. That allows you to use
>
> <% ... %>
>
> blocks to delineate your server-side code without specifying the language
> each time.

Joe
Wed Dec 01 10:22:03 CST 2004

"John Bradley" <armordata@hotmail.com> wrote in message
news:938cfc0.0412010632.1d42ec96@posting.google.com...
> Bob:
>
>
> FYI: I'm not shouting when I use caps below.
>
> ----------------------------------
> Here is my simple test.ASP page:
> ----------------------------------
>
> <% @LANGUAGE="VBScript" %>
>
> <% Response.Write "Hello World!" %>
>
> NOTE: That's all that is in the file. NO more code. THIS works fine!
>
> --------------------------------------------------
> NOW, when I encode the file, here is the result.
> Notice how there are 3 lines of code now??!!
> --------------------------------------------------
> <% @LANGUAGE="VBScript"%>
> <%#@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@%>
>
> <%#@~^KQAAAA==@#@&InkwKx/Rq.kD+~J_+ssKPK.V9"J@#@&@#@&bgoAAA==^#~@%>
>
> ----------------------------------------------------------
> NOTE: Even when I remove the <% @LANGUAGE="VBScript" %>
> from the original "test.asp" page, the results in my
> encrypted page are the SAME AS THE ENCRYPTED CODE ABOVE -
> still 3 lines of code.
> ----------------------------------------------------------
>
> When I run the encrypted file, here's the error message I
> get each time:
>
> Expected statement
> /test/encrypted/test.asp, line 2
> #@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@
>
>
>
> Ideas????
>
> John
>
>
>
> "Bob Barrows [MVP]" <reb01501@NOyahoo.SPAMcom> wrote in message
> news:<O61DCNy1EHA.4004@tk2msftngp13.phx.gbl>...
>> Here is an example of an asp page that works on my server. Does it work
>> on
>> yours?
>>
>> <% @LANGUAGE="VBScript"%>
>> <%
>> Response.Write "Hello World"
>> %>
>>
>> See below for more comments.
>>
>>
>>
>> John Bradley wrote:
>> > SCENARIO:
>> >
>> > I have a very simple application that queries a database.
>> > All my web pages are .ASP files.
>> > I was able to successfully encode all the files.
>> > Each file starts with the <% @LANGUAGE="VBScript"%> statement.
>>
>> This simply tells the compiler what the default language on the page is
>> going to be. That allows you to use
>>
>> <% ... %>
>>
>> blocks to delineate your server-side code without specifying the language
>> each time.

I didn't know ASP understood encoded files, why would you want to do that
anyway? The server side code is not seen by the browser and they are easily
unencoded by even the the most neophytic hacker.

--

Joe (MVP)

Bob
Wed Dec 01 13:05:18 CST 2004

John Bradley wrote:
> --------------------------------------------------
> NOW, when I encode the file, here is the result.
> Notice how there are 3 lines of code now??!!
> --------------------------------------------------
> <% @LANGUAGE="VBScript"%>
> <%#@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@%>
>
> <%#@~^KQAAAA==@#@&InkwKx/Rq.kD+~J_+ssKPK.V9"J@#@&@#@&bgoAAA==^#~@%>
>
> ----------------------------------------------------------
> NOTE: Even when I remove the <% @LANGUAGE="VBScript" %>
> from the original "test.asp" page, the results in my
> encrypted page are the SAME AS THE ENCRYPTED CODE ABOVE -
> still 3 lines of code.
> ----------------------------------------------------------
>
> When I run the encrypted file, here's the error message I
> get each time:
>
> Expected statement
> /test/encrypted/test.asp, line 2
> #@~^GAAAAA==~"+daW /+cA!W0D~',Y.;PVAgAAA==^#~@
>
>
>
> Ideas????
>

No sorry, I've never tried to run an encoded server-side script block. I saw
the word "Encoder" in your subject line, but just did not believe that you
were actually trying to encode some server-side script.

As Joe says, it's futile. If you need to prevent your web host from reading
your server-side code, then you need to encapsulate it in a dll. Encoding is
mindlessly easy to defeat.

Bob Barrows

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Michael
Wed Dec 01 20:22:19 CST 2004

> <% @LANGUAGE="VBScript" %>

What's wrong is the line above which should have been changed by screnc.exe
to

<% @LANGUAGE="VBScript.Encoded" %>

Can you post the **exact** command line you used to run screnc.exe to encode
the asp file?


--
Michael Harris
Microsoft MVP Scripting

armordata
Thu Dec 02 10:52:33 CST 2004

"Michael Harris \(MVP\)" <mikhar at mvps dot org> wrote in message news:<uMk29WB2EHA.1396@tk2msftngp13.phx.gbl>...
> > <% @LANGUAGE="VBScript" %>
>
> What's wrong is the line above which should have been changed by screnc.exe
> to
>
> <% @LANGUAGE="VBScript.Encoded" %>
>
> Can you post the **exact** command line you used to run screnc.exe to encode
> the asp file?


Mike:

Here's my command line syntax:
screnc /xl /l vbscript *.asp encrypted
...where "encrypted" is the name of my output folder.

Bob:

While I might believe your statement that encoding can be "easily"
defeated, I disagree with you in the context of the 'non-programmer or
average person'. I want to deliver a web application to potential
buyers but I don't necessarily want them to see how the code is
functioning. Encoding my code is as much security as I think I need
because I know my audience, and I doubt they will have the time or
energy to bother attempting to 'decode' it.

On another note, I must say that I myself have not spent a 'great
deal' of time looking for ways to decode it. BUT, in my attempts, I
did not find anything to do the 'decoding'. So I don't believe it's
really all that easy as you claim - unless you're a top notch
programmer.

But thanks for your comments all the same :)

Thanks for your help Mike!

Michael
Thu Dec 02 12:02:54 CST 2004

> Here's my command line syntax:
> screnc /xl /l vbscript *.asp encrypted
> ...where "encrypted" is the name of my output folder.

I think it may be the use of /xl to suppress insertion of the @Language
directive. Screnc.exe *may* not be updating an existing @Language
directive. If that's the case, you could either remove the @Language
directives from the *.asp files and drop the /xl switch, letting screnc.exe
insert them, or you could go back after the ending and manually update the
to specify VBScript.Encoded.

> On another note, I must say that I myself have not spent a 'great
> deal' of time looking for ways to decode it. BUT, in my attempts, I
> did not find anything to do the 'decoding'. So I don't believe it's
> really all that easy as you claim - unless you're a top notch
> programmer.

You must not have tried the most obvious search ;-)..

Google Search: "windows script decoder"
http://www.google.com/search?q="windows%20script%20decoder"&num=100&scoring=d


--
Michael Harris
Microsoft MVP Scripting

armordata
Fri Dec 03 09:52:48 CST 2004

Thanks Mike, I'll give your suggestion a try.


"Michael Harris \(MVP\)" <mikhar at mvps dot org> wrote in message news:<OHkejkJ2EHA.1152@TK2MSFTNGP14.phx.gbl>...
> > Here's my command line syntax:
> > screnc /xl /l vbscript *.asp encrypted
> > ...where "encrypted" is the name of my output folder.
>
> I think it may be the use of /xl to suppress insertion of the @Language
> directive. Screnc.exe *may* not be updating an existing @Language
> directive. If that's the case, you could either remove the @Language
> directives from the *.asp files and drop the /xl switch, letting screnc.exe
> insert them, or you could go back after the ending and manually update the
> to specify VBScript.Encoded.
>
> > On another note, I must say that I myself have not spent a 'great
> > deal' of time looking for ways to decode it. BUT, in my attempts, I
> > did not find anything to do the 'decoding'. So I don't believe it's
> > really all that easy as you claim - unless you're a top notch
> > programmer.
>
> You must not have tried the most obvious search ;-)..
>
> Google Search: "windows script decoder"
> http://www.google.com/search?q="windows%20script%20decoder"&num=100&scoring=d