Decompile AutoHotkey executables using Resource Hacker™ with automatic fallbacks for UPX-packed and legacy AHK formats. Integrates with Windows context menu for one-click decompilation.
Extracts source code from compiled AutoHotkey executables (.exe) by extracting the embedded RCDATA resource. Integrates with Windows right-click context menu for seamless decompilation workflow.
This skill helps you understand, modify, or extend the AHK-Hacker codebase—an AutoHotkey v2.0 decompiler that uses Resource Hacker™ to extract embedded scripts from compiled .exe files. It handles multiple AutoHotkey formats, UPX-packed executables, and legacy resource naming schemes through automatic fallback chains.
**Tech Stack:**
**Decompilation Strategy:**
1. Resource Hacker™ 5.x → extracts `RCDATA1_1.bin` from modern AHK executables
2. Resource Hacker™ 4.x → fallback for older AHK executables with `>AHK WITH ICON<` resource naming (v5.x has a bug with special characters in resource names)
3. UPX unpacking → automatic detection and unpacking of compressed executables, then retry RH5 → RH4
4. myAutToExe GUI → manual decompilation offer for very old AHK (v1.0.48.5 and earlier)
**Key Components:**
Start by reading the project structure:
```bash
ls -R src/
cat src/AHK-Hacker.ahk
cat src/Install.ahk
cat src/Uninstall.ahk
cat src/lib/*.ahk
```
**Key concepts to understand:**
Before making changes, ensure you have:
```bash
cd /path/to/AHK-Hacker
ls src/lib/
ls src/res/
```
**Manual testing workflow:**
```bash
cat src/log/*.txt
cat path/to/filename_decompiled.ahk
```
**Testing specific scenarios:**
#### Adding a new fallback method
1. Read `src/AHK-Hacker.ahk` lines 145-187 (fallback chain logic)
2. Add new function to `src/lib/` folder (follow naming: `Action-Target.ahk`)
3. Insert fallback call after UPX unpacking but before myAutToExe offer
4. Update `CLAUDE.md` file structure section
5. Test with all AHK format variants
#### Modifying context menu registration
1. Read `src/lib/Install-ContextMenu.ahk` and `src/lib/Uninstall-ContextMenu.ahk`
2. Modify registry path: `HKEY_CURRENT_USER\Software\Classes\exefile\shell\AHK-Hacker`
3. Test installation: Run `src/lib/Install-ContextMenu.ahk` → check `regedit`
4. Test uninstallation: Run `src/lib/Uninstall-ContextMenu.ahk` → verify removal
5. Restart Explorer if context menu doesn't update: `taskkill /f /im explorer.exe && start explorer.exe`
#### Updating Resource Hacker™ download logic
1. Read `src/lib/Update-ResourceHacker.ahk` (HTTP HEAD request + ZIP extraction)
2. Modify download URL or version caching logic
3. Test updater: Run with `/silent` parameter → check `src/bin/.rh_version`
4. Verify files are unblocked (no "downloaded from internet" flag)
#### Adding UPX detection improvements
1. Read `src/lib/Unpack-Exe.ahk` function `IsUPXPacked()`
2. Current detection: PE section headers matching `^UPX[0-9]$` regex
3. Add additional signatures or heuristics
4. Test with UPX-packed and non-UPX executables
5. Verify performance improvement (should skip download for non-UPX files)
**Development build (unsigned):**
```bash
```
**Production build (signed):**
```powershell
cd src/res
.\compile_and_sign.ps1
Get-AuthenticodeSignature ..\AHK-Hacker.exe
```
**Release workflow (GitHub Actions):**
**"ResourceHacker.exe not found in bin folder"**
**"Failed to extract script data"**
**Context menu doesn't appear**
**UPX unpacking fails**
**Empty or invalid RCDATA output**
| File | Purpose | Key Functions |
|------|---------|---------------|
| `src/AHK-Hacker.ahk` | Main decompiler | 4-stage fallback chain (RH5 → RH4 → UPX → mATE) |
| `src/lib/Unpack-Exe.ahk` | UPX handling | `IsUPXPacked()`, `TryUnpackExe()`, `DownloadUpx()` |
| `src/lib/Update-ResourceHacker.ahk` | RH updater | HTTP HEAD, ZIP extraction, version caching |
| `src/lib/Install-ContextMenu.ahk` | Registry setup | `HKCU\Software\Classes\exefile\shell` |
| `src/lib/Launch-MyAutToExe.ahk` | Legacy fallback | `OfferMyAutToExe()`, `DownloadMyAutToExe()` |
| `src/lib/Notifications.ahk` | UI feedback | `ShowProgress(message, iconType, title)` |
**Add a new extraction method:**
1. Read `src/AHK-Hacker.ahk` fallback chain (lines 145-187)
2. Create `src/lib/Extract-NewMethod.ahk` with `TryNewMethod(exePath, logFile)` function
3. Insert call after UPX unpacking: `if (newResult := TryNewMethod(exePath, logFile)) { ... }`
4. Update `CLAUDE.md` file structure and key components sections
5. Test with various AHK .exe formats
**Improve UPX detection accuracy:**
1. Read `src/lib/Unpack-Exe.ahk` function `IsUPXPacked()`
2. Add additional PE section signatures or entropy analysis
3. Test with 20+ UPX-packed and non-UPX executables
4. Measure performance impact (target: <1 second overhead)
5. Update detection state documentation (-1 = error, 0 = not UPX, 1 = UPX detected)
**Debug Resource Hacker™ extraction failure:**
1. Check `src/log/*.txt` for Resource Hacker™ command output
2. Verify `src/bin/ResourceHacker.exe` and `src/bin/ResourceHacker4.exe` exist
3. Run Resource Hacker™ GUI manually: `ResourceHacker.exe -open "input.exe"`
4. Inspect resource tree for RCDATA entries (look for numeric IDs vs `>AHK WITH ICON<`)
5. If RH5 failed but RH4 succeeded, verify `<>` character bug (see CLAUDE.md:165-220)
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/ahk-hacker-autohotkey-decompiler/raw