Retrieve plain text script from compiled bash script

Question

Some time ago, i wrote some bash scripts for my school. I thought it would be very clever to 'protect' them, so i compiled them with shc into a binary file. Some weeks later, i lost the uncompiled scripts and now i have only my binarys left.

Is there a way to retrieve the scripts back from the shc generated binarys? I looked into the source code of shc to find a way to decompile the binarys with no luck.

Answer 1

Using shc to compile your scripts does not protect them. You don't get more security this way. The shc compiled binary decrypts and loads the script into memory when started. You could then, right after you started the binary, just segfault it and retrieve your script from the coredump.

Here's a little example script named test.sh:

#! /bin/bash
echo "starting script and doing stuff"
sleep 1
echo "finished doing stuff"

Compile it with shc:

shc -f test.sh

Start it as background process and segfault it right away:

./test.sh.x&  ( sleep 0.2 && kill -SIGSEGV $! )

sleep 0.2 will give the binary enough time to start up and decrypt the original script. The variable $! contains the pid of the last background process started, so we can easily kill it with the segmentation fault signal SIGSEGV (same as kill -11 $!).

[1]  + segmentation fault (core dumped)  ./test.sh.x

Now we can search the dump for the original script:

cat core | strings

We pipe the data in the dumpfile to strings, which will then show us all the printable characters in the file and we can now see the original script between the garbage:

...
4.0.37(2)-release
BASH_VERSINFO
BASH_VERSINFO
release
i686-pc-linux-gnu
BASH_EXECUTION_STRING
BASH_EXECUTION_STRING
                           #! /bin/bash
echo "starting script and doing stuff"
sleep 1
echo "finished doing stuff"
1000
EUID
EUID
1000
...

If the script is pretty big, maybe you have to adjust the core file size with ulimit. Pretty easy, right?

Answer 2

Keep it simple! :)

To retrieve the scripts back from the shc generated binaries just save the copy of original sh system executable, then rename cat system executable to sh and run the shc generated binary :) So you will see the decrypted source of the shell script in the console.

Answer 3

Just a guess.. you can record system calls using for example strace or something similar and then try to restore at least basic functionality.

Or, you can ask author of shc (http://www.datsi.fi.upm.es/~frosal/sources/shc.html).

PS

The rumour has that somebody has written deshc (http://www.linuxjournal.com/article/8256)

Answer 4

UnSHc, an automatic script to recover *.sh.x encrypted file encrypted with SHc tool has been released on github here.

UnSHc is a tool to reverse the encryption of any SHc encrypted *.sh.x script. It's based on auto-extraction of all cryptographic data embeded in the *.sh.x by reversing it automaticaly. With these cryptographic data (used at encryption), the tool regenerate the initial *.sh file in plaintext.

How to use UnSHc :

[root@server:~/unshc]$ ./unshc.sh -h
 _   _       _____ _   _
| | | |     /  ___| | | |
| | | |_ __ \ `--.| |_| | ___
| | | | '_ \ `--. \  _  |/ __|
| |_| | | | /\__/ / | | | (__
 \___/|_| |_\____/\_| |_/\___|

--- UnSHc - The shc decrypter.
--- Version: 0.6
------------------------------
UnSHc is used to decrypt script encrypted with SHc
Original idea from Luiz Octavio Duarte (LOD)
Updated and modernized by Yann CAM
- SHc   : [http://www.datsi.fi.upm.es/~frosal/]
- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]
------------------------------

[*] Usage : ./unshc.sh [OPTIONS] <file.sh.x>
         -h | --help                          : print this help message
         -a OFFSET | --arc4 OFFSET            : specify the arc4() offset arbitrarily (without 0x prefix)
         -d DUMPFILE | --dumpfile DUMPFILE    : provide an object dump file (objdump -D script.sh.x > DUMPFILE)
         -s STRFILE | --stringfile STRFILE    : provide a string dump file (objdump -s script.sh.x > STRFILE)
         -o OUTFILE | --outputfile OUTFILE    : indicate the output file name

[*] e.g :
        ./unshc.sh script.sh.x
        ./unshc.sh script.sh.x -o script_decrypted.sh
        ./unshc.sh script.sh.x -a 400f9b
        ./unshc.sh script.sh.x -d /tmp/dumpfile -s /tmp/strfile
        ./unshc.sh script.sh.x -a 400f9b -d /tmp/dumpfile -s /tmp/strfile -o script_decrypted.sh

Demonstration video can be seen here (in english and french).