diff --git a/ChangeLog b/ChangeLog index 69432b7..00776ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -122,8 +122,8 @@ CHANGES - Fixed bug: "rlax" used after encryption. Thanks to Nalneesh Gaur for: - - Read permision of the script.x exposes it to disassembling. - - Group and others read permision is now removed by default. + - Read permission of the script.x exposes it to disassembling. + - Group and others read permission is now removed by default. @@ -227,15 +227,15 @@ SCO, both not used now. 3.0b1 Wed Feb 26 14:27:22 WET 1997 The main difference with 2.4 is that in it the script was -compressed an then shuffle around, now int 3.0 the script is encripted -with an inline code, so not needend any external comand to work, and been -faster at startup. Other related adventage is that the only information -not encripted in .x.c is an stamp, expiration date and provider email +compressed an then shuffle around, now int 3.0 the script is encrypted +with an inline code, so not needend any external command to work, and been +faster at startup. Other related advantage is that the only information +not encrypted in .x.c is an stamp, expiration date and provider email address. - Something equivalent to cheksums have been used to enforced at + Something equivalent to checksums has been used to enforce at execution that the executing shell has not been modified from the time -the script was compiled. If anybody tries to change the excuting shell, +the script was compiled. If anybody tries to change the executing shell, .x will refuse to execute. The generated .x.c source code is now readable. diff --git a/man.html b/man.html index 3b7af51..10970bd 100644 --- a/man.html +++ b/man.html @@ -1,97 +1,397 @@ - - - - - - - - shc(1) shc user manual - - - - - -
- -

NAME

-

shc - Generic shell script compiler

-

SYNOPSIS

-

shc [ -e date ] [ -m addr ] [ -i iopt ] [ -x cmnd ] [ -l lopt ] [ -o outfile ] [ -ABCDhUHsvSr ] -f script

-

DESCRIPTION

-

shc creates a stripped binary executable version of the script specified with -f on the command line.

-

The binary version will get a .x extension appended by default if outfile is not defined with [-o outfile] option and will usually be a bit larger in size than the original ascii code. Generated C source code is saved in a file with the extension .x.c or in a file specified with appropriate option.

-

If you supply an expiration date with the -e option, the compiled binary will refuse to run after the date specified. The message Please contact your provider will be displayed instead. This message can be changed with the -m option.

-

You can compile any kind of shell script, but you need to supply valid -i, -x and -l options.

-

The compiled binary will still be dependent on the shell specified in the first line of the shell code (i.e. #!/bin/sh), thus shc does not create completely independent binaries.

-

shc itself is not a compiler such as cc, it rather encodes and encrypts a shell script and generates C source code with the added expiration capability. It then uses the system compiler to compile a stripped binary which behaves exactly like the original script. Upon execution, the compiled binary will decrypt and execute the code with the shell -c option. Unfortunately, it will not give you any speed improvement as a real C program would.

-

shc's main purpose is to protect your shell scripts from modification or inspection. You can use it if you wish to distribute your scripts but don't want them to be easily readable by other people.

-

OPTIONS

-

-e date : Expiration date in dd/mm/yyyy format [none]

-

-m message : message to display upon expiration ["Please contact your provider"]

-

-f script_name : File path of the script to compile

-

-i inline_option : Inline option for the shell interpreter i.e: -e

-

-x command : eXec command, as a printf format i.e: exec(\\'%s\\',@ARGV);

-

-l last_option : Last shell option i.e: --

-

-o outfile : output to the file specified by outfile

-

-r : Relax security. Make a redistributable binary which executes on different systems running the same operating system. You can release your binary with this option for others to use

-

-v : Verbose compilation

-

-S : Switch ON setuid for root callable programs [OFF]

-

-D : Switch on debug exec calls

-

-U : Make binary to be untraceable (using strace, ptrace, truss, etc.)

-

-H : Hardening. Extra security flag without root access requirement that protects against dumping, code injection, cat /proc/pid/cmdline, ptrace, etc.. This feature is experimental and may not work on all systems. This option currently only works with Bourne shell (sh) scripts without any positional parameters.

-

-s : Hardening with single process. Requires -H option, runs the binary in a single process, shell is called in the main process otherwise its called in a child process. This feature is experimental (may hang) and may not work on all systems. This option currently only works with Bourne shell (sh) scripts without any positional parameters.

-

-C : Display license and exit

-

-A : Display abstract and exit

-

-B : Compile for BusyBox

-

-h : Display help and exit

-

ENVIRONMENT VARIABLES

-

CC : C compiler command [cc]

-

CFLAGS : C compiler flags [none]

-

LDFLAGS : Linker flags [none]

-

EXAMPLES

-

Compile a script which can be run on other systems with the trace option enabled (without -U flag):

-
shc -f myscript -o mybinary
-

Compile an untraceable binary:

-
shc -Uf myscript -o mybinary
-

Compile an untraceable binary that doesn't require root access (experimental):

-
shc -Hf myscript -o mybinary
-

LIMITATIONS

-

The maximum size of the script that could be executed once compiled is limited by the operating system configuration parameter _SC_ARG_MAX (see sysconf(2))

-

AUTHORS

-

Francisco Rosales

-

Md Jahidul Hamid

-

REPORT BUGS TO

-

https://github.com/neurobin/shc/issues

- - + + + + + + + + + shc(1) shc user manual + + + +
+

shc(1) shc user manual

+

+

January 14, 2019

+
+
+

NAME

+

shc - Generic shell script compiler

+

SYNOPSIS

+

shc [ -e date ] [ -m addr ] [ -i +iopt ] [ -x cmnd ] [ -l lopt ] [ -o +outfile ] [ -ABCDhUHvSr ] -f script

+

DESCRIPTION

+

shc creates a stripped binary executable version of +the script specified with -f on the command line.

+

The binary version will get a .x extension appended by +default if outfile is not defined with [-o outfile] +option and will usually be a bit larger in size than the original ascii +code. Generated C source code is saved in a file with the extension +.x.c or in a file specified with appropriate option.

+

If you supply an expiration date with the -e option, the +compiled binary will refuse to run after the date specified. The message +Please contact your provider will be displayed instead. +This message can be changed with the -m option.

+

You can compile any kind of shell script, but you need to supply +valid -i, -x and -l options.

+

The compiled binary will still be dependent on the shell specified in +the first line of the shell code (i.e. #!/bin/sh), thus +shc does not create completely independent +binaries.

+

shc itself is not a compiler such as cc, it rather +encodes and encrypts a shell script and generates C source code with the +added expiration capability. It then uses the system compiler to compile +a stripped binary which behaves exactly like the original script. Upon +execution, the compiled binary will decrypt and execute the code with +the shell -c option. Unfortunately, it will not give you +any speed improvement as a real C program would.

+

shc’s main purpose is to protect your shell scripts +from modification or inspection. You can use it if you wish to +distribute your scripts but don’t want them to be easily readable by +other people.

+

OPTIONS

+
+
-e date
+
+Expiration date in dd/mm/yyyy format [none] +
+
-m message
+
+message to display upon expiration +["Please contact your provider"] +
+
-f script_name
+
+File path of the script to compile +
+
-i inline_option
+
+Inline option for the shell interpreter i.e: -e +
+
-x command
+
+eXec command, as a printf format i.e: exec(\\'%s\\',@ARGV); +
+
-l last_option
+
+Last shell option i.e: -- +
+
-o outfile
+
+output to the file specified by outfile +
+
-r
+
+Relax security. Make a redistributable binary which executes on +different systems running the same operating system. You can release +your binary with this option for others to use +
+
-v
+
+Verbose compilation +
+
-S
+
+Switch ON setuid for root callable programs [OFF] +
+
-D
+
+Switch on debug exec calls +
+
-U
+
+Make binary to be untraceable (using strace, ptrace, +truss, etc.) +
+
-H
+
+Hardening. Extra security flag without root access requirement that +protects against dumping, code injection, +cat /proc/pid/cmdline, ptrace, etc.. This feature is +experimental and may not work on all systems. it +requires bourne shell (sh) scripts +
+
-C
+
+Display license and exit +
+
-A
+
+Display abstract and exit +
+
-B
+
+Compile for BusyBox +
+
-h
+
+Display help and exit +
+
+

ENVIRONMENT VARIABLES

+
+
CC
+
+C compiler command [cc] +
+
CFLAGS
+
+C compiler flags [none] +
+
LDFLAGS
+
+Linker flags [none] +
+
+

EXAMPLES

+

Compile a script which can be run on other systems with the trace +option enabled (without -U flag):

+
shc -f myscript -o mybinary
+

Compile an untraceable binary:

+
shc -Uf myscript -o mybinary
+

Compile an untraceable binary that doesn’t require root access +(experimental):

+
shc -Hf myscript -o mybinary
+

LIMITATIONS

+

The maximum size of the script that could be executed once compiled +is limited by the operating system configuration parameter +_SC_ARG_MAX (see sysconf(2))

+

AUTHORS

+

Francisco Rosales frosal@fi.upm.es

+

Md Jahidul Hamid jahidulhamid@yahoo.com

+

REPORT BUGS TO

+

https://github.com/neurobin/shc/issues

+ + diff --git a/man.md b/man.md index 6c3dd90..9db7fe2 100644 --- a/man.md +++ b/man.md @@ -71,7 +71,7 @@ You can use it if you wish to distribute your scripts but don't want them to be : Make binary to be untraceable (using *strace*, *ptrace*, *truss*, etc.) -H -: Hardening. Extra security flag without root access requirement that protects against dumping, code injection, `cat /proc/pid/cmdline`, ptrace, etc.. This feature is **experimental** and may not work on all systems. it require bourne shell (sh) scripts +: Hardening. Extra security flag without root access requirement that protects against dumping, code injection, `cat /proc/pid/cmdline`, ptrace, etc.. This feature is **experimental** and may not work on all systems. it requires bourne shell (sh) scripts -C : Display license and exit diff --git a/shc.1 b/shc.1 index ae9d47a..34fc9cc 100644 --- a/shc.1 +++ b/shc.1 @@ -1,147 +1,154 @@ -.TH "shc" "1" "January 14, 2019" "shc user manual" "" -.SH NAME -.PP -shc \- Generic shell script compiler -.SH SYNOPSIS -.PP -\f[B]shc\f[] [ \-e \f[I]date\f[] ] [ \-m \f[I]addr\f[] ] [ \-i -\f[I]iopt\f[] ] [ \-x \f[I]cmnd\f[] ] [ \-l \f[I]lopt\f[] ] [ \-o -\f[I]outfile\f[] ] [ \-ABCDhUHvSr ] \-f \f[I]script\f[] -.SH DESCRIPTION -.PP -\f[B]shc\f[] creates a stripped binary executable version of the script -specified with \f[C]\-f\f[] on the command line. -.PP -The binary version will get a \f[C]\&.x\f[] extension appended by -default if \f[I]outfile\f[] is not defined with [\-o \f[I]outfile\f[]] -option and will usually be a bit larger in size than the original ascii -code. -Generated C source code is saved in a file with the extension -\f[C]\&.x.c\f[] or in a file specified with appropriate option. -.PP -If you supply an expiration date with the \f[C]\-e\f[] option, the -compiled binary will refuse to run after the date specified. -The message \f[B]Please contact your provider\f[] will be displayed -instead. -This message can be changed with the \f[C]\-m\f[] option. -.PP -You can compile any kind of shell script, but you need to supply valid -\f[C]\-i\f[], \f[C]\-x\f[] and \f[C]\-l\f[] options. -.PP -The compiled binary will still be dependent on the shell specified in -the first line of the shell code (i.e. -\f[C]#!/bin/sh\f[]), thus \f[B]shc\f[] does not create completely -independent binaries. -.PP -\f[B]shc\f[] itself is not a compiler such as cc, it rather encodes and -encrypts a shell script and generates C source code with the added -expiration capability. -It then uses the system compiler to compile a stripped binary which -behaves exactly like the original script. -Upon execution, the compiled binary will decrypt and execute the code -with the shell \f[C]\-c\f[] option. -Unfortunately, it will not give you any speed improvement as a real C -program would. -.PP -\f[B]shc\f[]\[aq]s main purpose is to protect your shell scripts from -modification or inspection. -You can use it if you wish to distribute your scripts but don\[aq]t want -them to be easily readable by other people. -.SH OPTIONS -.PP -\-e \f[I]date\f[] : Expiration date in \f[I]dd/mm/yyyy\f[] format -\f[C][none]\f[] -.PP -\-m \f[I]message\f[] : message to display upon expiration -\f[C]["Please\ contact\ your\ provider"]\f[] -.PP -\-f \f[I]script_name\f[] : File path of the script to compile -.PP -\-i \f[I]inline_option\f[] : Inline option for the shell interpreter -i.e: \f[C]\-e\f[] -.PP -\-x \f[I]command\f[] : eXec command, as a printf format i.e: -\f[C]exec(\\\\\[aq]%s\\\\\[aq],\@ARGV);\f[] -.PP -\-l \f[I]last_option\f[] : Last shell option i.e: \f[C]\-\-\f[] -.PP -\-o \f[I]outfile\f[] : output to the file specified by outfile -.PP -\-r : Relax security. -Make a redistributable binary which executes on different systems -running the same operating system. -You can release your binary with this option for others to use -.PP -\-v : Verbose compilation -.PP -\-S : Switch ON setuid for root callable programs [OFF] -.PP -\-D : Switch on debug exec calls -.PP -\-U : Make binary to be untraceable (using \f[I]strace\f[], -\f[I]ptrace\f[], \f[I]truss\f[], etc.) -.PP -\-H : Hardening. -Extra security flag without root access requirement that protects -against dumping, code injection, \f[C]cat\ /proc/pid/cmdline\f[], -ptrace, etc.. -This feature is \f[B]experimental\f[] and may not work on all systems. -it require bourne shell (sh) scripts -any positional parameters. -.PP -\-C : Display license and exit -.PP -\-A : Display abstract and exit -.PP -\-B : Compile for BusyBox -.PP -\-h : Display help and exit -.SH ENVIRONMENT VARIABLES -.PP -CC : C compiler command \f[C][cc]\f[] -.PP -CFLAGS : C compiler flags \f[C][none]\f[] -.PP -LDFLAGS : Linker flags \f[C][none]\f[] -.SH EXAMPLES -.PP -Compile a script which can be run on other systems with the trace option -enabled (without \f[C]\-U\f[] flag): -.IP -.nf -\f[C] -shc\ \-f\ myscript\ \-o\ mybinary -\f[] -.fi -.PP -Compile an untraceable binary: -.IP -.nf -\f[C] -shc\ \-Uf\ myscript\ \-o\ mybinary -\f[] -.fi -.PP -Compile an untraceable binary that doesn\[aq]t require root access -(experimental): -.IP -.nf -\f[C] -shc\ \-Hf\ myscript\ \-o\ mybinary -\f[] -.fi -.SH LIMITATIONS -.PP -The maximum size of the script that could be executed once compiled is -limited by the operating system configuration parameter -\f[C]_SC_ARG_MAX\f[] (see sysconf(2)) -.SH AUTHORS -.PP -Francisco Rosales -.PP -intika -.PP -Md Jahidul Hamid -.SH REPORT BUGS TO -.PP -https://github.com/neurobin/shc/issues +.\" Automatically generated by Pandoc 3.1.13 +.\" +.TH "shc" "1" "January 14, 2019" "shc user manual" "" +.SH NAME +shc \- Generic shell script compiler +.SH SYNOPSIS +\f[B]shc\f[R] [ \-e \f[I]date\f[R] ] [ \-m \f[I]addr\f[R] ] [ \-i +\f[I]iopt\f[R] ] [ \-x \f[I]cmnd\f[R] ] [ \-l \f[I]lopt\f[R] ] [ \-o +\f[I]outfile\f[R] ] [ \-ABCDhUHvSr ] \-f \f[I]script\f[R] +.SH DESCRIPTION +\f[B]shc\f[R] creates a stripped binary executable version of the script +specified with \f[CR]\-f\f[R] on the command line. +.PP +The binary version will get a \f[CR].x\f[R] extension appended by +default if \f[I]outfile\f[R] is not defined with [\-o \f[I]outfile\f[R]] +option and will usually be a bit larger in size than the original ascii +code. +Generated C source code is saved in a file with the extension +\f[CR].x.c\f[R] or in a file specified with appropriate option. +.PP +If you supply an expiration date with the \f[CR]\-e\f[R] option, the +compiled binary will refuse to run after the date specified. +The message \f[B]Please contact your provider\f[R] will be displayed +instead. +This message can be changed with the \f[CR]\-m\f[R] option. +.PP +You can compile any kind of shell script, but you need to supply valid +\f[CR]\-i\f[R], \f[CR]\-x\f[R] and \f[CR]\-l\f[R] options. +.PP +The compiled binary will still be dependent on the shell specified in +the first line of the shell code (i.e.\ \f[CR]#!/bin/sh\f[R]), thus +\f[B]shc\f[R] does not create completely independent binaries. +.PP +\f[B]shc\f[R] itself is not a compiler such as cc, it rather encodes and +encrypts a shell script and generates C source code with the added +expiration capability. +It then uses the system compiler to compile a stripped binary which +behaves exactly like the original script. +Upon execution, the compiled binary will decrypt and execute the code +with the shell \f[CR]\-c\f[R] option. +Unfortunately, it will not give you any speed improvement as a real C +program would. +.PP +\f[B]shc\f[R]\[cq]s main purpose is to protect your shell scripts from +modification or inspection. +You can use it if you wish to distribute your scripts but don\[cq]t want +them to be easily readable by other people. +.SH OPTIONS +.TP +\-e \f[I]date\f[R] +Expiration date in \f[I]dd/mm/yyyy\f[R] format \f[CR][none]\f[R] +.TP +\-m \f[I]message\f[R] +message to display upon expiration +\f[CR][\[dq]Please contact your provider\[dq]]\f[R] +.TP +\-f \f[I]script_name\f[R] +File path of the script to compile +.TP +\-i \f[I]inline_option\f[R] +Inline option for the shell interpreter i.e: \f[CR]\-e\f[R] +.TP +\-x \f[I]command\f[R] +eXec command, as a printf format i.e: +\f[CR]exec(\[rs]\[rs]\[aq]%s\[rs]\[rs]\[aq],\[at]ARGV);\f[R] +.TP +\-l \f[I]last_option\f[R] +Last shell option i.e: \f[CR]\-\-\f[R] +.TP +\-o \f[I]outfile\f[R] +output to the file specified by outfile +.TP +\-r +Relax security. +Make a redistributable binary which executes on different systems +running the same operating system. +You can release your binary with this option for others to use +.TP +\-v +Verbose compilation +.TP +\-S +Switch ON setuid for root callable programs [OFF] +.TP +\-D +Switch on debug exec calls +.TP +\-U +Make binary to be untraceable (using \f[I]strace\f[R], \f[I]ptrace\f[R], +\f[I]truss\f[R], etc.) +.TP +\-H +Hardening. +Extra security flag without root access requirement that protects +against dumping, code injection, \f[CR]cat /proc/pid/cmdline\f[R], +ptrace, etc.. +This feature is \f[B]experimental\f[R] and may not work on all systems. +it requires bourne shell (sh) scripts +.TP +\-C +Display license and exit +.TP +\-A +Display abstract and exit +.TP +\-B +Compile for BusyBox +.TP +\-h +Display help and exit +.SH ENVIRONMENT VARIABLES +.TP +CC +C compiler command \f[CR][cc]\f[R] +.TP +CFLAGS +C compiler flags \f[CR][none]\f[R] +.TP +LDFLAGS +Linker flags \f[CR][none]\f[R] +.SH EXAMPLES +Compile a script which can be run on other systems with the trace option +enabled (without \f[CR]\-U\f[R] flag): +.IP +.EX +shc \-f myscript \-o mybinary +.EE +.PP +Compile an untraceable binary: +.IP +.EX +shc \-Uf myscript \-o mybinary +.EE +.PP +Compile an untraceable binary that doesn\[cq]t require root access +(experimental): +.IP +.EX +shc \-Hf myscript \-o mybinary +.EE +.SH LIMITATIONS +The maximum size of the script that could be executed once compiled is +limited by the operating system configuration parameter +\f[CR]_SC_ARG_MAX\f[R] (see sysconf(2)) +.SH AUTHORS +Francisco Rosales \c +.MT frosal@fi.upm.es +.ME \c +.PP +Md Jahidul Hamid \c +.MT jahidulhamid@yahoo.com +.ME \c +.SH REPORT BUGS TO +https://github.com/neurobin/shc/issues diff --git a/src/shc.c b/src/shc.c index 2475311..f975c1e 100644 --- a/src/shc.c +++ b/src/shc.c @@ -46,7 +46,7 @@ static const char * copying[] = { " along with this program; if not, write to the Free Software", " @Neurobin, Dhaka, Bangladesh", "", -" Report problems and questions to:http://github.com/neurobin/shc", +" Report problems and questions to:https://github.com/neurobin/shc", "", 0}; @@ -57,7 +57,7 @@ static const char * abstract[] = { " of the script specified at command line.", "", " Binary version will be saved with a .x extension by default.", -" You can specify output file name too with [-o filname] option.", +" You can specify output file name too with [-o FILENAME] option.", "", " You can specify expiration date [-e] too, after which binary will", " refuse to be executed, displaying \"[-m]\" instead.", @@ -1167,7 +1167,7 @@ void prnt_array(FILE * o, void * ptr, char * name, int l, char * cast) int m = rand_mod(1+l/4); /* Random amount of random pre padding (offset) */ int n = rand_mod(1+l/4); /* Random amount of random post padding (tail) */ int a = (offset+m)%l; - if (cast && a) m += l - a; /* Type alignement. */ + if (cast && a) m += l - a; /* Type alignment. */ fprintf(o, "\n"); fprintf(o, "#define %s_z %d", name, l); fprintf(o, "\n");