{"id":17383225,"url":"https://github.com/yanncam/unshc","last_synced_at":"2025-04-05T11:08:41.968Z","repository":{"id":43148818,"uuid":"52994097","full_name":"yanncam/UnSHc","owner":"yanncam","description":"UnSHc - How to decrypt SHc *.sh.x encrypted file ?","archived":false,"fork":false,"pushed_at":"2020-10-15T08:28:30.000Z","size":94,"stargazers_count":375,"open_issues_count":8,"forks_count":259,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-04-05T11:08:36.399Z","etag":null,"topics":["arc4","arm","bash","decryption","encryption","mips","shc","shell","shellscript","unshc","x64","x86"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yanncam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-03-02T20:27:32.000Z","updated_at":"2025-04-04T13:02:18.000Z","dependencies_parsed_at":"2022-09-05T10:41:44.547Z","dependency_job_id":null,"html_url":"https://github.com/yanncam/UnSHc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yanncam%2FUnSHc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yanncam%2FUnSHc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yanncam%2FUnSHc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yanncam%2FUnSHc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yanncam","download_url":"https://codeload.github.com/yanncam/UnSHc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247325693,"owners_count":20920714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arc4","arm","bash","decryption","encryption","mips","shc","shell","shellscript","unshc","x64","x86"],"created_at":"2024-10-16T07:40:59.550Z","updated_at":"2025-04-05T11:08:41.948Z","avatar_url":"https://github.com/yanncam.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# UnSHc\nUnSHc - How to decrypt SHc *.sh.x encrypted file ?\n\n# Please note\n\nI will not decrypt any file for people.\nIssues on GitHub are only to discuss about bug and/or improvement of the tool \"UnSHc\".\n\n**Due to the many problems since shc 4.0.3, there seems to be a need for clarification. In shc 4.0.3 many structural changes have been incorporated, so that shc now makes use of various security mechanisms provided by the linux-kernel itself. Therefore, it is now almost impossible to extract the original shell script at all with current UnSHc version, if the new shc version was used. This requires a more in-depth approach, which means that a modified bash or a modified linux-kernel is needed to bypass the security measures.**\n\nIf you think you have found a bug, please provide me the encrypted file ***AND the unencrypted file corresponding***. Without these two files I can't reverse it and analyze it.\nAdd some information about the architecture where the encrypted file has been created (what linux distribution and version, what architecture x86 or x64, etc.).\n\n***All others \"file decryption issues\" will be closed directly.***\n\n# SHc review\n\nSHc (SHell compiler) is a fabulous tool created and maintained by Francisco Javier Rosales Garcia (http://www.datsi.fi.upm.es/~frosal/).\nThis tool protect any shell script with encryption (ARC4).\n\n```shell\nwget -q http://www.datsi.fi.upm.es/~frosal/sources/shc-3.8.9.tgz\ntar zxvf shc-3.8.9.tgz\ncd shc-3.8.9\nmake\n```\n\n# How to use SHc ?\n\n```shell\nroot@server:~/shc/shc-3.8.9# shc -h\nshc Version 3.8.9, Generic Script Compiler\nshc Copyright (c) 1994-2012 Francisco Rosales \u003cfrosal@fi.upm.es\u003e\nshc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script\n-e %s Expiration date in dd/mm/yyyy format [none]\n-m %s Message to display upon expiration [\u0026quot;Please contact your provider\u0026quot;]\n-f %s File name of the script to compile\n-i %s Inline option for the shell interpreter i.e: -e\n-x %s eXec command, as a printf format i.e: exec('%s',@ARGV);\n-l %s Last shell option i.e: --\n-r Relax security. Make a redistributable binary\n-v Verbose compilation\n-D Switch ON debug exec calls [OFF]\n-T Allow binary to be traceable [no]\n-C Display license and exit\n-A Display abstract and exit\n-h Display help and exit\nEnvironment variables used:\nName Default Usage\nCC cc C compiler command\nCFLAGS C compiler flags\nPlease consult the shc(1) man page.\n```\n\nEncrypted shell script are named \"*.sh.x\" by default.\n\nUnSHc is a tool to reverse the encryption of any SHc encrypted *.sh.x script.\n\n# How to use UnSHc ?\n\n```shell\n[root@server:~/unshc]$ ./unshc.sh -h\n _   _       _____ _   _\n| | | |     /  ___| | | |\n| | | |_ __ \\ `--.| |_| | ___\n| | | | '_ \\ `--. \\  _  |/ __|\n| |_| | | | /\\__/ / | | | (__\n \\___/|_| |_\\____/\\_| |_/\\___|\n\n--- UnSHc - The shc decrypter.\n--- Version: 0.6\n------------------------------\nUnSHc is used to decrypt script encrypted with SHc\nOriginal idea from Luiz Octavio Duarte (LOD)\nUpdated and modernized by Yann CAM\n- SHc   : [http://www.datsi.fi.upm.es/~frosal/]\n- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]\n------------------------------\n\n[*] Usage : ./unshc.sh [OPTIONS] \u003cfile.sh.x\u003e\n         -h | --help                          : print this help message\n         -a OFFSET | --arc4 OFFSET            : specify the arc4() offset arbitrarily (without 0x prefix)\n         -d DUMPFILE | --dumpfile DUMPFILE    : provide an object dump file (objdump -D script.sh.x \u003e DUMPFILE)\n         -s STRFILE | --stringfile STRFILE    : provide a string dump file (objdump -s script.sh.x \u003e STRFILE)\n         -o OUTFILE | --outputfile OUTFILE    : indicate the output file name\n\n[*] e.g :\n        ./unshc.sh script.sh.x\n        ./unshc.sh script.sh.x -o script_decrypted.sh\n        ./unshc.sh script.sh.x -a 400f9b\n        ./unshc.sh script.sh.x -d /tmp/dumpfile -s /tmp/strfile\n        ./unshc.sh script.sh.x -a 400f9b -d /tmp/dumpfile -s /tmp/strfile -o script_decrypted.sh\n```\n\nUnSHc can only decrypt SHc encrypted file on **X86/x64** architecture.\n\n* Demonstration in video : \n    * https://www.youtube.com/watch?v=tmHVhMuG-Vg\n* SHc (in french) : \n    * https://www.asafety.fr/prog-and-dev/bashshunix-shc-le-compilateur-et-protecteur-de-script-shell/\n* UnSHc (in french) : \n    * https://www.asafety.fr/unshc-the-shc-decrypter/\n    \n# UnSHc-MIPS\n\nThanks to @fffonion, a dedicated version of UnSHc has been released targeting SHc encrypted file on MIPS architecture.\nThis **UnSHc-MIPS** version is available here : https://github.com/fffonion/UnSHc-MIPS\n\nThank you again for your work and contribution !\n\n# UnSHc-ARM\n\nThanks to @cliffalbert, a dedicated version of UnSHc has been released targeting SHc encrypted file on ARM architecture.\nThis **UnSHc-ARM** version is available here : https://github.com/cliffalbert/UnSHc-arm\n\nThank you again for your work and contribution !\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyanncam%2Funshc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyanncam%2Funshc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyanncam%2Funshc/lists"}