Skip to content

Commit

Permalink
Delete macro definition
Browse files Browse the repository at this point in the history
  • Loading branch information
chenzhch committed Jun 6, 2024
1 parent 42b4ec6 commit ee92e34
Show file tree
Hide file tree
Showing 3 changed files with 56 additions and 35 deletions.
15 changes: 9 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ cc example.sh.c -O2 -o example
The generated C code is ```example.sh.c```, which is the original file name followed by ```.c```.
For programs used in production environments, it is recommended to add the parameter ```-s``` or use the ```strip``` command after compilation to remove the symbol table in the executable program, increasing the difficulty of disassembly and reverse engineering.

I have tried the tools ```shc``` and ```shellcrypt```, which can compile shell scripts into executable programs. The main problems are:
- The ```shc``` command actually calls the ```sh -c``` command. The source code can be seen through the ```ps -ef``` command. The length of the shell script cannot exceed ARG_ MAX .
- ```Shellcrypt``` does not support external parameter input, and the encryption algorithm is relatively simple. The generated executable program can be decrypted by XORing with ```0x000C``` to obtain the source code.
I have tried the tools ```shc```, which can compile shell scripts into executable programs. The main problems are:

In addition to solving the problems of the above two tools, ```shellc``` also adds code obfuscation, randomly generating effective character position calculation functions, random character encryption, and debugging to increase the complexity of disassembly and reverse engineering.
The ```shc``` command actually calls the ```sh -c``` command. The source code can be seen through the ```ps -ef``` command. The length of the shell script cannot exceed ARG_MAX .

Shellc not only solves the problems that exist in ```shc```, ```shellc``` also adds code obfuscation, randomly generating effective character position calculation functions, random character encryption, and debugging to increase the complexity of disassembly and reverse engineering.If further difficulty is required, professional tools such as ```obfuscator-llvm``` can be used to further obfuscate the generated C code.

Version 1.0 or above not only support shell, but also other scripting languages, which can completely replace ```shc```.
At present, the program has practical applications in ```AIX```, ```UNIX```, ```Linux``` environments. It is recommended to conduct comprehensive testing on the compiled program to prevent production failures.
Expand Down Expand Up @@ -76,6 +76,10 @@ macOS 13|lldb|NO

### History

- v1.02 2024-06-06

Removing macro definitions from generated code makes it easier for professional tools to generate more complex and confusing code

- v1.01 2024-06-02

Remove special handling of FreeBSD
Expand Down Expand Up @@ -107,5 +111,4 @@ macOS 13|lldb|NO
- v0.1 2023-12-01

Initial version



59 changes: 36 additions & 23 deletions shellc.c
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* Author: ChenZhongChao
* E-Mail: [email protected]
* Date: 2023-12-25
* Version: 1.01
* Version: 1.0
* Github: https://github.com/chenzhch/shellc.git
* Gitee: https://gitee.com/chenzhch/shellc.git
*/
Expand Down Expand Up @@ -250,8 +250,27 @@ static const char *fourth_safe[] = {
" fprintf(stderr, \"Error: Command %s not found\\n\", command);",
" return(1);",
" }",
" free(name);"
" if (argc > 1) {",
" fputs(\"__shellc_main__() { \", pipe);",
" srand(time(0));",
" length = rand() % 9 + 16;",
" name = malloc((size_t) length);",
" memset(name, 0, length);",
" for (i = 0; i < length - 1; i++) {",
" switch(rand() % 3) {",
" case 0:",
" sprintf(name + i, \"%c\", rand() % 26 + 65);",
" break;",
" case 1:",
" sprintf(name + i, \"%c\", rand() % 26 + 97);",
" break;",
" default:",
" sprintf(name + i, \"%c\", 95);",
" break;",
" }",
" }",
" fputs(name, pipe);",
" fputs(\"() { \", pipe);",
" }",
0
};
Expand All @@ -272,9 +291,8 @@ static const char *fifth[] = {
" }",
" args[j] = 0;",
" if ((pid = fork()) == 0) {",
" write_script(file[1]);",
" close(file[1]);",
" close(file[0]);",
" write_script(file[1]);",
" return(0);",
" } else if (pid < 0) {",
" perror(\"Failed to fork\");",
Expand All @@ -292,7 +310,10 @@ static const char *fifth[] = {
static const char *fifth_safe[] = {
" write_script(pipe);",
" if (argc > 1) {",
" fputs(\" } ; __shellc_main__ \", pipe);",
" fputs(\" } ; \", pipe);",
" fputs(name, pipe);",
" free(name);",
" fputc(' ', pipe);",
" }",
" for(i = 1; i < argc; i++) {",
" fputs(\" \\\"\", pipe);",
Expand Down Expand Up @@ -581,7 +602,7 @@ int main(int argc, char **argv)
}
}
if (input_flag != 1 || command_flag != 1 || fix_flag > 1 || trace_flag > 1 || safe_flag > 1) {
fprintf(stderr, "Usage1: %s command inputfile [-t] [-s] [-f fix-argv0]\n", argv[0]);
fprintf(stderr, "Usage: %s command inputfile [-t] [-s] [-f fix-argv0]\n", argv[0]);
return(1);
}

Expand Down Expand Up @@ -728,43 +749,35 @@ int main(int argc, char **argv)
fprintf(out, "#include <sys/ptrace.h>\n");
}

/*Macro definitions are generated based on the calculation path*/
/*Calculation path function*/
for (i = 0; i < 32; i++) {
j = 0;
while (route[i][j] != 0) {
if(j == 0){
fprintf(out, "#define F%d(a, b) (\\\n", i + 1);
fprintf(out, "long f%d(long a, long b) \n{\n return (\n", i + 1);
}
memset(str, 0, (size_t) sizeof(str));
macro(route[i][j], x[i][j], y[i][j], str);
fprintf(out, " %s%s\\\n", j == 0 ? " ":" +", str);
fprintf(out, " %s%s\n", j == 0 ? " ":" +", str);
j++;
}
fprintf(out, ")\n\n");
fprintf(out, " );\n}\n\n");
}

/*Character mask calculation function*/
for (i = 0; i < 32; i++) {
j = 0;
while (algorithm[i][j] != 0) {
if(j == 0){
fprintf(out, "#define F%d(a, b) labs(\\\n", 32 + i + 1);
fprintf(out, "long f%d(long a, long b) \n{\n return labs(\n", 32 + i + 1);
}
fprintf(out, " %s(%s%c%s)\\\n", j == 0 ? " ":" +", number[i][j * 2], algorithm[i][j], number[i][j * 2 + 1]);
fprintf(out, " %s(%s%c%s)\n", j == 0 ? " ":" +", number[i][j * 2], algorithm[i][j], number[i][j * 2 + 1]);
j++;
}
fprintf(out, ")\n\n");
fprintf(out, " );\n}\n\n");
}

/*Generate a call function*/
for (i = 0; i < 64; i++) {
fprintf(out, "long f%d(long a, long b)\n", i + 1);
fprintf(out, "{\n");
fprintf(out, " return(F%d(a, b));\n", i + 1);
fprintf(out, "}\n\n");
}

fprintf(out, "static const char *command = \"%s\";\n", command);

fprintf(out, "static const char *command = \"%s\";\n\n", command);

/*Write to the data section*/
fprintf(out, "static const char *data[] = {\n");
Expand Down
17 changes: 11 additions & 6 deletions 说明.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,12 @@ cc example.sh.c -O2 -o example
生成的C代码是 ```example.sh.c```,即原始文件名后加```.c```
对于生产环境中使用的程序,建议在编译时添加参数```-s```或编译后用```strip```命令, 以删除可执行程序中的符号表,增加了反汇编和逆向工程的难度。

本人试用了可以将shell脚本编译成可执行程序的工具```shc``````shellcrypt```,存在的主要问题是:
- ```shc``` 实际调用的是```sh -c``` 命令,通过```ps -ef``` 命令就能看到源码。shell脚本长度不能超过ARG_MAX值。
- ```shellcrypt```不支持外部参数输入,加密算法相对简单。生成的可执行程序可以通过与```0x000C```进行异或解密来获得源代码。
本人试用了可以将shell脚本编译成可执行程序的工具```shc```,存在的主要问题是:

shellc除了解决上述这两工具存在的问题外,还增加了代码混淆、随机生成有效字符位置计算函数、随机字符加密、反调试等增加反汇编逆向复杂度。
```shc``` 实际调用的是```sh -c``` 命令,通过```ps -ef``` 命令就能看到源码。shell脚本长度不能超过ARG_MAX值。

shellc除了解决```shc```存在的问题外,还增加了代码混淆、随机生成有效字符位置计算函数、随机字符加密、反调试等增加反汇编逆向复杂度。
如果需要进一步增加逆向难度,还可使用```obfuscator-llvm```等专业工具对生成后的C代码进一步进行混淆。
1.0及以上版本除了支持shell外,还支持其他脚本语言,可以完全替代```shc```
目前,该程序已在```AIX``````UNIX``````Linux``` 环境中具有实际应用。建议对编译后的程序进行全面测试,以防止生产故障。

Expand Down Expand Up @@ -49,7 +50,7 @@ shellc除了解决上述这两工具存在的问题外,还增加了代码混

- 参数0修复

支持```BASH``````FISH``````ZSH``````PERL``````PYTHON``````JAVASCRIPT``````LUA``````RUBY```修复。
支持```BASH``` ```FISH``````ZSH``````PERL``````PYTHON``````JAVASCRIPT``````LUA``````RUBY```修复。

除了内置的修复类型,还可使用自定义文件修复。自定义文件格式:``````表示参数0值,换行必须明确使用```\n```,双引号需加转义符```\```。参考```test/fix.txt```

Expand All @@ -75,9 +76,13 @@ macOS 13|lldb|不支持


### 修改记录
- v1.02 2024-06-06

删除生代码中的宏定义便于专业工具生成更复杂的混淆代码

- v1.01 2024-06-02

删除FreeBSD特殊处理
删除对FreeBSD特殊处理

- v1.0 2024-06-01

Expand Down

0 comments on commit ee92e34

Please sign in to comment.