GitHub Repository

shell script protector (obfuscation, embedded interpreter, anti-tamper, DRM) - linux, IoT

7 starsShell

HimitsuShell – Shell scripts invisible even to kernel tracing

Name: HimitsuShell – Shell scripts invisible even to kernel tracing
Availability: InStock
Author: mushstory

by mushstory·Aug 5, 2026·2 points·0 comments

Visit Project View on HN

AI Analysis

●●SolidBig BrainNiche Gem

Embedded BusyBox interpreter beats shc by hiding scripts from auditd and bpftrace.

Strengths

•Static binary compilation prevents script exposure via /proc filesystem or process arguments.
•LLVM-based control flow obfuscation significantly raises the bar for reverse engineering.
•Anti-debugging protections detect and block common dynamic analysis tools automatically.

Weaknesses

•Security through obscurity fails against determined attackers with memory dumping capabilities.
•PolyForm NC license restricts commercial usage compared to standard open source alternatives.

Post Description

shc simply wraps a shell script in C and turns it into a binary. As a result, if you monitor the kernel with tools like auditd or bpftrace, the shell script is still visible.

I solved this by combining a shell interpreter (such as BusyBox) and the shell script into a single static binary. Because the shell script is never passed to the operating system's /bin/sh or /bin/bash, it remains invisible even when monitoring the kernel.

I also added LLVM-based obfuscation and anti-debugging to make reverse engineering more difficult.