Skip to content

Show HN: HimitsuShell – Shell scripts invisible even to kernel tracing

github.com/HimitsuShell
3 pointsmushstorydiscuss
On HN

shc simply wraps a shell script in C and turns it into a binary. As a result, if you monitor the kernel with tools like auditd or bpftrace, the shell script is still visible.

I solved this by combining a shell interpreter (such as BusyBox) and the shell script into a single static binary. Because the shell script is never passed to the operating system's /bin/sh or /bin/bash, it remains invisible even when monitoring the kernel.

I also added LLVM-based obfuscation and anti-debugging to make reverse engineering more difficult.

Comments

No comments yet.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.