60

I'm looking for a free open source tool-set that will compile various "classic" scripting languages, e.g. Korn Shell, ksh, csh, bash etc. as an executable -- and if the script calls other programs or executables, for them to be included in the single executable.

Reasons:

  1. To obfuscate the code for delivery to a customer so as not to reveal our Intellectual Property - for delivery onto a customer's own machine/systems for which I have no control over what permissions I can set regarding access, so the program file has to be binary whereby the workings cannot be easily seen by viewing in a text editor or hexdump viewer.

  2. To make a single, simply deployed program for the customer without/or a minimal amount of any external dependencies.

I would prefer something simple without the need for package manager since:

  1. I can't rely on the customer's knowledge to carry out (un) packaging instructions and

  2. I can't rely on the policies governing their machines regarding installing packages (and indeed from third parties).

The simplest preferred approach is to be able to compile to proper machine code a single executable that will run out of the box without any dependencies.

7 Answers 7

51

The solution that fully meets my needs would be SHC - a free tool, or CCsh a commercial tool. Both compile shell scripts to C, which then can be compiled using a C compiler.

Links about SHC:

Links about CCsh:

8
  • 1
    I'd never heard of this before, but it seems to do what the OP is asking for. Note that it may or may not be compaitble with some features of bash or ksh, but this probabaly doesn't matter for the OP's purposes. It also has a function to give the compiled binary an expiry date. Commented Jun 22, 2011 at 10:54
  • 1
    This is the definite answer. I been using SHC to compile my shell scripts, it's around since 2002, if I am not mistaken. SHC was made by Francisco Javier Rosales García. Although, it's a bit told, but it still works. Commented Jul 2, 2012 at 8:09
  • I recently tried this tool, SHC, and though it compiled on my dated Fedora 14 system, the resulting executables did not work correctly, they would run as if they were backgrounded, and I'd have to type fg to bring them to the foreground. This was the case for the most basic scripts, so I'm not sure what's up.
    – slm
    Commented Sep 11, 2013 at 5:30
  • 3
    shc is not effective obfuscation -- it's trivial to read the script contents out at runtime. strace or sysdig, or even just an appropriate scan of /proc will do the job of extracting the original script. Commented Jul 8, 2015 at 12:04
  • 3
    I realize this was posted six years ago, but running a program compiled by shc still requires the shell and all called utilities to be installed. The only thing it is good for is (weak) obfuscation
    – Fox
    Commented Mar 8, 2017 at 15:34
10

You could use this: http://megastep.org/makeself/

This generates a shell script that auto-extracts a bundled tar.gz archive into the temporary directory, and then can run an arbitrary command upon extraction.

Using this tool, you can provide only one shell script to the client.

This script will then extract your ofbsh obfuscated scripts and binaries into /tmp, and run them transparently.

4
  • Accepted answer is to use SHC as below: stackoverflow.com/questions/6423007/… Commented Jun 24, 2011 at 10:40
  • @therobyouknow, the accepted answer re: SHC doesn't support bundling in other executables, which your question says is a requirement. Commented Jul 8, 2015 at 12:07
  • "SHC doesn't support bundling in other executables". I take your word for it, certainly, but it does not need to be bundled in other executables - if the output of SHC is pure C code, then this C code can be compiled, linked and built using standard tools that do support bundling (?) Commented Sep 1, 2015 at 9:39
  • Executable, bundle files... that sound a lot like SFX package (at 7zip, winrar). I've used shc and is great, even created a executable binary of obfsh script to try combine them.
    – m3nda
    Commented Nov 27, 2015 at 17:09
5

You can obfuscate shell scripts with something like ofbsh. You won't easily bundle other programs into a single executable for unix, though. Normally the approach for installation would be to buld a package for your platform's package manager (e.g. rpm, deb, pkg) or to provide a tarball to unravel in the appropriate directory.

If you need an executable file that unpacks the contents you might be able to use a shell archive. Take a look at the docs for shar(1) and see if that will get what you want

If you really need a scripting capability to glue multiple C programs together, take a look at the Tcl language. It has an API that is designed to trivially wrap C programs that expect to see argv[] style parameters. You can even embed the chunks of C code into a custom Tcl interpreter and glue it together with various Tcl scripts.

If you really need to make it opaque, you could encrypt the tcl scripts and wrap the whole thing in something that unencrypts the tcl scripts to a buffer and then runs the Tcl interpreter on them. Tcl can accept scripts from a file or a char* buffer, so the unencrypted scripts never have to hit the file system.

3
  • I would prefer something simple without the need for package manager as 1) I can't rely on the customer's knowledge to carry out such instructions and 2) I can't rely on the policies governing their machines regarding installing packages (and indeed from third parties). The simplest preferred approach is to be able to compile to proper machine code a single executable that will run out of the box without any dependencies. Commented Jun 21, 2011 at 9:37
  • +1 For ofbsh, this might be useful in some cases. Though it might damage customer perception if the code looks unreadable, perhaps the customer may be concerned about quality issues, unless it is explained to them that the code is deliberately obfuscated so they can't understand it - which doesn't necessarily help build a relationship based on trust if we are trying to hide things from a 3rd-party, paying customer. Commented Jun 22, 2011 at 10:22
  • Better to give an executable in the first place, which eliminates any kind of hiding concerns, it is probably what the customer expects anyway and gives no indication as to how the software is implemented. No-one is going to feel that things are being hidden from them if plain executable is offered. Commented Jun 22, 2011 at 10:23
4

shc

I have modified the original source and upgraded to a new version with some feature addition and bug fixes. It's here.

Example Usage:

shc -f script.sh -o binary_name

script.sh will be compiled to a binary named binary_name

Note that, you still need the required shell to be installed in your system to run this executable.

3
  • This doesnt seem to work in Ubuntu 18.04; any updates?
    – qodeninja
    Commented Sep 6, 2019 at 3:24
  • @qodeninja : Please provide details on the issue page of the project. You may be doing something wrong..
    – Jahid
    Commented Sep 6, 2019 at 12:49
  • thanks for the reply. do you mind if I email you? I was really excited about your project but couldn't figure out how to make it work.
    – qodeninja
    Commented Sep 6, 2019 at 18:47
2

arx is a great bundler, and you may be able to integrate a obfuscator in its workflow.

1

Options that are available to you:

  • Write a logic in your code that, when the code is run for the first time on a box, it'll check to see if all the required packages exist. And if they do not, the code will automatically go get the packages itself and will install them...without asking to the user to do anything. The only question the user needs to be asked is "Is it ok to proceed with the install of the aforementioned packages? (Y/N)". Anything outside of that is too much.

  • Once the above code is complete (yes, i'm aware it may not be all that simple for you to code this, or may be it is, i don't know your coding capabilities), copy and paste your completed code to a site like kinglazy.com and an actual executable file will be generated for you.

There are quite a few benefits of this particular option:

  • Yes, you will be able to run the encrypted version of your script without exposing any proprietary information.
  • No one can try to "view" your script, because if they do, they'll see nothing but indecipherable, encrypted jargon which wont make sense to them.
  • No one can attempt to modify your script because if they do, the script will immediately become inoperable.
  • No one can run a debugger on your script to see how it works. If they do, the script will abort.
  • Also, no one can create copies of your script on the same server. If they do, it will abort and won't work. It'll only allow users to create symlinks to the original location of wherever you want the script to be.

I may be missing some things in what you asked for, but i believe the above satisfies a good portion of what you wanted.

Not sure if this works on other scripts but it certainly does for shell scripts.

-1

You can also use the free online version of CCsh to compile a shell script into a binary: http://www.comeaucomputing.com/tryccsh/

2
  • 1
    unfortunately the domain is gone away.
    – luca76
    Commented Jan 14, 2019 at 10:37
  • That link just redirects to the home page of the website. Commented Mar 25, 2023 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.