{"id":1005,"date":"2015-11-11T16:57:08","date_gmt":"2015-11-11T14:57:08","guid":{"rendered":"https:\/\/www.asafety.fr\/?page_id=1005"},"modified":"2016-09-14T22:29:19","modified_gmt":"2016-09-14T20:29:19","slug":"unshc-the-shc-decrypter","status":"publish","type":"page","link":"https:\/\/www.asafety.fr\/en\/unshc-the-shc-decrypter\/","title":{"rendered":"UnSHc &#8211; The SHc decrypter"},"content":{"rendered":"<p><\/p>\n<blockquote><p>How to recover a script protected by SHc?<\/p>\n<p>How to decrypt a file * .sh.x?<\/p>\n<p>Cryptographic aspects of the SHc tool are sufficiently robust?<\/p><\/blockquote>\n<p style=\"text-align: center;\"><strong>The tool UnSHc allows to recover the original source code (*.sh) of any scripts encrypted via SHc (* .sh.x).<\/strong><\/p>\n<p style=\"text-align: center;\"><strong><a href=\"https:\/\/github.com\/yanncam\/UnSHc\" target=\"_blank\" rel=\"attachment wp-att-1836\">Download unshc<\/a><\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/UnSHc\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2245\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/githubbutton.png\" alt=\"githubbutton\" width=\"230\" height=\"70\" \/><\/a><\/p>\n<h1>How to use\u00a0UnSHc ?<\/h1>\n<pre>[root@server:<span class=\"pl-k\">~<\/span>\/unshc]$ .\/unshc.sh -h\r\n _   _       _____ _   _\r\n<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>     \/  ___<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>\r\n<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>_ __ <span class=\"pl-cce\">\\ <\/span><span class=\"pl-s\"><span class=\"pl-pds\">`<\/span>--.<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> ___<\/span>\r\n<span class=\"pl-s\"><span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-pds\">'<\/span>_ \\ `--. \\  _  |\/ __|<\/span>\r\n<span class=\"pl-s\">| |_| | | | \/\\__\/ \/ | | | (__<\/span>\r\n<span class=\"pl-s\"> \\___\/|_| |_\\____\/\\_| |_\/\\___|<\/span>\r\n\r\n<span class=\"pl-s\">--- UnSHc - The shc decrypter.<\/span>\r\n<span class=\"pl-s\">--- Version: 0.6<\/span>\r\n<span class=\"pl-s\">------------------------------<\/span>\r\n<span class=\"pl-s\">UnSHc is used to decrypt script encrypted with SHc<\/span>\r\n<span class=\"pl-s\">Original idea from Luiz Octavio Duarte (LOD)<\/span>\r\n<span class=\"pl-s\">Updated and modernized by Yann CAM<\/span>\r\n<span class=\"pl-s\">- SHc   : [http:\/\/www.datsi.fi.upm.es\/~frosal\/]<\/span>\r\n<span class=\"pl-s\">- UnSHc : [https:\/\/www.asafety.fr\/unshc-the-shc-decrypter\/]<\/span>\r\n<span class=\"pl-s\">------------------------------<\/span>\r\n\r\n<span class=\"pl-s\">[*] Usage : .\/unshc.sh [OPTIONS] &lt;file.sh.x&gt;<\/span>\r\n<span class=\"pl-s\">         -h | --help                          : print this help message<\/span>\r\n<span class=\"pl-s\">         -a OFFSET | --arc4 OFFSET            : specify the arc4() offset arbitrarily (without 0x prefix)<\/span>\r\n<span class=\"pl-s\">         -d DUMPFILE | --dumpfile DUMPFILE    : provide an object dump file (objdump -D script.sh.x &gt; DUMPFILE)<\/span>\r\n<span class=\"pl-s\">         -s STRFILE | --stringfile STRFILE    : provide a string dump file (objdump -s script.sh.x &gt; STRFILE)<\/span>\r\n<span class=\"pl-s\">         -o OUTFILE | --outputfile OUTFILE    : indicate the output file name<\/span>\r\n\r\n<span class=\"pl-s\">[*] e.g :<\/span>\r\n<span class=\"pl-s\">        .\/unshc.sh script.sh.x<\/span>\r\n<span class=\"pl-s\">        .\/unshc.sh script.sh.x -o script_decrypted.sh<\/span>\r\n<span class=\"pl-s\">        .\/unshc.sh script.sh.x -a 400f9b<\/span>\r\n<span class=\"pl-s\">        .\/unshc.sh script.sh.x -d \/tmp\/dumpfile -s \/tmp\/strfile<\/span>\r\n<span class=\"pl-s\">        .\/unshc.sh script.sh.x -a 400f9b -d \/tmp\/dumpfile -s \/tmp\/strfile -o script_decrypted.sh<\/span><\/pre>\n<h1><strong>Demonstration :<\/strong><\/h1>\n<p><iframe loading=\"lazy\" width=\"600\" height=\"450\" src=\"https:\/\/www.youtube.com\/embed\/tmHVhMuG-Vg?feature=oembed\" frameborder=\"0\" allowfullscreen><\/iframe><\/p>\n<p>UnSHc is a project originally started in 2008 by Luiz Otavio Duarte (a.k.a. LOD) and brought up to date by ASafety to fix some bugs present and increase the use of new architectures.<\/p>\n<p style=\"text-align: center;\"><strong><a href=\"https:\/\/github.com\/yanncam\/UnSHc\" target=\"_blank\" rel=\"attachment wp-att-1836\">Download unshc<\/a><\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/UnSHc\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2245\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/githubbutton.png\" alt=\"githubbutton\" width=\"230\" height=\"70\" \/><\/a><\/p>\n<p><\/p>","protected":false},"excerpt":{"rendered":"<p>How to recover a script protected by SHc? How to decrypt a file * .sh.x? Cryptographic aspects of the SHc [&hellip;]<\/p>\n","protected":false},"author":1337,"featured_media":1134,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-1005","page","type-page","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/1005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=1005"}],"version-history":[{"count":14,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/1005\/revisions"}],"predecessor-version":[{"id":2247,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/1005\/revisions\/2247"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media\/1134"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=1005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}