Shell Script Compiler / Encoder, And How To Decode

Encode and Decode a Shell Script / Bash Script With SHC, Then Decode With SHX-DUMPER

Shell Compiler

Shell compiler source code can be found at this repo

You may need to read the at their repo carefully .

Quick Start

A quickstart for usage the shc a.k.a shell compiler from me:

Build from source using GitHub codespace

Go to github codespace and create new, or you may go to and select create codespace.

Then input this command to configure.

git clone
cd shc 
sudo make install

Create simple file named as :

echo "hello world"
uname -a

Then use shc with this command :

shc -f

We got two file, and, for now while type this article, i dont know at much what is file for.

Lets chmod for allow executing the binary.

chmod +x ./

Then execute the binary :


Sample output :

@anasfanani ➜ /workspaces/ (master) $ ./ 
hello world
uid=1000(codespace) gid=1000(codespace) groups=1000(codespace),106(ssh),107(docker),988(pipx),989(python),990(oryx),991(golang),992(sdkman),993(rvm),994(php),995(conda),996(nvs),997(nvm),998(hugo),999(dotnet)
Linux codespaces-67d0c2 5.15.0-1041-azure #48-Ubuntu SMP Tue Jun 20 20:34:08 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Trying to read the file with cat ./ | head -n 2 :

��kX���O�퐖��GNU��@��ݣk�e�mĹ�@9��a >S-Z�rLy��; �(����Q�tdR�td-==��/lib64/�GNU��
                                                    �J E��!��!��"���������iieuipfwrit@�?��?�?�?�B�B(?0?8?@?H?P?X?trer`?r__libc_start_main__environ__xstatGLIBC_2.7GLIBC_2.14GLIBC_2.4GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTableii
�?�?�?�?�?�?�?�?�?�?�?��H�H��/H��t��H���5�.��%�.��h���������h���������h���������h��������h��������h��������h��������h��q��������a������h        ��Q������h

Then using file : ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/, BuildID[sha1]=bcdc0dde1319c86b5802a7b9c34f9eed909684e2, for GNU/Linux 3.2.0, stripped

Deobfuscate / Decompile

Found how to decompile the binary from

Quick Start

Lets try the quickstart from me using this snippet :

git clone
cd bash-shxdumper
make -j$(nproc) || make

At this point, we got new modified ./bash file, now move this bash file to the system :

sudo mv /bin/bash /bin/bash.bak && sudo cp ./bash /bin/bash

Dont worry, your original bash is backup to /bin/bash.bak, I dont need told you about this.

Now we try to deobfuscate ./ files :


And result is failed to deobfuscate ( -_- ).

It seems the shc update their code, shxdumper doesnt work again.

I have another trick to show the running code from process, while you run a shx code, you can see the source with ps -aux | grep ./ the code is showing in process list, but you cant see again if process already killed, thats all I know.

I wont write much more because I’m boring and this blog is for my personal note.

Licensed under CC BY-NC-SA 4.0
Built with Hugo
Theme Stack designed by Jimmy