Won't work :-(

[Maxxika]

I made a testfile with echo "CRYPT/DECRYPT TEST"
`shc -f test.sh
Tested binary

./test.sh.x
CRYPT/DECRYPT TEST
`
Run unshc

`./unshc.sh test.sh.x

...

[] Input file name to decrypt [test.sh.x]
[+] ARC4 address call candidate : [0x804894e]
[] Extracting each args address and size for the 14 arc4() calls with address [0x804894e]...
[0] Working with var address at offset [0x804b09c] (0x8 bytes)
[1] Working with var address at offset [0x804b2c8] (0x8 bytes)
[2] Working with var address at offset [0x804b2c9] (0x8 bytes)
[3] Working with var address at offset [0x804b0de] (0x8 bytes)
[4] Working with var address at offset [0x804b0e2] (0x8 bytes)
[5] Working with var address at offset [0x804b0f4] (0x8 bytes)
[6] Working with var address at offset [0x804b123] (0x8 bytes)
[7] Working with var address at offset [0x804b13e] (0x8 bytes)
[8] Working with var address at offset [0x804b082] (0x8 bytes)
[9] Working with var address at offset [0x804b157] (0x8 bytes)
[10] Working with var address at offset [0x804b158] (0x8 bytes)
[11] Working with var address at offset [0x804b0f7] (0x8 bytes)
[12] Working with var address at offset [0x804b159] (0x8 bytes)
[13] Working with var address at offset [0x804b2b1] (0x8 bytes)
[*] Extracting password...
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
[-] Error, function call previous first call of arc4() hasn't been identified...
`
Callfile content:

`

[*] Extracting password...
8048cad: e8 cf fb ff ff call 8048881 <gmon_start@plt+0x161>
8048cb2: 83 c4 10 add $0x10,%esp
8048cb5: 83 ec 08 sub $0x8,%esp
8048cb8: 6a 41 push $0x41
8048cba: 68 9c b0 04 08 push $0x804b09c
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
8048ca8: 68 9e b1 04 08 push $0x804b19e
8048cad: e8 cf fb ff ff call 8048881 <gmon_start@plt+0x161>
8048cb2: 83 c4 10 add $0x10,%esp
8048cb5: 83 ec 08 sub $0x8,%esp
8048cb8: 6a 41 push $0x41
8048cba: 68 9c b0 04 08 push $0x804b09c
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
8048ca3: 68 00 01 00 00 push $0x100
8048ca8: 68 9e b1 04 08 push $0x804b19e
8048cad: e8 cf fb ff ff call 8048881 <gmon_start@plt+0x161>
8048cb2: 83 c4 10 add $0x10,%esp
8048cb5: 83 ec 08 sub $0x8,%esp
8048cb8: 6a 41 push $0x41
8048cba: 68 9c b0 04 08 push $0x804b09c
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
8048ca0: 83 ec 08 sub $0x8,%esp
8048ca3: 68 00 01 00 00 push $0x100
8048ca8: 68 9e b1 04 08 push $0x804b19e
8048cad: e8 cf fb ff ff call 8048881 <gmon_start@plt+0x161>
8048cb2: 83 c4 10 add $0x10,%esp
8048cb5: 83 ec 08 sub $0x8,%esp
8048cb8: 6a 41 push $0x41
8048cba: 68 9c b0 04 08 push $0x804b09c
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
8048c9b: e8 8b fb ff ff call 804882b <gmon_start@plt+0x10b>
8048ca0: 83 ec 08 sub $0x8,%esp
8048ca3: 68 00 01 00 00 push $0x100
8048ca8: 68 9e b1 04 08 push $0x804b19e
8048cad: e8 cf fb ff ff call 8048881 <gmon_start@plt+0x161>
8048cb2: 83 c4 10 add $0x10,%esp
8048cb5: 83 ec 08 sub $0x8,%esp
8048cb8: 6a 41 push $0x41
8048cba: 68 9c b0 04 08 push $0x804b09c
Usage: /usr/bin/grep [OPTION]... PATTERN [FILE]...
Try '/usr/bin/grep --help' for more information.
[-] Error, function call previous first call of arc4() hasn't been identified...
`

[yanncam]

Hello,

Can you send to me the orignal *.sh and encrypted files *.sh.x in attachment ?

What is your distribution version (Ubuntu, Debian, CentOS ?) and architrecture (x86 / x64) ?

It seems to be a problem with the grep command arround the line 309 in the latest version.

Keep me informed,

[Maxxika]

Of course, I attached all items for test. Arch is x86 and this is blackpanther-distro.
yes, i saw that problem have in grep command because callfile not contain the expected values.

unshc-wrong-test.tar.gz

[yanncam]

Ok, I check on my side and I return to you as soon as possible.

Sincerely,

[hujingzhen]

Hi yanncam,

I saw the same issue. did shc change the algorithm?
the unshc could not find the right address and size according to the grep regular expression.

Thanks
Jingzhen

[intika]

did shc change the algorithm?

Yes i did lol ... it's open for new easy exploit search if any one find... :)

[yanncam]

Hello,

Can you try again with the relaxed option of SHc (before using UnSHc) ?
Like this to produce your encrypted test file:

./shc -r -f myScript.sh

The -r is needed to make a redistribuable binary (work on several distribution).

Then retry to decrypt it with UnSHc.

Sincerely,

[droidamlogic]

Hai yanncam

can you help me decrypt this file
thank you for you help

9191.zip