shc(1)

💖 shc — like, the manual, but make it make sense 💖

okay bestie, welcome to shc(1), the section-1 manual page for the one and only Generic shell script compiler. yes it's a real thing. no it's not a real compiler. we'll get there. grab a strawberry 🍓 and let's go.

---

✨ NAME ✨

shc — Generic shell script compiler. that's the whole name, she's simple like that.

---

🌸 SYNOPSIS 🌸

shc [ -e date ] [ -m addr ] [ -i iopt ] [ -x cmnd ] [ -l lopt ] [ -o
outfile ] [ -ABCDhUHvSr ] -f script

okay so the way this reads: you need -f script, and everything else is optional garnish. the -ABCDhUHvSr cluster is just a bunch of single-letter flags you can squish together like a friendship bracelet. 🫶

---

🦋 DESCRIPTION 🦋

shc creates a stripped binary executable version of the script you point at with -f on the command line. that's the whole bit. she takes your readable little shell script and gives it main character energy as a binary.

the binary version gets a .x extension appended by default — but only if you don't define outfile with the [-o outfile] option. and heads up: it will usually be a bit larger in size than the original ascii code. (not smaller. never smaller. we don't do smaller here.) the generated C source code gets saved in a file with the extension .x.c, or in a file you specify with the appropriate option. 💅

if you supply an expiration date with the -e option, the compiled binary will refuse to run after the date specified. instead it displays the message Please contact your provider. that message can be changed with the -m option. so like, the binary literally stops working on schedule. dramatic. iconic. on brand.

you can compile any kind of shell script, but you need to supply valid -i, -x and -l options. those three are the holy trinity, don't skip them.

⚠️ important, bestie: the compiled binary will still be dependent on the shell specified in the first line of the shell code (i.e. #!/bin/sh). so shc does not create completely independent binaries. no cap. it's still a shell script underneath the leather jacket.

shc itself is not a compiler such as cc — it rather encodes and encrypts a shell script and generates C source code with the added expiration capability. then it uses the system compiler to compile a stripped binary which behaves exactly like the original script. upon execution, the compiled binary will decrypt and execute the code with the shell -c option. unfortunately, it will not give you any speed improvement as a real C program would. 😭 so sorry. no speedrun.

shc's main purpose is to protect your shell scripts from modification or inspection. use it if you wish to distribute your scripts but don't want them to be easily readable by other people. it's giving "privacy screen for your code". 👑

---

💅 OPTIONS 💅

one bullet per flag, every single one, no skipping, periodt.

• -e date — Expiration date in dd/mm/yyyy format [none]
• -m message — message to display upon expiration [Please contact your provider]
• -f script_name — File path of the script to compile
• -i inline_option — Inline option for the shell interpreter i.e: -e
• -x command — eXec command, as a printf format i.e: exec(\\'%s\\',@ARGV);
• -l last_option — Last shell option i.e: --
• -o outfile — output to the file specified by outfile
• -r — Relax security. Make a redistributable binary which executes on different systems running the same operating system. You can release your binary with this option for others to use
• -v — Verbose compilation
• -S — Switch ON setuid for root callable programs [OFF]
• -D — Switch on debug exec calls
• -U — Make binary to be untraceable (using strace, ptrace, truss, etc.)
• -H — Hardening. Extra security flag without root access requirement that protects against dumping, code injection, cat /proc/pid/cmdline, ptrace, etc.. This feature is experimental and may not work on all systems. it require bourne shell (sh) scripts any positional parameters.
• -C — Display license and exit
• -A — Display abstract and exit
• -B — Compile for BusyBox
• -h — Display help and exit

🫶 friendly reminder that -H is the experimental one. she's cute but she "may not work on all systems", and she "require bourne shell (sh) scripts any positional parameters." that's exactly what the page says, so that's exactly what you get.

---

🌈 ENVIRONMENT VARIABLES 🌈

these are the vibes she reads from your environment, no arguments needed:

• CC — C compiler command [cc]
• CFLAGS — C compiler flags [none]
• LDFLAGS — Linker flags [none]

---

✨ EXAMPLES ✨

Compile a script which can be run on other systems with the trace option enabled (without -U flag):

shc -f myscript -o mybinary

Compile an untraceable binary:

shc -Uf myscript -o mybinary

Compile an untraceable binary that doesn't require root access (experimental):

shc -Hf myscript -o mybinary

see how -U and -H get smushed right up against -f? that's the cluster energy we talked about. 💅

---

💀 LIMITATIONS 💀

the maximum size of the script that could be executed once compiled is limited by the operating system configuration parameter _SC_ARG_MAX (see sysconf(2)). so if your script is a whole novel, the OS said no. not our fault, that's the kernel's boundary-setting era. 🧚

---

👑 AUTHORS 👑

• Francisco Rosales <frosal@fi.upm.es>
• intika <intika@librefox.org>
• Md Jahidul Hamid <jahidulhamid@yahoo.com>

three legends. ate. 🍓

---

🔥 REPORT BUGS TO 🔥

<https://github.com/neurobin/shc/issues>

go there, tell them everything, they're lovely. 🫶

---

and that's the whole page, bestie!! 🎀 this was the shc user manual, dated January 14, 2019, brought to you as shc(1) — now go compile something and protect your little scripts. mwah. 💖✨