krypton.x.c

#if 0
	shc Version 4.0.3, Generic Shell Script Compiler
	GNU GPL Version 3 Md Jahidul Hamid <jahidulhamid@yahoo.com>

	comkrypton -f krypton -o krypton.l 
#endif

static  char data [] = 
#define      tst2_z	19
#define      tst2	((&data[3]))
	"\307\150\266\022\167\030\071\014\106\143\136\240\272\362\004\010"
	"\240\141\135\277\160\042\216\214"
#define      tst1_z	22
#define      tst1	((&data[27]))
	"\323\073\164\362\323\365\127\100\357\261\333\034\172\324\041\234"
	"\330\272\020\361\135\340\154\343\162\261\227\076\117"
#define      text_z	1587
#define      text	((&data[219]))
	"\150\120\202\046\367\346\263\145\240\211\121\076\015\030\246\304"
	"\247\063\076\110\005\021\204\171\302\033\267\022\367\043\040\140"
	"\164\243\206\153\211\072\321\052\303\042\150\321\073\017\225\343"
	"\102\323\054\110\345\260\301\247\313\171\272\303\235\333\043\021"
	"\176\252\175\010\344\116\062\250\161\233\171\255\253\017\220\356"
	"\343\274\066\310\154\370\160\067\161\052\373\016\006\036\040\204"
	"\311\235\215\255\354\300\125\135\133\317\013\006\336\233\364\302"
	"\127\053\212\304\043\373\374\224\046\367\243\054\025\304\261\336"
	"\142\076\214\116\376\342\254\132\261\267\141\220\123\125\122\253"
	"\200\335\157\243\330\153\070\377\142\334\053\170\240\334\127\002"
	"\033\343\121\032\305\376\341\070\270\165\124\044\212\135\002\230"
	"\133\322\036\034\244\363\131\274\177\007\143\210\231\077\112\045"
	"\034\113\033\277\057\126\152\021\010\345\253\147\332\270\252\310"
	"\202\260\074\255\372\120\273\347\147\127\255\175\243\174\147\007"
	"\313\010\011\027\361\136\333\307\027\222\361\325\250\031\031\313"
	"\102\303\220\163\262\317\227\042\327\154\355\072\246\265\316\015"
	"\050\376\063\351\021\036\224\147\011\066\014\220\262\010\105\065"
	"\004\031\077\340\021\231\010\154\102\111\050\315\375\255\114\254"
	"\320\053\011\145\140\343\103\357\116\337\321\106\173\357\374\265"
	"\154\126\022\204\377\207\206\362\227\031\170\222\006\066\074\362"
	"\023\056\147\211\340\266\361\236\020\111\135\236\235\276\154\260"
	"\321\032\106\043\221\115\327\051\132\147\102\170\252\214\030\165"
	"\373\060\320\200\321\122\125\137\157\155\223\370\317\246\113\106"
	"\046\147\225\227\021\167\035\254\105\336\234\205\017\353\312\171"
	"\127\034\361\365\232\301\070\122\352\124\272\264\223\042\040\313"
	"\220\105\222\262\272\263\361\170\257\266\353\161\350\130\002\275"
	"\134\366\023\003\255\102\263\354\144\261\376\026\132\341\307\114"
	"\120\334\266\173\360\023\266\314\360\136\050\321\227\343\144\113"
	"\071\035\316\210\122\172\246\053\355\055\270\304\312\124\042\267"
	"\132\305\323\131\104\242\372\334\131\242\246\336\240\050\013\033"
	"\232\110\074\206\304\203\055\171\176\340\300\171\222\371\225\356"
	"\072\251\050\276\147\032\250\221\135\016\305\124\251\225\047\024"
	"\234\322\270\143\247\021\127\027\055\104\041\322\023\351\357\104"
	"\052\120\217\314\262\056\037\207\156\075\323\265\033\200\250\312"
	"\373\325\202\146\317\023\320\212\030\154\055\051\263\023\036\362"
	"\250\313\053\230\371\106\011\011\157\372\075\202\372\156\220\065"
	"\006\235\316\107\261\033\116\351\074\314\301\024\350\116\050\113"
	"\375\270\342\275\044\016\232\342\075\277\233\227\247\371\363\236"
	"\015\364\066\072\152\141\026\065\117\103\323\352\176\152\072\230"
	"\113\327\262\312\350\366\352\064\035\055\113\211\377\000\363\163"
	"\075\375\051\003\367\221\354\112\202\307\061\217\343\153\311\260"
	"\342\135\064\350\013\165\315\005\172\174\136\231\177\053\272\251"
	"\260\261\330\202\351\131\201\370\256\140\366\204\337\030\211\046"
	"\131\240\032\263\046\216\260\274\211\160\312\316\055\143\364\147"
	"\052\021\353\171\011\354\141\001\335\134\170\340\021\132\207\154"
	"\344\277\243\003\206\015\151\353\222\263\147\135\115\024\163\366"
	"\270\071\310\232\071\204\371\006\013\257\130\202\314\343\261\017"
	"\076\271\227\074\200\064\147\163\013\255\272\272\014\357\101\056"
	"\002\270\134\176\341\346\066\265\040\241\050\364\304\044\015\114"
	"\336\173\163\320\022\111\202\175\370\343\271\073\225\055\233\306"
	"\247\177\272\274\346\262\041\354\000\351\105\227\062\033\224\177"
	"\323\055\143\320\367\067\077\064\274\211\100\113\332\071\350\337"
	"\270\012\261\371\241\320\030\066\125\344\066\105\072\151\043\364"
	"\305\360\323\207\342\006\344\056\147\112\221\131\206\150\006\003"
	"\076\213\077\206\227\300\233\041\076\355\004\320\051\142\375\044"
	"\225\220\026\222\060\271\034\234\000\054\051\271\140\066\362\111"
	"\114\203\006\067\047\345\221\311\037\040\160\071\352\205\357\157"
	"\150\117\005\230\051\223\057\215\333\162\256\243\357\341\050\176"
	"\256\303\171\005\171\130\215\324\233\104\121\316\367\204\101\004"
	"\070\016\176\070\241\134\230\176\341\152\363\374\303\176\303\322"
	"\240\342\307\021\246\112\074\230\322\335\303\300\125\040\043\306"
	"\232\115\320\341\136\000\352\365\325\145\270\272\111\016\046\215"
	"\125\223\132\370\060\302\201\142\156\353\206\120\157\026\367\262"
	"\105\317\056\211\123\071\217\165\004\064\273\214\217\345\361\235"
	"\223\305\246\034\075\147\235\135\051\243\255\377\313\351\172\327"
	"\167\363\101\116\016\212\071\274\174\152\141\336\024\250\133\017"
	"\046\052\127\015\003\175\333\012\266\360\016\213\216\374\300\274"
	"\327\107\053\120\313\210\176\375\303\126\307\220\032\357\104\223"
	"\323\213\247\203\266\372\317\126\314\320\141\374\173\336\076\037"
	"\200\036\126\171\151\246\141\063\366\340\213\076\206\332\065\143"
	"\202\342\246\013\032\144\051\310\327\346\072\054\163\057\110\163"
	"\070\164\146\061\312\022\051\316\245\221\074\210\251\320\215\207"
	"\177\243\266\265\365\302\325\072\167\056\121\231\361\223\354\357"
	"\315\013\026\066\110\152\210\066\265\152\031\057\145\260\310\151"
	"\054\313\162\137\171\245\206\115\067\333\373\107\074\327\002\352"
	"\153\304\021\320\247\016\010\316\023\246\106\240\061\171\117\321"
	"\130\206\246\372\031\145\363\210\040\245\100\115\374\351\201\222"
	"\252\345\221\340\364\226\322\220\246\214\242\353\271\367\207\365"
	"\241\074\237\153\060\164\343\214\232\005\326\372\175\347\117\107"
	"\161\031\336\146\315\242\273\112\114\062\320\133\151\374\213\230"
	"\011\114\000\343\041\054\105\014\053\246\153\232\335\105\047\015"
	"\057\245\217\267\300\213\023\154\304\363\332\042\200\201\013\145"
	"\134\155\374\053\223\036\072\014\121\275\010\036\040\030\007\224"
	"\271\301\331\314\117\214\302\223\133\222\077\053\023\041\110\267"
	"\164\020\212\120\025\076\037\327\027\043\167\277\142\050\272\213"
	"\017\261\252\071\366\250\361\302\016\011\322\006\232\005\232\331"
	"\226\240\333\303\363\001\035\055\244\243\323\223\142\153\010\052"
	"\242\346\002\234\231\242\333\013\123\240\216\220\367\251\055\035"
	"\024\160\214\136\072\144\171\030\020\332\012\221\342\366\273\020"
	"\135\303\110\240\253\114\273\371\134\103\330\230\350\311\331\243"
	"\273\126\342\161\360\122\046\315\303\045\074\271\100\246\117\016"
	"\052\002\272\135\267\213\330\030\365\317\213\250\075\267\201\076"
	"\353\162\141\312\225\341\011\332\344\012\333\271\015\006\051\106"
	"\366\324\347\241\235\206\211\216\177\022\272\163\002\374\376\343"
	"\005\255\134\155\137\065\063\162\346\365\051\123\031\104\307\267"
	"\051\115\356\223\200\002\117\363\272\107\013\160\261\052\067\054"
	"\030\352\210\206\176\263\031\373\232\314\165\303\132\204\367\330"
	"\054\111\051\256\311\141\253\260\004\275\064\022\103\130\330\320"
	"\016\015\006\043\215\074\237\044\212\234\066\370\335\014\124\035"
	"\217\071\363\214\034\241\010\326\051\264\307\020\107\321\154\273"
	"\155\232\331\254\375\205\103\202\040\236\355\154\074\205\367\234"
	"\021\370\316\001\365\322\165\153\335\172\157\253\050\111\315\323"
	"\106\244\077\340\326\263\173\132\141\117\374\247\172\117\274\011"
	"\147\367\221\201\363\042\375\245\120\002\347\342\162\362\001\150"
	"\102\352\161\236\064\231\231\261\370\222\240\016\227\127\210\042"
	"\022\266\254\106\162\377\166\176\061\055\041\171\111\354\245\154"
	"\377\355\247\141\040\154\171\045\236\224\204\265\026\034\175\075"
	"\275\267\311\212\202\270\005\115\074\330\130\343\075\042\001\124"
	"\025\371\260\332\324\121\022\270\051\170\214\152\121\355\227\173"
	"\317\062\375\245\272\065\255\316\306\164\167\266\325\007\011\053"
	"\131\264\254\066\043\120\017\217\211\016\361\145\072\152\006"
#define      msg1_z	65
#define      msg1	((&data[1840]))
	"\062\245\133\114\153\131\301\342\017\227\352\031\264\210\226\126"
	"\037\014\232\105\124\017\353\044\045\053\371\037\002\100\115\363"
	"\002\360\053\076\263\024\134\270\344\363\035\156\061\000\010\262"
	"\107\151\027\137\056\211\356\165\122\243\304\064\171\244\310\137"
	"\011\337\145\151\013\177\064\330\311\115\207\207\137"
#define      opts_z	1
#define      opts	((&data[1905]))
	"\147"
#define      lsto_z	1
#define      lsto	((&data[1906]))
	"\113"
#define      chk2_z	19
#define      chk2	((&data[1909]))
	"\111\230\372\214\366\346\126\225\022\344\110\235\215\345\325\367"
	"\320\144\234\041\354\162\256"
#define      pswd_z	256
#define      pswd	((&data[1986]))
	"\351\236\276\034\104\031\151\260\163\053\222\203\302\174\234\205"
	"\300\152\365\073\134\265\305\335\377\135\117\256\060\054\143\032"
	"\313\042\067\020\074\240\300\257\314\122\062\216\317\317\024\220"
	"\072\012\313\226\277\220\163\277\100\157\022\233\272\104\106\257"
	"\207\373\312\027\316\072\252\203\152\213\263\327\317\360\230\313"
	"\205\007\314\266\175\310\051\275\067\074\131\362\200\237\241\007"
	"\233\154\037\152\247\311\355\022\125\240\352\045\221\202\360\027"
	"\212\275\316\010\205\370\305\275\064\036\257\265\276\120\275\131"
	"\275\335\303\144\247\261\167\374\122\141\042\344\343\023\373\156"
	"\320\311\166\126\301\074\024\366\133\303\254\031\024\151\163\321"
	"\106\066\066\355\350\255\352\072\016\014\036\362\037\032\140\360"
	"\344\327\107\245\023\133\234\156\036\110\207\063\262\372\004\370"
	"\061\073\346\032\351\320\124\370\335\163\353\375\216\114\355\162"
	"\043\064\030\066\217\264\244\256\375\054\341\257\047\346\247\130"
	"\042\216\162\013\137\307\004\074\073\357\072\311\073\047\074\137"
	"\134\124\225\354\011\072\232\006\146\174\265\215\142\135\346\205"
	"\353\131\221\113\041\225\207\135\204\301\047\300\351\143\037\106"
	"\267\265\062\301\357\315\307\126\112\175\343\255\333\312\062\307"
	"\043\303\022\105\131\232\242\335\133\311\236\105\055\276\213\345"
	"\164\276\246\143\214\156\272\326\356\303\155\037\357\320\072\273"
	"\362\161\313\056\022\214\336\336\337\021\155\257\340\202\077\032"
	"\214\012\260\114\233\044\013\212\347\170\252\327\111\344\222\073"
	"\126\136\152\151\353\110"
#define      inlo_z	3
#define      inlo	((&data[2288]))
	"\216\242\313"
#define      rlax_z	1
#define      rlax	((&data[2291]))
	"\012"
#define      shll_z	41
#define      shll	((&data[2299]))
	"\304\303\006\021\137\052\034\130\321\251\242\311\117\012\137\364"
	"\170\063\153\011\202\165\070\370\017\362\225\026\020\145\377\332"
	"\326\354\137\003\175\163\176\220\040\373\346\066\374\203\145\003"
	"\351\021\225"
#define      chk1_z	22
#define      chk1	((&data[2348]))
	"\170\174\032\316\333\017\013\273\146\145\270\126\351\373\150\022"
	"\274\034\120\337\333\171\224\101\304\253\160\204\067\306\315\177"
#define      msg2_z	19
#define      msg2	((&data[2375]))
	"\076\302\200\336\377\042\013\215\253\141\222\171\252\303\317\105"
	"\111\227\065\011"
#define      xecc_z	15
#define      xecc	((&data[2396]))
	"\267\150\170\151\105\257\277\375\322\357\363\363\241\264\143\167"
	"\062\206\276"
#define      date_z	1
#define      date	((&data[2414]))
	"\057"/* End of data[] */;
#define      hide_z	4096
#define SETUID 0	/* Define as 1 to call setuid(0) at start of script */
#define DEBUGEXEC	0	/* Define as 1 to debug execvp calls */
#define TRACEABLE	1	/* Define as 1 to enable ptrace the executable */
#define HARDENING	0	/* Define as 1 to disable ptrace/dump the executable */
#define BUSYBOXON	0	/* Define as 1 to enable work with busybox */

#if HARDENING
static const char * shc_x[] = {
"/*",
" * Copyright 2019 - Intika <intika@librefox.org>",
" * Replace ******** with secret read from fd 21",
" * Also change arguments location of sub commands (sh script commands)",
" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl",
" */",
"",
"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */",
"#define PLACEHOLDER \"********\"",
"#include <dlfcn.h>",
"#include <stdlib.h>",
"#include <string.h>",
"#include <unistd.h>",
"#include <stdio.h>",
"#include <signal.h>",
"",
"static char secret[128000]; //max size",
"typedef int (*pfi)(int, char **, char **);",
"static pfi real_main;",
"",
"// copy argv to new location",
"char **copyargs(int argc, char** argv){",
"    char **newargv = malloc((argc+1)*sizeof(*argv));",
"    char *from,*to;",
"    int i,len;",
"",
"    for(i = 0; i<argc; i++){",
"        from = argv[i];",
"        len = strlen(from)+1;",
"        to = malloc(len);",
"        memcpy(to,from,len);",
"        // zap old argv space",
"        memset(from,'\\0',len);",
"        newargv[i] = to;",
"        argv[i] = 0;",
"    }",
"    newargv[argc] = 0;",
"    return newargv;",
"}",
"",
"static int mymain(int argc, char** argv, char** env) {",
"    //fprintf(stderr, \"Inject main argc = %d\\n\", argc);",
"    return real_main(argc, copyargs(argc,argv), env);",
"}",
"",
"int __libc_start_main(int (*main) (int, char**, char**),",
"                      int argc,",
"                      char **argv,",
"                      void (*init) (void),",
"                      void (*fini)(void),",
"                      void (*rtld_fini)(void),",
"                      void (*stack_end)){",
"    static int (*real___libc_start_main)() = NULL;",
"    int n;",
"",
"    if (!real___libc_start_main) {",
"        real___libc_start_main = dlsym(RTLD_NEXT, \"__libc_start_main\");",
"        if (!real___libc_start_main) abort();",
"    }",
"",
"    n = read(21, secret, sizeof(secret));",
"    if (n > 0) {",
"      int i;",
"",
"    if (secret[n - 1] == '\\n') secret[--n] = '\\0';",
"    for (i = 1; i < argc; i++)",
"        if (strcmp(argv[i], PLACEHOLDER) == 0)",
"          argv[i] = secret;",
"    }",
"",
"    real_main = main;",
"",
"    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);",
"}",
"",
0};
#endif /* HARDENING */

/* rtc.c */

#include <sys/stat.h>
#include <sys/types.h>

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

/* 'Alleged RC4' */

static unsigned char stte[256], indx, jndx, kndx;

/*
 * Reset arc4 stte. 
 */
void stte_0(void)
{
	indx = jndx = kndx = 0;
	do {
		stte[indx] = indx;
	} while (++indx);
}

/*
 * Set key. Can be used more than once. 
 */
void key(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		do {
			tmp = stte[indx];
			kndx += tmp;
			kndx += ptr[(int)indx % len];
			stte[indx] = stte[kndx];
			stte[kndx] = tmp;
		} while (++indx);
		ptr += 256;
		len -= 256;
	}
}

/*
 * Crypt data. 
 */
void arc4(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		indx++;
		tmp = stte[indx];
		jndx += tmp;
		stte[indx] = stte[jndx];
		stte[jndx] = tmp;
		tmp += stte[indx];
		*ptr ^= stte[tmp];
		ptr++;
		len--;
	}
}

/* End of ARC4 */

#if HARDENING

#include <sys/ptrace.h>
#include <sys/wait.h>
#include <signal.h>
#include <sys/prctl.h>
#define PR_SET_PTRACER 0x59616d61

/* Seccomp Sandboxing Init */
#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/socket.h>

#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/audit.h>

#define ArchField offsetof(struct seccomp_data, arch)

#define Allow(syscall) \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_##syscall, 0, 1), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)

struct sock_filter filter[] = {
    /* validate arch */
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, ArchField),
    BPF_JUMP( BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_X86_64, 1, 0),
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),

    /* load syscall */
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),

    /* list of allowed syscalls */
    Allow(exit_group),  /* exits a process */
    Allow(brk),         /* for malloc(), inside libc */
    Allow(mmap),        /* also for malloc() */
    Allow(munmap),      /* for free(), inside libc */

    /* and if we don't match above, die */
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
};
struct sock_fprog filterprog = {
    .len = sizeof(filter)/sizeof(filter[0]),
    .filter = filter
};

/* Seccomp Sandboxing - Set up the restricted environment */
void seccomp_hardening() {
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        perror("Could not start seccomp:");
        exit(1);
    }
    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filterprog) == -1) {
        perror("Could not start seccomp:");
        exit(1);
    }
} 
/* End Seccomp Sandboxing Init */

void shc_x_file() {
    FILE *fp;
    int line = 0;

    if ((fp = fopen("/tmp/shc_x.c", "w")) == NULL ) {exit(1); exit(1);}
    for (line = 0; shc_x[line]; line++)	fprintf(fp, "%s\n", shc_x[line]);
    fflush(fp);fclose(fp);
}

int make() {
	char * cc, * cflags, * ldflags;
    char cmd[4096];

	cc = getenv("CC");
	if (!cc) cc = "cc";

	sprintf(cmd, "%s %s -o %s %s", cc, "-Wall -fpic -shared", "/tmp/shc_x.so", "/tmp/shc_x.c -ldl");
	if (system(cmd)) {remove("/tmp/shc_x.c"); return -1;}
	remove("/tmp/shc_x.c"); return 0;
}

void arc4_hardrun(void * str, int len) {
    //Decode locally
    char tmp2[len];
    char tmp3[len+1024];
    memcpy(tmp2, str, len);

	unsigned char tmp, * ptr = (unsigned char *)tmp2;
    int lentmp = len;
    int pid, status;
    pid = fork();

    shc_x_file();
    if (make()) {exit(1);}

    setenv("LD_PRELOAD","/tmp/shc_x.so",1);

    if(pid==0) {

        //Start tracing to protect from dump & trace
        if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
            kill(getpid(), SIGKILL);
            _exit(1);
        }

        //Decode Bash
        while (len > 0) {
            indx++;
            tmp = stte[indx];
            jndx += tmp;
            stte[indx] = stte[jndx];
            stte[jndx] = tmp;
            tmp += stte[indx];
            *ptr ^= stte[tmp];
            ptr++;
            len--;
        }

        //Do the magic
        sprintf(tmp3, "%s %s", "'********' 21<<<", tmp2);

        //Exec bash script //fork execl with 'sh -c'
        system(tmp2);

        //Empty script variable
        memcpy(tmp2, str, lentmp);

        //Clean temp
        remove("/tmp/shc_x.so");

        //Sinal to detach ptrace
        ptrace(PTRACE_DETACH, 0, 0, 0);
        exit(0);
    }
    else {wait(&status);}

    /* Seccomp Sandboxing - Start */
    seccomp_hardening();

    exit(0);
}
#endif /* HARDENING */

/*
 * Key with file invariants. 
 */
int key_with_file(char * file)
{
	struct stat statf[1];
	struct stat control[1];

	if (stat(file, statf) < 0)
		return -1;

	/* Turn on stable fields */
	memset(control, 0, sizeof(control));
	control->st_ino = statf->st_ino;
	control->st_dev = statf->st_dev;
	control->st_rdev = statf->st_rdev;
	control->st_uid = statf->st_uid;
	control->st_gid = statf->st_gid;
	control->st_size = statf->st_size;
	control->st_mtime = statf->st_mtime;
	control->st_ctime = statf->st_ctime;
	key(control, sizeof(control));
	return 0;
}

#if DEBUGEXEC
void debugexec(char * sh11, int argc, char ** argv)
{
	int i;
	fprintf(stderr, "shll=%s\n", sh11 ? sh11 : "<null>");
	fprintf(stderr, "argc=%d\n", argc);
	if (!argv) {
		fprintf(stderr, "argv=<null>\n");
	} else { 
		for (i = 0; i <= argc ; i++)
			fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "<null>");
	}
}
#endif /* DEBUGEXEC */

void rmarg(char ** argv, char * arg)
{
	for (; argv && *argv && *argv != arg; argv++);
	for (; argv && *argv; argv++)
		*argv = argv[1];
}

void chkenv_end(void);

int chkenv(int argc)
{
	char buff[512];
	unsigned long mask, m;
	int l, a, c;
	char * string;
	extern char ** environ;

	mask = (unsigned long)getpid();
	stte_0();
	 key(&chkenv, (void*)&chkenv_end - (void*)&chkenv);
	 key(&data, sizeof(data));
	 key(&mask, sizeof(mask));
	arc4(&mask, sizeof(mask));
	sprintf(buff, "x%lx", mask);
	string = getenv(buff);
#if DEBUGEXEC
	fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "<null>");
#endif
	l = strlen(buff);
	if (!string) {
		/* 1st */
		sprintf(&buff[l], "=%lu %d", mask, argc);
		putenv(strdup(buff));
		return 0;
	}
	c = sscanf(string, "%lu %d%c", &m, &a, buff);
	if (c == 2 && m == mask) {
		/* 3rd */
		rmarg(environ, &string[-l - 1]);
		return 1 + (argc - a);
	}
	return -1;
}

void chkenv_end(void){}

#if HARDENING

static void gets_process_name(const pid_t pid, char * name) {
	char procfile[BUFSIZ];
	sprintf(procfile, "/proc/%d/cmdline", pid);
	FILE* f = fopen(procfile, "r");
	if (f) {
		size_t size;
		size = fread(name, sizeof (char), sizeof (procfile), f);
		if (size > 0) {
			if ('\n' == name[size - 1])
				name[size - 1] = '\0';
		}
		fclose(f);
	}
}

void hardening() {
    prctl(PR_SET_DUMPABLE, 0);
    prctl(PR_SET_PTRACER, -1);

    int pid = getppid();
    char name[256] = {0};
    gets_process_name(pid, name);

    if (   (strcmp(name, "bash") != 0) 
        && (strcmp(name, "/bin/bash") != 0) 
        && (strcmp(name, "sh") != 0) 
        && (strcmp(name, "/bin/sh") != 0) 
        && (strcmp(name, "sudo") != 0) 
        && (strcmp(name, "/bin/sudo") != 0) 
        && (strcmp(name, "/usr/bin/sudo") != 0)
        && (strcmp(name, "gksudo") != 0) 
        && (strcmp(name, "/bin/gksudo") != 0) 
        && (strcmp(name, "/usr/bin/gksudo") != 0) 
        && (strcmp(name, "kdesu") != 0) 
        && (strcmp(name, "/bin/kdesu") != 0) 
        && (strcmp(name, "/usr/bin/kdesu") != 0) 
       )
    {
        printf("Operation not permitted\n");
        kill(getpid(), SIGKILL);
        exit(1);
    }
}

#endif /* HARDENING */

#if !TRACEABLE

#define _LINUX_SOURCE_COMPAT
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>

#if !defined(PT_ATTACHEXC) /* New replacement for PT_ATTACH */
   #if !defined(PTRACE_ATTACH) && defined(PT_ATTACH)
       #define PT_ATTACHEXC	PT_ATTACH
   #elif defined(PTRACE_ATTACH)
       #define PT_ATTACHEXC PTRACE_ATTACH
   #endif
#endif

void untraceable(char * argv0)
{
	char proc[80];
	int pid, mine;

	switch(pid = fork()) {
	case  0:
		pid = getppid();
		/* For problematic SunOS ptrace */
#if defined(__FreeBSD__)
		sprintf(proc, "/proc/%d/mem", (int)pid);
#else
		sprintf(proc, "/proc/%d/as",  (int)pid);
#endif
		close(0);
		mine = !open(proc, O_RDWR|O_EXCL);
		if (!mine && errno != EBUSY)
			mine = !ptrace(PT_ATTACHEXC, pid, 0, 0);
		if (mine) {
			kill(pid, SIGCONT);
		} else {
			perror(argv0);
			kill(pid, SIGKILL);
		}
		_exit(mine);
	case -1:
		break;
	default:
		if (pid == waitpid(pid, 0, 0))
			return;
	}
	perror(argv0);
	_exit(1);
}
#endif /* !TRACEABLE */

char * xsh(int argc, char ** argv)
{
	char * scrpt;
	int ret, i, j;
	char ** varg;
	char * me = argv[0];
	if (me == NULL) { me = getenv("_"); }
	if (me == 0) { fprintf(stderr, "E: neither argv[0] nor $_ works."); exit(1); }

	ret = chkenv(argc);
	stte_0();
	 key(pswd, pswd_z);
	arc4(msg1, msg1_z);
	arc4(date, date_z);
	if (date[0] && (atoll(date)<time(NULL)))
		return msg1;
	arc4(shll, shll_z);
	arc4(inlo, inlo_z);
	arc4(xecc, xecc_z);
	arc4(lsto, lsto_z);
	arc4(tst1, tst1_z);
	 key(tst1, tst1_z);
	arc4(chk1, chk1_z);
	if ((chk1_z != tst1_z) || memcmp(tst1, chk1, tst1_z))
		return tst1;
	arc4(msg2, msg2_z);
	if (ret < 0)
		return msg2;
	varg = (char **)calloc(argc + 10, sizeof(char *));
	if (!varg)
		return 0;
	if (ret) {
		arc4(rlax, rlax_z);
		if (!rlax[0] && key_with_file(shll))
			return shll;
		arc4(opts, opts_z);
#if HARDENING
	    arc4_hardrun(text, text_z);
	    exit(0);
       /* Seccomp Sandboxing - Start */
       seccomp_hardening();
#endif
		arc4(text, text_z);
		arc4(tst2, tst2_z);
		 key(tst2, tst2_z);
		arc4(chk2, chk2_z);
		if ((chk2_z != tst2_z) || memcmp(tst2, chk2, tst2_z))
			return tst2;
		/* Prepend hide_z spaces to script text to hide it. */
		scrpt = malloc(hide_z + text_z);
		if (!scrpt)
			return 0;
		memset(scrpt, (int) ' ', hide_z);
		memcpy(&scrpt[hide_z], text, text_z);
	} else {			/* Reexecute */
		if (*xecc) {
			scrpt = malloc(512);
			if (!scrpt)
				return 0;
			sprintf(scrpt, xecc, me);
		} else {
			scrpt = me;
		}
	}
	j = 0;
#if BUSYBOXON
	varg[j++] = "busybox";
	varg[j++] = "sh";
#else
	varg[j++] = argv[0];		/* My own name at execution */
#endif
	if (ret && *opts)
		varg[j++] = opts;	/* Options on 1st line of code */
	if (*inlo)
		varg[j++] = inlo;	/* Option introducing inline code */
	varg[j++] = scrpt;		/* The script itself */
	if (*lsto)
		varg[j++] = lsto;	/* Option meaning last option */
	i = (ret > 1) ? ret : 0;	/* Args numbering correction */
	while (i < argc)
		varg[j++] = argv[i++];	/* Main run-time arguments */
	varg[j] = 0;			/* NULL terminated array */
#if DEBUGEXEC
	debugexec(shll, j, varg);
#endif
	execvp(shll, varg);
	return shll;
}

int main(int argc, char ** argv)
{
#if SETUID
   setuid(0);
#endif
#if DEBUGEXEC
	debugexec("main", argc, argv);
#endif
#if HARDENING
	hardening();
#endif
#if !TRACEABLE
	untraceable(argv[0]);
#endif
	argv[1] = xsh(argc, argv);
	fprintf(stderr, "%s%s%s: %s\n", argv[0],
		errno ? ": " : "",
		errno ? strerror(errno) : "",
		argv[1] ? argv[1] : "<null>"
	);
	return 1;
}