bash 如何混淆shell脚本？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/9700893/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to obfuscate a shell script?
提问by Viswa
I am using Ubuntu 10.04. i have created a shell script. After writing the script, the code can be edited when right clicking the file and selecting Gedit. I want to know how to make the script unreadable in Gedit.
我正在使用 Ubuntu 10.04。我已经创建了一个 shell 脚本。写好脚本后，右击文件，选择Gedit就可以编辑代码了。我想知道如何使脚本在 Gedit 中不可读。
回答by l0b0
Obfuscation (which is what most people mean when they say they want a "binary" shell script) is a Bad Idea(TM) - Been there, done that. It doesn't provide any security against a determined programmer (they'd just trace the script to figure out what it's doing), and it makes it really, really hard to debug (which, possibly unless you're GreyCat, you willneed to do. A lot.).
混淆（这是大多数人在说他们想要一个“二进制”shell 脚本时的意思）是一个坏主意 (TM) - 去过那里，做到了。它不会针对坚定的程序员提供任何安全性（他们只是跟踪脚本以找出它在做什么），并且它真的非常难以调试（这可能除非你是GreyCat，否则你将需要要做。很多。）。
回答by Sedison
GEditis just another tool that can be used to edit a file, much like "vi" or "nano" is. Only difference is, I believe it is graphical. Nevertheless, it appears that what the original poster is attempting to do here is to simply make it impossible for others to view certain scripts. If that's true, there are solutions that may be worth investigating.
GEdit只是另一个可用于编辑文件的工具，就像“vi”或“nano”一样。唯一的区别是，我相信它是图形化的。尽管如此，原始海报在这里试图做的似乎只是让其他人无法查看某些脚本。如果这是真的，那么有些解决方案可能值得研究。
SHC:
SHC：
SHC is a great tool to use for this purpose. and based on the last post in this thread, it appears the OP has already tried it but, it didn't work on certain systems. If that's the case, heres's the reason why. The way SHC works is actually pretty straight-forward. When using it to obfuscate a script, you have to re-compile the script for whichever OS you intend to run it on. What that means is, you cannot run the SHC compiler on a ubuntu box and expect the produced script to work on a Red Hat/CentOS box. It appears the latest version of SHC can be accessed here.
SHC 是用于此目的的绝佳工具。并且基于该线程中的最后一篇文章，看来 OP 已经尝试过它，但是它在某些系统上不起作用。如果是这样，这就是原因。SHC 的工作方式实际上非常简单。当使用它来混淆脚本时，您必须为要运行它的任何操作系统重新编译脚本。这意味着，您不能在 ubuntu 机器上运行 SHC 编译器并期望生成的脚本在 Red Hat/CentOS 机器上运行。似乎可以在此处访问最新版本的 SHC 。
EnScryption:
加密：
If your main goal is to discourage others from attempting to read your code, you can just paste your script to a site like this one. This site will automatically generate an obfuscated version of your script that should be able to run without issues on most common Unix systems.
如果你的主要目标是从尝试读取你的代码劝阻别人，你可以只贴上你的脚本喜欢的网站这一个。该站点将自动生成您的脚本的混淆版本，该版本应该能够在最常见的 Unix 系统上正常运行。
If you do not wish to paste your code to the above site or use SHC for whatever reason, then, there's yet another solution. Use openssl!
如果您不希望将代码粘贴到上述站点或出于任何原因使用 SHC，那么还有另一种解决方案。使用openssl！
OpenSSL:
开放式SSL：
If your scripts are really that sensitive, then Openssl(or a similar tool) is probably the best option for you. Why? Because the openssl tool in particular is present on most Unix systems...i.e. Ubuntu, CentOS, Red Hat, Macs, AIX. It comes as part of the default installation. If you decide to go this route, note, you will need to write your script in such a way that before it runs, the user has to provide a password.
如果您的脚本真的那么敏感，那么 Openssl（或类似工具）可能是您的最佳选择。为什么？因为 openssl 工具特别适用于大多数 Unix 系统......即 Ubuntu、CentOS、Red Hat、Macs、AIX。它是默认安装的一部分。如果您决定走这条路，请注意，您需要以这样一种方式编写脚本，即在运行之前，用户必须提供密码。
Encrypting your script with OpenSSL:
使用 OpenSSL 加密您的脚本：
cat yourscript.sh | openssl aes-128-cbc -a -salt -k (specify-a-password-here) > yourscript.enc.sh
(OR)
openssl aes-128-cbc -a -salt -in yourscript.sh -k (specify-a-password-here) > yourscript.enc.sh
(OR)
openssl aes-128-cbc -a -salt -in yourscript.sh -out yourscript.enc.sh -k (specify-a-password-here)
Decrypting your script with OpenSSL:
使用 OpenSSL 解密您的脚本：
cat yourscript.enc.sh | openssl aes-128-cbc -a -d -salt -k (specify-a-password-here) > yourscript.dec.sh
(OR)
openssl aes-128-cbc -a -d -salt -in yourscript.sh -k (specify-a-password-here) > yourscript.dec.sh
(OR)
openssl aes-128-cbc -a -d -salt -in yourscript.sh -out yourscript.enc.sh -k (specify-a-password-here)
A quick thing to note about the openssl encryption mechanism 'aes-128-cbc':
关于 openssl 加密机制“ aes-128-cbc”的一个快速注意事项：
There are probably more secure mechanisms out there. But there is a good chance some of the systems you wish to run your encrypted scripts on wont have those mechanisms, thereby making it impossible to run your script. So keep that in mind if you decide to change it.
那里可能有更安全的机制。但是，您希望在其上运行加密脚本的某些系统很可能没有这些机制，因此无法运行您的脚本。因此，如果您决定更改它，请记住这一点。
回答by KillerX
You are probably looking for something like shc. From the man page:
您可能正在寻找类似 shc 的东西。从手册页：
shc creates a stripped binary executable version of the script specified with -f on the command line.
shc 创建在命令行上使用 -f 指定的脚本的剥离二进制可执行版本。
http://freecode.com/projects/shc
http://freecode.com/projects/shc
Disclaimer: I have not tested shc nor do I know how well/if it works
免责声明：我没有测试过 shc 也不知道它的效果如何/是否有效
回答by davidag
What you want to do is not readily possible. Scripts are interpreted, not compiled, that's why you see text in there.
你想做的事情并不容易。脚本是被解释的，而不是被编译的，这就是你在那里看到文本的原因。
For an script to be executed, the effective user must have read access to it. An alternative to giving execution permission or using shc (as KillerX has nicely proposed), without letting the user look at the contests of the script, would be to use sudo. You would edit the sudoersfile like this (remember to use visudoto edit this file!):
对于要执行的脚本，有效用户必须具有读取权限。提供执行权限或使用 shc（正如 KillerX 很好地提出的那样）的替代方案是使用sudo，而不让用户查看脚本的竞赛。你会sudoers像这样编辑文件（记住使用visudo来编辑这个文件！）：
username ALL=(ALL) /path/to/your_script.sh
Now the script would be executable by "username" but he wouldn't be able to read its contents. Of course, you need to remove all permissions to "username" from this file...
现在脚本可以通过“用户名”执行，但他将无法读取其内容。当然，您需要从此文件中删除“用户名”的所有权限...
