Show HN: HimitsuShell – Shell scripts invisible even to kernel tracing
github.comshc simply wraps a shell script in C and turns it into a binary. As a result, if you monitor the kernel with tools like auditd or bpftrace, the shell script is still visible.
I solved this by combining a shell interpreter (such as BusyBox) and the shell script into a single static binary. Because the shell script is never passed to the operating system's /bin/sh or /bin/bash, it remains invisible even when monitoring the kernel.
I also added LLVM-based obfuscation and anti-debugging to make reverse engineering more difficult.
No comments yet.