解码优衣库 T 恤上的混淆 Bash 脚本
Decoding the obfuscated bash script on a Uniqlo t-shirt

原始链接: https://tris.sherliker.net/blog/obfuscated-self-evaluating-bash-script-by-cdn-akamai-being-supplied-to-consumers-via-retail-stores/

作者分享了一个有趣的发现:他的妻子购买了一件由 Akamai 设计的优衣库“Peace for All”系列 T 恤。衣服背面的字母数字方块经仔细查看,竟然是一段经过 Base64 编码的 Bash 脚本。 在利用多种 OCR 工具转录代码后,作者将其解码,发现了一个有趣的彩蛋:一段基于终端的动画,能够以色彩鲜艳的振荡正弦波形式显示“PEACE FOR ALL”字样。 作者指出,该设计巧妙地致敬了早期互联网文化:T 恤的米色代表了复古的“米色机箱”电脑,而代码则向作为“互联网语言”的 Linux 致敬。该设计甚至选用了 Consolas 字体——这对于一件印有代码的服饰来说,是一个既出人意料又精致的选择。尽管作者并不是第一个通过解码该设计来“自找麻烦”的极客,但这一发现凸显了科技、营销与街头时尚之间巧妙的交集。

近期 Hacker News 上的一场讨论关注了一件走红的优衣库 T 恤,其背面印有一段经过混淆的 bash 脚本。*sherliker.net* 的一篇博文详细记录了破译这段文字的过程,引发了读者关于使用 OCR 工具识别此类图像难度的讨论。 评论者们指出了准确读取该脚本的挑战性,一些人认为这可以作为现代视觉模型的严苛测试基准。另一些人则推测了代码的来源,质疑其是否由大语言模型生成,或是潜在的恶意代码。该脚本源于优衣库与科技公司 Akamai 的联名合作,这是该服装零售商常见的营销策略。
相关文章

原文

When my wife said to me “Let me show you a t-shirt I saw…”, I wasn’t sure what to expect, but it definitely wasn’t an obfuscated bash script printed on the back designed to print a happy Easter egg message.

I’m not in the habit of clickbaity headlines

And it’s very cool! The front has a heart in curly braces:

Front

While the back has a big alphanumeric block:

Back

Is that … a shebang?!

My wife was right that I’d want to see it. Was that… a shebang?

Take a closer look at the text block:

The Script

Yes, a shebang! On a t-shirt sold in a high street store, no less. And it is clearly a base64 encoded Here string being fed to eval via base64 --decode.

Interesting. I told my wife "that’s basically how people ship viruses’ and bought it.

OCR was cumbersome

There was good news and bad news:

I ran OCR in a few ways: First, using the built-in OCR of the circle-to-search feature on Android, which is often very good. Second, by using Tesseract with a few options and tweaks. And third by running it through Claude. After diffing the three to look for mismatches and getting Claude to output a table of locations for quick scanning, it became trivial but time-consuimg to tidy up the remainder. The resulting string was:

IyEvYmluL2Jhc2gKCiMgQ29uZ3JhdHVsYXRpb25zISBZb3UgZm91bmQgdGhlIGVhc3RlciBlZ2chIOKdpO+4jwojIOOBiuOCgeOBp+OBqOOBhuOBlOOBluOBhOOBvuOBme+8gemaoOOBleOCjOOBn+OCteODl+ODqeOCpOOCuuOCkuimi+OBpOOBkeOBvuOBl+OBn++8geKdpO+4jwoKIyBEZWZpbmUgdGhlIHRleHQgdG8gYW5pbWF0ZQp0ZXh0PSLimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlUEVBQ0XimaVGT1LimaVBTEzimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlIgoKIyBHZXQgdGVybWluYWwgZGltZW5zaW9ucwpjb2xzPSQodHB1dCBjb2xzKQpsaW5lcz0kKHRwdXQgbGluZXMpCgojIENhbGN1bGF0ZSB0aGUgbGVuZ3RoIG9mIHRoZSB0ZXh0CnRleHRfbGVuZ3RoPSR7I3RleHR9CgojIEhpZGUgdGhlIGN1cnNvcgp0cHV0IGNpdmlzCgojIFRyYXAgQ1RSTCtDIHRvIHNob3cgdGhlIGN1cnNvciBiZWZvcmUgZXhpdGluZwp0cmFwICJ0cHV0IGNub3JtOyBleGl0IiBTSUdJTlQKCiMgU2V0IGZyZXF1ZW5jeSBzY2FsaW5nIGZhY3RvcgpmcmVxPTAuMgoKIyBJbmZpbml0ZSBsb29wIGZvciBjb250aW51b3VzIGFuaW1hdGlvbgpmb3IgKCggdD0wOyA7IHQrPTEgKSk7IGRvCiAgICAjIEV4dHJhY3Qgb25lIGNoYXJhY3RlciBhdCBhIHRpbWUKICAgIGNoYXI9IiR7dGV4dDp0ICUgdGV4dF9sZW5ndGg6MX0iCiAgICAKICAgICMgQ2FsY3VsYXRlIHRoZSBhbmdsZSBpbiByYWRpYW5zCiAgICBhbmdsZT0kKGVjaG8gIigkdCkgKiAkZnJlcSIgfCBiYyAtbCkKCiAgICAjIENhbGN1bGF0ZSB0aGUgc2luZSBvZiB0aGUgYW5nbGUKICAgIHNpbmVfdmFsdWU9JChlY2hvICJzKCRhbmdsZSkiIHwgYmMgLWwpCgogICAgIyBDYWxjdWxhdGUgeCBwb3NpdGlvbiB1c2luZyB0aGUgc2luZSB2YWx1ZQogICAgeD0kKGVjaG8gIigkY29scyAvIDIpICsgKCRjb2xzIC8gNCkgKiAkc2luZV92YWx1ZSIgfCBiYyAtbCkKICAgIHg9JChwcmludGYgIiUuMGYiICIkeCIpCgogICAgIyBFbnN1cmUgeCBpcyB3aXRoaW4gdGVybWluYWwgYm91bmRzCiAgICBpZiAoKCB4IDwgMCApKTsgdGhlbiB4PTA7IGZpCiAgICBpZiAoKCB4ID49IGNvbHMgKSk7IHRoZW4geD0kKChjb2xzIC0gMSkpOyBmaQoKICAgICMgQ2FsY3VsYXRlIGNvbG9yIGdyYWRpZW50IGJldHdlZW4gMTIgKGN5YW4pIGFuZCAyMDggKG9yYW5nZSkKICAgIGNvbG9yX3N0YXJ0PTEyCiAgICBjb2xvcl9lbmQ9MjA4CiAgICBjb2xvcl9yYW5nZT0kKChjb2xvcl9lbmQgLSBjb2xvcl9zdGFydCkpCiAgICBjb2xvcj0kKChjb2xvcl9zdGFydCArIChjb2xvcl9yYW5nZSAqIHQgLyBsaW5lcykgJSBjb2xvcl9yYW5nZSkpCgogICAgIyBQcmludCB0aGUgY2hhcmFjdGVyIHdpdGggMjU2LWNvbG9yIHN1cHBvcnQKICAgIGVjaG8gLW5lICJcMDMzWzM4OzU7JHtjb2xvcn1tIiQodHB1dCBjdXAgJHQgJHgpIiRjaGFyXDAzM1swbSIKCiAgICAjIExpbmUgZmVlZCB0byBtb3ZlIGRvd253YXJkCiAgICBlY2hvICIiCgpkb25lCgo=

The decoded script

After Base64 decoding, the resulting script is a welcoming and nicely commented Easter egg:

#!/bin/bash

# Congratulations! You found the easter egg! ❤️
# おめでとうございます!隠されたサプライズを見つけました!❤️

# Define the text to animate
text="♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥"

# Get terminal dimensions
cols=$(tput cols)
lines=$(tput lines)

# Calculate the length of the text
text_length=${#text}

# Hide the cursor
tput civis

# Trap CTRL+C to show the cursor before exiting
trap "tput cnorm; exit" SIGINT

# Set frequency scaling factor
freq=0.2

# Infinite loop for continuous animation
for (( t=0; ; t+=1 )); do
    # Extract one character at a time
    char="${text:t % text_length:1}"
    
    # Calculate the angle in radians
    angle=$(echo "($t) * $freq" | bc -l)

    # Calculate the sine of the angle
    sine_value=$(echo "s($angle)" | bc -l)

    # Calculate x position using the sine value
    x=$(echo "($cols / 2) + ($cols / 4) * $sine_value" | bc -l)
    x=$(printf "%.0f" "$x")

    # Ensure x is within terminal bounds
    if (( x < 0 )); then x=0; fi
    if (( x >= cols )); then x=$((cols - 1)); fi

    # Calculate color gradient between 12 (cyan) and 208 (orange)
    color_start=12
    color_end=208
    color_range=$((color_end - color_start))
    color=$((color_start + (color_range * t / lines) % color_range))

    # Print the character with 256-color support
    echo -ne "\033[38;5;${color}m"$(tput cup $t $x)"$char\033[0m"

    # Line feed to move downward
    echo ""

done

The result is a continuous happy sine-wave loop of the campaign message, Peace for All:

Peace for All

Detail: The font choice

I guess Uniqlo is run through Windows though: one thing that struck me was the font, which I’m almost certain is Consolas

Linux, the language of the Internet

Akamai put out a press release about the shirt when it was released, which is another sort of interesting due to the blend of tech and marketing:

Design message

More than 25 years ago, Akamai helped make the internet we know today possible. This shirt’s design is a callback to those early days of life online. The light tan color is a reference to the “beige box” plastic casings that housed the early internet computers, and the heart on the front represents how the internet has been used for good all over the world. On the back of the T-shirt is real code. It’s a reference to Linux, the open-source language of the internet. This common language unites Akamai with the world’s top brands and the people they serve, as we work together toward a vision of a safer and more connected world.

Not the first

I deliberately didn’t search for spoilers at first, but I see that I am of course not the first person to get nerd-sniped by this. Wen Chuan Lee and that post also links to another (against which I’ve cross-checked my transcription above). I’m happy to carry on the chain.

联系我们 contact @ memedata.com