Unraveling the Obfuscated Bash Script on a Uniqlo Tee

By Tris Sherliker

When my wife mentioned a t-shirt she'd spotted, I had no idea I was about to encounter an obfuscated bash script printed on fabric—a clever Easter egg designed to output a cheerful message.

I'm not trying to write clickbait here (mostly because I suspect my monthly readership is in the single digits), but the title of this piece is technically accurate, even if it's not what you'd expect.

The Origin of the Code

The script isn't a malicious payload; it's a creative Easter egg. It appears on a t-shirt produced by Akamai for their Peace for All campaign, sold through Uniqlo retail stores.

Design Elements

• Front: A heart enclosed in curly braces {❤️}.
• Back: A dense block of alphanumeric characters.

Upon closer inspection, the back looks like it starts with a shebang. Specifically, it is a Base64 encoded "Here string" being passed into eval via the base64 --decode command.

"That’s basically how people ship viruses," I told my wife. Then I bought the shirt.

---

The Challenge of OCR

Transcribing the code was the hardest part. The bad news is that Base64 lacks error correction, meaning a single character mistake ruins the entire decode.

Fortunately, the string on my shirt appeared complete, featuring the correct padding, quotes, and braces. This was a stroke of luck, as other shirts in the same Uniqlo x Akamai line are plainly incomplete. One version features truncated imports and ends abruptly with retu instead of return. It also contains a snippet of highly idiomatic Go code: go doStuff(msg, work..., which is a crop from a larger block and would never actually compile.

My Decoding Workflow

I employed several methods to get the text into a digital format:

• Used Android's "circle-to-search" built-in OCR.
• Ran multiple OCR passes to generate different versions.
• Diffed the results to find discrepancies.
• Used Claude to organize mismatches into a table for manual verification.

OCR Comparison Process

---

The Technical Reveal

The final extracted string was: IyEvYmluL2Jhc2gKCiMgQ29uZ3JhdHVsYXRpb25zISBZb3UgZm91bmQgdGhlIGVhc3RlciBlZ2chIOKdpO+4jwojIOOBiuOCgeOBp+OBqOOBhuOBlOOBluOBhOOBvuOBme+8gemaoOOBleOCjOOBn+OCteODl+ODqeOCpOOCuuOCkuimi+OBpOOBkeOBvuOBl+OBn++8geKdpO+4jwoKIyBEZWZpbmUgdGhlIHRleHQgdG8gYW5pbWF0ZQp0ZXh0PS LimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlUEVBQ0XimaVGT1LimaVBTEzimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlIgoKIyBHZXQgdGVybWluYWwgZGltZW5zaW9ucwpjb2xzPSQodHB1dCBjb2xzKQpsaW5lcz0kKHRwdXQgbGluZXMpCgojIENhbGN1bGF0ZSB0aGUgbGVuZ3RoIG9mIHRoZSB0ZXh0CnRleHRfbGVuZ3RoPSR7I3RleHR9CgojIEhpZGUgdGhlIGN1cnNvcgp0cHV0IGNpdmlzCgojIFRyYXAgQ1RSTCtDIHRvIHNob3cgdGhlIGN1cnNvciBiZWZvcmUgZXhpdGluZwp0cmFwICJ0cHV0IGNub3JtOyBleGl0IiBTSUdJTlQKCiMgU2V0IGZyZXF1ZW5jeSBzY2FsaW5nIGZhY3RvcgpmcmVxPTAuMgoKIyBJbmZpbml0ZSBsb29wIGZvciBjb250aW51b3VzIGFuaW1hdGlvbgpmb3IgKCggdD0wOyA7IHQrPTEgKSk7IGRvCiAgICAjIEV4dHJhY3Qgb25lIGNoYXJhY3RlciBhdCBhIHRpbWUKICAgIGNoYXI9IiR7dGV4dDp0ICUgdGV4dF9sZW5ndGg6MX0iCiAgICAKICAgICMgQ2FsY3VsYXRlIHRoZSBhbmdsZSBpbiByYWRpYW5zCiAgICBhbmdsZT0kKGVjaG8gIigkdCkgKiAkZnJlcSIgfCBiYyAtbCkKCiAgICAjIENhbGN1bGF0ZSB0aGUgc2luZSBvZiB0aGUgYW5nbGUKICAgIHNpbmVfdmFsdWU9JChlY2hvICJzKCRhbmdsZSkiIHwgYmMgLWwpCgogICAgIyBDYWxjdWxhdGUgeCBwb3NpdGlvbiB1c2luZyB0aGUgc2luZSB2YWx1ZQogICAgeD0kKGVjaG8gIigkY29scyAvIDIpICsgKCRjb2xzIC8gNCkgKiAkc2luZV92YWx1ZSIgfCBiYyAtbCkKICAgIHg9JChwcmludGYgIiUuMGYiICIkeCIpCgogICAgIyBFbnN1cmUgeCBpcyB3aXRoaW4gdGVybWluYWwgYm91bmRzCiAgICBpZiAoKCB4IDwgMCApKTsgdGhlbiB4PTA7IGZpCiAgICBpZiAoKCB4ID49IGNvbHMgKSk7IHRoZW4geD0kKChjb2xzIC0gMSkpOyBmaQoKICAgICMgQ2FsY3VsYXRlIGNvbG9yIGdyYWRpZW50IGJldHdlZW4gMTIgKGN5YW4pIGFuZCAyMDggKG9yYW5nZSkKICAgIGNvbG9yX3N0YXJ0PTEyCiAgICBjb2xvcl9lbmQ9MjA4CiAgICBjb2xvcl9yYW5nZT0kKChjb2xvcl9lbmQgLSBjb2xvcl9zdGFydCkpCiAgICBjb2xvcj0kKChjb2xvcl9zdGFydCArIChjb2xvcl9yYW5nZSAqIHQgLyBsaW5lcykgJSBjb2xvcl9yYW5nZSkpCgogICAgIyBQcmludCB0aGUgY2hhcmFjdGVyIHdpdGggMjU2LWNvbG9yIHN1cHBvcnQKICAgIGVjaG8gLW5lICJcMDMzWzM4OzU7JHtjb2xvcn1tIiQodHB1dCBjdXAgJHQgJHgpIiRjaGFyXDAzM1swbSIKCiAgICAjIExpbmUgZmVlZCB0byBtb3ZlIGRvd253YXJkCiAgICBlY2hvICIiCgpkb25lCgo=

The Decoded Script

Once decoded, the script reveals itself as a well-commented, friendly program:

#!/bin/bash
# Congratulations! ❤️
# おめでとうございます！隠されたサプライズを見つけました！❤️

# Define the text to animate
text="♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥"

# Get terminal dimensions
cols=$(tput cols)
lines=$(tput lines)

# Calculate the length of the text
text_length=${#text}

# Hide the cursor
tput civis

# Trap CTRL+C to show the cursor before exiting
trap "tput cnorm; exit" SIGINT

# Set frequency scaling factor
freq=0.2

# Infinite loop for continuous animation
for (( t=0; ; t+=1 )); do
    # Extract one character at a time
    char="${text:t % text_length:1}"
    
    # Calculate the angle in radians
    angle=$(echo "($t) * $freq" | bc -l)
    
    # Calculate the sine of the angle
    sine_value=$(echo "s($angle)" | bc -l)
    
    # Calculate x position using the sine value
    x=$(echo "($cols / 2) + ($cols / 4) * $sine_value" | bc -l)
    x=$(printf "%.0f" "$x")
    
    # Ensure x is within terminal bounds
    if (( x < 0 )); then x=0; fi
    if (( x >= cols )); then x=$((cols - 1)); fi
    
    # Calculate color gradient between 12 (cyan) and 208 (orange)
    color_start=12
    color_end=208
    color_range=$((color_end - color_start))
    color=$((color_start + (color_range * t / lines) % color_range))
    
    # Print the character with 256-color support
    echo -ne "\033[38;5;${color}m"$(tput cup $t $x)"$char\033[0m"
    
    # Line feed to move downward
    echo ""
done

How it Works

The script creates a visual sine wave of the "Peace for All" message. Mathematically, the horizontal position $x$ is determined by:

$x = \frac{\text{cols}}{2} + \left( \frac{\text{cols}}{4} \times \sin(t \times \text{freq}) \right)$

As the loop progresses, it iterates through a color gradient from cyan (12) to orange (208), creating a flowing, colorful animation that moves down the terminal screen.

A Final Detail: Typography

One interesting observation was the font used for the code on the shirt. It looks remarkably like Consolas, suggesting the design was likely created on a Windows machine. I previously corresponded with the font's designer, Lucas de Groot, regarding a legal case involving a forged document. He was incredibly helpful then, and his work is clearly visible here.