Decoding the obfuscated bash script on a Uniqlo t-shirt

"Uniqlo x Akamai sells another design of shirt in the same range which is plainly incomplete"

Imagine having to return a t-shirt because that malfunction!

— I don't understand why are you returning this, was the size wrong or you didn't like it?

— No, there is a syntax error at line 37 that makes it impossible to run, and I'm concerned people on the street may think I promote unsafe bash scripting.

If you enjoy this kind of thing, you might also like Martin Kleppe's work, such as the Quine Clock:

https://aem1k.com/qlock/

I reverse engineered it to a unobfuscated version a few years ago:

https://gist.github.com/olooney/a89db3932b089925b71b68d7e9f2...

He's done a ton of other great ASCII visualizations as well:

https://aem1k.com/

The font is Roboto Mono, not Consolas.

There's something else a lot stranger going on, though. It is a proper monospace font, but the typesetting on the shirt is not. There's some kerning going on (I noticed it especially in the 'Iy' pair), and also it appears that narrower characters such as 'i' take less horizontal space. If I had to guess, I would say that it was set with a tool such as "optical kerning" in InDesign.

I love this shirt! Here's a nice video from the actual designer about the process of making this shirt (including intentionally making it hard to OCR): https://youtu.be/jocGLiecpjU?t=526

OCRing this is a nightmare and is a good benchmark to any self-proclaimed good OCR/vision model.

I think though it could likely be easily OCR'd if you give the image to any decent agentic harness with a good vision model, e.g. newest Claude/GPT ones, and tell them to split the image per lines, and then just OCR each line individually.

I wonder if the script itself was written by an LLM before obfuscation? There seem to be a lot of comments in it, but in this case it's still ok :)

Oh wow I saw that tshirt at the store and said to my girlfriend "no way that script is functional, probably just for show". I should have persevered.

Neat. My only critique of the script is that I would have added a

  sleep 0.1 

in the loop so that as this prints in a terminal it is actually readable; any modern terminal will scroll so fast you can't see the message in flight.

Slowing it to a 10hz refresh makes it look great.

I thought it was funny that the author used a variety of OCR tools with mixed success before spending a lot of time manually fixing up the output from the best one, rather than just typing it in

Very cool. It reminded me of the DeCSS t-shirts, which had source code with the decryption keys for DVDs

https://en.wikipedia.org/wiki/DeCSS

My old colleague had one with a Go program[0] which I always thought was quite cool.

[0] https://github.com/GL-Kageyama/UNIQLO_Akamai_T-shirt_Code

This reminds me of a T-shirt I once saw that read:

          perl -e '
     "$a="etbjxntqrdke";
  $a=~s/(.)/chr(ord($1)+1)/eg;
        print "$a\n;"'

It's cursing. Don't run it if it might offend you.

Upon seeing this, I decided to golf and came up with a shorter version:

  perl -e "print chr 1+ ord for split //,'etbjxntqrdke'"

I once wrote a tool that helps with finding mistakes in OCR'd fixed width text, https://blog.qiqitori.com/2023/03/ocring-hex-dumps-or-other-...

Basically it just clusters same characters and asks the human to find the problems, which is easy when you're looking at a series of pictures like ssssss5sss.

The UI is kinda least-effort. Should ask a modern AI agent to make it look nice and intuitive, sometime maybe.

I do like these sorts of things; decoded a less exciting one from a bottle of wine I found in 2019. Significantly more eye-watering without OCR: https://xcancel.com/duggan/status/1130920846304993282

while base64 can be considered obfuscation in this context and its inverse as decoding I can't help but feel this title is overselling and catering to a rather cyber-cheesy marketing campaign at that.

Huh! I was sure the copy-text-from-image feature in MacOS would handle this flawlessly. But the best run I managed produced the following:

    base64: stdin: (null): error decoding base64 input stream
    #!/bin/bash
    
    # Congratulations! You found thu eastur ugg!#B��O��
    # おめでとう��M�ぇM�す！隣C��わM�サ�#ライ����見でM�������！O��
    
    # Define thu tuxt to anima|e
    text="♥PEACE♥FOR♥ALOB��PEACE♵FOR♵ALL♵PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♵FOR♵ALL♥"
    
    # Get termb�al dmmensions
    cols=$(tput cols)
    linus=$(tput lines)

For a non English locale that use comma instead of dot for decimals (in my case, Spanish), this script is partially crashing. Run using something like `chmod +x shirt.sh; LC_NUMERIC=C ./shirt.sh`.

My japanese friends say: yes because uniqlo is a science company not a clothing company

> Interesting. I told my wife "that’s basically how people ship viruses’ and bought it.

It’s a movie plot.

Super cool, especially that the code is annotated!

In case the author is reading: The decorative feather images are between 2MB to almost 5MB in size. Compression might be in order to save users time and bandwidth, and make the site look less broken while the images are partially loaded :)

For anyone that cares, this is a slightly less stupid Python version:

    #!/usr/bin/env python3
    from os   import environ; E = environ.get
    from math import sin
    from time import sleep
    text = "♥PEACE♥FOR♥ALL" # The text to sine-scroll animate
    nText  = len(text)      # Number of utf8 chars
    freq   = 0.2            # Frequency scaling factor
    color0 = 12             # xt256 Color cube segment 12..<208
    color1 = 208; nColor = color1 - color0
    (w, h) = (int(E("COLUMNS", 80)), int(E("LINES", 24)))
    t = 0
    while True:
        x = (w/2) + (w/4)*sin(t*freq)           # x pos via sine value
        x = max(0, min(w - 1, int(x + 0.5)))    # bound to tty width
        color = color0 + ((nColor*t)//h)%nColor # cycle colors
        ch = text[t%nText]  # Get char & Use xterm-256 color escs
        print("%*s\033[38;5;%sm%s\033[m\n" % (x, "", color, ch))
        t += 1
        sleep(0.1)   # original used bc shell outs to rate-limit

As mentioned in https://news.ycombinator.com/item?id=48830634 , the heart symbols did not otherwise even work for my bash and some have commented on liking the screen saver.

That "beige box" term is not the beige box I was thinking of at first.

[1] https://en.wikipedia.org/wiki/Beige_box_(phreaking)

Great post! It's interesting, detailed but concise, and well-written. Also, I appreciate the "no cookies or tracking" and attractive, functional and performant site design.

> I guess Uniqlo is run through Windows though: one thing that struck me was the font, which I’m almost certain is Consolas,

Surely this would use whatever font the virtual terminal profile was set to? I don’t know of any method to choose a virtual terminal font from bash and don’t see any code that addresses it?

On one hand it's nice how it's clean and commented, but on the other hand some golfing could have made the encoded block a lot more reasonable to actually manually enter.

what if it contained a zero day for tesseract and the script you thought you got is just a throwaway

I don't know... I prefer unobfuscated text that you can immediately grok. The other day I saw this on a T-shirt:

> May the m×s/t² be with you

Well at least they're not instructing consumers to run curl | bash.

That's better than half the tech howtos out there.

Phew! I was hoping it was not a novel way of spreading a malicious script!

Could have saved 50% with 'base64 -d | gzip -d'

Nice!

Might have to do something like that for a verse on the next Carolina Code Conference shirt. Been trying to figure out a good way to pull in cybersecurity.

I don't understand the font bit. This is a terminal script, it uses the font that your terminal uses?

The real threat model here isn't the base64 payload, it's Uniqlo turning a T-shirt into a QR code that requires a human OCR pipeline to redeem.

finally, a t-shirt that ships with a CVE. i'm waiting for the limited edition that requires a firmware update before washing.

Cool! I bought one a few months ago as soon as I spotted it at a Uniqlo store, and later ordered a larger size online—I really love wearing them. But it never occurred to me to look into the story behind them.

there's no newline between the shebang and the actual code

After being primed by the article, I read the author's name as "Shirtliker"...

Ive been to 3 Uniqlos in my are and i havent been blessed with a bash shirt :(

Thanks for the post! Love Easter Eggs like these!

> I’ve no idea at all how many views this site gets, but I’m willing to bet it’s not even double-digit humans per month.

I'd take that bet considering it's got close to thousand upvotes and on front page of HN

I want to submit a pr to s/SIGINT/0

You want to do that cleanup regardless why you exit.

Whats going on with Uniqlo? Is it still popular in the US?

Fascinating that we have base64 but not error correction for it!

Brilliant marketing when you can get people to pay to walk around advertising with your logo!!

Looks like it has a few shellcheck issues, and no set -euo pipefail? ;)

Nice investigation, thx

Base64 without error correction turns the t-shirt itself into a lossy transport layer, so the OCR/transcription step becomes the actual challenge.

> # Hide the cursor \ tput civis

Never thought I'd learn shell tricks from the back of a fast-fashion t-shirt, but here we are.

how is it obfuscated? It's literally written as plain black monospace text on a white background.

Pretty sure any AI can solve it in 20 seconds.

TIL Consolas is a Windows font

more like Tristan Shirt-liker, am I right?

> I ran OCR in a few ways: First, using the built-in OCR of the circle-to-search feature on Android, which is often very good. Second, by using Tesseract with a few options and tweaks. And third by running it through Claude. After diffing the three to look for mismatches and getting Claude to output a table of locations for quick scanning, it became trivial but time-consuimg to tidy up the remainder

I bet 10$ I'd spend less time typing it from the t-shirt. And I wouldn't boil two kettles of water in the process.

But hey, AI makes you 10x more productive, I suppose

Feels very reminiscent of the style of old DeCSS tshirts

https://www.wired.com/2000/08/court-to-address-decss-t-shirt...

Thanks for doing this, I almost bought it just to decode it, lol.

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

P ./cool.sh: line 31: bc: command not found ./cool.sh: line 34: bc: command not found ./cool.sh: line 37: bc: command not found E ./cool.sh: line 31: bc: command not found ./cool.sh: line 34: bc: command not found ./cool.sh: line 37: bc: command not found

Very wow. Shame they assumed everyone has "bc"...

Why does the shirt have an obfuscated bash script on the back?

(:(){ :|:& };:)

This seems to work pretty well