Geedge's shared build-environment Docker image (MESA_Platform/build-env) bakes in a binary "shelling"/packing step for TSG executables and shared libraries, configurable via a "die_at_expiration" option (self-destruct on license/time expiration) read from a config file, and a separate commit explicitly strips --debug/--memdump flags from packed production binaries.
加壳时从配置文件中读取参数，并启用die_at_expiration选项 程序加壳时删除 --debug --memdump 参数
Defense implications
- Field-seized or leaked TSG binaries should be expected to be packed with anti-debugging/anti-dump protections and a time-based self-destruct, complicating static/dynamic analysis of captured appliances -- researchers should budget for unpacking effort and watch for license-expiry triggers that could wipe evidence.
capabilitydeployment-config