Hi Jymm 
Yes,
It starts with a function definition, redefining the command ‘:’
Everything between the braces is executed when the function is called.
Let’s first change the function name from ‘:’ to ‘bomb’ to make it more readable.
The first line is the function definition
bomb()
{
bomb | bomb &
}
bomb
Here is how it works:
Let’s first take a look at the payload of the function ‘bomb()’
what does bomb | bomb & mean or do ?
what it literally means:
- start function ‘bomb’
- pipe the output to another (on the spot created ) instance of the function ‘bomb’
- run this in the background
What it does:
It starts the function bomb and sends the output to another instance of bomb via pipe and puts it in the background, thereby giving it its own process and environment space.
We have now two processes ‘bomb’ running
-
They will never finish because the second instance of bomb is waiting for the first one to send something (i.o.w. read-locked) so they never exit.
-
we now have two functions in a separate process (subshell) which takes up space
-
In the meantime each “bomb” command is calling … itself
Thereby putting new copies of itself in new background processes … in an endless recursive loop.
The last ‘bomb’ command is actually the command that starts it all.