I had no idea you could do this sort of stuff, it honestly scares me a bit, but is cool, kudos.

FWIW you can get away with a lot from sh with the help of perl (arbitrary syscalls) and debuggers (like gdb, breakpoint and change return values or just call any function). In solaris it's particularly easy with truss and the p* commands.