Locked PythonMemoryModule: load dll and unmanaged exe entirely from memory

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory

PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim Bauch. It can load a dll or unmanaged exe using Python without requiring the use of an external library (pyd). It leverages pefile to parse PE headers and ctypes.

The tool was originally thought to be used as a Pyramid module to provide evasion against AV/EDR by loading dll/exe payloads in python.exe entirely from memory, however, other use-cases are possible (IP protection, pyds in-memory loading, spinoffs for other stealthier techniques) so I decided to create a dedicated repo.

This is the hidden content, please

• Sign In
• or
• Sign Up