From c676f20717c2e2ee256e2a5f87b402d5f7d7e250 Mon Sep 17 00:00:00 2001 From: naksyn <59816245+naksyn@users.noreply.github.com> Date: Thu, 27 Jul 2023 16:04:11 +0200 Subject: [PATCH] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 0ca553b..d461870 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,7 @@ pure-python implementation of MemoryModule technique to load a dll or unmanaged # What is it PythonMemoryModule is a Python ctypes porting of the [MemoryModule](https://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/) technique originally published by [Joachim Bauch](https://github.com/fancycode/MemoryModule). It can load a dll or unmanaged exe using Python without requiring the use of an external library (pyd) and has (partial) support for commandline parameters passing. + It leverages [pefile](https://github.com/erocarrera/pefile) to parse PE headers, [PythonForWindows](https://github.com/hakril/PythonForWindows) to access process parameters, and ctypes for the heavy lifting. The tool was originally thought to be used as a [Pyramid](https://github.com/naksyn/Pyramid/) module to provide evasion against AV/EDR by loading dll/exe payloads in python.exe entirely from memory, however other use-cases are possible (IP protection, pyds in-memory loading, spinoffs for other stealthier techniques) so I decided to create a dedicated repo.