Package: pyjectify
PyJectifyA Python library for memory manipulation, code injection and function hooking.Quick startPyJectify is available onPyPI.Alternatively, you can download releases from GitHub or clone the project.Documentation is available athttps://petitoto.github.io/pyjectify/FeaturesWindows (x86 & x86_64)CoreAllocate / Free / Read / Write memoryCreate threadsList loaded modulesPE parserUse kernel32 or ntdll functionsModulesMemScan: scan memory using regex patternsInject: load library, from disk (remote LoadLibrary) or from memory (fully map the DLL into the remote process)Hook: set up inline hooks in the target processPythonLib: embed python into a remote process (Python 3.6 - 3.11 supported)UtilsSyscall: parse syscall codes from ntdll.dll (from the loaded library or from the disk), and produce a ntdll-like object which can be used by the core to use direct syscallsApiSetSchema: parse Windows ApiSetExamplesMemory search & basic operationsimportpyjectify# Open notepad process (only the first found if multiple instances of notepad are running)notepad=pyjectify.byName('Notepad.exe')[0]# Use the pattern "secret( is)?: (.){10}", but encoded in utf-16-le because Notepad uses wchar_twords=['secret',' is',': ','.']pattern=b'%b(%b)?%b(%b){10}'%tuple(e.encode('utf-16-le')foreinwords)# Search for the secret in notepad's memoryaddrs=notepad.memscan.scan(pattern)# Process found addressesforaddrinaddrs:secret=notepad.process.read(addr,50).decode('utf-16-le')print('[+] Found secret:',secret)notepad.process.write(addr,('*'*len(secret)).encode('utf-16-le'))# let's hide the secret!# Reset memscan to perform a new search regardless of the previous scannotepad.memscan.reset()Python code injectionimportpyjectify# Open notepad processnotepad=pyjectify.byName('Notepad.exe')[0]# Inject Python DLLnotepad.pythonlib.python_mod=notepad.inject.load_library("C:\\path\\to\\python-embed\\python311.dll")# Run some Python code from notepadnotepad.pythonlib.initialize()notepad.pythonlib.exec('import os; os.system("calc.exe")')# Undo all initializationsnotepad.pythonlib.finalize()Setup an inline hook written in Pythonimportpyjectify# Open notepad process & inject Python DLLnotepad=pyjectify.byName('Notepad.exe')[0]notepad.pythonlib.python_mod=notepad.inject.load_library("C:\\path\\to\\python-embed\\python311.dll")notepad.pythonlib.initialize()# Let's hook GetClipboardData!# Step 1: define our new functionpycode="""import ctypesdef GetClipboardData(uFormat:ctypes.c_uint) -> ctypes.c_void_p:ctypes.windll.user32.MessageBoxW(0, "I hooked you :D", "MyNewGetClipboardData", 0)return o_GetClipboardData(uFormat)"""notepad.pythonlib.exec(pycode)# Step 2: get original function address and setup a trampoline (of 15 bytes size)user32=notepad.process.get_module('user32.dll')oaddr=user32.exports['GetClipboardData']+user32.base_addrtrampoline_addr=notepad.hook.trampoline(oaddr,15)# Step 3: prepare Python function hooking, ie create o_GetClipboardData and get ou Python GetClipboardData addresshook_addr=notepad.pythonlib.prepare_hook('GetClipboardData',trampoline_addr)# Step 4: inline hooknotepad.hook.inline(oaddr,hook_addr)Advanced DLL injectionimportpyjectify# Open processesproc1=pyjectify.byName('proc1.exe')[0]proc2=pyjectify.byName('proc2.exe')[0]# Extract a library from proc1's memorymodule=proc1.process.get_module('module.dll')[0]# Extract common syscalls from ntdll.dll and wrap them into a ntdll-like objectsyscall=pyjectify.windows.Syscall()syscall.get_common(from_disk=True)# Use direct syscalls to operate on proc2 (memory read / write / protect, thread creation...)proc2.process.ntdll=syscall# Inject the module directly from memory into proc2, at a random location and without copying PE headersproc2.inject.memory_loader(module,prefer_base_addr=False,copy_headers=False)