-
Notifications
You must be signed in to change notification settings - Fork 2
/
create_dll_cli.py
59 lines (56 loc) · 1.95 KB
/
create_dll_cli.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# -*- coding: utf-8 -*-
from py_mal_dll.create_dll import DllCreator
import argparse
if __name__ == "__main__":
parser = argparse.ArgumentParser(
description="Create Side-loading dll for use with implants"
)
parser = argparse.ArgumentParser(
usage=r"python create_dll_cli.py --original-dll C:\Windows\System32\user32.dll --output-folder ./output"
)
parser.add_argument(
"--output-folder",
dest="output_folder",
action="store",
help="The output location",
required=True,
)
parser.add_argument(
"--original-dll",
dest="original_dll",
action="store",
help="The original dll",
required=True,
)
parser.add_argument(
"--function-name",
dest="function_name",
default="RedirectedExecution",
action="store",
help="The name given to the redirected funciton",
required=False,
)
parser.add_argument(
"--unique-export-functions",
dest="unique_export_functions",
action="store_true",
help="If true, creates a uniquely named function for each export - WARNING: This can create VERY large .c files.",
)
args = parser.parse_args()
creator = DllCreator(original_dll=args.original_dll, outfolder=args.output_folder,)
print("[+] Parsing DLL exports.")
creator.parse_exports()
print(
"[+] {} exports extracted.".format(len(creator.target_dll_exported_functions))
)
print("[+] Parsing DLL version info.")
creator.parse_version_info()
print("[+] Rendering output files.")
creator.render(
function_name_stem=args.function_name, unique_name=args.unique_export_functions
)
print(
'[+] Files output to "{}". Open "{}" with Visual Studio to get started, if you\'re using a different version you may ned to upgrade the project'.format(
creator.outfolder, creator.outfolder / "MaliciousDLL.vcxproj"
)
)