ulexecve VS PythonMemoryModule

Compare ulexecve vs PythonMemoryModule and see what are their differences.

ulexecve

ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries ever having to touch storage. This is useful for red-teaming and anti-forensics purposes. (by anvilsecure)
userland execve Redteaming redteam-tools antiforensics python-hacking-tools
Source Code
anvilsecure.com
Suggest alternative
Edit details

PythonMemoryModule

pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory (by naksyn)
edr-evasion evasion Hacking memory-module memorymodule Python Redteam redteam-tools Redteaming runpe
Source Code
Suggest alternative
Edit details
InfluxDB
Our great sponsors
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • WorkOS - The modern identity platform for B2B SaaS
  • SaaSHub - Software Alternatives and Reviews
Our great sponsors
ulexecve PythonMemoryModule
2 4
169 277
1.2% -
5.2 4.9
4 months ago 5 months ago
Python Python
BSD 3-clause "New" or "Revised" License Apache License 2.0
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.

ulexecve

Posts with mentions or reviews of ulexecve. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-11-02.
  • Can I exec an new process without an executable file? (2015)
    3 projects | news.ycombinator.com | 2 Nov 2022
    Definitely tricky. I solved it with a Python implementation by building up a big jumpbuffer so that the moment I leave Python-land I copy from temporary buffers to the right addresses and then ultimately jump at the entry point of the newly loaded binary. It's tricky and took quite some debugging to get right, but it's proven rather solid now.

    See https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.p... for details. Especially the `CodeGenerator` classes with implementations in x86, x86-64 and aarch64.

PythonMemoryModule

Posts with mentions or reviews of PythonMemoryModule. We have used some of these posts to build our list of alternatives and similar projects.

What are some alternatives?

When comparing ulexecve and PythonMemoryModule you can also consider the following projects:

Pyramid - a tool to help operate in EDRs' blind spots

gmailc2 - A Fully Undetectable C2 Server That Communicates Via Google SMTP to evade Antivirus Protections and Network Traffic Restrictions

systemd-user-sleep - Activate a user sleep target when the system sleeps

Metadata-Remover - A simple Metadata Removal Tool for images and videos using exiftool and ffmpeg in C and Python3.

HavocNotion - A simple ExternalC2 POC for Havoc C2. Communicates over Notion using a custom python agent, handler and extc2 channel. Not operationally safe or stable, built as a PoC to showcase Havoc C2's modular C2 channel interface.

byob - An open-source post-exploitation framework for students, researchers and developers.

mmLoader - A library for loading dll module bypassing windows PE loader from memory (x86/x64)

ulexecve vs Pyramid PythonMemoryModule vs gmailc2 ulexecve vs systemd-user-sleep PythonMemoryModule vs Pyramid ulexecve vs Metadata-Remover PythonMemoryModule vs HavocNotion ulexecve vs byob PythonMemoryModule vs mmLoader