2 papers
cs.CR2021
An In-memory Embedding of CPython for Offensive Use
Ateeq Sharfuddin, Brian Chapman, Chris Balles
We offer an embedding of CPython that runs entirely in memory without "touching" the disk. This in-memory embedding can load Python scripts directly from memory instead these scrip…
cs.CR2019
Breaking Imphash
Chris Balles, Ateeq Sharfuddin
There are numerous schemes to generically signature artifacts. We specifically consider how to circumvent signatures based on imphash. Imphash is used to signature Portable Executa…