I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended state then performs DLL injection using the
createremotethread API. The DLL is loaded and the code is successfully executed.
I'd like the injected code to patch the executable so that it hooks certain API calls. Eventually I'd like to find code caves but I'm currently just allocating virtual memory (
virtualalloc). I'd like to do this using just Python. Is this possible?
I imagine since it can be done in C it can be accomplished using Python's C-Types. In my research I've seen people use
DiStorm for certain parts of this, but again I'd like to use Python. I understand that this has been done before but I'd like to code something up as a learning exercise. Looking for some direction and any guidance is welcomed.