Created
October 27, 2023 20:39
-
-
Save wsummerhill/fcaa8cf107398cb026f8677c5cb7ac53 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Original source: https://github.com/njcve/inflate.py/tree/main | |
| # File inflator to incease size of payload to help bypass AV/EDR | |
| import sys | |
| import struct | |
| import argparse | |
| import shutil # file copy | |
| def main(args=sys.argv[1:]): | |
| parser = argparse.ArgumentParser(description='PE file inflator - Inflates file with null bytes at the end of file') | |
| parser.add_argument("-file", "-f", help="Target PE file to inflate (EXE, DLL, etc.)") | |
| parser.add_argument("-output", "-o", help="Output file to write inflated PE to") | |
| parser.add_argument("-size", "-s", help="Size in MB to inflate binary by (default = 10 mb)", default="10", type=int) | |
| args = parser.parse_args(args) | |
| inputFile = args.file | |
| output = args.output | |
| size = args.size | |
| # Check input parameters | |
| if not inputFile or not output: | |
| print("""[ERROR] - Enter an input and output file.\n | |
| Usage: | |
| python -f payload.exe -o outfile.exe -s 100 # Inflate an EXE 100 mb | |
| python -f library.dll -o outlibrary.dll -s 250 # Inflate a DLL 250 mb | |
| """) | |
| sys.exit() | |
| # Do inflation | |
| inflate(inputFile, output, size) | |
| # Inflation function | |
| def inflate(file, outfile, size): | |
| print(f"[!] Inflating {file} by {size} mb") | |
| shutil.copyfile(file, outfile) | |
| blank_bytes = struct.pack('B', 0) | |
| transformer = open(outfile, 'ab') | |
| transformer.write(blank_bytes * 1024 * 1024 * size) | |
| transformer.close() | |
| print(f"[!] Inflating file by {size} megabytes") | |
| print(f"[!] Operation Complete. Written to output file '{outfile}'\n") | |
| ########################################################################### | |
| if __name__ == '__main__': | |
| main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment