DFMI

DFMI (Don't Fool My Installer) is a toolkit designed for fileless code execution and covert payload delivery via Windows Installer (.msi) files, exploiting the CustomAction mechanism to execute arbitrary payloads silently during installation. Notable features include the ability to inject backdoors into both signed and unsigned MSI packages without altering their signatures, support for cross-platform payload generation, and functionalities for SSL encryption and IPv6. This tool is intended for authorized red team engagements and penetration testing only.