diff --git a/Misc/NEWS b/Misc/NEWS
index 2e7297a..5159bf2 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -24,6 +24,9 @@
 Extensions
 ----------
 
+- Issue #5504 - ctypes should now work with systems where mmap can't
+  be PROT_WRITE and PROT_EXEC.
+
 - Issue #9507:  Named tuple repr will now automatically display the right
   name in a tuple subclass.
 
diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
index 09e202e..1f4c6a9 100644
--- a/Modules/_ctypes/_ctypes.c
+++ b/Modules/_ctypes/_ctypes.c
@@ -3353,7 +3353,7 @@
     self->callable = callable;
 
     self->thunk = thunk;
-    *(void **)self->b_ptr = (void *)thunk->pcl;
+    *(void **)self->b_ptr = (void *)thunk->pcl_exec;
 
     Py_INCREF((PyObject *)thunk); /* for KeepRef */
     if (-1 == KeepRef((CDataObject *)self, 0, (PyObject *)thunk)) {
diff --git a/Modules/_ctypes/callbacks.c b/Modules/_ctypes/callbacks.c
index 4c9c013..8e137a0 100644
--- a/Modules/_ctypes/callbacks.c
+++ b/Modules/_ctypes/callbacks.c
@@ -16,8 +16,8 @@
     Py_XDECREF(self->converters);
     Py_XDECREF(self->callable);
     Py_XDECREF(self->restype);
-    if (self->pcl)
-        _ctypes_free_closure(self->pcl);
+    if (self->pcl_write)
+        ffi_closure_free(self->pcl_write);
     PyObject_GC_Del(self);
 }
 
@@ -338,7 +338,8 @@
         return NULL;
     }
 
-    p->pcl = NULL;
+    p->pcl_exec = NULL;
+    p->pcl_write = NULL;
     memset(&p->cif, 0, sizeof(p->cif));
     p->converters = NULL;
     p->callable = NULL;
@@ -368,8 +369,9 @@
 
     assert(CThunk_CheckExact((PyObject *)p));
 
-    p->pcl = _ctypes_alloc_closure();
-    if (p->pcl == NULL) {
+    p->pcl_write = ffi_closure_alloc(sizeof(ffi_closure),
+									 &p->pcl_exec);
+    if (p->pcl_write == NULL) {
         PyErr_NoMemory();
         goto error;
     }
@@ -414,7 +416,9 @@
                      "ffi_prep_cif failed with %d", result);
         goto error;
     }
-    result = ffi_prep_closure(p->pcl, &p->cif, closure_fcn, p);
+    result = ffi_prep_closure_loc(p->pcl_write, &p->cif, closure_fcn,
+				  p,
+				  p->pcl_exec);
     if (result != FFI_OK) {
         PyErr_Format(PyExc_RuntimeError,
                      "ffi_prep_closure failed with %d", result);
diff --git a/Modules/_ctypes/ctypes.h b/Modules/_ctypes/ctypes.h
index 0af5fa1..27abe65 100644
--- a/Modules/_ctypes/ctypes.h
+++ b/Modules/_ctypes/ctypes.h
@@ -58,7 +58,8 @@
 
 typedef struct {
     PyObject_VAR_HEAD
-    ffi_closure *pcl; /* the C callable */
+    ffi_closure *pcl_write; /* the C callable, writeable */
+    void *pcl_exec;         /* the C callable, executable */
     ffi_cif cif;
     int flags;
     PyObject *converters;
diff --git a/Modules/_ctypes/libffi/fficonfig.py.in b/Modules/_ctypes/libffi/fficonfig.py.in
index b7bae9c..27c971f 100644
--- a/Modules/_ctypes/libffi/fficonfig.py.in
+++ b/Modules/_ctypes/libffi/fficonfig.py.in
@@ -1,5 +1,7 @@
 ffi_sources = """
 src/prep_cif.c
+src/closures.c
+src/dlmalloc.c
 """.split()
 
 ffi_platforms = {
diff --git a/Modules/_ctypes/libffi_msvc/ffi.c b/Modules/_ctypes/libffi_msvc/ffi.c
index 763d179..65581a7 100644
--- a/Modules/_ctypes/libffi_msvc/ffi.c
+++ b/Modules/_ctypes/libffi_msvc/ffi.c
@@ -371,10 +371,11 @@
 extern void ffi_closure_OUTER();
 
 ffi_status
-ffi_prep_closure (ffi_closure* closure,
-		  ffi_cif* cif,
-		  void (*fun)(ffi_cif*,void*,void**,void*),
-		  void *user_data)
+ffi_prep_closure_loc (ffi_closure* closure,
+					  ffi_cif* cif,
+					  void (*fun)(ffi_cif*,void*,void**,void*),
+					  void *user_data,
+					  void *codeloc)
 {
   short bytes;
   char *tramp;
@@ -452,6 +453,5 @@
   closure->cif  = cif;
   closure->user_data = user_data;
   closure->fun  = fun;
-
   return FFI_OK;
 }
diff --git a/Modules/_ctypes/libffi_msvc/ffi.h b/Modules/_ctypes/libffi_msvc/ffi.h
index a88d874..efb14c5 100644
--- a/Modules/_ctypes/libffi_msvc/ffi.h
+++ b/Modules/_ctypes/libffi_msvc/ffi.h
@@ -221,11 +221,15 @@
   void      *user_data;
 } ffi_closure;
 
+void ffi_closure_free(void *);
+void *ffi_closure_alloc (size_t size, void **code);
+
 ffi_status
-ffi_prep_closure (ffi_closure*,
+ffi_prep_closure_loc (ffi_closure*,
 		  ffi_cif *,
 		  void (*fun)(ffi_cif*,void*,void**,void*),
-		  void *user_data);
+		  void *user_data,
+		  void *codeloc);
 
 typedef struct {
   char tramp[FFI_TRAMPOLINE_SIZE];
diff --git a/Modules/_ctypes/malloc_closure.c b/Modules/_ctypes/malloc_closure.c
index ae857a2..519941b 100644
--- a/Modules/_ctypes/malloc_closure.c
+++ b/Modules/_ctypes/malloc_closure.c
@@ -89,7 +89,7 @@
 /******************************************************************/
 
 /* put the item back into the free list */
-void _ctypes_free_closure(void *p)
+void ffi_closure_free(void *p)
 {
     ITEM *item = (ITEM *)p;
     item->next = free_list;
@@ -97,7 +97,7 @@
 }
 
 /* return one item from the free list, allocating more if needed */
-void *_ctypes_alloc_closure(void)
+void *ffi_closure_alloc(size_t ignored, void** codeloc)
 {
     ITEM *item;
     if (!free_list)
@@ -106,5 +106,7 @@
         return NULL;
     item = free_list;
     free_list = item->next;
-    return item;
+	*codeloc = (void *)item;
+    return (void *)item;
 }
+
diff --git a/setup.py b/setup.py
index ef6f2f6..ac37aa9 100644
--- a/setup.py
+++ b/setup.py
@@ -1639,8 +1639,7 @@
                    '_ctypes/callbacks.c',
                    '_ctypes/callproc.c',
                    '_ctypes/stgdict.c',
-                   '_ctypes/cfield.c',
-                   '_ctypes/malloc_closure.c']
+                   '_ctypes/cfield.c']
         depends = ['_ctypes/ctypes.h']
 
         if sys.platform == 'darwin':