Mattiwatti/PPLKiller

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

999 stars · 144 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PPLKiller is a Windows kernel-mode driver that removes Protected Process Light (PPL) protection from all running processes on Windows 8.1 and 10. It is aimed at debugging scenarios where PPL restrictions on processes like csrss.exe and smss.exe block access, and also disables the binary signature policy mitigation on newer Windows builds.

Use cases

• disable protected process light on all running processes
• debug protected Windows processes like csrss.exe
• remove binary signature policy mitigation for code injection
• inspect PPL-protected process memory with a kernel debugger
• research Windows kernel process protection mechanisms

When to choose

• you need to debug or inspect PPL-protected processes on Windows 8.1/10
• you run a kernel debugger or can disable PatchGuard via tools like EfiGuard
• you are doing Windows security research in a controlled test environment

When to avoid

• you need a supported, production-safe tool on modern Windows 10/11 builds
• you cannot attach a kernel debugger or disable PatchGuard, since a bugcheck will occur
• you want to keep LSA and other security-critical processes protected

Facets

cli-tool · maturity maintenance

security security developer-tools operating-systems windows kernel-driver ppl patchguard reverse-engineering windows-kernel debugging

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Mattiwatti/PPLKiller")