{"adoption": {"forks": 144, "observed_at": "2026-09-03T02:15:06.627959+00:00", "stars": 999}, "canonical_url": "https://ross.abutalabs.com/products/pplkiller", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Protected Processes Light Killer", "domain": ["security", "developer-tools", "operating-systems"], "enriched": true, "function": ["security"], "health_score": 20, "homepage": null, "language": "C++", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "maintenance", "member_repos": ["Mattiwatti/PPLKiller"], "name": "Mattiwatti/PPLKiller", "platform": ["windows"], "pushed_at": "2023-03-24T17:12:47+00:00", "repo": "Mattiwatti/PPLKiller", "stars": 999, "tags": ["kernel-driver", "ppl", "patchguard", "reverse-engineering", "windows-kernel", "debugging"], "topics": ["process", "protection", "kernel", "driver", "debugging", "csrss"], "urls": [], "use_cases": ["disable protected process light on all running processes", "debug protected Windows processes like csrss.exe", "remove binary signature policy mitigation for code injection", "inspect PPL-protected process memory with a kernel debugger", "research Windows kernel process protection mechanisms"], "what_it_is": "PPLKiller is a Windows kernel-mode driver that removes Protected Process Light (PPL) protection from all running processes on Windows 8.1 and 10. It is aimed at debugging scenarios where PPL restrictions on processes like csrss.exe and smss.exe block access, and also disables the binary signature policy mitigation on newer Windows builds.", "when_to_avoid": ["you need a supported, production-safe tool on modern Windows 10/11 builds", "you cannot attach a kernel debugger or disable PatchGuard, since a bugcheck will occur", "you want to keep LSA and other security-critical processes protected"], "when_to_choose": ["you need to debug or inspect PPL-protected processes on Windows 8.1/10", "you run a kernel debugger or can disable PatchGuard via tools like EfiGuard", "you are doing Windows security research in a controlled test environment"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/pplkiller", "repo": "Mattiwatti/PPLKiller", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-09-03T02:15:06.627959+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T07:13:56.383221+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b51988dfda77855e62dc235f948291c2a217e1facfeece201f85363b254b0e8a", "fetched_at": "2026-09-03T02:15:06.627959+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mattiwatti/PPLKiller"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3492, "days_push": 1258, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 3, "stale_scrape": false}}