# Mattiwatti/PPLKiller

Protected Processes Light Killer

Repository: https://github.com/Mattiwatti/PPLKiller
Canonical: https://ross.abutalabs.com/products/pplkiller
Language: C++
License: GPL-3.0
License Family: copyleft
Topics: process, protection, kernel, driver, debugging, csrss
Last push: 2023-03-24T17:12:47+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3492, "days_push": 1258, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 999, forks 144 (observed 2026-09-03T02:15:06.627959+00:00)

## What it is
PPLKiller is a Windows kernel-mode driver that removes Protected Process Light (PPL) protection from all running processes on Windows 8.1 and 10. It is aimed at debugging scenarios where PPL restrictions on processes like csrss.exe and smss.exe block access, and also disables the binary signature policy mitigation on newer Windows builds.

## Use cases
- disable protected process light on all running processes
- debug protected Windows processes like csrss.exe
- remove binary signature policy mitigation for code injection
- inspect PPL-protected process memory with a kernel debugger
- research Windows kernel process protection mechanisms

## When to choose
- you need to debug or inspect PPL-protected processes on Windows 8.1/10
- you run a kernel debugger or can disable PatchGuard via tools like EfiGuard
- you are doing Windows security research in a controlled test environment

## When to avoid
- you need a supported, production-safe tool on modern Windows 10/11 builds
- you cannot attach a kernel debugger or disable PatchGuard, since a bugcheck will occur
- you want to keep LSA and other security-critical processes protected

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security
- domain: security, developer-tools, operating-systems
- platform: windows
- tags: kernel-driver, ppl, patchguard, reverse-engineering, windows-kernel, debugging

## Member repositories
- Mattiwatti/PPLKiller (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:06.627959+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:13:56.383221+00:00, confidence not recorded.
  - readme: https://github.com/Mattiwatti/PPLKiller (fetched 2026-09-03T02:15:06.627959+00:00, sha b51988dfda77)
- Data as of 2026-08-30T08:39:29.467469+00:00.