What is pplshade?

PPLShade is a Windows security research tool written in C that manipulates Protected Process Light (PPL) protections at the kernel level. PPL is a Windows feature that restricts which software can interact with sensitive system processes, including antivirus and endpoint detection tools. The project is aimed at security researchers and red teamers who study how these protections work or test whether they can be bypassed on systems they are authorized to test. The tool uses a technique called BYOVD, short for Bring Your Own Vulnerable Driver. This involves loading a legitimate but known-vulnerable kernel driver and using its memory access capabilities to read and write data inside the Windows kernel. Three specific drivers are included as supported options, each identified by its cryptographic hash. Once a driver is loaded, PPLShade can list all protected processes on the system along with their protection level and signer type, query the protection attributes of a specific process by its ID, change or remove those attributes, or terminate a protected process by first stripping its protection. Protection levels in Windows include PP (fully protected) and PPL (Protected Process Light), and each carries a signer type such as WinTcb, Lsa, or Antimalware that determines what can access it. PPLShade resolves kernel structure offsets dynamically at runtime rather than using hardcoded values, which helps it work across different builds of Windows 10 and 11. Building the project requires Visual Studio 2022 and the C++ latest language standard, because the memory address translation layer uses a modern C++ feature called std::expected. The resulting binary is a single standalone executable with no external library dependencies. A disclaimer in the README states the tool is intended for educational and authorized security research only, and that using it against systems you do not own or have explicit written permission to test is illegal.