This repository was archived by the owner on Sep 21, 2024. It is now read-only.
BranchesTags

Repository files navigation

PPLdump

⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.

This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.

I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.

Usage

Simply run the executable without any argument and you will get a detailed help/usage.

c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp

FAQ

Does it work on all versions of Windows?

First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.

How is it different from other tools?

Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.

"Userland", you say?!

This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.

Is it really "fileless"?

Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).

Can this tool cause a DoS?

Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.

Tests

Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️

⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.

[-] DefineDosDevice failed with error code 6 - The handle is invalid.

⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).

Build instructions

This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.

  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.

On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.

  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.

Credits

About

Dump the memory of a PPL with a userland exploit

Resources

Readme
MIT license
Activity

Stars

890 stars

Watchers

1 watching

Forks

141 forks
Report repository

Releases

Packages

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content

This repository was archived by the owner on Sep 21, 2024. It is now read-only.

BranchesTags
Repository files navigation
PPLdump
⚠️2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 (July 2022 update), the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here.
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.
I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.
Usage
Simply run the executable without any argument and you will get a detailed help/usage.
c:\Temp>PPLdump64.exe _____ _____ __ _| _ | _ | | _| |_ _ _____ ___| __| __| |__| . | | | | . | version 0.4|__| |__| |_____|___|___|_|_|_| _| by @itm4n |_|Description: Dump the memory of a Protected Process Light (PPL) with a *userland* exploitUsage: PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>Arguments: PROC_NAME The name of a Process to dump PROC_ID The ID of a Process to dump DUMP_FILE The path of the output dump fileOptions: -v (Verbose) Enable verbose mode -d (Debug) Enable debug mode (implies verbose) -f (Force) Bypass DefineDosDevice error checkExamples: PPLdump.exe lsass.exe lsass.dmp PPLdump.exe -v 720 out.dmp
FAQ
Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows versionBuildEditionArchAdminSYSTEM
Windows 10 20H219042Prox64✔️✔️
Windows 10 20H219042Prox86✔️✔️
Windows 10 190918363Prox64✔️✔️
Windows 10 150710240Educationalx64✔️✔️
Windows 10 150710240Homex64✔️✔️
Windows 10 150710240Prox64✔️✔️
Windows Server 201917763Standardx64✔️✔️
Windows Server 201917763Essentialsx64✔️✔️
Windows 8.19600Prox64⚠️⚠️
Windows Server 2012 R29600Standardx64⚠️⚠️
⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error.
[-] DefineDosDevice failed with error code 6 - The handle is invalid.
⚠️ On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).
Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable.
  1. Open the Solution with Visual Studio 2019.
  2. Select Release / x64 or Release / x86 depending on the architecture of the target machine.
  3. Build > Build Solution.
On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically.
  1. Right-click on the PPLdump project.
  2. Go to Configuration Properties > C/C++ > Code Generation.
  3. Select Multi-threaded (/MT) as the Runtime Library option.
  4. Build the Solution.
Credits
About
Dump the memory of a PPL with a userland exploit
Resources
Readme
MIT license
Activity
Stars
890 stars
Watchers
1 watching
Forks
141 forks
Report repository
Releases
Packages
Used by
Contributors
Languages