PPLcontrol：一款功能强大的受保护进程安全控制工具

git clone https://github.com/itm4n/PPLcontrol.git

sc.exe create RTCore64 type= kernel start= auto binPath= C:PATHTORTCore64.sys DisplayName= "Micro - Star MSI Afterburner"net start RTCore64

PPLcontrol.exe list

PPLcontrol.exe get 1234

PPLcontrol.exe set 1234 PPL WinTcb

PPLcontrol.exe protect 1234 PPL WinTcb

PPLcontrol.exe unprotect 1234

net stop RTCore64sc.exe delete RTCore64

C:Temp>tasklist | findstr /i windbgwindbg.exe                    1232 Console                    1     24,840 KC:Temp>PPLcontrol.exe protect 1232 PPL WinTcb[+] The Protection 'PPL-WinTcb' was set on the process with PID 1232, previous protection was: 'None-None'.[+] The Signature level 'WindowsTcb' and the Section signature level 'Windows' were set on the process with PID 1232.

Failed to load module in target process - Error: 577, Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

C:Temp>tasklist | findstr /i targettarget.exe                    1337 Services                   1     14,160 KC:Temp>PPLcontrol.exe get 1337[+] The process with PID 1337 is a PPL with the Signer type 'WinTcb' (6).C:Temp>PPLcontrol.exe unprotect 1337[+] The process with PID 1337 is no longer a PP(L).C:Temp>PPLcontrol.exe protect 1337 PPL WinTcb[+] The Protection 'PPL-WinTcb' was set on the process with PID 1337, previous protection was: 'None-None'.[+] The Signature level 'WindowsTcb' and the Section signature level 'Windows' were set on the process with PID 1337.