ongyuann / PPLDescribe

Tool for obtaining information about PPL processes

PPLDescribe

With PPLDescribe, you can retrieve information about processes that are protected by PPL. The tool parses PS_PROTECTION, PS_PROTECTED_TYPE and PS_PROTECTED_SIGNER structures to retrieve the information

Usage:

    ____  ____  __    ____                      _ __
   / __ \/ __ \/ /   / __ \___  _______________(_/ /_  ___
  / /_/ / /_/ / /   / / / / _ \/ ___/ ___/ ___/ / __ \/ _ \
 / ____/ ____/ /___/ /_/ /  __(__  / /__/ /  / / /_/ /  __/
/_/   /_/   /_____/_____/\___/____/\___/_/  /_/_.___/\___/

                https://github.com/MzHmO
Usage:
[Show info by PID] PPLDescriber.exe -p <PID>
        Ex: PPLDescriber.exe -p 123
[Show info by process name] PPLDescriber.exe -n <Process Name>
        Ex: PPLDescriber.exe -n lsass.exe