Tool to bypass LSA Protection (aka Protected Process Light / PPL)

1. Writes the RTCore64.sys kernel driver to disk (byte array embedded via #load at compile time — no base64 decoding needed)
2. Enables SeLoadDriverPrivilege via AdjustTokenPrivileges
3. Installs and starts the RTCore64 kernel service
4. Opens \\.\RTCore64 device and uses DeviceIoControl to read/write physical memory
5. Walks the kernel EPROCESS linked list, finds lsass.exe, and zeroes its SignatureLevel → disables PPL
6. Cleans up: stops the service, deletes the driver file

No flags/parameters needed — runs fully automated.

Requires Odin (https://odin-lang.org) and Administrator privileges at runtime.

odin build pplkiller.odin -file -out:PPLKiller_Odin.exe

If the RTCore64.sys driver file is not present during compilation, place it at C:\Users\Public\Documents\RTCore64.sys first — the #load directive embeds it into the binary.

PPLKiller_Odin.exe

The PowerShell script embeds PPLKiller_Odin.exe (GZip-compressed + Base64) and runs it entirely from memory.

EPROCESS offsets are resolved at runtime via the CurrentBuild registry key (fallback: ReleaseId).

• Requires Administrator privileges (driver loading)
• On systems with HVCI / Memory Integrity or Secure Boot, the unsigned driver may be blocked
• The driver binary (RTCore64.sys) is embedded at compile time via Odin's #load directive — no external files needed at runtime
• After execution, the driver service and file are automatically cleaned up