Why won't TerminateProcess work? about ppldump HOT 2 CLOSED

Hey!

You're right, you are not limited to dumping the memory of a PPL.

What you say is partially true but not completely accurate. Because PPLs have different protection levels, one PPL cannot necessarily access any other PPL. But in this particular case, it's not important because PPLdump injects code in a PPL running at WinTCB level, which is the highest level.

To answer your question, there may be a number of reasons why you get an "Access Denied" error.

• You didn't open the target process with the appropriate flag(s) (PROCESS_TERMINATE).
• The target process is protected at the Kernel level with a minifilter driver for instance.

My guess is you are trying to kill an AV/EDR process, so the second option is possible. 🙂

from ppldump.

@itm4n Thanks for the very quick reply.
Your guess is indeed correct. I checked this on an AV process. I did open the process with the appropriate flags (PROCESS_TERMINATE), so it might be indeed a kernel level minifilter. I didn't even consider this option.
Thank you for your advice!

from ppldump.