Windows version

[PACEJJ27]

Test on Windows 10 20H2 ，it doesn't work

[Octoberfest7]

Were you System when you ran it?

[tarekxxx]

i have same problem here

[Octoberfest7]

i have same problem here

Try out my version (same one in the pull request here). I modified it to elevate to system which i found necessary to make it work.

https://github.com/Octoberfest7/KillDefender

[tarekxxx]

i have same problem here

Try out my version (same one in the pull request here). I modified it to elevate to system which i found necessary to make it work.

https://github.com/Octoberfest7/KillDefender

oh thanks this useful

[GetRektBoy724]

Test on Windows 10 20H2 ，it doesn't work

update : Windows 10 v21H2 now completely patched, you will not get any token access from process handle with "Query Limited Information"

[Octoberfest7]

Test on Windows 10 20H2 ，it doesn't work

update : Windows 10 v21H2 now completely patched, you will not get any token access from process handle with "Query Limited Information"

Can confirm, tested on latest path Win11. Same code can still be used to access other PPL protected process tokens (smss, csrss, etc) but doesn't work for MsMpEng.exe

[GetRektBoy724]

Test on Windows 10 20H2 ，it doesn't work

update : Windows 10 v21H2 now completely patched, you will not get any token access from process handle with "Query Limited Information"

Can confirm, tested on latest path Win11. Same code can still be used to access other PPL protected process tokens (smss, csrss, etc) but doesn't work for MsMpEng.exe

Wait really? From my experience, u cant get any token access from "Query limited information" process handle, regardless of the process. Can u show me a proof or something? Thanks

[Octoberfest7]

https://github.com/Octoberfest7/KillDefender/blob/main/killdefender.cpp

If you use my code here you can do it. Just change line 136 to smss.exe or csrss.exe and then check it out in process explorer, you'll be able to see that the code will set the token integrity to untrusted and strip all privs like it did for MsMpEng.exe. Obviously do it in a VM.

[GetRektBoy724]

https://github.com/Octoberfest7/KillDefender/blob/main/killdefender.cpp

If you use my code here you can do it. Just change line 136 to smss.exe or csrss.exe and then check it out in process explorer, you'll be able to see that the code will set the token integrity to untrusted and strip all privs like it did for MsMpEng.exe. Obviously do it in a VM.

Oh wait you're right, tested csrss.exe, and it works.