# Inside Microsoft's plan to kill PPLFault

PPLFault abuses missing page-hash validation for PPL images plus Cloud Filter API to inject unsigned code into WinTcb-Light PPL processes, enabling EDR tampering and kernel memory access.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Gabriel Landau
- Disclosed: 2023-09-15
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/inside-microsofts-plan-to-kill-pplfault
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:research platform:threat-intel sev:high tech:windows technique:chained technique:incomplete-fix technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** Windows Code Integrity / memory manager (MiValidateSectionCreate, MiValidateInPage) and PPL processes
**Root cause:** Page hashes are not validated for PPL images, and the Cloud Filter API can violate immutability assumptions of files backing SEC_IMAGE sections, so paged-in code is trusted without re-verification.
**Steps:**
1. Create a SEC_IMAGE section from a DLL hosted over SMB so pages are file-backed and paged on demand.
2. Use the Cloud Filter API to violate the immutability assumption of the file backing the SEC_IMAGE section.
3. Trigger a page fault in the target PPL process so the memory manager re-reads the modified page from disk.
4. Because page hashes are not validated for PPL, the modified page is mapped into the WinTcb-Light PPL process, yielding unsigned code execution.
5. Chain GodFault: from WinTcb-Light, exploit kernel trust to modify kernel memory and gain full physical memory read-write.
**How found:** Reasoning about the loader/section-creation flow: signature is validated at section creation, but paged-in pages are only re-verified via page hashes, which are enabled for /INTEGRITYCHECK images, full PPs and drivers but not PPL. Combined with the observation that SEC_IMAGE can be created from files with user-writable references (as in Process Herpaderping), the researcher hypothesized paging could bypass CI for PPL.
**Exploitation:** Admin-to-PPL: load a payload DLL over the SMB network redirector into a WinTcb-Light PPL process, use Cloud Filter API to mutate the backing file, and rely on paging to inject unsigned code. PPL-to-kernel (GodFault) then abuses kernel trust of WinTcb-Light to modify kernel memory and obtain full physical memory access, bypassing LSA protection and blinding EDR without vulnerable drivers.
**Escalation:** PPLFault (admin-to-PPL) chained with GodFault (PPL-to-kernel) escalates from admin to full kernel/physical memory read-write.
**Insight:** When a security check runs at object-creation time, look for a second path that re-supplies the same bytes later (paging, lazy load, re-read from disk) and check whether the re-verification (page hashes) is enabled for your target protection level; also look for APIs like Cloud Filter that break immutability assumptions of file-backed sections.

## Proof of concept (copied exactly from the original report)

**WinDbg breakpoint on CI page hash validation**

```
bp /w "&CI!CipValidatePageHash == @rcx" CI!CipValidateImageHash 
 "dt _FILE_OBJECT @r8 FileName; g"
```

**Kernel debugger stack showing page hash failure**

```
0: kd> g
Breakpoint 1 hit
CI!CiValidateImagePages+0x360:
0010:fffff805`725028b4 b8280400c0 mov eax,0C0000428h
7: kd> k
 # Child-SP RetAddr Call Site
00 fffff508`1b4a6dc0 fffff805`72502487 CI!CiValidateImagePages+0x360
01 fffff508`1b4a6f90 fffff805`6f2f1bbd CI!CiValidateImageData+0x27
02 fffff508`1b4a6fd0 fffff805`6ee35de5 nt!SeValidateImageData+0x2d
03 fffff508`1b4a7020 fffff805`6efa167b nt!MiValidateInPage+0x305
04 fffff508`1b4a70d0 fffff805`6ef9fffe nt!MiWaitForInPageComplete+0x31b
05 fffff508`1b4a71d0 fffff805`6ef68692 nt!MiIssueHardFault+0x3fe
06 fffff508`1b4a72e0 fffff805`6f0a784b nt!MmAccessFault+0x3b2
07 fffff508`1b4a7460 00007fff`ccf71500 nt!KiPageFault+0x38b
08 000000b6`776bf1b8 00007fff`d5500ac0 0x00007fff`ccf71500
09 000000b6`776bf1c0 00000000`00000000 0x00007fff`d5500ac0
7: kd> !error C0000428
Error code: (NTSTATUS) 0xc0000428 (3221226536) - Windows cannot verify the 
 digital signature for this file. A recent hardware or software change 
 might have installed a file that is signed incorrectly or damaged, or 
 that might be malicious software from an unknown source.
```