How rootkits hide services on kernel mode?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
rootkit in kernel operate at the same security level as the operating system itself.
A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object manipulation (DKOM)
This method can be used to hide processes. A kernel mode rootkit can also hook the System Service Descriptor Table (SSDT), or modify the gates between user mode and kernel mode, in order to cloak itself
there is various way: