How to hide a process from all the methods of getting the list of processes?

Question

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not

so these are the ways i know :

1. QuerySystemInformation (Zw or Nt)

2. some place in the TEB which is pointed by FS register

3. CreateToolhelp32Snapshot

and i guess there are more ways too

so my questions are :

1. do these methods use the same structure/linked list in the virtual memory of the process or they might use different methods?

2. If i hook the ZwQuerySystemInformation, will this stop the process from getting the list of processes? if not, then how can i be sure that a process cannot get the list? which functions should i hook or modify?

Answer 1

1. Pretty much, they will all eventually read the PEPROCESS object directory.

2. Maybe not, depends on what you're trying to hide from. If it's just some basic usermode process iteration then you're probably fine. There's quite a few ways to iterate the process object directory though, such as ZwGetNextProcess.

Your best bet would probably be ObRegisterCallbacks if you want to block access to your process, but it still won't be enough depending on privilege level and how they're iterated.