So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not

so these are the ways i know :

  1. QuerySystemInformation (Zw or Nt)

  2. some place in the TEB which is pointed by FS register

  3. CreateToolhelp32Snapshot

and i guess there are more ways too

so my questions are :

  1. do these methods use the same structure/linked list in the virtual memory of the process or they might use different methods?

  2. If i hook the ZwQuerySystemInformation, will this stop the process from getting the list of processes? if not, then how can i be sure that a process cannot get the list? which functions should i hook or modify?

1 Answer 1

  1. Pretty much, they will all eventually read the PEPROCESS object directory.

  2. Maybe not, depends on what you're trying to hide from. If it's just some basic usermode process iteration then you're probably fine. There's quite a few ways to iterate the process object directory though, such as ZwGetNextProcess.

Your best bet would probably be ObRegisterCallbacks if you want to block access to your process, but it still won't be enough depending on privilege level and how they're iterated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.