So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
QuerySystemInformation (Zw or Nt)
some place in the TEB which is pointed by FS register
and i guess there are more ways too
so my questions are :
do these methods use the same structure/linked list in the virtual memory of the process or they might use different methods?
If i hook the ZwQuerySystemInformation, will this stop the process from getting the list of processes? if not, then how can i be sure that a process cannot get the list? which functions should i hook or modify?