Developer knowledge network ยท moderated exchange

Onbetrouwbare Code-gemeenschap

Ontwikkelaarsonderzoek, reverse engineering en coderingsgemeenschap

Knowledge indexLive
4Categories
919Threads
2.8KBerichten
Subforums Leiderbord Log in om te posten
Analysis

DKOM: Unlinking EPROCESS from ActiveProcessLinks in Windows Kernel

kernel_komrade
Driver Dev
MEMBER
Vertegenwoordiger: 145
Datum van deelname: Feb 2019
Berichten: 26
Bedankt: 45
1 maanden geleden ยท Jun 29, 2026 1:48 PM
#1

How Direct Kernel Object Manipulation (DKOM) hides processes from Task Manager:

  1. Locate target EPROCESS structure.
  2. EPROCESS.ActiveProcessLinks is a circular doubly-linked list (LIST_ENTRY at offset 0x448 on Windows 10/11).
  3. Unlink the process node:
C
PLIST_ENTRY pCurrent = &pTargetEProcess->ActiveProcessLinks;
PLIST_ENTRY pPrev = pCurrent->Blink;
PLIST_ENTRY pNext = pCurrent->Flink;
pPrev->Flink = pNext;
pNext->Blink = pPrev;
// Point unlinked entry to itself to prevent crashes on process exit
pCurrent->Flink = pCurrent;
pCurrent->Blink = pCurrent;

Target process disappears from CreateToolhelp32Snapshot and EnumProcesses instantly!

stack_smasher
Kernel Explorer
MEMBER
Vertegenwoordiger: 111
Datum van deelname: Feb 2019
Berichten: 30
Bedankt: 18
1 maanden geleden ยท Jun 29, 2026 8:25 PM
#2

Remember that PatchGuard periodically verifies ActiveProcessLinks integrity, so unlinking must be temporary or done through hypervisor SLAT.

bypass_bravo
Member
MEMBER
Vertegenwoordiger: 150
Datum van deelname: Jan 2022
Berichten: 2
Bedankt: 28
1 maanden geleden ยท Jun 30, 2026 9:59 AM
#3

Classic DKOM technique. Clean C code.