[kerpow1]

Hi,

This is a share stripped from a project I was working on, the goal was to deploy a driver that would remove a process/thread object from all handle tables.

This was nothing more than a pseudo project to see if it was possible to remove a process from all handle tables whilst retaining stability and compatibility, operating system won :)

The code provided is correct but not complete, it will require some work to become functional. The offsets are correct but the implementation is left to you and fixing various compatibility issues, for testing I used an upper callback (ObRegisterCallbacks) to execute hiding on a protected process.

Methods Covered:

PsActiveProcessList - EPROCESS -> ActiveProcessLinks
SessionProcessList - EPROCESS -> SessionProcessLinks
Process Handle Table - EPROCESS -> ObjectTable
PspCidTable/ExDestroyHandle - EPROCESS -> ThreadListHead / _ETHREAD -> ThreadListEntry / _ETHREAD -> Cid.UniqueThread

Credits:

Rohitab (Information)
KernelMode (Information)
BlackBone (Source Code)
PowerTools (x64)
PCHunter (x64)
GMER (x64)
HookShark (x64)

P.S. This has only been shared to Rohitab/KernelMode and if you post this else I would prefer you to retain a link back to here or atleast the credits.

[myid]

BSOS when running. Useless.

[EP_X0FF]

What is the point in these numerous try/excepts? Do you know how it work?

[kerpow1]

As I said it will need work, I don't believe this method is a viable solution though which is why I posted it. And the try/excepts are just lazy amendments because it was stripped from a much larger framework, sorry for that.

[m5home]

I like hide process nearly 6 years ago.
I found that hide process is not useful, because it make process cannot work normally (Some API, like CreateProcess, will always return failed after hide process).

[kerpow1]

Yes, you are right. Hiding process on x64 without interfering with PG is difficult and un-necessary same as this method of hiding/removing your processes handle from all references and the methods covered here are not all methods so all that work for little benefit at the end however elements can be useful and always good to share things.