A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #10296  by lorddoskias
 Sun Dec 11, 2011 2:39 pm
I'm compiling a list of techniques to hide a process. So far this is what I have:
- Hooking SSDT
- Detouring APIs
- Manipulating PsActiveProcessList
- Creating a thread in an arbitrary process? (thus avoiding the creation of a process altogether)

I'm particularly interested in DKOM type of techniques
 #10298  by EP_X0FF
 Sun Dec 11, 2011 5:41 pm
There are too many. I don't get last option in your list, because it not fit your task. You want hide process object or hide your code? That's different things. Removing references in PspCidTable, scheduler lists, zombifying system threads, eprocess object patching etc. All these bsod-generators were already implemented for education purposes and all abandoned because of uselessness.
 #10300  by lorddoskias
 Sun Dec 11, 2011 8:12 pm
So you mean there is a shift of paradigm - hiding code instead of hiding (respectively creating) a process? In that case what are some options to hide code?
 #10303  by EP_X0FF
 Mon Dec 12, 2011 2:01 am
Take most of modern malware as example. Usually they injects payload code into trusted processes, are lot of ways to do that. Standalone malware processes are rare and usually is the sign of badly written malware.