c++ - How to Detect Hidden Processes -

c++ - How to Detect Hidden Processes -

wondering how application "process explorer" or "combo fix" observe hidden process ??? i'm assuming must done in c or c++. easy plenty access process list in .net not accurate, know root kits can mask task manager. through memory access , io ? curious if knows how accomplished.

this question can't answered. depends how process has been hidden in first place. example, can hide process injecting usermode dll processes hooks enumprocesses, process32next, etc. , other apis related process enumeration. bypassed trampoline skips hook.

however, if process hidden through modifying kernel eprocess linked list holds list of processes, method needed subvert code performed hiding. if define how think process beingness 'hidden', maybe can suggest how observe it. processes think beingness hidden still beingness discovered process explorer?

also taking consideration there multiple ways hide process. of mutual ways observe ?

the problem if have no thought looking for, it's impossible find it. suppose process has made hidden task manager hooking enumprocesses. might think easy case detect. however, process hooking enumprocesses through variety of different ways. example, unconditional hook @ start of function, iat hook, causing access violation occur @ enumprocessesand catching veh , modifying eip/rip, etc. etc. in simple case, not possible guarantee detection of hook. assuming hook has been performed @ usermode on specific api , code makes no effort hide detection.

if looking general guidelines, best method @ mutual detouring techniques. 1 time know how method works, trivial write code observe manipulation.

perhaps if gave motivation write sort of code or purpose serve, able help better.

if looking ways programs detour execution of other processes, through 1 of 2 means:

dynamic (runtime) detouring - more mutual method , used libraries such microsoft detours. here relevant paper first few bytes of function overwritten unconditionally branch instrumentation. (static) binary rewriting - much less mutual method rootkits, used research projects. allows detouring performed statically analysing , overwriting binary. old (not publicly available) bundle windows performs etch. this paper gives high-level view of how works conceptually.

although detours demonstrates 1 method of dynamic detouring, there countless methods used in industry, in reverse engineering science , hacking arenas. these include iat , breakpoint methods mentioned above. 'point in right direction' these, should @ 'research' performed in fields of research projects , reverse engineering.

c++ c windows