Cheat Engine

alloveme1 · Newbie cheater Reputation: 0 Joined: 13 Oct 2005 Posts: 12

how can i find KPEB(Kernel Process Environment Block) of hidden process?
i'd like to modify activeprocesslink to unhide a hidden process~
btw a hidden process is shown in the windows list

and what peprocess stands for?

thanks in advance~

Dark Byte · Posted: Mon Jun 12, 2006 1:47 am Post subject:

PEprocess stand for: The pointer to the EProcess structure of the process.

the first part of the EProcess is a block called the KProcess block
That contains the activeprocesslink (the systemcallretriever figures out the offset of activeprocesslist, and peprocess+thatoffset=th eactiveprocesslink

(In short, you are already looking at it without even knowing it)

alloveme1 · Newbie cheater Reputation: 0 Joined: 13 Oct 2005 Posts: 12

thank you for the reply...

btw, i see all the process's KPEB on softice.

but i *can't * see the KPEB of hidden process.

fortunately, i see the program in the windows list.

what should i do find the KPEB of hidden process?

thx in advance~ Laughing

linden · Posted: Mon Jun 19, 2006 2:58 am Post subject:

Call PsLookupProcessByProcessId on every possible PID (0 through 0x41DC), enumerate all the successful PID's and compare it with the list you get from NtQuerySystemInformation. Anything missing from the list means it's hidden.