Cheat Engine

[Stylo]

so i was wondering how would i hide a process in C++?
which means i won't see it on task manager while it's running
i remember i saw something about EPROCESS list or something like that
i'm not asking for code just link me for an explanation or explain here if u can that'd be great
i want to understand how it works
thank you :]

[lurc]

Explains most of it:
http://www.rohitab.com/discuss/index.php?showtopic=23880

[tombana]

Well, for unlinking your process from the EPROCESS list you need a kernel mode driver.
And because you mentioned C++ (and I think you mean C++ for usermode apps, not kernelmode) you might find it easier to inject a dll into every process and hook functions like NtQuerySystemInformation and filter out your process. Then you don't need a driver.

[BanMe]

why hide the process if you Get Process running just protect the threads o0
and tombana u need to take a look at rootkit.com that method is mad old it can be bypassed by Object Handle Table:handles to Process Name, Csrss Reading the EPROCESS structs stored by the subsystem, Direct EPROCESS traversal looking for orphan's, PsCreateProcessNotifyRoutine(),PsSetImageNotifyRoutine()... and prolly a few more methods...like hooking KeInitThread()... the best method i can think of would be to have your own subsystem on top of the NATIVE subsystem(not the Win32_SubSystem) that loads conjuntively with Csrss..and cojoinly connects to smss ..this would prevent some of the csrsswalker from working on it but would be a heavyily identifiable method cause u have to add ur own SubSystem key in registry to provide a loading method.. but as to a hiden from Main() Usermode application that is virtually impossible .. ;}

[Overload]

Just hide it using DKOM.

[Stylo]

thanks all for helping :]
if i'll have more question i'll ask here

[dnsi0]

Have a look at ground zero. It is a driver that uses the FLink and BLink method to hide stuff.

[the_undead]

http://somebastardstolemyname.wordpress.com/2007/10/31/c-ring0-hiding-processes-by-the-dkom-method/

[Stylo]

how come my compiler doesn't recognize PEPROCESS type?
i get PEPROCESS: undeclared identifier error
do i need to add some library to my project?

[sponge]

You need DDK.

[dnsi0]

I though you had to do that crap in ring0 not ring3....

[Overload]

[BirdsEye]

[Stylo]

what is this DDK and how do i get it
i found in google download for windows server 2003 but i don't think that's what i'm looking for

[sponge]

Check out the Cheat Engine Source section. It's one of the stickies.