GCIH · Question #656
What is the result of unloading a process' forward and backwards links in memory?
The correct answer is A. The process is hidden from the operating system. Removing a process's forward and backward pointers from the kernel's EPROCESS doubly-linked list hides it from the operating system's process enumeration. This technique, known as DKOM (Direct Kernel Object Manipulation), causes standard OS APIs to skip the process entirely.
Question
What is the result of unloading a process' forward and backwards links in memory?
Options
- AThe process is hidden from the operating system
- BAnalysis tools cannot find the process when scanning memory
- CThe process owner is elevated to SYSTEM permissions
- DThe application crashes
How the community answered
(33 responses)- A58% (19)
- B15% (5)
- C24% (8)
- D3% (1)
Why each option
Removing a process's forward and backward pointers from the kernel's EPROCESS doubly-linked list hides it from the operating system's process enumeration. This technique, known as DKOM (Direct Kernel Object Manipulation), causes standard OS APIs to skip the process entirely.
Windows maintains a doubly-linked list of EPROCESS structures where each entry contains a Flink (forward link) and Blink (backward link) pointer. When those pointers are unlinked - redirected to point around the target entry - the OS list traversal skips that process, making it invisible to the operating system and any tool relying on standard APIs such as NtQuerySystemInformation to enumerate processes.
Memory forensic tools that scan physical or virtual memory directly, rather than walking the linked list, can still locate the unlinked process - so the process is not universally hidden from all analysis tools.
Unlinking the EPROCESS list entries manipulates process visibility only; privilege elevation requires modifying the security token object attached to the process, which is a separate kernel structure.
The process continues executing normally after its list links are removed - unlinking only affects discoverability and does not interfere with the process's execution context or memory mappings.
Concept tested: DKOM process hiding via EPROCESS list unlinking
Topics
Community Discussion
No community discussion yet for this question.