nerdexam
GIAC

GCIH · Question #656

What is the result of unloading a process' forward and backwards links in memory?

The correct answer is A. The process is hidden from the operating system. Removing a process's forward and backward pointers from the kernel's EPROCESS doubly-linked list hides it from the operating system's process enumeration. This technique, known as DKOM (Direct Kernel Object Manipulation), causes standard OS APIs to skip the process entirely.

Malware Analysis & Advanced Persistent Threats

Question

What is the result of unloading a process' forward and backwards links in memory?

Options

  • AThe process is hidden from the operating system
  • BAnalysis tools cannot find the process when scanning memory
  • CThe process owner is elevated to SYSTEM permissions
  • DThe application crashes

How the community answered

(33 responses)
  • A
    58% (19)
  • B
    15% (5)
  • C
    24% (8)
  • D
    3% (1)

Why each option

Removing a process's forward and backward pointers from the kernel's EPROCESS doubly-linked list hides it from the operating system's process enumeration. This technique, known as DKOM (Direct Kernel Object Manipulation), causes standard OS APIs to skip the process entirely.

AThe process is hidden from the operating systemCorrect

Windows maintains a doubly-linked list of EPROCESS structures where each entry contains a Flink (forward link) and Blink (backward link) pointer. When those pointers are unlinked - redirected to point around the target entry - the OS list traversal skips that process, making it invisible to the operating system and any tool relying on standard APIs such as NtQuerySystemInformation to enumerate processes.

BAnalysis tools cannot find the process when scanning memory

Memory forensic tools that scan physical or virtual memory directly, rather than walking the linked list, can still locate the unlinked process - so the process is not universally hidden from all analysis tools.

CThe process owner is elevated to SYSTEM permissions

Unlinking the EPROCESS list entries manipulates process visibility only; privilege elevation requires modifying the security token object attached to the process, which is a separate kernel structure.

DThe application crashes

The process continues executing normally after its list links are removed - unlinking only affects discoverability and does not interfere with the process's execution context or memory mappings.

Concept tested: DKOM process hiding via EPROCESS list unlinking

Topics

#DKOM#process hiding#EPROCESS list#rootkit technique

Community Discussion

No community discussion yet for this question.

Full GCIH Practice