Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking?

The book I am self-studying from: RootKits: Subverting the Windows Kernel

share|improve this question

closed as too broad by Xander, tylerl, Steve, Adi, Terry Chia Jan 7 '14 at 3:32

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

The rootkit replaces the legitimate call to EnumProcesses() with the address of its own implementation. Its implementation calls the original, but before it returns the list, it removes any mention of the processes it has been told to hide.

While the behavior and outcome are similar, I consider hooking to be slightly different, because it can be done legitimately. Hooking is generally done through an officially supported API, and the OS tracks all such hooks so it can undo them when the hooking process is terminated. A description of Microsoft's hooking mechanism can be seen here. Malware instead often directly modifies the memory without notifying the OS.

share|improve this answer
So why don't malware use hooking? – Pacerier Jun 8 '15 at 16:26
@Pacerier, there are multiple ways to achieve the outcome. Legitimate software uses "hooking", as described above. Malicious software might use the hooking APIs, or it may simply search modify the binary value of the current API's entry point, and roll their own hook. The advantage of using the published API is that it's supported on all platforms. The disadvantage to the malware author of calling the official API is that calling the CBT hooks is detectable as potentially suspicious behavior. – John Deters Jun 8 '15 at 20:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.