Script to unhide processes in Windows (DKOM)

Question

Hi colleagues.

I need an script .cpp (C++) to unhide processes in Windows. It needs to inform if there is any hidden process in the system by using EPROCESS and comparing results with the list generated by calling CreateToolhelp32Snapshot or similar function which can provide the list of processes. Any differences should highlight hidden processes (basically use cross-view method or difference based method).

Can you provide some support / help or any script which can be used for this purpose?

It would be much appreciated.

Thanks in advance.

Regards.

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

It is actually depending on how hidden the process is. But you can try these command:

#include <windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <vector>
 
// Structures used by the EPROCESS structure
struct EPROCESS_BASIC_INFORMATION
{
    ULONG Reserved1;
    PVOID PebBaseAddress;
    PVOID Reserved2[2];
    ULONG UniqueProcessId;
    PVOID Reserved3;
};
 
struct EPROCESS
{
    EPROCESS_BASIC_INFORMATION     BasicInfo;
    LIST_ENTRY                    ProcessListEntry;
    ULONG                         SessionId;
    PVOID                         Reserved1[3];
    ULONG                         UniqueProcessId;
    PVOID                         Reserved2;
    ULONG                         HandleCount;
    ULONG                         Reserved3[2];
    ULONG                         VmCounters;
    PVOID                         Reserved4[2];
    ULONG                         IoCounters;
};
 
// Function to list processes
void ListProcesses()
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE)
        return;
 
    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(PROCESSENTRY32);
    if (Process32First(hSnapshot, &pe))
    {
        std::vector<ULONG> processIds;
        do
        {
            processIds.push_back(pe.th32ProcessID);
        } while (Process32Next(hSnapshot, &

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.