Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED
Pique PoC Outline
Direct Kernel Object Manipulation (DKOM)
UNCLASSIFIED
Figure 2. (U) Locate Base Address of the Kernel Module
Find PsInitialSystemProcess
Walk the linked list of Executive Process (_EPROCESS) objects until it finds a process ID (PID)
matching the process to hide, which will be obtained via GetCurrentProcessId(). We will use the
appropriate offset in the _EPROCESS structure for the ActiveProcessLinks substructure to locate
the FLINK and BLINK. For example, the offset to the ActiveProcessLinks for Windows 7 32-bit
Raytheon Blackbird Technologies, Inc.
5
21 November 2014
Use or disclosure of data contained on this sheet is subject to the restrictions on the title page of this document.
UNCLASSIFIED