[Autogenerated] Let's look at the process Explorer,
perhaps other tools and see if you can identify protected processes.
So first, how can you identify protected process very easily in process Explorer.
One way of doing that is by using a color which is used by
Process Explorer to indicate protected processes.
However,
it is not shown by default so you can go to options and configure colors and
there is a color here for protected processes this color which by the way by
default called Fouke PCIe So if I just enable that,
we can see that now certain processes in have these
colonies such as these CSR recess processes,
how can we further see that these are in fact protected processes.
So if I grab any normal process, so to speak,
process which is not protected and I'm going to go to the DLS view,
we can see the list of DLS that are loaded into their particular process.
We can see what's going on here in D w m explore and any
other process which is not protected.
However, looking at a protected process such as CS rss,
you can see the list of DLL shows absolutely nothing and of
course it doesn't mean that there are no DLS,
it simply means that Process Explorer doesn't have enough power to
actually peer into the process and get the list of DLS.
Getting the list of DLS is done by process Explorer.
Using the function in nam process modules.
And so this this function requires a handle to a process which is open with
the process query information and process VM read access masks to access
masses just cannot get for a protected process,
even though process Explorer is running we don't mean
privileges so you just don't see anything.
I will say that the next version of Process Explorer is able to show them,
how does it do that uses its driver because we know that process explore when
running with the mean privileges is able to load the driver.
So currently Process Explorer is not using its drivers power to see
inside protected process and this is just a choice that was made many
years ago but now it is in fact going to do that in the next version
of Process Explorer because protected processes are only protected
from the user mode side, but not from the kernel side.
So here's my own System Explorer running here.
Let me just launch it and system Explorer has some
functionality which is similar to Process Explorer.
However,
one of the things that I have here is the ability to look at
protected processes in any way that they see fit.
So for example, here's a serious success process.
Notice that it says that this protected.
In fact this purplish color indicates protection in this tool.
So I'm going to right click and look at the modules of that process and you can
see the full list of modules in this process without any kind of issue and the
way I'm doing that is by using a kernel driver.
So this process also running with many privileges,
load the driver and uses that to peer into protected
processes without restriction,
essentially I'm asking the driver to open a full all powerful
handle to the processing question and then return that back
to the user of the application, which is the System explorer tool.
And that's why I'm able to do that.
And the same thing can be done if you have some kind of kernel component,
like a driver that would allow you to do something very similar.
But of course, if you just have using with powers,
you cannot peer inside protected processes,
no matter what, Even if you're running with admin privileges.