Klister is a simple set of utilities for Windows 2000, designed to read the internal kernel data structures, in order to get reliable information about the system state (including list of all processes, including those "hidden" by some rootkits).
Klister consists of a kernel module and some exemplary userland programs that communicate with the kernel module in order to display some internal kernel data structures. The most interesting ones are thread lists which are used by kernel dispatcher (scheduler) code. When reading such internal list we can be (almost;)) sure that we're getting list of all threads in the system (including those which belong to hidden process) and it also means that we can create complete list of ALL PROCESSESS in the system.
