Learning Malware Analysis

6.4 I/O Requests To Layered Drivers

So far, you have understood how an I/O request is handled by a simple device controlled by a single driver. The I/O request can go through multiple layers of drivers; I/O processing for the layered drivers happens in much the same way. The following screenshot illustrates an example of how an I/O request might travel through layered drivers before reaching the hardware-based devices:

This concept is better understood with an example, so let's trigger a write operation to c:\abc.txt using the following command. When this command is executed, netstat will open the handle to abc.txt and write to it:

C:\Windows\system32> ...