Learning Malware Analysis

2.1 Windows API Call Flow

The Windows operating system provides services by exposing APIs implemented in DLLs. An application uses the service by calling the API implemented in the DLL. Most API functions end up calling the system service routine in the ntoskrnl.exe (kernel executive). In this section, we will examine what happens when an application calls an API, and how the API ends up calling the system service routines in ntoskrnl.exe (executive). Specifically, we will look at what happens when an application invokes the WriteFile() API. The following diagram gives a high-level overview of the API call flow:

1. When a process is invoked ...