Learning Malware Analysis

1.2 Kernel Memory Contents (Kernel Space)

The kernel memory contains the operating system and the device drivers. The following screenshot shows the user-space and kernel space components. In this section, we will  mainly focus on the kernel space components:

The kernel memory consists of the following key components:

• hal.dll: The hardware abstraction layer (HAL) is implemented in the loadable kernel module hal.dll. HAL isolates the operating system from the hardware; it implements functions to support different hardware platforms (mostly chipsets). It primarily provides services to the Windows executive, kernel, and kernel mode device drivers ...