Learning Malware Analysis

6.2 The Role Of The I/O Manager

When the I/O request reaches the I/O manager, the I/O manager locates the driver and creates an IRP (I/O request packet), that is a data structure which contains information describing an I/O request. For an operation such as read, write, and so on, the IRP created by the I/O manager also contains a buffer in the kernel memory to be used by the driver to store the data read from the device or the data to be written to the device. The IRP created by the I/O manager is then passed to the correct driver's dispatch routine. The driver receives the IRP, and the IRP contains the major function code (IRP_MJ_XXX) that describes the operation (open, read, or write) to be performed. Before initiating an I/O operation, ...