Packt+ | Advance your knowledge in tech

You're reading from Learning Malware Analysis Explore the concepts, tools, and techniques to analyze and investigate Windows malware

Product type Paperback

Published in Jun 2018

Publisher

ISBN-13 9781788392501

Length 510 pages

Edition 1st Edition

Concepts

Malware Analysis

Author (1):

Monnappa K A

View More author details

Table of Contents (13) Chapters

Preface

1. Introduction to Malware Analysis FREE CHAPTER

2. Static Analysis

3. Dynamic Analysis

4. Assembly Language and Disassembly Primer

5. Disassembly Using IDA

6. Debugging Malicious Binaries

7. Malware Functionalities and Persistence

8. Code Injection and Hooking

9. Malware Obfuscation Techniques

10. Hunting Malware Using Memory Forensics

11. Detecting Advanced Malware Using Memory Forensics

12. Other Books You May Enjoy

Leave a review - let other readers know what you think

6. I/O Processing

While discussing the driverscan plugin, I had mentioned that driverscan gets module information from the DRIVER_OBJECT structure. Are you wondering what the DRIVER_OBJECT structure is? This will become clear soon. In this section, you will understand the interaction between the user-mode and kernel-mode components, the role of the device driver, and its interaction with the I/O manager. Typically, a rootkit consists of a user-mode component (EXE or DLL) and a kernel mode component (device driver). The user-mode component of the rootkit communicates with the kernel-mode components, using a specific mechanism. From a forensics standpoint, it is essential to understand how these communications work and the components involved. This section will help you understand the communication mechanism and lays the foundation for the upcoming topics.

Let's try to understand what happens when a user-mode application performs input/output (I/O) operations, and how it is processed at a high...