Windows internals
Before we dive into the malicious activities of rootkits, let's take a look at how the Windows OS works and how the interaction between the user mode and kernel mode is organized. This knowledge will allow us to understand the specifics of kernel-mode malware and what parts of the system it may target.
The anatomy of Windows
As we mentioned previously, the OS is divided into two parts: user mode and kernel mode. This is shown in the following diagram:
Figure 7.2 – The Windows OS design
Now, let's learn about the scope of these applications:
- User mode: This contains all the processes running in the system (which you can see in Task Manager). These processes run under subsystems such as POSIX, the Win32 subsystem, and (more recently) the Windows Subsystem for Linux. All of these subsystems call different APIs, which are tailored for that system through specific libraries, such as
kernel32.dllin the Win32 and Win64...
