For any driver to be able to receive and handle IRP requests, it is necessary to create a device object. This device can be attached to a chain of device drivers that process a specific type of IRP request. For example, if the attackers want to hook filesystem requests, they need to create a device and attach it to the chain of filesystem devices. After this, it becomes possible to start receiving IRP requests associated with this filesystem (such as opening a file or querying a directory).
Creating a device object is simple: the driver can simply call the IoCreateDevice API and provide the flags corresponding to the device it wants to attach to. For malware analysis, these flags could help you understand the goal of this device, such as the FILE_DEVICE_DISK_FILE_SYSTEM flag.
The driver also needs to set up all the functions that will receive and handle these requests. Each IRP request has a major function code in IRP_MJ_XXX format. This code helps to understand...
