This is the notes taken from this article, all credit goes the person who made the article.
KernelMode Rootkits, Part 1 | SSDT hooks * Adlice Software
Driver Flow…
Before reading. I am thinking the SSDT is like PE’ Export Directory (AddressofFunctions), which is an array of function pointers which is in ntoskrnl.exe. So this might be similar to IAT hooking?
Filtering any attmpet to open a handle on the process by Detouring the execution flow of an API to filter function
IRP (I/O Request Packet) -
I/O request packets - Windows drivers
Driver Stack
Driver stacks - Windows drivers
A kernel filter is a driver/device attached to another device, so that it’s inserted between 2 different layers of a driver stack.