← All talks

IRP Dispatch Routines Explained #shorts

BSides Frankfurt0:44305 viewsPublished 2026-01Watch on YouTube ↗
About this talk
IRP (I/O Request Packet) is used to communicate with the driver, from the process. Defining dispatch routines for each IRP major function like create, close, read, and write. #bsidesfrankfurt #bsides #bsidesfra #juansacco
Show transcript [en]

You define the dispatch routines for each IRP. We'll recall what is what IRP is. And then you have the major functions here. You see the IRP mayor create, close, read and write and then the device control. I'm just covering the fundamentals. So when we go into the Windows exploitation, it will make more sense. So remember I say you cannot go from users pay to kernel. So you use packages to communicate with the driver from the process in in this case is IO that's input output request package and then you here I'm declaring the measure functions and then at the end I'm just calling the the drivers through device IO and four.