In this module, let's see what happens on the end user machine when a program is run.
We can understand this in four layers, a user who uses the application.
The application itself.
And the application runs on a platform called Operating System, and finally the operating system runs
on hardware.
Usually a user uses an application like MS Word to document a report or Skype to communicate with their
friends and family or an application like browser to surf the Internet.
These application make use of building blocks in an operating system.
The building blocks that help in storing files, playing games or music, etc..
These building blocks interact with the hardware to give the desired output to the user.
This building blocks provided by the operating system or police functions, usually these are present
in c slash windows folder.
Examples of function include.
Get raw input data, which retrieves the raw input from the specified device.
Send input, synthesize keystrokes, mouse motions and button clicks.
Create file W create or open the file.
reg delete value removes a named value from the specified registry key.
There are thousands of functions available in Windows in order to help developers to quickly understand
which function to use.
These functions are grouped into categories called as libraries.
Few of the important libraries in windows are mentioned here.
An application developer makes use of libraries and functions to build the application.
Highlighted in blue are the popular libraries provided by Windows operating system, the ones in yellow
are the functions under each of the libraries.
Take a moment to familiarize yourself with a few libraries and functions.
At this point, you might be wondering, why should I know all these things?
Knowing the libraries and functions used in a program gives us hints on the intention of the application.
And it'll help us in terms of understanding what the application is trying to accomplish.
For example, if a program uses W sock 32 dot pll we can assume that the program is trying to use some
network services like it is trying to send and receive data.
Another example could be if our application uses ADV API 32 dot dll.
It means the application either create or delete or modify the registry settings on the machine.
All this information about the application come real handy during malware analysis as you will learn in the future modules.