What is the function of opening the C:\\Windows\\System32\\drivers\\filecrypt.sys？

[badboycxcc]

What is the function of opening the C:\Windows\System32\drivers\filecrypt.sys file? How to load your own sys file?

[Tserith]

The bootkit does not open filecrypt.sys. It adds an entry to BootDriverListHead so that the Windows bootloader will attempt to load it as a core driver. When it does that, the bootkit intercepts the disk read interrupt and provides the bootkit's custom driver instead. Once the custom driver is executed it removes the extra entry so filecrypt.sys will be properly loaded after kernel initialization.

[badboycxcc]

Is this how it works?

1. Windows bootloader loads the system filecrypt.sys normally
2. Bootkit intercepts and replaces Driver.sys (malicious sys)
3. Windows reloads filecrypt.sys and runs normally

[Tserith]

1. Bootkit tells bootloader to load filecrypt.sys earlier than normal (before initialization)
2. Windows tries to read filecrypt.sys and the bootkit replaces it with Driver.sys
3. Windows loads filecrypt.sys normally (after initialization)

[badboycxcc]

ok