Software firewalls

Hi guys. Does anyone know how s/w firewalls work? Any kind of documentation would be great.

Zone Alarm for example I heard takes up all the ports at the beginning, and assigns them to apps as they need it. Hopefully this info is correct. In anycase, what prevents an app/trojan from taking over a port before Zone Alarm is loaded (including trojans that might have taken over a windows dll, etc.)?.. After all, it is running on the same computer..

Thx.

It's actually quite simple. It just scans each bit of code and compared them to a known database of known virus code. Then it takes the correct action in what to do from there.