03 Flashcards by Kameron Cooks

___________________ Volatile hive created at boot that contains hardware information provided by the firmware (HKLM sub-key)

HKLM/Hardware

How well did you know this?

Not at all

Perfectly

_____________________ contains boot configuration data, used with 6.* and 10.* architectures (HKLM sub-key)

HKLM\BCD00000000000

How well did you know this?

Not at all

Perfectly

_____________ contains local account information as well as password values (HKLM sub-key)

HKLM/SAM

How well did you know this?

Not at all

Perfectly

____________ contains cached logons and local security policy (HKLM sub-key)

HKLM/Security

How well did you know this?

Not at all

Perfectly

__________ Contains a collection of sub-keys for various installed components and programs (HKLM-subkey)

HKLM\SOFTWARE

How well did you know this?

Not at all

Perfectly

__________ contains control sets from which HKCC is derived

HKLM/System

How well did you know this?

Not at all

Perfectly

_____________ contains information about currently installed hardware and contains several sub-keys with information that is generated during boot-up

HARDWARE Sub-Key

How well did you know this?

Not at all

Perfectly

____________ sub-key, contains all local account information

SAM sub-key

How well did you know this?

Not at all

Perfectly

___________ sub-key contains information about cached logons, policy, special accounts, and registry transaction (RXACT PACKAGE)

Security sub-key

How well did you know this?

Not at all

Perfectly

___________ sub-key contains logon information for the last ten people

cache sub-key

How well did you know this?

Not at all

Perfectly

__________ sub-key contains a collection of sub-keys for various installed components and applications

Software sub-key

How well did you know this?

Not at all

Perfectly

Important entries in the software sub-key

_______ defines current installation of windows

________list of executables that run on system start-up

________programs are deleted from key once executed (e.g., software updates)

________ similar to run but for services, (May not always be present

currentversion

currentversion\run

currentversion\runonce

currentversion\runservices

How well did you know this?

Not at all

Perfectly

Can the software sub-key be used to determine if the machine is a VM?

yes

How well did you know this?

Not at all

Perfectly

________ sub-key contains definitions, control sets, and information about removable media

System sub-key

How well did you know this?

Not at all

Perfectly

The select key contains
_______
_______
_______

Current
Failed
LastKnownGood

How well did you know this?

Not at all

Perfectly

What are the sub-keys for the control sets under System sub-key?

Control
Enum
Mounted Devices
Services

How well did you know this?

Not at all

Perfectly

What are the entries for control under controlsets?

_____________Local security authority. Validates security for local users.

____________ manages user’s session and basic start-up

___________System determines which edition is booted by querying registry values under HKLM\SYSTEM\CurrentControlSet\Control\Productoptions

LSA

Session Manager

Product options

How well did you know this?

Not at all

Perfectly

What are the entries for Enum under controlsets?

_________ Provides USB device information including a description and hardware identification. Useful for tracking usage of a particular USB-connected device across multiple machines.

_________ contains device driver information

USB/USBSTOR

SCSI

How well did you know this?

Not at all

Perfectly

_________ shows drives available to system (controlsets)

Mounted devices

How well did you know this?

Not at all

Perfectly

__________ contains information about services and drivers available to the system (controlsets)

Services

How well did you know this?

Not at all

Perfectly

Major sub-keys of HKCU include:

_________ user settings and defaults are stored here, including color schemes, appearance and accessibility options to name a few

_________ contains current session information

_____ contains installed software information

Control Panel

Session Information

Software

How well did you know this?

Not at all

Perfectly

HKCC is used to establish the current hardware configuration profile what are its two sub-keys?

_________ has a Microsoft sub-key, may have other application sub-keys

_________ contains objects that temporarily modify current control set

Software

System

How well did you know this?

Not at all

Perfectly

What are the Registry data types?

________ Raw binary data; hardware component information stored as binary data

________ Most common value type consisting of 32-bit numbers expressed in decimal or hexadecimal

_________ Fixed length text string

_________ A Variable-length text string allowing use of environmental variables

_________ contains lists or multiple text string values

REG_BINARY

REG_DWORD

REG_SZ

REG_EXPAND_SZ

REG_MULTI_SZ

How well did you know this?

Not at all

Perfectly

What command is used for editing the registry>

reg.exe

How well did you know this?

Not at all

Perfectly

___________ add an object or value to registry . registry path is root key or hive. Data type by default is REG_SZ unless another type is specified example? : C:

REG ADD reg add registrypath [data type] [\\Machine]

_______ Displays registry object value command? example? C:

Reg query reg query keyname [/v valuename or /ve] [\\Machine]

______ removes an object, it deletes a value forma remote machine example?

reg delete C:\>reg delete registrypath [//Machine] NewPath [\\Machine]

________ changes path or moves to another machine example?

reg copy C:\>reg copy OldPath [//Machine] NewPath [\\Machine]

_______ Loads a hive file example?

reg load C:\>reg load registrypath [filename]

________ Code written for adaptability and change to meet ever-changing market demands. (windows architecture)

Extensibility

_________ Support multiple hardware architectures and must be adaptable for innovations and new technologies. (windows architecture)

Portability

_________ Protect itself from internal malfunctions and faulty applications. (windows architecture)

Reliability

__________ Meet government and industry requirements for system security and protections against external tampering. (windows architecture)

Security

________ User interface and API must provide extended legacy support and integration with other systems, such as UNIX. (windows architecture)

Compatibility

________ Fast and responsive while meeting the constraints of the other design goals. (windows architecture)

Performance

The ______ runs in the most p[riviliged ring of the CPU (RIng ___) known as __________

Kernel 0 Kernel Mode

The OS Interface and user applications execute in the least privliged ring of the CPU (Ring __) known as __________

3 user mode

Kernel mode RIng 0 characteristics - - -

Access too all system memory and entire CPU instruction set Kernel mode OS and device driver code share address space privileged to perform almost any action closest to hardware

User mode Ring 3 characteristics - - - -

Greatly limited in permission and authority OS interface and system software User Applications Closest to User

____________ determine the environment a user operates in, how that user gets authenticated, how the user accesses resources, etc

Processes

The __________ process is loaded by the kernel during the boot process and is the first user mode process to start, WHAT LOADS THIS?

Session Manager NTOSKRNL.exe

WHAT LOADS THE SUBSYSTEM? What are the components of the windows subsystem? ________ THE subsystem process. Subsystem DLLs run in the context of this process ________ contains code that gives programs access to system functions _______ contains basic functions, such as window management, user input , text, etc ________ part of the windows graphic device interface that enables programs and applications to use graphics and formatted text on the video display and printer _____ part of an advanced API services library supporting numerous APIs including security and registry calls _____ itroduced with 6.1 architectures, it contains a combination of functions and code originally contained in kernel32 and advapi32 libraries _____ Subsystem kernel mode device driver that performs the following Controls window displays; manages screen output; collects input from keyboard, mouse, and other devices; and passes user messages to applications.  Serves as the GDI for line, text, and graphics manipulation.

SMSS.EXE csrss.exe kernal 32.dll user32.dll gdi32.dll advapi32.dll kernealbase.dll win32k.sys

Of the product type registry values, WinNT, LanmanNT, ServerNT What do each represent?

Windows workstation OS Windows server Domain COntroller OS Windows Server OS

What process initializes file swap? What process loads this?

pagefile.sys SMSS.exe

What process starts windows initialization process? What loads before this process?

wininit.exe CSRSS.exe

What process is loaded by the kernel during the boot process and is the first user mode process to start?

smss.exe session manager

What process acts as a message handling intermediary between the console and crss.exe to protect against certain exploits?

conhost.exe

What process is after csrss.exe and what are its sub processes? what are each responsible for?

winint.exe services.exe (service control manager) managing services Lsass.exe (authentication for user credentials)

What process follows wininit.exe? Can there be multiples of these? What does it do?

SMSS.EXE(1) yes for every user logged in, duplicating CSRSS.exe and all its dependencies

SMSS.exe(1) what does this new session initialize following CSRSS.exe(1)? What does it do? What are the three processes it initiates?

winlogon.exe -handles interactive user logon and logoffs Logonui.exe userint.exe explorer.exe

What process is the king of the whole boot sequence?

NTOSKRNL.exe

What is the order of the boot processes? SMSS.EXE (1) Services.exe LSAASS.exe Winit.exe CSRSS.exe (0) WinLogon.exe(1) LogonUI.exe(1) Userinit.exe(1) SMSS.EXE(0) CSRSS.exe(1) pagefile.sys explorer.exe NTOSKRNL.exe kernal32.dll user32.dll gdi32.dll advapi32.dll kernalbase.dll win32k.sys conhost.exe

NTOSKRNL.exe SMSS.EXE pagefile.sys win32k.sys Csrss.exe(0) kernal32.dll user32.dll gdi32.dll advapi32.dll kernalbase.dll win32k.sys conhost.exe WIniit.exe (0) Lssas.exe (0) services.exe (0) Smss.exe(1) Csrss.exe(all dependency's) winlogon.exe(1) logonui.exe userinit.exe explorer.exe

What process is responsible for the whole desktop?

explorer.exe

______ acts as the emulator for allowing 32-bit applications to run seamlessly on a windows 64.bit OS

Wow64

_______ core interface tha translates between 32-bit and 64-bit calls

wow64.dll

_______ provides architecture specific support and manages switching the CPU between 32-bit and 64-bit modes

wow64cpu.dll

____ intercepts GUI system calls exported by win32.sys

wow64win.dll

where are the built-in 64 bit images (cmd.exe) and DLL's including wow64 DLLs located?

\Windows\System32

Where are the 32 bit images and DLLs needed for redirection located?

\Windows\Syswow64

The _____ contains internal support functions used by the subsystem DLLs and serves as the service call dispatch to the windows executive

ntd.dll Native API