Block 1 Windows Flashcards
What is the Kernel?
Windows Components
heart of the OS providing basic low-level operations suck as schedulinng threads or routing hardware interrupts
Windows Components
Explain User mode for Processors
Windows Components
Private virtual address space in memory
unprivileged/restricted
Windows Components
Explain Kernel mode for Processors
Windows Components
Shares the same vitual address space in memory
Privileged/unrestricted
Windows Components
What Processor mode makes it possible to overwrite other programs and compromise the entire system?
Windows Components
Kernel Mode
Windows Components
What are drivers?
Windows Components
Software component that enables communication between hardware and the OS
Windows Components
What are the Driver Types?
Windows Components
User Mode and Kernel
Windows Components
Explain the Drivers User mode
Windows Components
Interfaces between a Win32 application and kernel-mode driver or other OS components
Windows Components
Explain the Drivers Kernel mode
Windows Components
Interface with I/O, Plug and play memory, process and thread management, security, etc…
Windows Components
Explain Lowest-level drivers
Windows Components
Control I/O bus in which the actual hardware device is connected
DOES NOT DEPEND ON LOWER LEVEL DRIVERS
Windows Components
Give an example of a Lowest-level driver
Windows Components
AGP/PCI hardware bus drivers
Windows Components
How are intermediate-level drivers divided?
Windows Components
Function, Filter and Software bus Drivers
Windows Components
What do intermediate-level drivers and highest-level drivers have in common
Windows Components
always depend on lower level drivers for support
Windows Components
What are some examples of highest-level drivers
Windows Components
NTFS, FAT, CDFS
Windows Components
What do filter drivers do?
Windows Components
communicates with other filter drivers or function drivers
(basically filters information)
Windows Components
What are the three driver categories?
Windows Components
Software, Bus, and Device
Windows Components
What mode do bus drivers always run in?
Windows Components
Kernel mode
Windows Components
What mode do software drivers always run in?
Windows Components
Kernel mode
Windows Components
What mode do Device drivers always run in?
Windows Components
Can run in both User and Kernel mode
Windows Components
What do software bus drivers do?
Windows Components
provides an interface for higher-level drivers to attah to a set of child devices
(the bus drives around children)
Windows Components
What do function drivers do?
Windows Components
Handles reads/writes to the device and manages device power policy
Windows Components
What are the three types of intermediate-level drivers?
Windows Components
Function, filter, and software bus
Windows Components
What do software bus drivers do?
Provides an interface for higher-level drivers to attach to a set of child services
What stage is the Master Boot Record read on?
Boot Process
The BIOS Phase
Boot Process
What is the the Boot Loader Phases’s purpose?
Boot Process
To load the Kernel into memory
Boot Process
What are the three phases of the Boot process?
Boot Process
Bios Phase, Boot Manager Phase, and the Kernel Phase
Boot Process
What is the Bios Phase’s reason for existing?
Boot Process
Hardware check on the system, then searches and run the “bootmgr” file
Boot Process
What are the two parts to the Boot Loader Phase?
Boot Process
Windows Boot Manager and Windows Boot Loader
Boot Process
What does the Windows Boot Manager do in the Boot Loader Phase?
Boot Process
Launches the Windows Boot Manager and reads in the BCD
Boot Process
What does the Windows Boot Loader do in the Boot Loader Phase?
Boot Process
Launches Windows Boot Loader then finds and starts the Winloader (WInload.exe)
Boot Process
What is the Kernel Phase’s (Windows NT OS Kernel) purpose for existing? (Name three)
Boot Process
Loads the registry and drivers marked as “Boot Start” ; Launches the Session Manager (smss.exe) ; User session processes launch ; Launches Services ; Winlogon.exe (logon screen) ; session is created for the user after logon
Boot Process
Explain a File System
File Systems
A file system is implemented by the OS designed to store and retrieve data when necessary
File Systems
Explain what a File Allocation Table (FAT) is
File Systems
File system initially developed for Windows systems starting from MS-DOS up to Windows ME
File Systems
What are the downsides to a FAT file system?
File Systems
Does not support file compression or security features
File Systems
What are the three advancements of FAT over it’s lifespan?
File Systems
FAT16, FAT32, and exFAT
File Systems
How much data can FAT16 format and what is it’s max file size?
File Systems
Formats up to 16GBs; handles max file size of 2GB
File Systems
How much data can FAT32 format and what is it’s max file size?
File Systems
Formats up to 16TBs; handles max file size of 4GB
File Systems
How much data can exFAT format and what is it’s max file size?
File Systems
Formats up to 512TiBs-64ZiB; handles max file size of approximately 128 PiB
File Systems
Define a Registry
Registry
a central hierarchical database that stores necessary configuration information for the system to run
Registry
What are the 2 Root Keys in the registry structure?
Registry
HKEY_LOCAL_MACHINE and HKEY_USERS
Registry
What are the 3 Linked Keys in the registry structure?
Registry
HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, and HKEY_CURRENT_CONFIG
Registry
What is the HKEY_CLASSES ROOT a shortcut to?
Registry
HKLM\SOFTWARE\Classes
Registry
What is the HKEY_CURRENT_USER a shortcut to?
Registry
HKU\SID
Registry
What is the HKEY_CURRENT_CONFIG a shortcut to?
Registry
HKLM\SYSTEM\CurrentControl\HarwareProfiles\Current
Registry
What is the structure of the Registry?
Registry
Keys which are comparable to folders of a file system and Values which are comparable to the files in a file system
Registry
What are the 6 different types similar to file extensions in the file system?
Registry
REG_BINARY. REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, and REG_QWORD
Registry
What does REG_BINARY represent in a registry?
Registry
Binary data in the values
Registry
What does REG_SZ represent in a registry?
Registry
Null-terminated strings in the values (String registry value)
Registry
What does REG_MULTI_SZ represent in a registry?
Registry
A sequence of Null-terminated strings in the values (Multi-string registry value)
Registry
What does REG_EXPAND_SZ represent in the registry?
Registry
That the registry values can use environmental variables (Expandable string registry value)
Registry
What does the REG_DWORD represent in the registry?
Registry
A 32 bit number inside the registry values (Double word registry value)
Registry
What does the REG_QWORD represent in the registry?
Registry
A 64 bit number inside the registry values (Quadruple word registry value)
Registry
What are the registry common items?
Registry
SIDs, GUIDs, and Hexs
Registry
What is a SID?
Registry
A unique value of variable length that is used to identify a security principal
Registry
What are SIDs that identify generic users or groups and whose values are static?
Registry
Well known SIDs
Registry
What is a GUID?
Registry
A 128 bit number used to identify information in computer systems
Registry
What is commonly used to identify hardware and software versions?
Registry
GUIDs
Registry
What is a Hex value?
Registry
Uses 16 characters (0-9,A-F)
Registry
What registry Run Software is used when a user logs in?
Registry
Either HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKU\Software\Microsoft\Windows\CurrentVersion\Run
Registry
What are commonly used pieces of persistent malware used on the registry?
Registry
Using the Autorun utility from Sysinternals to find software that is set to start from this location
Registry
What are some of the ways that you can make the Windows Command Interpreter autorun a command when you start cmd.exe? (Name one of the three)
Registry
To set up the autorun when you launch cmd.ex: Create the REG_SZ value AutoRun with the data “wmic qfe list” (When you launch cmd.exe - you’ll be presented with a list of installed hotfixes) — To create a DoS either create theREG_SZ value AutoRun with the data exit (When you launch the cmd.exe - it will immediately close) — Or Create the REG_SZ value AutoRun with the data start cmd.exe (When you launch cmd.exe - it will launch cmd.exe, which will launch cmd.exe, which will launch more instance of cmd.exe until it crashes)
Registry