Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BootProcess > Boot Process > Flashcards

Boot Process Flashcards

Learn the boot process

1
Q

Win XP - Pre-Boot

A

Power On Self Test (POST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Win XP - MBR

A

Loads boot code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Win XP - Bootcode

A

Searches partition table for boot sector and loads NTLDR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Win XP - NTLDR

A

Reads in boot.ini for OS choices, runs NTDETECT.com to query hardware
Stored data from NTDETECT.com in HKLM\Hardware registry key
Starts NTOSKRNL.exe and HAL.dll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Win XP - NTOSKRNL.exe

A

starts SMSS.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Win XP - SMSS.exe

A

Launches Winlogon.exe and CSRSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

WIn XP - Winlogon

A

starts LSASS, loads MSGINA, starts SCM, starts logonui.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

WIn XP - MSGINA.dll

A

Graphical Identification and Authorization (GINA) dll library
Activates the user shell
Customizable identification and authentication procedures
Logon dialog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

WIn XP - Winlogon

A

Receives credentials from MSGINA and passes them to LSASS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

WIn XP - LSASS

A

Checks creds against LSA database cache then NTLM or Kerberos if not found
Sends user token back to Winlogon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

WIn XP - Winlogon

A

Starts userinit in user context

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

WIn XP - Userinit

A

Loads user profile, runs startup programs, starts explorer.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

BIOS

A

Basic Input/Output System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Win7 - Pre-Boot

A

Power On Self Test (POST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Win7 - MBR

A

First 512 byte sector on hard disk

Reads and loads Volume Boot Record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Win7 - VBR

A

Loads bootmgr into memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Win7 - Bootmgr

A

Reads Boot Config Database (BCD)
Boot menu and memtest
Calls winload (fresh boot)
Calls winresume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Win7 - Winload

A

Loads NTOSKRNL.exe
Loads dependencies
Loads device drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Win7 - NTOSKRNL

A

SYSTEM
Prepares for running native system
Runs SMSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Win7 - HAL.dll

A

Hardware Abstraction Layer (HAL)

Interfaces driver to kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Win7 - SMSS

A

Session manager
Session 0 loads Win32k.sys (kernel subsystem)
Runs WININIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Win7 - WININIT

A

Starts Service Control Manager (SCM)
Starts Local Security Authority SubSystem (LSASS)
Starts Local Session Manager (LSM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Win7 - CSRSS

A

Client/Server Runtime SubSystem
Client side of the win32 subsystem process
Thread creation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

VBR

A

Volume Boot Record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CSRSS

A

Client/SErver Runtime SubSystem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

SMSS

A

Session Manager SubSystem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

BCD

A

Boot Config Database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

EFI

A

Extensible Firmware Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

UEFI

A

Unified Extensible Firmware Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

EFI/UEFI - Step 1

A

Power On Self Test (POST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

EFI/UEFI - Step 2

A 
Runs Bootloader (from NVRAM)
Loads BCD (also in NVRAM)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

EFI/UEFI - Step 3

A

Bootloader detects hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

EFI/UEFI - Step 4

A

EFI boot manager gives OS boot menu

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

EFI/UEFI - Step 5

A

Winload.efi: EFI version of winload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

EFI/UEFI - Step 6

A

Requires EFI system partition
Formatted as FAT
Up to 1GB in size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Win7 - Winlogon

A

Coordinates logon and useractivity

Launches logonui

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Win7 - Logonui

A

Interactive logon dialog box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Win7 - Services

A

Loads auto-start drivers and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Main difference between local and domain logon

A

Where the user is authenticating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Local Logon authenticates where?

A

Locally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Domain Logon authenticates where?

A

With the domain controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Tasklist

A

cmd.exe : loaded modules, services, owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Process States - New/Created

A

Open file (.exe)
Create initial thread
Pass to kernel32.dll to check permissions
Pass to csrss, build structure, spawns first sub-thread, inserts into windows subsystem-wide proc list
Starts execution of initial thread
For real-time systems, processes may be held in “New State” to avoid contention, otherwise moved to “Ready State”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Process States - Running

A

Process currently being executed (one or more threads executing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Process States - Ready

A

Process ready to execute when given the opportunity (CPU Time)

46
Q

Process States - Waiting

A

Process can’t execute until some event occurs (I/O Read)

47
Q

Process States - Terminated/Exit

A

Termination of a process due to a halt or abort

48
Q

Paging - Pages

A

Memory is allocated to process in distinct chunks

49
Q

Paging - Page Size

A

Smallest unit of protection at the hardware level

4KB for small page, 2MB for large page

50
Q

Paging - Overcommitted

A

Physical memory becomes overcommitted (threads try to use more memory than available) pages are written to the page file on disk

51
Q

Paging - Page Fault

A

Occurs when a thread references an invalid page

if page is on disk in the page file, it can be brought back into memory

52
Q

What are Windows Services?

A

Long running executable application that run in their own container (process)

Can be started automatically at boot, on demand, or when requested

Can be paused, stopped, or restarted

Run in the background, normally without a user interface

53
Q

sc

A

cmd.exe, querying and management

54
Q

Sc queryex eventlog

A

info for eventlog service including PID

55
Q

Tasklist /FI “pid eq XXX” /v

A

query tasklist for PID associated with eventlog

56
Q

Tasklist /FI “pid eq XXX” /svc

A

query tasklist for svchost services

57
Q

Sc qdescription eventlog

A

query eventlog service description

58
Q

Sc qc eventlog

A

show the binary command that loads the service

59
Q

Threads

A

Basic unit to which the OS allocates processor time
Can execute any part of the process code
Including parts currently being executed by another thread
Share memory with each other as well as the process
Deadlock is possible if the threads are waiting for each other’s resources
Synchronization (semaphores, mutexes) are used to control access to shared variables
Client/Server Run-Time Subsystem (CSRSS) maintains a list of threads
Threads are part of a execution priority pool 0-31 per processor, highest executes next

60
Q

Handles

A

Objects are data structures representing a system resource (file, thread, etc)
Applications can’t access objects directly, must obtain a handle
Handles for each process are tracked in an internal table known as the Object Manager
Handles allow a common interface to objects, regardless of underlying changes to the object
Handles allow Windows to track ACLs for objects during handle creation time

61
Q

Thread States - Ready

A

Waiting for Execution, in priority pool

62
Q

Thread States - Deferred Ready

A

Selected to run, but not yet executed. Optimization for scheduling database

63
Q

Thread States - Standby

A

Next thread to run, only one per processor per system

64
Q

Thread States - Running

A

A thread currently running on a processor

65
Q

Thread States - Waiting

A

A period of inactivity while waiting for an event

66
Q

Thread States - Transition

A

Ready for execution, but paging needed to bring back into memory

67
Q

Thread States - Terminated

A

Finished execution, heading for deallocation in most cases

68
Q

Thread States - Initialized

A

Thread is being created

69
Q

Process

A

The primary container (memory structure) for a program being executed

70
Q

Thread

A

Represents sequential machine-code instructions that a processor executes

71
Q

Handle

A

Pointer to OS objects referenced within a process

72
Q

What are system processes?

A

processes owned by, and executed by the operating system

required for the system to function

73
Q

What are the two types of system processes?

A

User

Kernel

74
Q

User mode processes

A

Runs in private virtual address space

Applications are isolated, one crash will not cause another to crash

75
Q

Kernel mode processes

A

All run in a single virtual address space

Not isolated from other processes

76
Q

Virus

A

Requires user interaction to replicate

77
Q

Worm

A

Does not require user interaction to replicate

78
Q

Trojan

A

Malware hidden within another legitimate program

Not usually self-replicating

79
Q

Malicious Mobile Code

A

Transmitted from remote host to local host

Executed without user instruction (i.e. Javascript, VBScript, etc)

80
Q

Blended Attack

A

Multiple infection/transmission methods used together

81
Q

Backdoor

A

Malicious program that allows illegitimate access to a machine
User is unaware

82
Q

Remote Access Tool (RAT)

A

Malicious program that provides remote command and control

83
Q

Rootkit

A

Malicious program that is ONLY used to hide things

DOES NOT provide access or command and control alone

84
Q

Keylogger

A

Records keyboard usage

85
Q

Botnet Client

A

Remote administration/Command and Control of a botnet

86
Q

Spyware

A

Monitors behavior of user

87
Q

Adware

A

Paid for ads to infected users

88
Q

Ransomware

A

Blocks access to a resource, requires payment from victim

89
Q

Bot Herder

A

Person in control of the botnet

90
Q

Botnet

A

Multiple machines infected and controlled by a bot herder

91
Q

Zombie

A

Individual machine infected and part of the botnet

92
Q

Static Analysis

A

Examine malware without executing it

Strings

93
Q

Dynamic Analysis

A

Examine malware while it is running

94
Q

What is virtualization?

A

Virtualization is technology that allows you to create multiple simulated environments or dedicated resources from a single, physical hardware system. Software called a HYPERVISOR connects directly to that hardware and allows you to split 1 system into separate, distinct, and secure environments known as VIRTUAL MACHINES (VMs).

95
Q

Benefits of virtualization

A

One set of Hardware -> Many virtual machines (VM)
VMs can be dynamically created and allocated to users
Baseline Image can be more rapidly updated
VMs instances can easily be rolled back to undo changes
Provide fault tolerance through redundant hardware and migration
Could be used as a pivot point
Could provide persistence if data store is compromised
Lessens attribution
Configurable software solution (OS, Services, Programs, etc)
Useful for protected Malware Analysis (Malware Detonation Chamber)
Quick restoration times
Usable as Honey Pot or Tar Pit
Difficult for malware to maintain persistence
Easily manageable across enterprise

96
Q

Risks of Virtualization

A

Typically require more upfront planning and configuration
In public cloud environments, lack of granularity in control of data at rest can lead to compliance issues (HIPPA, etc).
Some functions may not work well in a VM, such as copy/paste, printers, netstat, without additional setup effort.
Persistence can be lost if the target machine is restored
Could end up in a honey pot or tar pit
If the data store is compromised all new instances will also be compromised
Planning and initial setup cost more with virtual networks.

97
Q

What is situational awareness?

A

A method of gaining an understanding of the current operating environment on the target machine
It applies both defensively and offensively
Allows you to get an idea of what the system is used for and what type of users use it
Used to decide what courses of action are appropriate for the system

98
Q

Situational Awareness - What areas are the most important to be aware of?

A 
Running Processes
Active Users
Network Configuration
Network Communications
Logging
Scheduled Jobs
Aliases
99
Q

What runs SMSS

A

NTOSKRNL

100
Q

What runs WININIT?

A

SMSS

101
Q

What starts Service Control Manager (SCM)?

A

WININIT

102
Q

What starts Local Security Authority SubSystem (LSAAS)?

A

WININT

103
Q

What starts Local Session Manager (LSM)?

A

WININIT

104
Q

What starts CSRSS?

A

SMSS

105
Q

What starts Winlogon?

A

CSRSS

106
Q

What starts Userint?

A

WInlogon

107
Q

What starts Explorer?

A

Userinit

108
Q

What starts Winload?

A

Bootmgr

109
Q

What starts NTOSKRNL?

A

Winload

110
Q

What starts Services.exe?

A

WININIT

BootProcess (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions