Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mod 7 > Day 3 > Flashcards

Day 3 Flashcards

1
Q

Master Keys

A

contain everything in the registry

HKU and HKLM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

HKEY_USERS (HKU)

A

contains a SID sub-key for all loaded user profiles for all users currently logged in.
these profile environment settings are stored in each user’s NTUSER.dat file and loaded at login

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

HKEY_LOCAL_MACHINE (HKLM)

A

HKLM contains the hardware, SAM, security, software, and system sub-keys. The BCD000000 sub-key was introduced with 6.0 version architectures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

HKLM sub-keys

A

HKLM\BCD000000 contains boot configuration data, used with 6*architectures
HKLM\HARDWARE volatile hive created at boot that contains hardware information provided by the firm ware (created every time the system is started
HKLM\SAM contains local account information as well as password values.
HKLM\SECURITY contains cached logons and local security policy
HKLM\SOFTWARE contains a collection of sub-keys for various installed components and programs
HKLM\SYSTEM contains control sets from which HKCC is derived

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

HARDWARE subkey

A

volatile….contains information about currently installed hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SAM sub-key

A

contains all local account information.

SAM subkeys:account, passwords, built-in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SECURITY sub-key

A

security sub-key contains information about cached logons, policy, special accounts, and RXACT package
the CACHED subkey contains logon information for the last 10 people.
the POLICY subkey contains security settings for users, groups, and other components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SOFTWARE Sub-Key

A

CurrentVersion defines current installation of Windows
CurrentVersion/Run list of exe’s that run on system startup.
CurrentVersion\RunOnce runs an exe the next time a user logs on and then deletes it
CurrentVersion\RunServices Similar to run but for services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SYSTEM Sub-Key

A

ControlSet001-The control set (copy of windows) that booted
ControlSet002-The last known good control set (copy of windows) prior to current boot
CurrentControlSet an alias to ControlSet001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

subkeys to the system subkeys

A

each system subkey has the following subkeys:
Control-for booting and system initialization and has its own subkeys
LSA (Local Security Authority). Validates security for local users
Session Manager-Manages user’s session and basic startup
TimeZoneInformation-manages time and time zones
Product Options- System determines which edition is booted by querying registry values

Enum (a SYSTEM subkey like Control)–represents beginning of a hardware tree.
USB/USBSTOR-logs information for all USB devices connected to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Derived Keys

A

shortcuts to the master keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

HKEY_CLASSES_ROOT (HKCR)

A

used to associate file types with programs that are used to open them.
derived from two keys: HKLM\SOFTWARE\CLASSES and HKU\Software\Classes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HKEY_CURRENT_USER (HKCU)

A

contains user profile environment settings of the interactively logged on user. whenever an interactive logon loads a profile, HKCU is derived from HKU\SID.
Changes to environment settings are normally saved to HKU\SID (ntuser.dat file) at logoff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

HKEY_CURRENT_CONFIG (HKCC)

A

used to establish current hardware congif profile.
derived from HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.
Windows 6.* architecture no longer support hardware profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Registry values

A

keys contain values consisting of name, data type, and corresponding data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

data types

A

REG_BINARY Raw binary data
REG_DWORD 32-bit numbers expressed in hex or decimal
REG-SZ A fixed-length text string
REG-EXPAND_SZ A variable-length data string allowing use of environmental variables
REG_MULTI_SZ contains lists or multiple string values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Command line registry manipulation

A

REG Add add an object or value to registry
Reg query displays object value
Reg delete removes an object
Reg copy changes path or moves to another machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

windows architecture

A

Windows OS architecture was developed with very clear design goals: extensibility, portability, reliability, security, compatibility, performance

19
Q

extensibility

A

meet ever-changing market demands

20
Q

portability

A

adaptable for innovations and new technologies

21
Q

reliability

A

protect itself from internal malfunctions and faulty applications

22
Q

security

A

meet government and industry requirements for system securtiy

23
Q

compatibility

A

provide extended legacy support and integration with other systems

24
Q

performance

A

fast and responsive

25
Q

Kernel Mode (Ring 0)

A

Most privileged ring.
closest to hardware
privileged to perform almost any action
access to all system memory and entire CPU instruction set

26
Q

User Mode (Ring 3)

A

closest to user
user applications
OS interface and system software
greatly limited in permission and authority

27
Q

session manager (smss.exe)

A
  • smss.exe is loaded by the kernal during the boot process. smss.exe is responsible for:
  • creates system wide environment variables
  • initializes swap file (pagefile.sys)
  • initializes remaining HKLM sub-keys (SOFTWARE,SAM,SECURITY)
  • starts session 0 subsystem process (csrss.exe) and loads kernel mode portion of the subsystem (win32k.sys)
  • starts windows initialization process (wininit.exe) only started by master session manager at session 0
  • master session manager (session) initializes a copy of itself as session 1
  • session 1 session manager process (smss.exe) starts the subsystem for session 1 (csrss.exe and win32k.sys)
  • session 1 session manager then starts winlogon.exe for session 1
  • session 1 manager exits
28
Q

csrss.exe

A

the subsystem process. subsystem DLL’s run in this process

29
Q

subsystem dll’s containing documented windows API functions

dll’s for csrss.exe

A

kernel32.dll-contains code that gives programs access to system functions
user32.dll-contains basic functions, such as window management, user input, text, etc.
gdi32.dll-part of the Windows Graphics Device interface that allows applications to use graphics
advapi32.dll- advanced API services…phasing out with 6.1 architectures
KERNELBASE.dll-introduced with 6.1, is a combination of kernel32 and advapi32 libraries

30
Q

win32k.sys

A

subsystem kernel mode device driver.

enables kernel to use the services from gdi32.dll

31
Q

conhost.ext

A

message handling intermediary between the console and the csrss.exe to protect against certain exploits.

32
Q

wininit.exe

A

started by the master session manager (session 0). has the:
Service Control Manager(SCM) (services.exe)
Local Security Authority(LSA) (lsass.exe)
Local Session Manager (LSM)(lsm.exe)

33
Q

SCM (services.exe)

A

responsible for managing services (such as DHCP and DNS)

34
Q

LSA (lsass.exe)

A

utilizes authentication packages to perform user credential verifications for local and domain logins.
The SAM runs in the context of isass.exe as a DLL, samsrv.dll for 6, and samsrv.dll and samlib.dll for 5

35
Q

LSM (lsm.exe)

A

manages the state of sessions on the local system.
communicates with Winlogon and csrss.exe
logon and logoff
session connects and disconnects
desktop locks/unlocks.
notifies the csrss.exe of session connections and terminations

36
Q

Winlogon (winlogon.exe)

A

handles interactive user logons and logoffs.

Secure Attention Sequence (SAS) is a logon request initiated with CTRL+ALT+DEL

37
Q

logonui.exe

A

used by winlogon to retrieve/accept credentials and pass them to the lsass.exe

38
Q

native api (ntdll.dll

A

contains internal support functions used by subsystem DLL’s and serves as the dispatch to the Windows executive.
When a subsystem function requests a kernel mode service, ntdll.dll translates the request into the actual system call dispatched to the system call handler

39
Q

applications

A

user applications don’t call system services directly, but instead rely on API functions contained in subsystem DLL’s

40
Q

task manager (taskmgr.exe)

A

a built in windows tool used to view and manage active processes

41
Q

explorer (explorer.exe)

A

the windows user interface

our desktop!

42
Q

windows 32 on windows64 (wow64)

A

wow 64 acts as the emulator for allowing 32-bit applications to run seamlessly on a windows 64-bit OS

43
Q

redirecting DLL’s

A

wow64.dll– translates between 32-bit and 64-bit calls
wow64cpu.dll– provides architecture specific support and manages switching the CPU between 32-bit and 64 bit modes
wow64Win.dll– intercepts gui system calls exported by win32k.sys

44
Q

for 32-bit applications, Wow64 redirects all path related api calls by replacing the 64-bit directory location with the 32-bit location

A

64-bit 32 bit
\program files \program files (x86)
3rd party 64 bit images 3rd party 32 bit images
\windows\system32 \windows\syswow64
built-in 64 bit images 32 bit images and Dll’s
(cmd.exe) and DLL’s needed for redirection
including wow64 DLL’s

Mod 7 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions