Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mod 7 > Day 4 > Flashcards

Day 4 Flashcards

1
Q

ntoskrnl.exe

A

the kernel process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

HAL.DLL (hardware abstraction layer)

A

a kernel-loadable module that operates between the hardware and the executive so that applications an device drivers don’t have to be aware of hardware-specific information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Kernel

A 
lower layer of ntoskrnl.exe
has 4 main responsibilities:
Thread scheduling
Interrupt and exception handling
Low-level processor synchronization
power failure Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Windows executive

A

the upper layer of ntoskrnl.exe and is the Windows system call handler that verifies and provides kernel services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Windows executive components

A

Object manager, security reference monitor, process manager, virtual memory manager, I\O manager, asynchronous local inter-process communication, configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

object manager

A

provides standardized interface for every system object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

security reference monitor

A

enforces local computer security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

process manager

A

creates, manages, and terminates processes and threads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

virtual memory manager

A

provides private address space for each process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

I\O manager

A

processes all file and I\O requests; responsible for dispatching to device drivers as well as plug and play capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

asynchronous local inter-process communication (ALPC)

A

passes messages between client and server processes on the same computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

configuration manager

A

responsible for implementing and managing the registry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

object criteria

A

Each object belongs to a statically defined class
Objects are kernel services that multiple processes can share.
A process references objects via handles
Objects use pointers to reference and use other objects within kernel mode
Objects use hierarchical directories and naming structures
Objects are protected by object-based security and support synchronization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Object manager

A

key responsibilities: standardizing the interface with all objects, object retention, and object security.

each object has an object header and object body

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

object header and object body

A 
the object header stores data used by the object manager to manage objects regardless of their type or class.
Key object header fields:
Name
security descriptor
handle count
reference count

the executive manager responsible for creating the object controls the object body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

object header attributes

A

object type: points to the type of object it is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

type object attributes

A

methods: one or more routines that the object manager calls at certain points in an objects lifetime.
(the actions or routines the objects can perform)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

object methods

A

open
close
delete

19
Q

object security

A

specifies who can perform what actions on the object.

the SECURITY DESCRIPTOR holds the ACL for that object

20
Q

Security Descriptor

A

built from information from the following sources
default security
inherited from parent object
explicit permissions set by user

21
Q

ACL’s

A

there are two types of ACL’s: DACL and SACL

22
Q

DACL

A

identifies permissions to a resource
Empty DACL -no access to anyone
null DACL-access to everyone

23
Q

SACL

A

controls how the system audits object access attempts

24
Q

Security Reference Monitor (SRM)

A

enforces security policies.
guards kernel mode resources by performing object access protection and auditing.
The OBJECT MANAGER calls the SRM.

25
Q

two functions of the SRM

A

compares the process’s access token to the object’s security descriptor to determine whether access is permitted.
Generates most of the audit records in the Security event log

26
Q

windows security audits

A

used to track both user and system activities

we focus on OBJECT ACCESS events

27
Q

process manager

A

creates, manages, and terminates processes and threads

28
Q

process resources

A 
Handles
an Executable program (image file)
an Access token
a Private virtual address space
PID
Thread
29
Q

more on processes

A

although processes inherit handles and variables from their parents, each process is self contained. a parent can exit without effecting the child

30
Q

the seven stages of process completion

A

Step 1: Executable calls CreateProcess() function
Step2: System call opens the image
Step3: create executive process object
Step4: create the initial thread
Step5: subsystem notifications
Step6: start execution of initial thread
Step7 finalize new process initialization

31
Q

Virtual memory manager (VMM)

A

two primary tasks:
mapping
swapping

uses a swap file (pagefile.sys) for swapping memory

32
Q

VMM also performs:

A

provides a set of system services to virtual memory
shares memory between processes
maps files into memory
retrieves information about a range of virtual pages
changes virtual page protection
locks virtual pages into memory

33
Q

32 bit address space address space

A

x86 architecture uses 4GB of RAM

34
Q

64 bit address space

A

x64 architecture is aproximately 16 exabytes
current processors limit support to 256TB (only uses 48 of the 64 bit address space.

Windows 64 bit limits address space to 16TB.
8TB to the top space for the Kernel
8TB to the bottom space for the user.
the space in the middle is Free Space. if the top meets the bottom, an overflow occurs

35
Q

Paging

A

divides aprocess’s virtual address space and physical memory (RAM) into equally-sized chunks

36
Q

Page status

A

pages can be:
Free
reserved
committed

37
Q

VMM mapping virtual address to frame addess

A

Page Table Selector PTS
Page Table PT
Page Table Entry 48 bit PTE
Page Table Entry Selector PTES
12 bits Offset

38
Q

reasons for page faults

A

accessing a page that has been swapped out to disk
Accessing a page that isn’t committed
Attempting to write to a page that is read-only
Executing code in a page that is marked as “no execute”

39
Q

shared memory

A

memory that is visible or present in more than one process’s virtual address space

40
Q

memory protection :to keep processes from potentially corrupting unauthorized address space in the following ways

A

Each process has virtual address space
PTE control bits and ACL’s prevent unauthorized access
No execute page protection (DEP)
hardware controlled memory protection

41
Q

I\O manager

A

connects applications and system components to virtual, logical, and physical devices
Device, file, driver

42
Q

I\O requests

A

An I\O request packet (IRP) represents most I\O requests

43
Q

Asynchronous Local Inter-process communication (ALPC)

A

a message passing mechanism that passes requests.

actual method of communication

44
Q

Configuration manager

A

responsible for implementing and managing the system registry.
ensures the registry is always in a recoverable state

Mod 7 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions