Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Microsoft Windows Kernel Architecture > Flashcards

Microsoft Windows Kernel Architecture Flashcards

1
Q

Operating systems are fundamentally an abstraction layer between users and physical components:

A
  • Simplification of interactions
  • Ability to replace components, at times including emulation
  • Most modern systems provide different types of multiplexing and protective mechanisms
  • Requirements vary considerably: General-purpose systems value responsive multi-programming, transaction processing can be accomplished with batch programming and real-time systems require provable response-time boundaries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Core Operating System Functions - Scheduling:

A
  • Prioritisation, fairness

* Deadlock avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Core Operating System Functions - Memory Management:

A
  • Protection of concurrent programs, self-protection

* Virtual memory abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Core Operating System Functions - Storage Management:

A

Persistent storage provisioning in a consistent abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Core Operating System Functions - I/O Management:

A
  • Abstraction of hardware properties

* Synchronization and concurrency management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Most modern operating systems use a modular or layered construction. Privileges are also used in different modes or rings, Windows uses…

A

Ring based approach, but with only two rings active. Legacy of the original multi-platform design : MIPS, PPC. Only supported two modes. Important ramifications for security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

While subsequent generations have embellished the architecture of Windows NT…

A

The current generation (Win8) takes a step back an uses a more minimal (MinWin) core. Several subsystems have since been added, but some also have been depreciated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The Universal Windows Platform app mechanism introduces a parallel user mode layer; on desktop platforms the Win32 layer will be retained. UAP is a…

A

Superset of the earlier Windows 8, RT and WinRT user-mode runtime environment based in part of the Metro interface. UAP Applications are sandboxed and restricted to only a subset of the Win32 and COM APIs either via a Windows Runtime component or the Platform Invocation Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The Hardware Abstraction Layer (HAL) provides an abstraction to upper kernel layers that insulates particulars of given hardware platforms, primarily:

A
  • Multi-processor, multi-core and independent execution units
  • Interrupt controllers
  • Low-level I/O interfaces
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Layered between the HAL and Executive is the Kernel, which was the core of the original microkernel design:

A

Layered between the HAL and Executive is the Kernel, which was the core of the original microkernel design:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Executive Components - Object Manager:

A

Windows uses objects to encapsulate most resources, their creation, destruction, control and protection is handled through the Object Manager, which also provides name spaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Executive Components - Objects are divided into Administrative Elements:

A

Name, handle and reference count, type information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Executive Components - Kernel Objects:

A

Owned by the kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Executive Components - Executive Objects:

A

Owned by the executive, if it is not an outright kernel object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Executive Components - Configuration Manager:

A

Responsible for implementation and management of Registry database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Executive Components - Advanced Local Procedure Call:

A

Message passing interface between client and server processes, also used as local transport for RPC calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Executive Components - I/O Manager:

A

Provides device-independent I/O and is the interface to layered device driver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Executive Components - Cache Manager:

A

Retains recently referenced file I/O in memory and manages deferred writing of cache content, cache replacement. Tied closely to the Memory Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Executive Components - Process Manager:

A

Creates and terminates threads and processes, mainly as a layered service on top of the microkernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Executive Components - Memory Manager:

A

Implements Virtual Memory Management, including providing virtual address spaces, fie mapping, locking of physical memory and shared memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Executive Components - Power Manager:

A

Coordinates power events and generates notifications to device drivers and can put CPU to sleep in idle conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Executive Components - Plug & Play:

A

Determines types of drivers required to support devices and loads installs driver packages. Also assigns resources and must handle system notifications of device addition or removal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Executive Components - System Reference Monitor:

A

Enforces security policies on the local computer system, performs run-time object protection and auditing, communicates with user-mode components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Executive Components - Kernel-Mode Driver Contains Windows Subsystems - GDI

A

Abstraction layer for graphics interfaces (2D)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Executive Components - Kernel-Mode Driver Contains Windows Subsystems - DXG:

A

Provides a wrapper and access interface for other services via a common interface (DDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Executive Components - Kernel-Mode Driver Contains Windows Subsystems - USER:

A

Provides window manager and graphics services including keyboard and mouse, messaging services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Executive Components - Hypervisor Library:

A

Kernel support for Hyper-V virtualisation and operating in a client partition of a virtual machine environment

28
Q

Executive Components - Kernel Transaction Manager:

A

Provides a common 2-phase commit protocol for resource managers including transactional registry and transactional NTFS

29
Q

Executive Components - Kernel Debugger Library:

A

Provides access to kernel debuggers using KD protocol layers

30
Q

Executive Components - Errata Manager:

A

Contains workarounds for non-standard hardware, known errors, or non-compliant hardware components

31
Q

The I/O subsystem must meet multiple objectives:

A
  • Insulate shareable resources and provide abstractions
  • Dynamic loading and unloading of device drivers
  • Providing layered device drivers for extensions and modifications to driver behaviour
  • Supporting installable file systems
32
Q

Microsoft Windows I/O Components - I/O Manager:

A

Orchestrates I/O processing and connects application and kernel components

33
Q

Microsoft Windows I/O Components - Device Drivers:

A

Provides I/O interfaces for a particular device or class of devices in case of layered drivers. May also only provide aspects to other drivers

34
Q

Microsoft Windows I/O Components - PnP Manager:

A

Allocates resources, monitors and manages addition and removal devices. This is performed in coordination with the I/O Manager and bus drivers for gives types of interfaces

35
Q

Microsoft Windows I/O Components - Power Manager:

A

Handles power-state transitions, individual power states must be realised by device drivers

36
Q

Microsoft Windows I/O Components - Windows Management Instrumentation (WMI):

A

The Windows Management Instrumentation (WMI), also referred to as the Windows Driver Model (WDM) support, provides an interface with the user-mode WMI service

37
Q

Microsoft Windows I/O Components - Registry:

A

The registry holds a database for basic device data and individual driver configurations

38
Q

Microsoft Windows I/O Components - Configuration Files:

A

Driver installation files (.INF files) are scripts describing specific devices

39
Q

Microsoft Windows I/O Components - HAL:

A

The HAL provides abstractions for I/O mechanisms and is the bus driver “root” for all devices and interfaces on the mainboard

40
Q

I/O Request Flow:

A

User-Mode API > I/O System API > Kernel-Mode Device Drivers > HAL I/O Access Routines > I/O Ports and Registers

41
Q

User-Mode Device Driver - Virtual Device Drivers:

A

VDDs are only for 16-bit legacy systems are no longer supported on 64-bit platforms

42
Q

User-Mode Device Driver - Printer Drivers:

A

Responsible for translating device-independent graphics commands to device-specific ones. These are typically forwarded to kernel-mode port drivers

43
Q

User-Mode Device Driver - UMDF:

A

The User-Mode Driver Framework allows drivers to be hosted in used mode

44
Q

Kernel-Mode Device Driver - File System Drivers:

A

This type of layered driver accepts I/O requests for files and translates them into mass-storage or network driver requests, potentially across multiple layers

45
Q

Kernel-Mode Device Driver - Plug and Play Drivers:

A

These are aware of PnP and interoperate with the PnP and Power Manager

46
Q

Kernel-Mode Device Driver - Non-PnP Drivers:

A

May either be legacy drivers or ones that are not linked to specific hardware such as when extending kernel functionalities

47
Q

Kernel-Mode Device Driver - Windows Display Driver Model (WDDM):

A

The Windows Display Driver Model introduced with Vista and changed in each version since

48
Q

Windows Driver Model - Bus Drivers:

A

These Manage physical or logical buses and are responsible for handling device additions and removals together with the PnP manager, power setting for the bus and communicating with attached devices

49
Q

Windows Driver Model - Function Drivers:

A

These handle the actual devices as presented through the PnP manager and bus driver and provide the operating system with an interface to device functions

50
Q

Windows Driver Model - Filter Drivers:

A

These can be logically layered above or below function drivers and modify or extend behaviour of a device or another device driver

51
Q

Windows Driver Model - Miniport Drivers:

A

Provide a mapping of generic I/O to a port into requests specific to a device

52
Q

Simple Layering Example (File Access):

A

1) User-mode component places call: NtWriteFile(file_handle, buffer)
2) System services translate call into I/O Manager requests
3) I/O Manager instructs file system driver(FSD) to write at specific offset into a file
4) FSD translates file-relative to volume-relative offsets and calls next driver via I/O Manager
5) I/O Manager calls disk driver to write data at specified volume-relative offset
6) Disk driver translates volume-relative offset into disk-relative offset and transfers data

53
Q

Display drivers have been dealt with as a special case since Windows NT 4.0 resulting in a number of legacy interfaces:

A
  • With increasing graphics processing unit (GPU) power, off-loading of computations and rapid memory access became more important
  • The WDDM differs from the regular WDM and has also undergone significant changes, including in to WDDM 2.0 in Windows 10 introducing GPU virtual addressing - previously GPUs were able to access main memory directly, placing a burden on the host to manage virtual memory
  • Code on the GUP running in physical rather than virtual address mode may independently read and modify arbitrary memory locations
54
Q

One design objective for Windows was to consolidate system and user configuration data into a common database format…

A

This is separated into multiple databases based on usage

55
Q

Some applications may still use custom configuration file formats…

A
  • These can come in different formats, the legacy .INI format is merely one of them: Unstructured and un-typed key/value pairs
  • Others may include separate or proprietary database formats, RDF, plain or customised XML files or relational databases
56
Q

Registry Database - Keys:

A

Can be considered similar to directories in file systems and may themselves contain subkeys. Top-level keys are referred to as root keys

57
Q

Registry Database - Values:

A

Can be considered comparable to files

58
Q

Registry Sections and Hives - HKEY_CURRENT_USER:

A

Data associated with the currently logged-on user. This is stored in a separate file (NTUSER.DAT or USRCLASS.DAT) and can be used in a roaming profile

59
Q

Registry Sections and Hives - HKEY_CLASSES_ROOT:

A

File associations and Component Object Model (COM) object registration information. This information is merged from machine- and user-specific data

60
Q

Registry Sections and Hives - HKEY_LOCAL_MACHINE:

A

System-related information for the local machine (authentication or SAM, security, software and system keys; hardware-related keys are generated dynamically and are not stored in the database)

61
Q

Registry Sections and Hives - HKEY_USERS:

A

Data for all local user accounts

62
Q

Registry Sections and Hives - HKEY_PERFORMANCE_DATA:

A

Performance information

63
Q

Registry Sections and Hives - HKEY_CURRENT_CONFIG:

A

Volatile information generated at boot time and amended during run-time

64
Q

In networked Windows environments, user authentication and data as well as access control is often maintained via Active Directory…

A

This is an extended version of the LDAP protocol. A number of further services (Kerberos authentication, name resolution, network administration) are also supported. Organisation is into domains and forests and can replicate across sites and trust hierarchies

65
Q

The interacts with local configuration databases and the local authentication and Security Account Manager (SAM) subsystem. Access and changes to a local registry can also be…

A

Constrained by Group Policy entries among other attributes. This is typically used in larger enterprise environments

Digital Forensics (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions