win_internals Flashcards
What is the Windows NT code base?
The code base used by Windows NT beginning with version 3.1.
What is the Windows API?
The system programming interface to the Windows operating system family.
Where is the Windows API described?
In the Windows Software Development Kit (SDK) documentation. (www.msdn.microsoft.com)
What does the Windows API consist of?
Thousands of callable functions
What 7 major categories is the Windows API divided into?
- Base services
What are some of the key base services in the Windows API? (4)
- Processes and threads
What does the .NET framework consist of?
- A library of classes called the Framework Class Library (FCL) and
What are Windows API functions?
Documented, callable subroutines in the Windows API
What are native (or executive) system services?
The undocumented, underlying services in the operating system that are callable from user mode.
What are Windows services?
Processes started by the Windows service control manager
What are DLLs?
A set of callable subroutines linked together as a binary file that can be dynamically loaded by applications that use the subroutines
What is the difference between a program and a process?
A program is a static sequence of instructions, whereas a process is a container for a set of resources used when executing the instance of the program.
At the highest level of abstraction, what is a Windows process comprised of? (6)
- A private virtual address space
What do all threads within a process share?
The process’s virtual address space (in addition to the rest of the resources belonging to the process) meaning that all the threads in a process can write to and read from each other’s memory
When can threads in one process reference the address space of another process? (2)
- When the other process makes available part of its private address space as a shared memory section (called a file mapping object in the Windows API) or
In addition to a private address space and one or more threads, what does each process have?
A security identification (contained in the access token) and a list of open handles to objects (such as files, shared memory sections), or one of the synchronization objects (such as mutexes, events, or semaphores)
Where is a process’s security context stored?
In an object called an access token
What does a process’s access token contain?
The process’s security identification and credentials
Do threads have their own access tokens?
By default, threads don't have their own access token, but they can obtain one.
If a thread obtains its own access token, what becomes possible?
Individual threads can impersonate the security context of another process—including processes running on a remote Windows system—without affecting other threads in the process.
What are virtual address descriptors?
Virtual address descriptors (VADs) are data structures that the memory manager uses to keep track of the virtual addresses the process is using.
What is a job?
An extension to the process model.
What is a job object’s main function?
To allow groups of processes to be managed and manipulated as a unit.
When using virtual memory, how does the operating system ensure that individual processes don't bump into one another or overwrite operating system data?
At run time, the memory manager, with assistance from hardware, translates, or maps, the virtual addresses into physical addresses, where the data is actually stored. By controlling the protection and mapping, the operating system can ensure that individual processes don't bump into one another or overwrite operating system data
How does using virtual memory work when most systems have much less physical memory than virtual memory?
The memory manager transfers, or pages, some of the memory contents to disk which frees physical memory so that it can be used for other processes or for the operating system itself.
What happens if a thread accesses a virtual address that has been paged to disk?
The virtual memory manager loads the information back into memory from disk.
On a 32-bit x86 system, what is the theoretical maximum of the total virtual address space?
4GB
How does Windows allocate virtual address space?
2GB (the lower half from x00000000 through x7FFFFFFF) are allocated to processes for their unique private storage.
Why does Windows use two processor access modes?
To protect user applications from accessing and/or modifying critical operating system data
What does kernel mode refer to?
A processor execution mode that grants access to all system memory and all CPU instructions
What privilege levels (rings) does Windows use for kernel mode and user mode?
Windows uses privilege level 0 (or ring 0) for kernel mode and privilege level 3 (or ring 3) for user mode.
Why does Windows use only two of the four available privilege levels?
Some hardware architectures that were supported in the past (such as Compaq Alpha and Silicon Graphics MIPS) implemented only two privilege levels.
Although each Windows process has its own private memory space, these two share a single virtual address space:
The kernel-mode operating system and device driver code
How are read/write restrictions maintained between pages in system space and pages in user address space?
Each page in virtual memory is tagged as to what access mode the processor must be in to read and/or write the page. Pages in system space can be accessed only from kernel mode, whereas all pages in the user address space are accessible from user mode.
