1109127
Description
Flashcards by jeriel.juarbe, updated more than 1 year ago
|
Created by jeriel.juarbe
almost 12 years ago
|
|
| Question | Answer |
| What are the 4 Design goals of Windows? | -object-based modular design -portability -highly reliable kernel -compatibility (support legacy apps) |
| 3. What are the 2 processor rings/ privilege levels? | Kernel Mode (Ring 0) and User Mode (Ring 3) |
| This privelege mode is closest to the hardware and can perform almost any action? | Kernel Mode (Ring 0) |
| This Privilege level is closer to the user and limited in permission and authority... | User Mode (Ring 3) |
| A _____ is comprised of a static sequence of instructions compiled with file name extensions of .exe. | Program or Application |
| What is a Process? | an executing instance of an application. |
| What is considered to be a container with ingredients (executing application's required resources)? | Process |
| -Consists of callable functions implemented as a subsystem. -Uses Dynamic Link Libraries (DLL's) -makes it easier for programmers to create do their jobs | Application Programming Interface (API) |
| What is a set of callable functions and subroutines? -these cannot be executed individually -must function in the context of a process -Can be shared by multiple processes | Dynamic Link Library (DDL) |
| Native API | translates the request into an actual system call. (IE: goes from English to Spanish. In this case the kernel speaks Spanish) |
| Who is that guy who takes care of it? -A kernel-loadable module -operates between the hardware and the Executive | Hardware Abstraction Layer (HAL) |
| hal.dll? | HAL |
| What does the Ntoskrnl.exe do? and When does it happen? | loads the kernel during the boot process |
| What does the HAL do? | so that applications and device drivers do not need to be aware of hardware specific information *It translates! |
| Where is the Kernel located? | Over the HAL Layer |
| The Kernel is object-oriented and had what four main responsibilities? | 1. Recovery from power failures 2. Interrupts and exceptions 3. Thread Scheduling 4. Low-Level Processor synchonization |
| Threads are like what? | minions from despicable me movie...get the work done son |
| The Windows system call handler that verifies and provides kernel services? | The Executive |
| What are the 8 managers in the Executive? | 1. Object Manager 2. Process Manager 3. Virtual Memory Manager (VMM) 4. I/O Manager 5. Security Reference Monitor (SRM) 6. Local Procedure Call (LPC) 7. PnP Manager 8. Configuration Manager |
| Provides standardized interface for every system object. | Object Manager |
| creates, manages, and terminates processes and threads | Process Manager |
| Provides private address space for each process IE:RAM/Swap file | Virtual Memory Manager (VMM) |
| processes all file AND I/O requests. | I/O Manager |
| AKA the club Bouncer: Enforces local computer security policy | Security Reference Manager (SRM) |
| Passes messages between client and server processes on the same computer | (LPC) Local Procedure Call |
| works closely with the I/O Manger: determines which drivers are required to support a particular device and loads loads those drivers. | PnP Manager |
| implements and manages the registry | Configuration Manager |
| What is Registry? | Is the the configuration of your computer |
| What are the 4 ways windows defines an object? | 1. instance of a static class 2. 2 or more user mode processes can share 3. can have names 4. are protected by object-based security |
| Are used as a mechanism for referring to an object indirectly. | Symbolic Link Example: use to translate these MS DOS style device names into window internal device names. (kind of like an ALIAS) |
| Object Manager what two main things? | Object Header and Object Body |
| What is the following describing? 1. Object Name 2. Object Descriptor 3. Open Handle Count 4. Object Type 5. Reference Count | The attributes of the Object Header |
| makes an object visible to other processes for sharing | Object Name |
| Determines who can use the object and what they can do with it | Security Descriptor |
| Counts the number of times a handle has been opened to an object | Open Handle Count |
| Points to a type of object that contains attributes common to objects of this type | Object Type |
| counts the number of times a kernel mode component has referenced the address object | Referenced Count |
| What does the Executive Manager provide to the object manger? | Methods |
| What are methods in regards to the Object Manager? | are actions or routines that their objects can perform |
| The Object manager uses a ____ to contain and manage this common data for each class object. (MASTER MOLD) | Type Object |
| The communication interfaces to the kernel services being requested. | Handles |
| What does Object Retention rely on? | relies on the Open handle count and reference count to determine of an object is in use or if it may be deleted. |
| Open handle count (Accountability) | open handle count is increased or decreased by one |
| Reference Count (Pointers) | known as pointers. also increases and decreases |
| The object manger implements object retention in what 2 phases? | Name Retention & Object Deletion |
| Name Retention | when open handle count reaches zero, the object manager deletes the name from the global namespace |
| Object Deletion | handle count and reference count must both be zero |
| What is known as resource accounting? | charging a process for memory space it occupies |
| How does the object manger build the security descriptor information? | 1. explicitely 2. default security info 3. parent object provides inherit info |
| what are the two types of ACL's contained in the security descriptor? | Discretionary ACLS (DACLS) or System Access ACLS (SACLS) |
| DACL | identifies permissions to a resource |
| SACL | system audits object access attempts |
| what does the Security Reference Manager (SRM) do? | compares the process' access token to the object's security descriptor to determine whether access is permitted. "To get a handle or not to get a handle" |
| this generates most of the audit records in the security event log | SRM |
Want to create your own Flashcards for free with GoConqr? Learn more.