Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Mod 7 > Day 3 > Flashcards

Day 3 Flashcards

(44 cards)

Start Studying
1
Q

Master Keys

A

contain everything in the registry

HKU and HKLM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

HKEY_USERS (HKU)

A

contains a SID sub-key for all loaded user profiles for all users currently logged in.
these profile environment settings are stored in each user’s NTUSER.dat file and loaded at login

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

HKEY_LOCAL_MACHINE (HKLM)

A

HKLM contains the hardware, SAM, security, software, and system sub-keys. The BCD000000 sub-key was introduced with 6.0 version architectures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

HKLM sub-keys

A

HKLM\BCD000000 contains boot configuration data, used with 6*architectures
HKLM\HARDWARE volatile hive created at boot that contains hardware information provided by the firm ware (created every time the system is started
HKLM\SAM contains local account information as well as password values.
HKLM\SECURITY contains cached logons and local security policy
HKLM\SOFTWARE contains a collection of sub-keys for various installed components and programs
HKLM\SYSTEM contains control sets from which HKCC is derived

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

HARDWARE subkey

A

volatile….contains information about currently installed hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SAM sub-key

A

contains all local account information.

SAM subkeys:account, passwords, built-in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SECURITY sub-key

A

security sub-key contains information about cached logons, policy, special accounts, and RXACT package
the CACHED subkey contains logon information for the last 10 people.
the POLICY subkey contains security settings for users, groups, and other components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SOFTWARE Sub-Key

A

CurrentVersion defines current installation of Windows
CurrentVersion/Run list of exe’s that run on system startup.
CurrentVersion\RunOnce runs an exe the next time a user logs on and then deletes it
CurrentVersion\RunServices Similar to run but for services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SYSTEM Sub-Key

A

ControlSet001-The control set (copy of windows) that booted
ControlSet002-The last known good control set (copy of windows) prior to current boot
CurrentControlSet an alias to ControlSet001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

subkeys to the system subkeys

A

each system subkey has the following subkeys:
Control-for booting and system initialization and has its own subkeys
LSA (Local Security Authority). Validates security for local users
Session Manager-Manages user’s session and basic startup
TimeZoneInformation-manages time and time zones
Product Options- System determines which edition is booted by querying registry values

Enum (a SYSTEM subkey like Control)–represents beginning of a hardware tree.
USB/USBSTOR-logs information for all USB devices connected to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Derived Keys

A

shortcuts to the master keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

HKEY_CLASSES_ROOT (HKCR)

A

used to associate file types with programs that are used to open them.
derived from two keys: HKLM\SOFTWARE\CLASSES and HKU\Software\Classes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HKEY_CURRENT_USER (HKCU)

A

contains user profile environment settings of the interactively logged on user. whenever an interactive logon loads a profile, HKCU is derived from HKU\SID.
Changes to environment settings are normally saved to HKU\SID (ntuser.dat file) at logoff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

HKEY_CURRENT_CONFIG (HKCC)

A

used to establish current hardware congif profile.
derived from HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.
Windows 6.* architecture no longer support hardware profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Registry values

A

keys contain values consisting of name, data type, and corresponding data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

data types

A

REG_BINARY Raw binary data
REG_DWORD 32-bit numbers expressed in hex or decimal
REG-SZ A fixed-length text string
REG-EXPAND_SZ A variable-length data string allowing use of environmental variables
REG_MULTI_SZ contains lists or multiple string values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Command line registry manipulation

A

REG Add add an object or value to registry
Reg query displays object value
Reg delete removes an object
Reg copy changes path or moves to another machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

windows architecture

Study These Flashcards
A

Windows OS architecture was developed with very clear design goals: extensibility, portability, reliability, security, compatibility, performance

19
Q

extensibility

Study These Flashcards
A

meet ever-changing market demands

20
Q

portability

Study These Flashcards
A

adaptable for innovations and new technologies

21
Q

reliability

Study These Flashcards
A

protect itself from internal malfunctions and faulty applications

22
Q

security

Study These Flashcards
A

meet government and industry requirements for system securtiy

23
Q

compatibility

Study These Flashcards
A

provide extended legacy support and integration with other systems

24
Q

performance

Study These Flashcards
A

fast and responsive

25
Kernel Mode (Ring 0)
Most privileged ring. closest to hardware privileged to perform almost any action access to all system memory and entire CPU instruction set
26
User Mode (Ring 3)
closest to user user applications OS interface and system software greatly limited in permission and authority
27
session manager (smss.exe)
- smss.exe is loaded by the kernal during the boot process. smss.exe is responsible for: - creates system wide environment variables - initializes swap file (pagefile.sys) - initializes remaining HKLM sub-keys (SOFTWARE,SAM,SECURITY) - starts session 0 subsystem process (csrss.exe) and loads kernel mode portion of the subsystem (win32k.sys) - starts windows initialization process (wininit.exe) only started by master session manager at session 0 - master session manager (session) initializes a copy of itself as session 1 - session 1 session manager process (smss.exe) starts the subsystem for session 1 (csrss.exe and win32k.sys) - session 1 session manager then starts winlogon.exe for session 1 - session 1 manager exits
28
csrss.exe
the subsystem process. subsystem DLL's run in this process
29
subsystem dll's containing documented windows API functions | dll's for csrss.exe
kernel32.dll-contains code that gives programs access to system functions user32.dll-contains basic functions, such as window management, user input, text, etc. gdi32.dll-part of the Windows Graphics Device interface that allows applications to use graphics advapi32.dll- advanced API services...phasing out with 6.1 architectures KERNELBASE.dll-introduced with 6.1, is a combination of kernel32 and advapi32 libraries
30
win32k.sys
subsystem kernel mode device driver. | enables kernel to use the services from gdi32.dll
31
conhost.ext
message handling intermediary between the console and the csrss.exe to protect against certain exploits.
32
wininit.exe
started by the master session manager (session 0). has the: Service Control Manager(SCM) (services.exe) Local Security Authority(LSA) (lsass.exe) Local Session Manager (LSM)(lsm.exe)
33
SCM (services.exe)
responsible for managing services (such as DHCP and DNS)
34
LSA (lsass.exe)
utilizes authentication packages to perform user credential verifications for local and domain logins. The SAM runs in the context of isass.exe as a DLL, samsrv.dll for 6*, and samsrv.dll and samlib.dll for 5*
35
LSM (lsm.exe)
manages the state of sessions on the local system. communicates with Winlogon and csrss.exe logon and logoff session connects and disconnects desktop locks/unlocks. notifies the csrss.exe of session connections and terminations
36
Winlogon (winlogon.exe)
handles interactive user logons and logoffs. | Secure Attention Sequence (SAS) is a logon request initiated with CTRL+ALT+DEL
37
logonui.exe
used by winlogon to retrieve/accept credentials and pass them to the lsass.exe
38
native api (ntdll.dll
contains internal support functions used by subsystem DLL's and serves as the dispatch to the Windows executive. When a subsystem function requests a kernel mode service, ntdll.dll translates the request into the actual system call dispatched to the system call handler
39
applications
user applications don't call system services directly, but instead rely on API functions contained in subsystem DLL's
40
task manager (taskmgr.exe)
a built in windows tool used to view and manage active processes
41
explorer (explorer.exe)
the windows user interface | our desktop!
42
windows 32 on windows64 (wow64)
wow 64 acts as the emulator for allowing 32-bit applications to run seamlessly on a windows 64-bit OS
43
redirecting DLL's
wow64.dll-- translates between 32-bit and 64-bit calls wow64cpu.dll-- provides architecture specific support and manages switching the CPU between 32-bit and 64 bit modes wow64Win.dll-- intercepts gui system calls exported by win32k.sys
44
for 32-bit applications, Wow64 redirects all path related api calls by replacing the 64-bit directory location with the 32-bit location
64-bit 32 bit \program files \program files (x86) 3rd party 64 bit images 3rd party 32 bit images \windows\system32 \windows\syswow64 built-in 64 bit images 32 bit images and Dll's (cmd.exe) and DLL's needed for redirection including wow64 DLL's

Mod 7 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions