Software Flashcards
1
Q
ASIF
3 Facts
A
Sparse format
Delta layers
Plugin for Amber
2
Q
AMBER
Definition
A
Apple Modular Block Device Library
3
Q
AEBD
Definition
A
Apple Encrypted Block Device
4
Q
KNOX
2 facts
A
Asset database
Fast and secure storage
5
Q
NBD
Definition
A
Network block device
6
Q
FileVault
Definition, Use on ASM
A
Storage encryption with volume key
Class C protection on ASM
7
Q
Data Protection
Definition
A
File Encryption
8
Q
Data Vault
Definition
A
Restrict access to the data of an app from all other requesting apps
9
Q
Sandbox access controls
Definition
A
Restrict what data an app can access
10
Q
GCD
definition and description
A
Grand central dispatch
Execute code concurrently on multicore hardware by submitting work to dispatch queues managed by the system
11
Q
Forward secrecy
Definition
A
Ensures session keys will not be compromised even if long term secrets used in the session key exchange are compromised
12
Q
ARV
Definition
A
Authenticated root volume
13
Q
Evil Maid Attack
Description
A
An attack on an unattended device, in which an attacker alters it in some undetectable way so that they can later access the device, or the data on it.
14
Q
ABD
description
A
file format for external customers that support AMBER like functions
15
Q
ACS
Definition
A
Apple Cloud Service
16
Q
DT
Apple Team
definition, two goals
A
Developer Tools
Planning to use virtual machine to test different OS and Xcode
replace Xcode simulator
17
Q
MAC stadium
Purpose
A
Build and run with macOS in the cloud
18
Q
Journaling file system
Description
A
Keep track of uncommitted changes in a data structure to avoid data corruptions
19
Q
CAS
Apple Technology
Description
A
Build server
20
Q
What are the two ways to find build records?
A
xbs buildrecords
knox download/extract build-record
21
Q
Libkrun
Description
A
Rust based virtual machine monitor that links directly to hypervisor framework
22
Q
Orbstack
Purpose
A
Run docker container and Linux on macOS VM
23
Q
Accelerate framework
Apple Software Stack
Description
A
Make large scale mathematical computations and image calculations using SME and AMX
24
Q
define, who, what
ESP
Networking Technology
A
Encapsulating security payload
Member of IPSec set of protocols
encrypt and authenticate the data packets between computers using a VPN
25
# Description
VMNet
| Apple Tech
Apple Framework for virtual machines to read and write packets
26
# Description
Stolen time
Time that guest is ready to run but not scheduled
27
# Description
Network link conditioner
Xcode tool to control bandwidth, latency and packet loss
28
# Description
VZVirtioSocketDevice
A device that manages port-based connections between guest and host
29
Four trap controls for performance monitors
| ARM
ARM PMU register
CPMU, UPMU and CLPC registers
30
How CPMU registers are partitioned
| ARM
Guarded vs unguarded
Host vs guest
31
Two functions of PMCR0_EL1
| ARM
Enabling CPMU counters
Configuring overflow interrupts
32
# Description
Apple framework
A bundled shared library (dylib), which contains code and miscellaneous files
33
# 3 Facts
libSystem
| Apple Tech
Darwin’s most essential library
Services provided by the lowest level of the C runtime
Wrappers over kernel functions
34
# Definition
NMOS
| Apple Term
Next mainline OS
35
# Description
Linux namespace
Partition kernel resources such that a process can only access resources of its namespace
36
# protocol, request, handling
VirtioFS
This uses the FUSE protocol, funnels requests through shared memory, and handles them on macOS
37
# Description
Recap
| Apple Tech
API and CLI to Synthetically playback events or gestures on a device
38
# what, how, who
Virtio Net
Paravirtualized network device
Use shared memory for data transmission
Adopted in Linux and other operating systems
39
# 3 Entitlements
Impacts of entitlements on VM ISA
| Apple Tech
security.hypervisor allows generic ISA
Private.hypervisor.apple - allows Apple ISA
private.hypervisor - allows Apple ISA at least but also internal ISA for
Development kernel, AppleInternal, research guests
40
Darwin’s four kernel interfaces
| Apple Tech
System calls
Mach traps
Machine dependent calls (machdep)
Comm page
41
# definition, info, code, management
ACPI
| Standard
Advanced configuration and power interface
Description of a computer’s configuration and its various components
Associate drivers with its system peripherals
Platform interfaces for power and system management
42
# definition and four management functions
PSCI
| Standard
Power state coordination interface
Core idle management
Dynamic addition and removal of cores
secondary core boot
System shutdown and reset
43
# 4 things defined
SMCCC
| ARM
Defines a common calling mechanism to be used with SMC and HVC
Defines how registers are used to pass parameters and results
Defines service types
Defines Arm architectural calls
44
# definition and description
NAT
| Networking Tech
Network address translation
Map one address space to another by modifying address information in the IP header in transit across a routing device or virtual machine monitor
45
# definition, what, vm, why
TAP
| Linux
Terminal access point
Network device mode that allows the creation of a virtual network interface
Support network backend for virtual machines
More performant and capable than SLIRP (user networking)
46
# Description
CentOS
| Linux
Linux distribution derived from Red Hat Enterprise Linux
47
Three VMWare scheduling constraints
Shares
Reservation
Limit
48
Two ways to put expiring workarounds
| Apple Tech
_CFAppVersionCheckLessThan
dyld_program_sdk_at_least
49
Names of 1000 bytes to the power of 1 to 5
Kilobytes, megabytes, gigabytes, terabytes, petabytes
50
Names of 1024 bytes to the power of 1 to 5
Kibibytes, Mebibytes, Gibibytes, tebibytes, pebibytes
51
# what, where and how many
PCIe BAR
| Virtio Standard
Describe a memory region the CPU accesses to interact with a PCIe device
Defined in configuration space
Each device has 8 functions, and each has 6 BARs
52
# Purpose
Kali Linux
Debian based Linux distribution geared toward information security tasks
53
# definition and description
P2V
Physical to virtual
Migration of physical machines to virtual machines
54
# Description
Libkern
| Apple Tech
C++ runtime environment in XNU
55
# what, find, interface, support
IOKit
| Apple Tech
Objected oriented kernel drivers
A driver is looked up through IORegistry
Driver properties are provided in IOUserClient
Kernel APIs
56
# definition and 4 features
APFS
| Apple Tech
Apple File System
Full 64-bit mode, snapshots, encryption, volume management
57
# what, why
DMG
| Apple Tech
Disk image
bundling software distribution into single files and can be mounted as a block device
58
# description
FSEvent
| Apple Tech
File system wide notifications
59
Apple CLI to gather details about every aspect of the system
system_profiler
60
Apple home applications
MacOS: finder
iOS: SpringBoard
TvOS: Pineboard
WatchOS: carousel
AudioOS: soundboard
61
Apple HID monitor
MacOS: WindowServer
Others: backboardd
62
Visible view and user input of MacOS window
Visible view: IOSurface
User input: Tactile layer
63
# what and how to communicate
VirtioBlk
| Standard
Simple virtual block device
Communication based on the virtio notification and queues
64
Isochronous transfer in USB
Transmit at a constant rate for real time information such as audio and video
65
# What, VM consequence
Bridged networking
Replicate another node in the physical network
VM will receive its own IP address if DHCP is enabled in the network
66
# definition and function
SMBIOS
System Management BIOS
Reading management information produced by the BIOS of a computer
67
# definition and 2 facts
MDM
Mobile device management
Securely and wirelessly configure a device by sending profiles and commands
Administer managed preferences
68
# protocol, usage
Apple Open Directory
Light weight directory access protocol (LDAP) implementation from Apple
Organize information about a network’s users and resources
69
When isn’t APFS clone used?
Copy to a different volume
Copy nested directory
## Footnote
Extra: cp -c
70
# Conforms, Integrate
REST API
| Standard
conforms to the representational state transfer principles
Integrate applications and components in microservices architecture
71
# Mediate, continue, narrow
XPC services
| Apple Tech
mediate access to a shared resource
continue work beyond a client’s lifecycle
narrow the scope of access for different functionality
72
3 Apple service types
Launch agent
Launch daemon
XPC service
73
# Definition
GPTK
| Apple Tech
Game porting kit
74
# Description
Ray tracing
Technique for rendering light transport
75
# Symbols, Prove
Turing machine
Abstract machine that manipulates symbols on a strip of tape according to a table of rules
Prove properties of computation in general
76
# definition and description
IPSW
| Apple Tech
iPhone software
File format for most Apple firmware
77
Apple three commands to debug memory usage
leaks —outputGraph
Footprint
Vmmap
78
# Description
Owned unmapped memory
Represent memory that your process allocated, shared with another process, unmapped from its own address space but not yet unmapped from the other process address space
79
# Definition
SFR
| Apple Tech
System firmware and recovery
80
# Description
EBS
| Amazon
Block storage service designed for Amazon Elastic Compute Cloud (EC2)
81
# Description
BSD interface name
| Networking
Network driver name followed by a number.
Ex. En0
82
# Definition
Thimble
| Apple Tech
Trusted hybrid inference machine learning
83
# definition and description
TCB
| Security
Trusted computer base
Set of components that collectively enforce the system’s security properties
84
# definition and description
Inode
| Linux
Index node
Data structure that describes a file or directory
85
# Description
VHDX
| Microsoft
Virtual hard disk drive of a virtual machine used by hyper-v
86
# Description
Universal binary
| Apple Tech
Package with one binary for each architecture
87
Apple CLI to see architectures of a universal binary
file
88
Apple CLI to see details of a Mach O file
otool
89
# Definition
WASM
Web assembly
90
# Description
Shared library cache
| Apple Tech
Prelink various commonly used Mach O dylibs into one file per architecture
91
What does kevent do?
| Apple Tech
Block current thread until any of the requested events occur
92
# Definition
SPRR
| Apple Hardware
Shadow permissions remap registers
93
# Definition
APRR
| Apple Hardware
Access permissions remap registers
94
# Definition
CTRR
| Apple Hardware
Configurable text read only region
95
# Definition, Description
CDN
| Networking
Content distribution network
Geographically distributed network of proxy servers and their data centers
96
# Definition
UAF
| Software Security
Use after free
97
# Description
Palladium
| Hardware Tech
In circuit emulation for verification and debug
98
# Definition
AMI
| Amazon
Amazon machine image
99
# Description
AWS Nitro
| Amazon
Combination of dedicated hardware and lightweight hypervisor for running EC2 instances efficiently and securely
100
# Link, Run
Tart VM
| 3rd Party
Link to virtualization framework
Run locally or in the cloud
101
# Description, Purpose
AI quantization
Convert input values from a large set to output values in a small set
Reduce computation demands of AI models
102
# Description
NumPy
| Python
Python package for scientific computing
103
# Two keywords and their meanings
Swift structured concurrency
Async to define a method for doing asynchronous work
Await to call an async method
104
# what and why
Apple VideoToolbox
Low level framework that provides direct access to hardware encoders and decoders
For video compression and decompression, and for conversion between raster image formats
105
# Description
Rasterization
| Graphics
Converting images in a vector graphics format to raster format used by display monitors
106
# Definition, Description
TBB
| C++
Thread building block
C++ template library from Intel for parallel programming on multi core processors
107
# Description
Future
| Programming
place holder for the result of an asynchronous operation
108
# Description
Promise
| Programming
Set the value of a future once an asynchronous operation is complete
109
# Do, Don't
Pure function
| Programming
Return the same result given the same argument
Cannot be affected by mutable states or other side effects
110
# define, what, why
VFS
| File
Virtual file system
Standard interface for all file systems
Enable Linux to support large number of file systems
111
# define, push, pop
SQ
| Apple Software
DI2 submission queue
Producer pushes a SQE for a new IO request, which rings the doorbell
Consumer pops a SQE to service the request
112
# define, push, pop
CQ
| Apple Software
DI2 Complete Queue
Push a CQE for a completed IO operation, which may invoke a callback function.
Pop CQE to acknowledge
113
# Description
Upward dependency
| Programming
Two software modules that have link dependencies on each other
114
# definition, user perspective, OS perspective
TCC
| Apple Software
Transparency, consent and control
OS perspective: manager of authorizing system
User perspective: decision input point
115
# Definition, trade mark
ACIO
| Apple Tech
Apple Converged Input Output
Apple trade-mark for USB 4.0
116
# definition, connections, routing
OVS
| Networking
Open vSwitch
Connecting different VMs and Internet
Route packets from vhost net and NIC
117
# configuration, daemon
Libvirt
| Linux QEMU
Translate XML configurations to QEMU CLI calls
Provide admin daemon to manage QMU child processes
118
# Description
vhost protocol
| Networking
Allows the virtio data plane implementation to be offloaded to another element (user process or kernel module) for performance
119
# Two meanings
virtio net
| Networking
Virtio networking device implementation
Guest kernel front end described in the vhost net protocol
120
# Definition, device, library
DPDK
| Networking
Data plane development kit
Bypass the kernel to access network devices
Libraries to accelerate data processing workloads running on a wide variety of CPUs.
121
# definition, two checks
AMFI
| Apple Software
Apple Mobile files integrity
Check code signatures
Check they are signed by a trusted authority
122
# Description
ABA problem in concurrency
| Programming
A value is read is twice and it’s having the same value is used to conclude nothing has happened in the interim
123
# what, each letter
REMITS
| Security
Chain of trust pipeline
Root of trust
Endorsement
Measurement
Identity
Trust
Secrets
124
# Definition, Description
TCG
| QEMU
Tiny Code Generator
Dynamic translation backend that translates guest code to host code
125
# what, trust, 3 services
COCONUT SVSM
| Linux
Secure VM service module
same trust boundary but isolated from guest operating system
vTPM
UEFI variable store
Live migration for CVMs
126
# definition, 2 facts
IGVM
| Linux
Independent guest virtual machine
Encapsulate all the information required to launch a virtual machine on any virtualization stack
Contain measurement
127
# define, how, so what
ARC
| Apple Programming
Automatic reference counting
Retain and release are inserted at compile time
Deallocate objects with zero reference
128
# Definition, Description
VPC
| Netwoking
Virtual private cloud
An isolated and customizable network within a public cloud
129
# Description
Syntactic sugar
| Programming
Programming syntax that’s easier to read and write
130
# Description
Mersenne twister
| Software
Pseudo number generator
131
# security, function
Paravisor
Executed within the VM but higher privilege than the guest OS
Provide virtualization and device services
132
# Description
OpenVMM
Modular cross-platform virtual machine monitor written in Rust
133
# what, parts, why
OpenHCL
Open source paravisor
Consists of OpenVMM, boot loader and Linux kernel
Confidential compute for non enlightened guests
134
# 5 Steps
Progression of kernel memory corruption exploit
vulnerability → memory corruption → memory read/write → control flow integrity bypass → arbitrary code execution
135
# what, why
Monad
| Programming
Structure that combines program fragments and wraps their return values in a type with additional computations
Simplifying common operations and abstracting control flows
136
# what, who
Hyperlight
| Microsoft Tech
Open Source Rust library enabling fast and secure execution of small functions using hypervisor based protection
Developed by Microsoft Azure
137
Virtio initialization: Four Status Bits
Acknowledge
Driver
Features OK
Driver OK
138
Five parts of virtio device
Device status field
Feature bits
Notifications
Device configuration space
At least one virt queues
139
Three virtio notifications
Configuration change
Available buffer
Used buffer
140
Three parts of a virtqueue
Descriptor area - describe buffers
Driver area - data from driver
Device area - data from device
141
Two virtqueue formats
Split
Packed
142
Five steps for a buffer to transfer from driver to device and back on split virtqueue
• Driver fills a slot in the descriptor table.
• Driver writes the descriptor index into the available ring.
• Driver sends an available buffer notification.
• Device writes the descriptor index into the used ring.
• Device sends a used buffer notification.
143
Three parts of packed virt queues
Descriptor ring
Driver event suppression
Device event suppression
144
Four steps for sending a buffer to a device and back via a packed virtqueue
- Driver writes an available descriptor for the buffer in the descriptor ring.
- Driver sends an available buffer notification.
- Device writes a used descriptor in the descriptor ring, thereby overwriting a descriptor previously made available.
- Device sends an used buffer notification.
145
# DD, why
vDSO
| Linux
Virtual dynamic shared object
Mechanism to export kernel routines to user space
Avoid costs of system calls
146
# Definition, description, 3 components
ATS
| PCIe
Address translation service
Converts device IO address to physical address
Translation agent, address translation page table, address translation cache
147
PCI: PRI: d2
| PCIe
Page request interface
Sent by an endpoint to request a page be mapped into system memory for an ATS transaction
148
CXL: define, 3 facts
| PCIe
Compute express link
Open standard interconnect
high speed, high capacity CPU to memory and CPU to device connections
For data center computers
149
SFINAE: d2
| Programming
Substitution failure is not an error
It's a powerful technique used in template metaprogramming to enable conditional compilation based on the properties of types.
150
Suppress buddy flow
| Apple Software
defaults write com.apple.purplebuddy SetupFinishedAllSteps -bool YES
151
#graphics
Vulkan
| description
Low level, Low overhead cross platform API and open standard for 3D graphics and computing
152
#graphics
MoltenVK
| description
Software library that allows Vulkan software to run on top of metal on Apple devices
153
#graphics
Metal
| description
low-level, low-overhead hardware-accelerated 3D graphic and compute shader API created by Apple
154
RO Used
| XNU HV State
Indicate a set of registers used by the guest
155
RW Dirty
| XNU HV State
Indicate a set of registers to be set to user provided values
156
RO Dirty
| XNU HV State
Indicate a set of registers to be modified with kernel validated values
157
RO Valid
| XNU HV State
Indicate a set of register value already saved in memory
158
# what, when is it used?
`GXF_CONFIG_EL2.HVAC`
Disallow writes to guarded mode registers in EL2
Prevent XNU from hosting guarded mode guests
159
Two types uncategorized errors
| XNU
ARM uncategorized exceptions
DTrace
