Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Windows Internals > win_internals > Flashcards

win_internals Flashcards

(87 cards)

Start Studying
1
Q

What is the Windows NT code base?

A

The code base used by Windows NT beginning with version 3.1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the Windows API?

A

The system programming interface to the Windows operating system family.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where is the Windows API described?

A

In the Windows Software Development Kit (SDK) documentation. (www.msdn.microsoft.com)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the Windows API consist of?

A

Thousands of callable functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What 7 major categories is the Windows API divided into?

A
  1. Base services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some of the key base services in the Windows API? (4)

A
  1. Processes and threads
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does the .NET framework consist of?

A
  1. A library of classes called the Framework Class Library (FCL) and
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are Windows API functions?

A

Documented, callable subroutines in the Windows API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are native (or executive) system services?

A

The undocumented, underlying services in the operating system that are callable from user mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Windows services?

A

Processes started by the Windows service control manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are DLLs?

A

A set of callable subroutines linked together as a binary file that can be dynamically loaded by applications that use the subroutines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the difference between a program and a process?

A

A program is a static sequence of instructions, whereas a process is a container for a set of resources used when executing the instance of the program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

At the highest level of abstraction, what is a Windows process comprised of? (6)

A
  1. A private virtual address space
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do all threads within a process share?

A

The process’s virtual address space (in addition to the rest of the resources belonging to the process) meaning that all the threads in a process can write to and read from each other’s memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When can threads in one process reference the address space of another process? (2)

A
  1. When the other process makes available part of its private address space as a shared memory section (called a file mapping object in the Windows API) or
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In addition to a private address space and one or more threads, what does each process have?

A

A security identification (contained in the access token) and a list of open handles to objects (such as files, shared memory sections), or one of the synchronization objects (such as mutexes, events, or semaphores)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Where is a process’s security context stored?

A

In an object called an access token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does a process’s access token contain?

A

The process’s security identification and credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Do threads have their own access tokens?

A

By default, threads don't have their own access token, but they can obtain one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

If a thread obtains its own access token, what becomes possible?

A

Individual threads can impersonate the security context of another process—including processes running on a remote Windows system—without affecting other threads in the process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are virtual address descriptors?

A

Virtual address descriptors (VADs) are data structures that the memory manager uses to keep track of the virtual addresses the process is using.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a job?

A

An extension to the process model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a job object’s main function?

A

To allow groups of processes to be managed and manipulated as a unit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

When using virtual memory, how does the operating system ensure that individual processes don't bump into one another or overwrite operating system data?

A

At run time, the memory manager, with assistance from hardware, translates, or maps, the virtual addresses into physical addresses, where the data is actually stored. By controlling the protection and mapping, the operating system can ensure that individual processes don't bump into one another or overwrite operating system data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
How does using virtual memory work when most systems have much less physical memory than virtual memory?
The memory manager transfers, or pages, some of the memory contents to disk which frees physical memory so that it can be used for other processes or for the operating system itself.
26
What happens if a thread accesses a virtual address that has been paged to disk?
The virtual memory manager loads the information back into memory from disk.
27
On a 32-bit x86 system, what is the theoretical maximum of the total virtual address space?
4GB
28
How does Windows allocate virtual address space?
2GB (the lower half from x00000000 through x7FFFFFFF) are allocated to processes for their unique private storage.
29
Why does Windows use two processor access modes?
To protect user applications from accessing and/or modifying critical operating system data
30
What does kernel mode refer to?
A processor execution mode that grants access to all system memory and all CPU instructions
31
What privilege levels (rings) does Windows use for kernel mode and user mode?
Windows uses privilege level 0 (or ring 0) for kernel mode and privilege level 3 (or ring 3) for user mode.
32
Why does Windows use only two of the four available privilege levels?
Some hardware architectures that were supported in the past (such as Compaq Alpha and Silicon Graphics MIPS) implemented only two privilege levels.
33
Although each Windows process has its own private memory space, these two share a single virtual address space:
The kernel-mode operating system and device driver code
34
How are read/write restrictions maintained between pages in system space and pages in user address space?
Each page in virtual memory is tagged as to what access mode the processor must be in to read and/or write the page. Pages in system space can be accessed only from kernel mode, whereas all pages in the user address space are accessible from user mode.
35
What mode does the processor need to be in to write to read-only pages?
Trick question: Read-only pages (such as those that contain static data) are not writable from any mode.
36
How does Windows prevent inadvertent code execution in data areas?
On processors that support no-execute memory protection, Windows marks pages containing data as non-executable.
37
What is "private read/write system memory"?
...
38
Once in kernel mode, what does operating system and device driver code have complete access to?
System space memory. This means operating system and device driver code can bypass Windows security to access objects.
39
Why is it so important to be careful when loading a third-party device driver?
Because once in kernel mode the software has complete access to all operating system data.
40
How has Windows responded to the potential for a dangerous third-party driver to be loaded by users?
1. Windows introduced the driver-signing mechanism
41
What\'s the difference between 32-bit and 64-bit versions of Windows when it comes to installing unsigned drivers?
With 64-bit Windows, the user cannot explicitly force the installation of an unsigned driver, even as an administrator (unless this restriction is disabled manually at boot time by pressing F8 and choosing the advanced boot option Disable Driver Signature Enforcement).
42
When do user applications switch from user mode to kernel mode?
When they make a system service call.
43
How do user applications switch from user mode to kernel mode?
The transition is accomplished by the use of a special processor instruction that causes the processor to switch to kernel mode. The operating system traps this instruction, notices that a system service is being requested, validates the arguments the thread passed to the system function, and then executes the internal function. Before returning control to the user thread, the processor mode is switched back to user mode.
44
What does terminal services refer to?
The support in Windows for multiple interactive user sessions on a single system.
45
What three forms of access control does Windows have over objects?
1. Discretionary access control
46
What is discretionary access control?
The method by which owners of objects (such as files or printers) grant or deny access to others.
47
What is privileged access control?
A method of ensuring that someone can get to protected objects if the owner isn\'t available. (Admin needs access to files under an ex-employee\'s control, for example)
48
What is mandatory integrity control?
An additional level of security control to protect objects that are being accessed from within the same user account.
49
What is the registry?
The system database
50
What does the registry contain? (4)
1. The information required to boot and configure the system
51
What kinds of in-memory volatile data is the registry a window into? (2)
1. The current hardware state of the system (what device drivers are loaded, the resources they are using, and so on)
52
How does Windows differ from most other operating systems?
Most internal text strings are stored and processed as 16-bit-wide Unicode characters.
53
What is Unicode?
Unicode is an international character set standard that defines unique 16-bit values for most of the world\'s known character sets.
54
What does kernel debugging mean?
Examining internal kernel data structures and/or stepping through functions in the kernel
55
What do symbol files contain?
The names of functions and variables
56
Where does the symbol file come from?
It's generated by the linker.
57
Who uses the symbol file?
Debuggers use them to reference and display symbol names during a debug session
58
What\'s the minimum requirement to use any of the kernel debugging tools to examine internal Windows kernel data structures?
The correct symbol files for at least the kernel image, Ntoskrnl.exe.
59
What are the debugger extension commands?
Commands that begin with \"!\" that allow you to display the contents of internal data structures such as threads, processes, I/O request packets, and memory management information.
60
What does the LiveKd tool allow you to do?
It allows you to use the standard Microsoft kernel debuggers to examine the running system without booting the system in debugging mode.
61
Why might it be useful to debug a running system without booting that system into debugging mode?
When kernel-level troubleshooting is required on a machine that wasn\'t booted in debugging mode. A reboot with the debug option enabled might not result in the same error.
62
What does the Windows SDK contain?
The documentation, C header files, and libraries necessary to compile and link Windows applications.
63
Although the Windows WDK is aimed at device driver developers, what else makes it useful?
It's an abundant source of Windows internals information. For example, the WDK documentation contains a comprehensive description of all the Windows kernel support functions and mechanisms used by device drivers in both tutorial and reference form (information not included in the Windows Internals book).
64
In addition to documentation, what else does the WDK contain?
Header files
65
What are three important header files contained in the WDK documentation?
ntddk.h, ntifs.h, and wdm.h
66
What is a private virtual address space?
A set of virtual memory addresses that the process can use
67
What\'s an access token?
A security context
68
What\'s a process ID?
A unique identifier (internally part of an identifier called a client ID)
69
Is it possible to have a process with no threads?
Yes, although it's not useful.
70
What does the access token identify? (6)
1. The user
71
What does the CLR provide?
A managed code execution environment
72
What kind of features does CLR provide? (4)
1. Just-in-time compilation
73
What are Windows Performance Counters?
Counters that profile system performance
74
What is a virtual address space?
A set of virtual memory addresses that the process can use
75
What does an executable program define?
Initial code and data and is mapped into the process's virtual address space
76
What are some examples of system resources that have handles?
Semaphores, communication ports, and files
77
What does the access token identify? (6)
1. The user
78
What do the header files in the WDK define? (2)
1. Key internal data structures and constants
79
What's the implication of all threads within a process sharing the process's virtual address space?
All the threads in a process can write to and read from each other's memory.
80
What's a file mapping object?
In the Windows API, this is the term for when one process makes available part of its private address space as a shared memory section to another process.
81
What is the driver-signing mechanism?
A mechanism which warns the user if an attempt is made to add an unauthorized (unsigned) driver.
82
How does the Driver Verifier mechanism help device driver writers?
It helps writers find bugs (such as buffer overruns or memory leaks) that can cause security or reliability issues.
83
What does the Kernel Mode Code Signing policy state?
That 64-bit device drivers must be signed with a cryptographic key assigned by one of the major code certification authorities.
84
What is the Windows service control manager (SCM)?
A special system process which starts, stops and interacts with Windows service processes.
85
What's a Windows service?
A long-running executable that performs specific functions and is designed not to require user intervention. Windows services are similar in concept to a Unix daemon.
86
What's an object?
A single, run-time instance of a statically defined object type.
87
CID
Client ID.The internal name for a process ID.

Windows Internals (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions