WINDOWS INS AND OUTS MICHELE SENSALARI MCT, MCSE, MCSA,

Size: px

Start display at page:

Download "WINDOWS INS AND OUTS MICHELE SENSALARI MCT, MCSE, MCSA,"

Clemence Adams
7 years ago
Views:

1 WINDOWS INS AND OUTS MICHELE SENSALARI MCT, MCSE, MCSA,

2 DA WINDOWS 1 A WINDOWS 10

3 SO MajorNumber MinorNumber Note Windows Vista 6 0 6=6+0 Windows =6+1 Windows =6+2 Windows 8.1 aka Windows 9 WINDOWS VERSION NUMBER 6 3 9=8+1=6+3 Windows =6+4

4 SIMPLIFIED WINDOWS ARCHITECTURE

5 KERNEL MODE VS. USER MODE TO PROTECT USER APPLICATIONS FROM ACCESSING AND/ OR MODIFYING CRITICAL OPERATING SYSTEM DATA, WINDOWS USES TWO PROCESSOR ACCESS MODES: USER MODE AND KERNEL MODE. USER APPLICATION CODE RUNS IN USER MODE, NONPRIVILEGED PROCESSOR MODE WITH A LIMITED SET OF INTERFACES AVAILABLE, LIMITED ACCESS TO SYSTEM DATA, AND NO DIRECT ACCESS TO HARDWARE OPERATING SYSTEM CODE (SUCH AS SYSTEM SERVICES AND DEVICE DRIVERS) RUNS IN KERNEL MODE. KERNEL MODE REFERS TO A MODE OF EXECUTION IN A PROCESSOR THAT GRANTS ACCESS TO ALL SYSTEM MEMORY AND ALL CPU INSTRUCTIONS. WHEN A USER-MODE PROGRAM CALLS A SYSTEM SERVICE, THE PROCESSOR EXECUTES A SPECIAL INSTRUCTION THAT SWITCHES THE CALLING THREAD TO KERNEL MODE. WHEN THE SYSTEM SERVICE COMPLETES, THE OPERATING SYSTEM SWITCHES THE THREAD CONTEXT BACK TO USER MODE AND ALLOWS THE CALLER TO CONTINUE. BY PROVIDING THE OPERATING SYSTEM SOFTWARE WITH A HIGHER PRIVILEGE LEVEL THAN THE APPLICATION SOFTWARE HAS, THE PROCESSOR PROVIDES A NECESSARY FOUNDATION FOR OPERATING SYSTEM DESIGNERS TO ENSURE THAT A MISBEHAVING APPLICATION CAN T DISRUPT THE STABILITY OF THE SYSTEM AS A WHOLE.

(SUCH AS SYSTEM SERVICES AND DEVICE DRIVERS) RUNS IN KERNEL MODE. KERNEL MODE REFERS TO A MODE OF EXECUTION IN A PROCESSOR THAT GRANTS ACCESS TO ALL SYSTEM MEMORY AND ALL CPU INSTRUCTIONS.

6 WINDOWS API THE WINDOWS APPLICATION PROGRAMMING INTERFACE (API) IS THE USER-MODE SYSTEM PROGRAMMING INTERFACE TO THE WINDOWS OPERATING SYSTEM FAMILY. PRIOR TO THE INTRODUCTION OF 64-BIT VERSIONS OF WINDOWS, THE PROGRAMMING INTERFACE TO THE 32-BIT VERSIONS OF THE WINDOWS OPERATING SYSTEMS WAS CALLED THE WIN32 API TO DISTINGUISH IT FROM THE ORIGINAL 16-BIT WINDOWS API, WHICH WAS THE PROGRAMMING INTERFACE TO THE ORIGINAL 16-BIT VERSIONS OF WINDOWS. THE WINDOWS API CONSISTS OF THOUSANDS OF CALLABLE FUNCTIONS, WHICH ARE DIVIDED INTO THE FOLLOWING MAJOR CATEGORIES: BASE SERVICES COMPONENT SERVICES USER INTERFACE SERVICES GRAPHICS AND MULTIMEDIA SERVICES MESSAGING AND COLLABORATION NETWORKING WEB SERVICES

DISTINGUISH IT FROM THE ORIGINAL 16-BIT WINDOWS API, WHICH WAS THE PROGRAMMING INTERFACE TO THE ORIGINAL 16-BIT VERSIONS OF WINDOWS.

7 PROCESSES A PRIVATE VIRTUAL ADDRESS SPACE, WHICH IS A SET OF VIRTUAL MEMORY ADDRESSES THAT THE PROCESS CAN USE AN EXECUTABLE PROGRAM, WHICH DEFINES INITIAL CODE AND DATA AND IS MAPPED INTO THE PROCESS VIRTUAL ADDRESS SPACE A LIST OF OPEN HANDLES TO VARIOUS SYSTEM RESOURCES SUCH AS SEMAPHORES, COMMUNICATION PORTS, AND FILES THAT ARE ACCESSIBLE TO ALL THREADS IN THE PROCESS A SECURITY CONTEXT CALLED AN ACCESS TOKEN THAT IDENTIFIES THE USER, SECURITY GROUPS, PRIVILEGES, USER ACCOUNT CONTROL (UAC) VIRTUALIZATION STATE, SESSION, AND LIMITED USER ACCOUNT STATE ASSOCIATED WITH THE PROCESS A UNIQUE IDENTIFIER CALLED A PROCESS ID AT LEAST ONE THREAD OF EXECUTION - A THREAD IS THE ENTITY WITHIN A PROCESS THAT WINDOWS SCHEDULES FOR EXECUTION. EACH PROCESS ALSO POINTS TO ITS PARENT OR CREATOR PROCESS. IF THE PARENT NO LONGER EXISTS, THIS INFORMATION IS NOT UPDATED.

CONTEXT CALLED AN ACCESS TOKEN THAT IDENTIFIES THE USER, SECURITY GROUPS, PRIVILEGES, USER ACCOUNT CONTROL (UAC) VIRTUALIZATION STATE, SESSION, AND LIMITED USER ACCOUNT STATE ASSOCIATED WITH THE

8 VIRTUAL MEMORY WINDOWS IMPLEMENTS A VIRTUAL MEMORY SYSTEM BASED ON A ADDRESS SPACE THAT PROVIDES EACH PROCESS WITH THE ILLUSION OF HAVING ITS OWN LARGE, PRIVATE ADDRESS SPACE. VIRTUAL MEMORY PROVIDES A LOGICAL VIEW OF MEMORY THAT MIGHT NOT CORRESPOND TO ITS PHYSICAL LAYOUT. AT RUN TIME, THE MEMORY MANAGER, WITH ASSISTANCE FROM HARDWARE, TRANSLATES, OR MAPS, THE VIRTUAL ADDRESSES INTO PHYSICAL ADDRESSES, WHERE THE DATA IS ACTUALLY STORED. BY CONTROLLING THE PROTECTION AND MAPPING, THE OPERATING SYSTEM CAN ENSURE THAT INDIVIDUAL PROCESSES DON T BUMP INTO ONE ANOTHER OR OVERWRITE OPERATING SYSTEM DATA. BECAUSE MOST SYSTEMS HAVE MUCH LESS PHYSICAL MEMORY THAN THE TOTAL VIRTUAL MEMORY IN USE BY THE RUNNING PROCESSES, THE MEMORY MANAGER TRANSFERS, OR PAGES, SOME OF THE MEMORY CONTENTS TO DISK PAGING DATA TO DISK FREES PHYSICAL MEMORY SO THAT IT CAN BE USED FOR OTHER PROCESSES OR FOR THE OPERATING SYSTEM ITSELF. WHEN A THREAD ACCESSES A VIRTUAL ADDRESS THAT HAS BEEN PAGED TO DISK, THE VIRTUAL MEMORY MANAGER LOADS THE INFORMATION BACK INTO MEMORY FROM DISK. APPLICATIONS DON T HAVE TO BE ALTERED IN ANY WAY TO TAKE ADVANTAGE OF PAGING BECAUSE HARDWARE SUPPORT ENABLES THE MEMORY MANAGER TO PAGE WITHOUT THE KNOWLEDGE OR ASSISTANCE OF PROCESSES OR THREADS.

AT RUN TIME, THE MEMORY MANAGER, WITH ASSISTANCE FROM HARDWARE, TRANSLATES, OR MAPS, THE VIRTUAL ADDRESSES INTO PHYSICAL ADDRESSES, WHERE THE DATA IS ACTUALLY STORED.

9 SERVICES NATIVE SYSTEM SERVICES (OR SYSTEM CALLS). THE UNDOCUMENTED, UNDERLYING SERVICES IN THE OPERATING SYSTEM THAT ARE CALLABLE FROM USER MODE. KERNEL SUPPORT FUNCTIONS (OR ROUTINES). SUBROUTINES INSIDE THE WINDOWS OPERATING SYSTEM THAT CAN BE CALLED ONLY FROM KERNEL MODE). WINDOWS SERVICES. PROCESSES STARTED BY THE WINDOWS SERVICE CONTROL MANAGER. FOR EXAMPLE, THE TASK SCHEDULER SERVICE RUNS IN A USER-MODE PROCESS THAT SUPPORTS THE AT COMMAND (WHICH IS SIMILAR TO THE UNIX COMMANDS AT OR CRON).

10 USER MODE SYSTEM SUPPORT PROCESSES, SUCH AS THE LOGON PROCESS AND THE SESSION MANAGER, THAT ARE NOT WINDOWS SERVICES. SERVICE PROCESSES THAT HOST WINDOWS SERVICES, SUCH AS THE TASK SCHEDULER AND PRINT SPOOLER SERVICES. SERVICES GENERALLY HAVE THE REQUIREMENT THAT THEY RUN INDEPENDENTLY OF USER LOGONS. MANY WINDOWS SERVER APPLICATIONSALSO INCLUDE COMPONENTS THAT RUN AS SERVICES. ENVIRONMENT SUBSYSTEM SERVER PROCESSES, WHICH IMPLEMENT PART OF THE SUPPORT FOR THE OPERATING SYSTEM ENVIRONMENT, SUBSYSTEM DLLS UNDER WINDOWS, USER APPLICATIONS DON T CALL THE NATIVE WINDOWS OPERATING SYSTEM SERVICES DIRECTLY; RATHER, THEY GO THROUGH ONE OR MORE SUBSYSTEM DYNAMIC-LINK LIBRARIES (DLLS). THE ROLE OF THE SUBSYSTEM DLLS IS TO TRANSLATE A DOCUMENTED FUNCTION INTO THE APPROPRIATE INTERNAL (AND GENERALLY UNDOCUMENTED) NATIVE SYSTEM SERVICE CALLS.

MANY WINDOWS SERVER APPLICATIONSALSO INCLUDE COMPONENTS THAT RUN AS SERVICES.

11 KERNEL MODE EXECUTIVE CONTAINS THE BASE OPERATING SYSTEM SERVICES, SUCH AS MEMORY MANAGEMENT, PROCESS AND THREAD MANAGEMENT, SECURITY, I/ O, NETWORKING, AND INTERPROCESS COMMUNICATION. THE WINDOWS KERNEL CONSISTS OF LOW-LEVEL OPERATING SYSTEM FUNCTIONS, SUCH AS THREAD SCHEDULING, INTERRUPT AND EXCEPTION DISPATCHING, AND MULTIPROCESSOR SYNCHRONIZATION. ALSO PROVIDES A SET OF ROUTINES AND BASIC OBJECTS THAT THE REST OF THE EXECUTIVE USES TO IMPLEMENT HIGHER-LEVEL CONSTRUCTS. DEVICE DRIVERS INCLUDE BOTH HARDWARE DEVICE DRIVERS, WHICH TRANSLATE USER I/ O FUNCTION CALLS INTO SPECIFIC HARDWARE DEVICE I/ O REQUESTS, AS WELL AS NON HARDWARE DEVICE DRIVERS SUCH AS FILE SYSTEM AND NETWORK DRIVERS. THE HARDWARE ABSTRACTION LAYER (HAL) IS A LAYER OF CODE THAT ISOLATES THE KERNEL, THE DEVICE DRIVERS, AND THE REST OF THE WINDOWS EXECUTIVE FROM PLATFORM-SPECIFIC HARDWARE DIFFERENCES (SUCH AS DIFFERENCES BETWEEN MOTHERBOARDS). THE WINDOWING AND GRAPHICS SYSTEM IMPLEMENTS THE GRAPHICAL USER INTERFACE (GUI) FUNCTIONS (BETTER KNOWN AS THE WINDOWS USER AND GDI FUNCTIONS), SUCH AS DEALING WITH WINDOWS, USER INTERFACE CONTROLS, AND DRAWING.

ALSO PROVIDES A SET OF ROUTINES AND BASIC OBJECTS THAT THE REST OF THE EXECUTIVE USES TO IMPLEMENT HIGHER-LEVEL CONSTRUCTS.

12 WINDOWS ARCHITECTURE

13 DIFFERENCES BETWEEN CLIENT AND SERVER VERSIONS WINDOWS SHIPS IN BOTH CLIENT AND SERVER RETAIL PACKAGES. WINDOWS CLIENT: WINDOWS 10 HOME, WINDOWS 10 PROFESSIONAL, WINDOWS 10 ENTERPRISE WINDOWS SERVER: WINDOWS 2012 R2 STANDARD, WINDOWS SERVER 2012 R2 ENTERPRSIE, WINDOWS SERVER 2012 R2 DATACENTER E DERIVATI THESE VERSIONS DIFFER BY THE NUMBER OF PROCESSORS SUPPORTED (IN TERMS OF SOCKETS, NOT CORES OR THREADS) THE AMOUNT OF PHYSICAL MEMORY SUPPORTED THE NUMBER OF CONCURRENT NETWORK CONNECTIONS SUPPORT FOR FEATURES SUCH AS BITLOCKER, VHD BOOTING, APPLOCKER, AND MORE THAN 100 OTHER CONFIGURABLE LICENSING POLICY VALUES LAYERED SERVICES THAT COME WITH WINDOWS SERVER EDITIONS THAT DON T COME WITH THE CLIENT EDITIONS (FOR EXAMPLE, DIRECTORY SERVICES AND CLUSTERING)

E DERIVATI THESE VERSIONS DIFFER BY THE NUMBER OF PROCESSORS SUPPORTED (IN TERMS OF SOCKETS, NOT CORES OR THREADS) THE AMOUNT OF PHYSICAL MEMORY SUPPORTED THE NUMBER OF CONCURRENT NETWORK

14 WINDOWS BOOT THE NORMAL STARTUP SEQUENCE FOR WINDOWS IS: 1. POWER-ON SELF TEST (POST) PHASE. 2. INITIAL STARTUP PHASE. 3. WINDOWS BOOT MANAGER PHASE (BCD BOOT CONFIGURATION DATA). 4. WINDOWS BOOT LOADER PHASE (BCD). 5. KERNEL LOADING PHASE (NTOSKRNL.EXE) 6. LOGON PHASE.

WINDOWS BOOT MANAGER PHASE (BCD BOOT CONFIGURATION DATA). 4.

15 CORE WINDOWS SYSTEM FILE

16 WHAT ARE FILE PERMISSIONS? File permissions control access for files and folders on NTFS or ReFS formatted storage volumes File Permissions: Are configured for files or folders Can be granted or denied Are inherited from parent folders Permissions conflict precedence: 1. Explicitly assigned Deny 2. Explicitly assigned Allow 3. Inherited Deny 4. Inherited Allow

volumes File Permissions: Are configured for files or folders Can be granted or denied Are

17 SIMPLE PERMISSIONS VS ADVANCED PERMISSIONS

18 WHAT ARE SHARED FOLDERS? Shared folders grant network access to their contents Folders can be shared, but individual files cannot Shared folders can be hidden by creating a share with a $ at the end of the share name Accessing a shared folder using the UNC path: \\ServerA\Sales (standard share) \\ServerA\Sales$ (hidden share) Administrative shares are hidden shares that allow administrators access to the root of every volume and special system folders, such as the operating system folder

$\\ServerA\Sales (standard share) \\ServerA\Sales$ (hidden share) Administrative shares are hidden shares that allow$

19 PERMISSIONS INHERITANCE Inheritance is used to manage access to resources without explicitly assigning permissions to each object By default, permissions are inherited in a parent/child relationship Blocking inheritance: You can block permission inheritance You can apply blocking at the file or folder level You can set blocking on a folder to propagate the new permissions to child objects

relationship Blocking inheritance: You can block permission inheritance You can apply blocking at

20 EFFECTIVE PERMISSIONS When combining file system and shared folder permissions, the most restrictive permission is applied Example: If a user or group has the shared folder permission of Read and the file system permission of Write, the user or group will only be able to read the files in the folder because it is the more restrictive permission The user must have both file system and shared folder permissions, otherwise the user will be denied access to the resource

the user or group will only be able to read the files in the folder because it is the more restrictive permission The

How To Write A Windows Operating System (Windows) (For Linux) (Windows 2) (Programming) (Operating System) (Permanent) (Powerbook) (Unix) (Amd64) (Win2) (X

How To Write A Windows Operating System (Windows) (For Linux) (Windows 2) (Programming) (Operating System) (Permanent) (Powerbook) (Unix) (Amd64) (Win2) (X (Advanced Topics in) Operating Systems Winter Term 2009 / 2010 Jun.-Prof. Dr.-Ing. André Brinkmann brinkman@upb.de Universität Paderborn PC 1 Overview Overview of chapter 3: Case Studies 3.1 Windows Architecture.....3