x64, ARM, Windows Modern Binary Exploitation CSCI Spring 2015 Markus Gaasedelen MBE - 05/08/2015 x64, ARM, Windows 1
|
|
|
- Griffin Edwards
- 7 years ago
- Views:
Transcription
1 x64, ARM, Windows Modern Binary Exploitation CSCI Spring 2015 Markus Gaasedelen MBE - 05/08/2015 x64, ARM, Windows 1
2 Lecture Overview This course has largely revolved around exploiting x86 binaries on Ubuntu i386 Linux is easier and a bit more academic Same can be said about 32bit x86 MBE - 05/08/2015 x64, ARM, Windows 2
3 Lecture Overview This course has largely revolved around exploiting x86 binaries on Ubuntu i386 Linux is easier and a bit more academic Same can be said about 32bit x86 But how does exploitation change for x86_64 systems? ARM devices? How about Windows? MBE - 05/08/2015 x64, ARM, Windows 3
4 Lecture Overview Architecture Differences x86 x86_64 ARM Platform Differences Windows MBE - 05/08/2015 x64, ARM, Windows 4
5 x86 Overview x86 is a 32bit instruction set developed by Intel Sometimes known as x32, x86, IA32 MBE - 05/08/2015 x64, ARM, Windows 5
6 x86 Overview x86 is a 32bit instruction set developed by Intel Sometimes known as x32, x86, IA32 It s a CISC architecture that is super popular and used all around the world yadayadayada, you ve been using it all semester MBE - 05/08/2015 x64, ARM, Windows 6
7 x86 CPU MBE - 05/08/2015 x64, ARM, Windows 7
8 x86 Registers MBE - 05/08/2015 x64, ARM, Windows 8
9 x86 Registers EAX (32bits) EAX MBE - 05/08/2015 x64, ARM, Windows 9
10 x86 Registers EAX (32bits) AX AX (16bits) MBE - 05/08/2015 x64, ARM, Windows 10
11 x86 Registers EAX (32bits) AH AL AH AL <---- (8bits each) AX (16bits) MBE - 05/08/2015 x64, ARM, Windows 11
12 x86 Calling Conventions cdecl Caller cleans up the stack Unknown or variable # of arguments, eg printf() stdcall Callee cleans up the stack Standard calling convention for the Win32 API fastcall First two arguments are put into ECX, and EDX, the rest are put onto the stack MBE - 05/08/2015 x64, ARM, Windows 12
13 x86 Misc Notes x86 is like the wild west in computing it s like it was designed to be exploited MBE - 05/08/2015 x64, ARM, Windows 13
14 x86 Misc Notes x86 is like the wild west in computing it s like it was designed to be exploited No instruction alignment, and you can jump in the middle of instructions (great for ROP Gadgets) MBE - 05/08/2015 x64, ARM, Windows 14
15 x86 Misc Notes x86 is like the wild west in computing it s like it was designed to be exploited No instruction alignment, and you can jump in the middle of instructions (great for ROP Gadgets) Hundreds of instructions, many rarely used MBE - 05/08/2015 x64, ARM, Windows 15
16 x86 Instruction Stats MBE - 05/08/2015 x64, ARM, Windows 16
17 x86 Misc Notes x86 is like the wild west in computing it s like it was designed to be exploited No instruction alignment, and you can jump in the middle of instructions (great for ROP Gadgets) Hundreds of instructions, many rarely used Instructions can range from 1 byte long, to 15 bytes long! MBE - 05/08/2015 x64, ARM, Windows 17
18 x86 Long Instructions lock add DWORD PTR ds:[esi+ecx*4+0x ],0xefcdab f0 3e e ab cd ef (from MBE - 05/08/2015 x64, ARM, Windows 18
19 x86 Misc Notes x86 is like the wild west in computing it s like it was designed to be exploited No instruction alignment, and you can jump in the middle of instructions (great for ROP Gadgets) Hundreds of instructions, many rarely used Instructions can range from 1 byte long, to 15 bytes long! It s the devil s playground MBE - 05/08/2015 x64, ARM, Windows 19
20 Lecture Overview Architecture Differences x86 x86_64 ARM Platform Differences Windows MBE - 05/08/2015 x64, ARM, Windows 20
21 x86_64 Overview x86_64 is the 64bit successor to 32bit x86 Sometimes known as x64, x86_64, AMD64 MBE - 05/08/2015 x64, ARM, Windows 21
22 x86_64 Overview x86_64 is the 64bit successor to 32bit x86 Sometimes known as x64, x86_64, AMD64 We re well into the 64bit era at this point with 32bit x86 machines slowly on their way out MBE - 05/08/2015 x64, ARM, Windows 22
23 x86_64 Overview x86_64 is the 64bit successor to 32bit x86 Sometimes known as x64, x86_64, AMD64 We re well into the 64bit era at this point with 32bit x86 machines slowly on their way out x86_64 is Bigger, better, faster and familiar! MBE - 05/08/2015 x64, ARM, Windows 23
24 x86_64 CPU MBE - 05/08/2015 x64, ARM, Windows 24
25 x86_64 Registers Pretty similar to x86, but with a few upgrades General Purpose Registers Everything starts with R instead of E - RAX, RBX, RCX... GPR s are now 64bit, not 32bit There is now 8 more GPR s for use - R8 to R15 More XMM* registers (128 bits) MBE - 05/08/2015 x64, ARM, Windows 25
26 x86_64 Registers MBE - 05/08/2015 x64, ARM, Windows 26
27 x86_64 Registers RAX (64bits) RAX MBE - 05/08/2015 x64, ARM, Windows 27
28 x86_64 Registers RAX (64bits) EAX (32bits) AL AH AX (16bits) MBE - 05/08/2015 x64, ARM, Windows 28
29 x86_64 Registers MBE - 05/08/2015 x64, ARM, Windows 29
30 x86_64 Calling Conventions The 64bit calling convention is a lot like 32bit fastcall where arguments are put into registers MBE - 05/08/2015 x64, ARM, Windows 30
31 x86_64 Calling Conventions The 64bit calling convention is a lot like 32bit fastcall where arguments are put into registers But Linux and Windows use different registers for their respective calling conventions MBE - 05/08/2015 x64, ARM, Windows 31
32 x86_64 Calling Conventions The 64bit calling convention is a lot like 32bit fastcall where arguments are put into registers But Linux and Windows use different registers for their respective calling conventions Linux: RDI, RSI, RDX, RCX, R8, R9 Windows: RCX, RDX, R8, R9 MBE - 05/08/2015 x64, ARM, Windows 32
33 x86_64 Calling Conventions The 64bit calling convention is a lot like 32bit fastcall where arguments are put into registers But Linux and Windows use different registers for their respective calling conventions Linux: RDI, RSI, RDX, RCX, R8, R9 Windows: RCX, RDX, R8, R9 (any other arguments are pushed onto the stack) MBE - 05/08/2015 x64, ARM, Windows 33
34 x86_64 ROP Chaining multiple function calls via ROP is way easier on 64bit Why? MBE - 05/08/2015 x64, ARM, Windows 34
35 x86_64 ROP Chaining multiple function calls via ROP is way easier on 64bit Why? You simply load function arguments into registers, they don t need to be on the stack! MBE - 05/08/2015 x64, ARM, Windows 35
36 x86_64 ASLR 64bit address space means better ASLR better simply means more entropy to bruteforce Bruteforcing ASLR on 64bit is rarely done MBE - 05/08/2015 x64, ARM, Windows 36
37 x86_64 ASLR cat /proc/self/maps (the same segment after multiple runs) 7f638218c000-7f r-xp : MBE - 05/08/2015 x64, ARM, Windows 37
38 x86_64 ASLR cat /proc/self/maps (the same segment after multiple runs) 7f638218c000-7f r-xp : f6fa368e000-7f6fa r-xp : MBE - 05/08/2015 x64, ARM, Windows 38
39 x86_64 ASLR cat /proc/self/maps (the same segment after multiple runs) 7f638218c000-7f r-xp : f6fa368e000-7f6fa r-xp : f974db f974dcf3000 r-xp : MBE - 05/08/2015 x64, ARM, Windows 39
40 x86_64 ASLR cat /proc/self/maps (the same segment after multiple runs) 7f638218c000-7f r-xp : f6fa368e000-7f6fa r-xp : f974db f974dcf3000 r-xp : MBE - 05/08/2015 x64, ARM, Windows 40
41 x86_64 ASLR cat /proc/self/maps (the same segment after multiple runs) 7f638218c000-7f r-xp : f6fa368e000-7f6fa r-xp : f974db f974dcf3000 r-xp : At least 7 nibbles of libc is changing per run on Ubuntu x64 7 (nibbles) * 4 (bits) = bruteforce % exploit reliability! MBE - 05/08/2015 x64, ARM, Windows 41
42 x86_64 Addresses 64bit addresses almost always have a NULL upper byte, meaning ROP chains and string functions (eg strncpy) don t get along MBE - 05/08/2015 x64, ARM, Windows 42
43 x86_64 Addresses cat /proc/self/maps b000 r-xp : /bin/cat 0060a b000 r--p 0000a000 08: /bin/cat 0060b c000 rw-p 0000b000 08: /bin/cat... 7fc6a fc6a r-xp : libc-2.19.so 7fc6a fc6a4b p 001bb000 08: libc-2.19.so 7fc6a4b fc6a4b46000 r--p 001ba000 08: libc-2.19.so 7fc6a4b fc6a4b48000 rw-p 001be000 08: libc-2.19.so... MBE - 05/08/2015 x64, ARM, Windows 43
44 x86_64 Addresses cat /proc/self/maps b000 r-xp : /bin/cat 0060a b000 r--p 0000a000 08: /bin/cat 0060b c000 rw-p 0000b000 08: /bin/cat... 7fc6a fc6a r-xp : libc-2.19.so 7fc6a fc6a4b p 001bb000 08: libc-2.19.so 7fc6a4b fc6a4b46000 r--p 001ba000 08: libc-2.19.so 7fc6a4b fc6a4b48000 rw-p 001be000 08: libc-2.19.so... 0x x b000 0x00007fc6a x00007fc6a These are 64bit addresses, so yes there s plenty of space for nulls MBE - 05/08/2015 x64, ARM, Windows 44
45 x86_64 Syscalls The syscall numbers in 32bit vs 64bit Linux are different, so be sure you re looking at the respective table when writing your payloads MBE - 05/08/2015 x64, ARM, Windows 45
46 x86_64 Syscalls The syscall numbers in 32bit vs 64bit Linux are different, so be sure you re looking at the respective table when writing your payloads exec syscall on 32bit: 0x0b exec syscall on 64bit: 0x3b MBE - 05/08/2015 x64, ARM, Windows 46
47 Lecture Overview Architecture Differences x86 x86_64 ARM Platform Differences Windows MBE - 05/08/2015 x64, ARM, Windows 47
48 ARM Overview ARM is a 32bit RISC instruction set built for low power devices Has a 16bit THUMB mode MBE - 05/08/2015 x64, ARM, Windows 48
49 ARM Overview ARM is a 32bit RISC instruction set built for low power devices Has a 16bit THUMB mode Used on your phone, tablet, raspberry pi, other small or mobile devices low power MBE - 05/08/2015 x64, ARM, Windows 49
50 ARM Registers MBE - 05/08/2015 x64, ARM, Windows 50
51 ARM Calling Convention Calling convention is basically like fastcall r0-r3 hold your function arguments MBE - 05/08/2015 x64, ARM, Windows 51
52 ARM Assembly Some ARM/THUMB instructions can operate on multiple registers at once pop {r4, r5, r6, lr}... MBE - 05/08/2015 x64, ARM, Windows 52
53 Instruction Alignment ARM mode has 4 byte instruction alignment Can t jump in the middle of instructions THUMB mode has 2 byte instruction alignment When ROPing there s usually more THUMB gadgets that will be of use due to the 2 byte alignment MBE - 05/08/2015 x64, ARM, Windows 53
54 An Interesting Bit Because of 2 & 4 byte instruction alignment, the lowest bit of the program counter (eg r15) will never be set 0x080462B MBE - 05/08/2015 x64, ARM, Windows 54
55 An Interesting Bit Because of 2 & 4 byte instruction alignment, the lowest bit of the program counter (eg r15) will never be set 0x080462B This bit is re-purposed to tell the processor if we are in THUMB mode or ARM mode MBE - 05/08/2015 x64, ARM, Windows 55
56 An Interesting Bit r15 = 0x080462B0 = Interpret bytes at 0x080462B0 as ARM r15 = 0x080462B1 = Interpret bytes at 0x080462B0 as THUMB MBE - 05/08/2015 x64, ARM, Windows 56
57 Caching In x86 the processor will invalidate icache lines if the line is written to MBE - 05/08/2015 x64, ARM, Windows 57
58 Caching In x86 the processor will invalidate icache lines if the line is written to With ARM you have to request manual cache flushes, or do large memory operations to flush the cache naturally MBE - 05/08/2015 x64, ARM, Windows 58
59 Caching In x86 the processor will invalidate icache lines if the line is written to With ARM you have to request manual cache flushes, or do large memory operations to flush the cache naturally Can get annoying in exploitation what you seez, may not beez what it iz MBE - 05/08/2015 x64, ARM, Windows 59
60 Lecture Overview Architecture Differences x86 x86_64 ARM Platform Differences Windows MBE - 05/08/2015 x64, ARM, Windows 60
61 Windows vs Linux Almost all the vulnerability classes and exploitation techniques you have learned in this course will apply directly to Windows MBE - 05/08/2015 x64, ARM, Windows 61
62 Windows Basics The executable format on Windows is obviously.exe s instead of Linux ELF s MBE - 05/08/2015 x64, ARM, Windows 62
63 MBE - 05/08/2015 x64, ARM, Windows 63
64 Windows Basics The executable format on Windows is obviously.exe s instead of Linux ELF s Libraries are.dll s, like Linux.so s eg: MSVCRT.dll is like libc Microsoft Visual C(++) Common Runtime MBE - 05/08/2015 x64, ARM, Windows 64
65 Windows Basics Loaded DLL s MBE - 05/08/2015 x64, ARM, Windows 65
66 Windows Basics The executable format on Windows is obviously.exe s instead of Linux ELF s Libraries are.dll s, like Linux.so s eg: MSVCRT.dll is like libc Microsoft Visual C(++) Common Runtime A process usually loads lots of libs (dll s) MBE - 05/08/2015 x64, ARM, Windows 66
67 Windows Debuggers If you re going to get rolling on Windows, try to pick up skills debugging with WinDbg EARLY MBE - 05/08/2015 x64, ARM, Windows 67
68 Windows Debuggers If you re going to get rolling on Windows, try to pick up skills debugging with WinDbg EARLY WinDBG is Microsoft s debugger Basically GDB with different command mappings Not as convenient as OllyDBG, but way less sketchy Best 64bit debugger MBE - 05/08/2015 x64, ARM, Windows 68
69 WinDbg MBE - 05/08/2015 x64, ARM, Windows 69
70 Windows Exploitation Basics Raw syscalls are virtually never seen in native windows applications or libraries MBE - 05/08/2015 x64, ARM, Windows 70
71 Windows Exploitation Basics Raw syscalls are virtually never seen in native windows applications or libraries No more `int 0x80` shellcode MBE - 05/08/2015 x64, ARM, Windows 71
72 Windows Exploitation Basics Raw syscalls are virtually never seen in native windows applications or libraries No more `int 0x80` shellcode Why? MBE - 05/08/2015 x64, ARM, Windows 72
73 Windows Exploitation Basics Raw syscalls are virtually never seen in native windows applications or libraries No more `int 0x80` shellcode Why? Syscall numbers tend to change from version to version of Windows and would be hard or unreliable to code into an exploit MBE - 05/08/2015 x64, ARM, Windows 73
74 ntdll.dll and kernel32.dll ntdll.dll the Native API Wraps all the syscalls for the given version of Windows, is pretty low level stuff kernel32.dll the Win32 API More familiar high level stuff OpenFile(), ReadFile(), CreateProcess(), LoadLibrary(), GetProcAddress(), MBE - 05/08/2015 x64, ARM, Windows 74
75 Windows Fun Facts Most people think kernel32.dll is required by every windows process, but ntdll.dll is infact the only one that MUST be loaded MBE - 05/08/2015 x64, ARM, Windows 75
76 Windows Exploitation Basics So instead of using syscalls, an exploit will almost always use existing imported functions MBE - 05/08/2015 x64, ARM, Windows 76
77 Windows Exploitation Basics If a function of interest is not imported by a loaded DLL, an exploit payload will usually do what is known as walking the IAT It resolves the function location manually MBE - 05/08/2015 x64, ARM, Windows 77
78 Windows Exploitation Basics If a function of interest is not imported by a loaded DLL, an exploit payload will usually do what is known as walking the IAT It resolves the function location manually If GetProcAddress() is imported from kernel32.dll, you can easily lookup functions Same as dlsym() on Linux MBE - 05/08/2015 x64, ARM, Windows 78
79 Windows Exploitation Basics GetProcAddress(k32h, CreateProcess );... Looking up the CreateProcess function MBE - 05/08/2015 x64, ARM, Windows 79
80 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 80
81 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Hardware Enforced DEP ROP Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 81
82 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Hardware Enforced DEP ROP Stack Cookies (GS) Leak & replace, write past, SEH Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 82
83 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Hardware Enforced DEP ROP Stack Cookies (GS) Leak & replace, write past, SEH Safe heap unlinking Heap metadata exploits Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 83
84 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Hardware Enforced DEP ROP Stack Cookies (GS) Leak & replace, write past, SEH Safe heap unlinking Heap metadata exploits SafeSEH? Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 84
85 Windows XP Security Windows XP SP2 marked the start of the modern security era (Summer 2004) Hardware Enforced DEP ROP Stack Cookies (GS) Leak & replace, write past, SEH Safe heap unlinking Heap metadata exploits SafeSEH? What is SEH/SafeSEH? Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 85
86 Structured Exception Handling Structured Exception Handling is a lot like assigning signal handlers on Linux MBE - 05/08/2015 x64, ARM, Windows 86
87 Structured Exception Handling Structured Exception Handling is a lot like assigning signal handlers on Linux You simply register an exception handler, and if something bad like a segfault happens, code flow is redirected to the handler Print an error message, exit semi-gracefully, etc MBE - 05/08/2015 x64, ARM, Windows 87
88 Exploiting SEH Exception records are placed on the stack, so they re relatively easy to corrupt MBE - 05/08/2015 x64, ARM, Windows 88
89 Exploiting SEH Because you only have one gadget of execution through an overwritten SEH record, you usually have to use it to stack pivot MBE - 05/08/2015 x64, ARM, Windows 89
90 Exploiting SEH Because you only have one gadget of execution through an overwritten SEH record, you usually have to use it to stack pivot Classically you could use a pop pop ret gadget to easily return onto the smashed stack (assumes executable stack) as a pointer to your overwritten SEH record is nearby MBE - 05/08/2015 x64, ARM, Windows 90
91 Exploiting SEH MBE - 05/08/2015 x64, ARM, Windows 91
92 SafeSEH SafeSEH is an additional set of checks made to ensure that a registered exception handler has not been corrupted You can enable it using the /SAFESEH flag at compile time MBE - 05/08/2015 x64, ARM, Windows 92
93 Bypassing SafeSEH With SafeSEH, an exception record is invalid if: The exception handler is pointing onto the stack The exception handler does not match the list of registered exception handlers in module it is pointing into MBE - 05/08/2015 x64, ARM, Windows 93
94 Windows Vista Security Windows Vista was marred by instability and performance issues, but made good progress in terms of security Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 94
95 Windows Vista Security Windows Vista was marred by instability and performance issues, but made good progress in terms of security ASLR Info leaks, partial overwrites, non aslr d code Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 95
96 Windows Vista Security Windows Vista was marred by instability and performance issues, but made good progress in terms of security ASLR Info leaks, partial overwrites, non aslr d code SEHOP? Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 96
97 SEH Overwrite Protection SEH Overwrite Protection (SEHOP) is the second attempt Microsoft made to mitigate SEH exploitation MBE - 05/08/2015 x64, ARM, Windows 97
98 SEH Overwrite Protection SEH Overwrite Protection (SEHOP) is the second attempt Microsoft made to mitigate SEH exploitation When an exception is triggered, the SEH dispatcher attempts to walk the SEH chain to a symbolic terminating record If this record cannot be reached, the chain is bad MBE - 05/08/2015 x64, ARM, Windows 98
99 SEH Overwrite Protection MBE - 05/08/2015 x64, ARM, Windows 99
100 Bypassing SEHOP Bypassing SEHOP is pretty painful and basically involves faking a chain to the terminating record MBE - 05/08/2015 x64, ARM, Windows 100
101 Windows Vista Security Windows Vista was marred by instability and performance issues, but made good progress in terms of security ASLR Info leaks, partial overwrites, non aslr d code SEHOP Faking SEH Chains Heap Hardening More heap metadata checks Protection Bypass??? MBE - 05/08/2015 x64, ARM, Windows 101
102 Windows 7 Security I don t think much new stuff happened with Windows 7 in terms mitigation technologies Mostly cleaning up stability issues from Vista MBE - 05/08/2015 x64, ARM, Windows 102
103 Windows 8 Security Windows 8/8.1 took a big step forward in sec Enhanced GS (Stack Cookies) VTGuard Like a Vtable Canary Heap Hardening Allocation order randomization Non-deterministic alloc. order Guard pages A bit like canaries between heap pages ASLR Entropy Improvements More entropy all around PatchGuard Prevent the kernel from being live patched Secure Boot Eliminate root/boot kits with chain of trust Control Flow Guard Whitelist indirect calls MBE - 05/08/2015 x64, ARM, Windows 103
104 Desktop Market Share, May 2015 Windows market share, ~90.93% MBE - 05/08/2015 x64, ARM, Windows 104
105 Windows Summary In the end, Windows based exploitation isn t too different from Linux, but it s quickly getting harder MBE - 05/08/2015 x64, ARM, Windows 105
106 Windows Summary In the end, Windows based exploitation isn t too different from Linux, but it s quickly getting harder Some main takeaways Differing 64bit calling convention Syscalls aren t really a thing on Windows New class of vulnerabilities, SEH Exploitation New protections, SafeSEH, SEHOP Better ASLR & Heap internals Its mitigation technologies are rapidly evolving MBE - 05/08/2015 x64, ARM, Windows 106
Bypassing Memory Protections: The Future of Exploitation
Bypassing Memory Protections: The Future of Exploitation Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Research into reliable exploitation techniques: Heap Feng Shui in JavaScript
Exploiting nginx chunked overflow bug, the undisclosed attack vector
Exploiting nginx chunked overflow bug, the undisclosed attack vector Long Le longld@vnsecurity.net About VNSECURITY.NET CLGT CTF team 2 VNSECURITY.NET In this talk Nginx brief introduction Nginx chunked
Bypassing Browser Memory Protections in Windows Vista
Bypassing Browser Memory Protections in Windows Vista Mark Dowd & Alexander Sotirov markdowd@au1.ibm.com alex@sotirov.net Setting back browser security by 10 years Part I: Introduction Thesis Introduction
Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail
![Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail](/thumbs/31/15336358.jpg "Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail")
Hacking Techniques & Intrusion Detection Ali Al-Shemery arabnix [at] gmail All materials is licensed under a Creative Commons Share Alike license http://creativecommonsorg/licenses/by-sa/30/ # whoami Ali
Modern Binary Exploitation Course Syllabus
Modern Binary Exploitation Course Syllabus Course Information Course Title: Modern Binary Exploitation Course Number: CSCI 4968 Credit Hours: 4 Semester / Year: Spring 2015 Meeting Days: Tuesday/Friday
Custom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich
I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation Mathias Payer, ETH Zurich Motivation Applications often vulnerable to security exploits Solution: restrict application
64-Bit NASM Notes. Invoking 64-Bit NASM
64-Bit NASM Notes The transition from 32- to 64-bit architectures is no joke, as anyone who has wrestled with 32/64 bit incompatibilities will attest We note here some key differences between 32- and 64-bit
風 水. Heap Feng Shui in JavaScript. Alexander Sotirov. asotirov@determina.com
風 水 Heap Feng Shui in JavaScript Alexander Sotirov asotirov@determina.com Black Hat Europe 2007 Introduction What is Heap Feng Shui? the ancient art of arranging heap blocks in order to redirect the program
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com
Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic
Security & Exploitation
Security & Exploitation Operating Systems Spring 2015 RPISEC - 05/11/2015 OS Security 1 whoami Markus Gaasedelen B.S. Computer Science 15 Security Enthusiast I like to hack things President of RPISEC http://rpis.ec
Lecture 7: Machine-Level Programming I: Basics Mohamed Zahran (aka Z) mzahran@cs.nyu.edu http://www.mzahran.com
CSCI-UA.0201-003 Computer Systems Organization Lecture 7: Machine-Level Programming I: Basics Mohamed Zahran (aka Z) mzahran@cs.nyu.edu http://www.mzahran.com Some slides adapted (and slightly modified)
Software Vulnerability Exploitation Trends. Exploring the impact of software mitigations on patterns of vulnerability exploitation
Software Vulnerability Exploitation Trends Exploring the impact of software mitigations on patterns of vulnerability exploitation Software Vulnerability Exploitation Trends This document is for informational
Example of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
Defense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
Betriebssysteme KU Security
Betriebssysteme KU Security IAIK Graz University of Technology 1 1. Drivers 2. Security - The simple stuff 3. Code injection attacks 4. Side-channel attacks 2 1. Drivers 2. Security - The simple stuff
Buffer Overflows. Security 2011
Buffer Overflows Security 2011 Memory Organiza;on Topics Kernel organizes memory in pages Typically 4k bytes Processes operate in a Virtual Memory Space Mapped to real 4k pages Could live in RAM or be
Return-oriented programming without returns
Faculty of Computer Science Institute for System Architecture, Operating Systems Group Return-oriented programming without urns S. Checkoway, L. Davi, A. Dmitrienko, A. Sadeghi, H. Shacham, M. Winandy
Turn the Page: Why now is the time to migrate off Windows Server 2003
Turn the Page: Why now is the time to migrate off Windows Server 2003 HP Security Research Contents Introduction... 1 What does End of Support mean?... 1 What End of Support doesn t mean... 1 Why you need
Software Vulnerabilities
Software Vulnerabilities -- stack overflow Code based security Code based security discusses typical vulnerabilities made by programmers that can be exploited by miscreants Implementing safe software in
Exploiting Trustzone on Android
1 Introduction Exploiting Trustzone on Android Di Shen(@returnsme) retme7@gmail.com This paper tells a real story about exploiting TrustZone step by step. I target an implementation of Trusted Execution
Operating System Structures
COP 4610: Introduction to Operating Systems (Spring 2015) Operating System Structures Zhi Wang Florida State University Content Operating system services User interface System calls System programs Operating
Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows
Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military
CORE SECURITY. Exploiting Adobe Flash Player in the era of Control Flow Guard. Francisco Falcon (@fdfalcon) Black Hat Europe 2015 November 12-13, 2015
CORE SECURITY Exploiting Adobe Flash Player in the era of Control Flow Guard Francisco Falcon (@fdfalcon) Black Hat Europe 2015 November 12-13, 2015 About me 2 About me Exploit Writer for Core Security.
Attacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com
Attacking Host Intrusion Prevention Systems Eugene Tsyrklevich eugene@securityarchitects.com Agenda Introduction to HIPS Buffer Overflow Protection Operating System Protection Conclusions Demonstration
Attacking x86 Windows Binaries by Jump Oriented Programming
Attacking x86 Windows Binaries by Jump Oriented Programming L. Erdődi * * Faculty of John von Neumann, Óbuda University, Budapest, Hungary erdodi.laszlo@nik.uni-obuda.hu Abstract Jump oriented programming
Software security. Buffer overflow attacks SQL injections. Lecture 11 EIT060 Computer Security
Software security Buffer overflow attacks SQL injections Lecture 11 EIT060 Computer Security Buffer overflow attacks Buffer overrun is another common term Definition A condition at an interface under which
esrever gnireenigne tfosorcim seiranib
esrever gnireenigne tfosorcim seiranib Alexander Sotirov asotirov@determina.com CanSecWest / core06 Reverse Engineering Microsoft Binaries Alexander Sotirov asotirov@determina.com CanSecWest / core06 Overview
http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention
http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention Oct 2, 2005 skape mmiller@hick.org Skywing Skywing@valhallalegends.com One of the big changes that Microsoft introduced
COS 318: Operating Systems
COS 318: Operating Systems OS Structures and System Calls Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall10/cos318/ Outline Protection mechanisms
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: The most dangerous threat is the one which do not have a CVE. Until now developing reliable exploits
Introduction. Application Security. Reasons For Reverse Engineering. This lecture. Java Byte Code
Introduction Application Security Tom Chothia Computer Security, Lecture 16 Compiled code is really just data which can be edit and inspected. By examining low level code protections can be removed and
Title: Bugger The Debugger - Pre Interaction Debugger Code Execution
White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers
EMET 4.0 PKI MITIGATION. Neil Sikka DefCon 21
EMET 4.0 PKI MITIGATION Neil Sikka DefCon 21 ABOUT ME Security Engineer on MSRC (Microsoft Security Response Center) I look at 0Days EMET Developer I enjoy doing security research on my free time too:
Off-by-One exploitation tutorial
Off-by-One exploitation tutorial By Saif El-Sherei www.elsherei.com Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as a good friend
MSc Computer Science Dissertation
University of Oxford Computing Laboratory MSc Computer Science Dissertation Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities Author: Sean Heelan Supervisor: Dr. Daniel
CS161: Operating Systems
CS161: Operating Systems Matt Welsh mdw@eecs.harvard.edu Lecture 2: OS Structure and System Calls February 6, 2007 1 Lecture Overview Protection Boundaries and Privilege Levels What makes the kernel different
5. Calling conventions for different C++ compilers and operating systems
5. Calling conventions for different C++ compilers and operating systems By Agner Fog. Technical University of Denmark. Copyright 2004-2014. Last updated 2014-08-07. Contents 1 Introduction... 3 2 The
telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012
telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012 Content Part I Info Bug Telnet Exploit Part II Advanced Exploitation Meta Information Disclosed
Practical taint analysis for protecting buggy binaries
Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't care Erik Bosman Traditional Stack Smashing buf[16] GET / HTTP/1.100baseretnarg1arg2 Traditional
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement. MJ0011 th_decoder@126.com
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement MJ0011 th_decoder@126.com Agenda Background A Patched Vulnerability: CVE-2010-4398 Bypass DSE on Windows7 x64 Windows8
Lecture 26: Obfuscation
Lecture 26: Obfuscation 15411: Compiler Design Robbie Harwood and Maxime Serrano 21 November 2013 1 Introduction We have previously (lecture 20) considered the problem of doing compilation backwards (i.e.,
Ivan Medvedev Principal Security Development Lead Microsoft Corporation
Ivan Medvedev Principal Security Development Lead Microsoft Corporation Session Objectives and Takeaways Session Objective(s): Give an overview of the Security Development Lifecycle Discuss the externally
Faculty of Engineering Student Number:
Philadelphia University Student Name: Faculty of Engineering Student Number: Dept. of Computer Engineering Final Exam, First Semester: 2012/2013 Course Title: Microprocessors Date: 17/01//2013 Course No:
Last Class: OS and Computer Architecture. Last Class: OS and Computer Architecture
Last Class: OS and Computer Architecture System bus Network card CPU, memory, I/O devices, network card, system bus Lecture 3, page 1 Last Class: OS and Computer Architecture OS Service Protection Interrupts
CS3600 SYSTEMS AND NETWORKS
CS3600 SYSTEMS AND NETWORKS NORTHEASTERN UNIVERSITY Lecture 2: Operating System Structures Prof. Alan Mislove (amislove@ccs.neu.edu) Operating System Services Operating systems provide an environment for
Windows XP SP3 Registry Handling Buffer Overflow
Windows XP SP3 Registry Handling Buffer Overflow by Matthew j00ru Jurczyk and Gynvael Coldwind Hispasec 1. Basic Information Name Windows XP SP3 Registry Handling Buffer Overflow Class Design Error Impact
Objectives. Chapter 2: Operating-System Structures. Operating System Services (Cont.) Operating System Services. Operating System Services (Cont.
Objectives To describe the services an operating system provides to users, processes, and other systems To discuss the various ways of structuring an operating system Chapter 2: Operating-System Structures
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 20: Stack Frames 7 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 20: Stack Frames 7 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Where We Are Source code if (b == 0) a = b; Low-level IR code
LSN 2 Computer Processors
LSN 2 Computer Processors Department of Engineering Technology LSN 2 Computer Processors Microprocessors Design Instruction set Processor organization Processor performance Bandwidth Clock speed LSN 2
Intel 8086 architecture
Intel 8086 architecture Today we ll take a look at Intel s 8086, which is one of the oldest and yet most prevalent processor architectures around. We ll make many comparisons between the MIPS and 8086
CS 377: Operating Systems. Outline. A review of what you ve learned, and how it applies to a real operating system. Lecture 25 - Linux Case Study
CS 377: Operating Systems Lecture 25 - Linux Case Study Guest Lecturer: Tim Wood Outline Linux History Design Principles System Overview Process Scheduling Memory Management File Systems A review of what
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge Antonio Bianchi antoniob@cs.ucsb.edu University of California, Santa Barbara HITCON Enterprise August 27th, 2015 Agenda Shellphish The
Last Class: OS and Computer Architecture. Last Class: OS and Computer Architecture
Last Class: OS and Computer Architecture System bus Network card CPU, memory, I/O devices, network card, system bus Lecture 3, page 1 Last Class: OS and Computer Architecture OS Service Protection Interrupts
Operating System Components
Lecture Overview Operating system software introduction OS components OS services OS structure Operating Systems - April 24, 2001 Operating System Components Process management Memory management Secondary
System Structures. Services Interface Structure
System Structures Services Interface Structure Operating system services (1) Operating system services (2) Functions that are helpful to the user User interface Command line interpreter Batch interface
Computer Organization and Architecture
Computer Organization and Architecture Chapter 11 Instruction Sets: Addressing Modes and Formats Instruction Set Design One goal of instruction set design is to minimize instruction length Another goal
Assembly Language: Function Calls" Jennifer Rexford!
Assembly Language: Function Calls" Jennifer Rexford! 1 Goals of this Lecture" Function call problems:! Calling and returning! Passing parameters! Storing local variables! Handling registers without interference!
W4118 Operating Systems. Junfeng Yang
W4118 Operating Systems Junfeng Yang Outline Linux overview Interrupt in Linux System call in Linux What is Linux A modern, open-source OS, based on UNIX standards 1991, 0.1 MLOC, single developer Linus
CSC 2405: Computer Systems II
CSC 2405: Computer Systems II Spring 2013 (TR 8:30-9:45 in G86) Mirela Damian http://www.csc.villanova.edu/~mdamian/csc2405/ Introductions Mirela Damian Room 167A in the Mendel Science Building mirela.damian@villanova.edu
DAWSON -- Synthetic Diversity for Intrusion Tolerance 1
DAWSON -- Synthetic Diversity for Intrusion Tolerance 1 1. Introduction Global Infotek, Inc.: James Just, Nathan Li UC Davis: Karl Levitt, Jeff Rowe, Tufan Demire SUNY-Stonybrook: R. Sekar Fault-tolerant
Exception and Interrupt Handling in ARM
Exception and Interrupt Handling in ARM Architectures and Design Methods for Embedded Systems Summer Semester 2006 Author: Ahmed Fathy Mohammed Abdelrazek Advisor: Dominik Lücke Abstract We discuss exceptions
OS Virtualization Frank Hofmann
OS Virtualization Frank Hofmann OP/N1 Released Products Engineering Sun Microsystems UK Overview Different approaches to virtualization > Compartmentalization > System Personalities > Virtual Machines
Instruction Set Architecture
CS:APP Chapter 4 Computer Architecture Instruction Set Architecture Randal E. Bryant adapted by Jason Fritts http://csapp.cs.cmu.edu CS:APP2e Hardware Architecture - using Y86 ISA For learning aspects
An Introduction to Assembly Programming with the ARM 32-bit Processor Family
An Introduction to Assembly Programming with the ARM 32-bit Processor Family G. Agosta Politecnico di Milano December 3, 2011 Contents 1 Introduction 1 1.1 Prerequisites............................. 2
AppSecUSA New York City 2013
AppSecUSA New York City 2013 ME? Simón Roses Femerling Founder & CEO, VULNEX www.vulnex.com Blog: www.simonroses.com Twitter: @simonroses Former Microsoft, PwC, @Stake DARPA Cyber Fast Track award on software
Compromise-as-a-Service
ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg 3/31/14 Compromise-as-a-Service Our PleAZURE Felix Wilhelm & Matthias Luft {fwilhelm, mluft}@ernw.de ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg Agenda
Stack Allocation. Run-Time Data Structures. Static Structures
Run-Time Data Structures Stack Allocation Static Structures For static structures, a fixed address is used throughout execution. This is the oldest and simplest memory organization. In current compilers,
Advanced IBM AIX Heap Exploitation. Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com
Advanced IBM AIX Heap Exploitation Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com Introduction Our society has become dependent on computers and network systems.
Buffer Overflows. Code Security: Buffer Overflows. Buffer Overflows are everywhere. 13 Buffer Overflow 12 Nov 2015
CSCD27 Computer and Network Security Code Security: Buffer Overflows 13 Buffer Overflow CSCD27 Computer and Network Security 1 Buffer Overflows Extremely common bug. First major exploit: 1988 Internet
Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>
![Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>](/thumbs/32/15517621.jpg "Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>")
Unix Security Technologies Pete Markowsky What is this about? The goal of this CPU/SWS are: Introduce you to classic vulnerabilities Get you to understand security advisories Make
CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis
Your texte here. CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis October 11 th, 2012 Brian MARIANI & Frédéric BOURLA A FEW WORDS ABOUT FLASH PLAYER Your Adobe texte Flash here
X86-64 Architecture Guide
X86-64 Architecture Guide For the code-generation project, we shall expose you to a simplified version of the x86-64 platform. Example Consider the following Decaf program: class Program { int foo(int
HTC Windows Phone 7 Arbitrary Read/Write of Kernel Memory 10/11/2011
MWR InfoSecurity Advisory HTC Windows Phone 7 Arbitrary Read/Write of Kernel Memory 10/11/2011 Package Name Date 10/11/2011 Affected Versions HTC Windows Phone 7 Phones HTC HD7 confirmed to be vulnerable.
ERNW Newsletter 51 / September 2015
ERNW Newsletter 51 / September 2015 Playing With Fire: Attacking the FireEye MPS Date: 9/10/2015 Classification: Author(s): Public Felix Wilhelm TABLE OF CONTENT 1 MALWARE PROTECTION SYSTEM... 4 2 GAINING
Advanced Computer Architecture-CS501. Computer Systems Design and Architecture 2.1, 2.2, 3.2
Lecture Handout Computer Architecture Lecture No. 2 Reading Material Vincent P. Heuring&Harry F. Jordan Chapter 2,Chapter3 Computer Systems Design and Architecture 2.1, 2.2, 3.2 Summary 1) A taxonomy of
Choosing a Computer for Running SLX, P3D, and P5
Choosing a Computer for Running SLX, P3D, and P5 This paper is based on my experience purchasing a new laptop in January, 2010. I ll lead you through my selection criteria and point you to some on-line
CS61: Systems Programing and Machine Organization
CS61: Systems Programing and Machine Organization Fall 2009 Section Notes for Week 2 (September 14 th - 18 th ) Topics to be covered: I. Binary Basics II. Signed Numbers III. Architecture Overview IV.
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING. Presented by: Dave Kennedy Eric Smith
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING Presented by: Dave Kennedy Eric Smith AGENDA Penetration Testing by the masses Review of current state by most service providers Deficiencies in
Attacking Obfuscated Code with IDA Pro. Chris Eagle
Attacking Obfuscated Code with IDA Pro Chris Eagle Outline Introduction Operation Demos Summary 2 First Order Of Business MOVE UP AND IN! There is plenty of room up front I can't increase the font size
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 24 Windows and Windows Vista Security First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Windows and Windows Vista Security
İSTANBUL AYDIN UNIVERSITY
İSTANBUL AYDIN UNIVERSITY FACULTY OF ENGİNEERİNG SOFTWARE ENGINEERING THE PROJECT OF THE INSTRUCTION SET COMPUTER ORGANIZATION GÖZDE ARAS B1205.090015 Instructor: Prof. Dr. HASAN HÜSEYİN BALIK DECEMBER
Using the Game Boy Advance to Teach Computer Systems and Architecture
Using the Game Boy Advance to Teach Computer Systems and Architecture ABSTRACT This paper presents an approach to teaching computer systems and architecture using Nintendo s Game Boy Advance handheld game
Chapter 3: Operating-System Structures. System Components Operating System Services System Calls System Programs System Structure Virtual Machines
Chapter 3: Operating-System Structures System Components Operating System Services System Calls System Programs System Structure Virtual Machines Operating System Concepts 3.1 Common System Components
MICROPROCESSOR AND MICROCOMPUTER BASICS
Introduction MICROPROCESSOR AND MICROCOMPUTER BASICS At present there are many types and sizes of computers available. These computers are designed and constructed based on digital and Integrated Circuit
ASSEMBLY PROGRAMMING ON A VIRTUAL COMPUTER
ASSEMBLY PROGRAMMING ON A VIRTUAL COMPUTER Pierre A. von Kaenel Mathematics and Computer Science Department Skidmore College Saratoga Springs, NY 12866 (518) 580-5292 pvonk@skidmore.edu ABSTRACT This paper
Processor Architectures
ECPE 170 Jeff Shafer University of the Pacific Processor Architectures 2 Schedule Exam 3 Tuesday, December 6 th Caches Virtual Memory Input / Output OperaKng Systems Compilers & Assemblers Processor Architecture
CS3235 - Computer Security Thirteenth topic: System attacks. defenses
Overflows... Security case studies CS3235 - Computer Security Thirteenth topic: System attacks and defenses Hugh Anderson National University of Singapore School of Computing March/April, 2016 Hugh Anderson
Lecture 17: Virtual Memory II. Goals of virtual memory
Lecture 17: Virtual Memory II Last Lecture: Introduction to virtual memory Today Review and continue virtual memory discussion Lecture 17 1 Goals of virtual memory Make it appear as if each process has:
OWASP Spain Barcelona 2014
OWASP Spain Barcelona 2014 ME & VULNEX Simon Roses Femerling Founder & CEO, VULNEX www.vulnex.com @simonroses @vulnexsl Former Microsoft, PwC, @Stake Black Hat, RSA, OWASP, SOURCE, AppSec, DeepSec, TECHNET,
How do Users and Processes interact with the Operating System? Services for Processes. OS Structure with Services. Services for the OS Itself
How do Users and Processes interact with the Operating System? Users interact indirectly through a collection of system programs that make up the operating system interface. The interface could be: A GUI,
For a 64-bit system. I - Presentation Of The Shellcode
#How To Create Your Own Shellcode On Arch Linux? #Author : N3td3v!l #Contact-mail : 4nonymouse@usa.com #Website : Nopotm.ir #Spcial tnx to : C0nn3ct0r And All Honest Hackerz and Security Managers I - Presentation
An Introduction to the ARM 7 Architecture
An Introduction to the ARM 7 Architecture Trevor Martin CEng, MIEE Technical Director This article gives an overview of the ARM 7 architecture and a description of its major features for a developer new
CHAPTER 4 System Exploitation
CHAPTER 4 System Exploitation In this chapter, we present the tactics of system exploitation used by attackers in targeted attacks. In the last chapter, we presented a variety of models deployed by attackers
Computer Architectures
Computer Architectures 2. Instruction Set Architectures 2015. február 12. Budapest Gábor Horváth associate professor BUTE Dept. of Networked Systems and Services ghorvath@hit.bme.hu 2 Instruction set architectures
The Plan Today... System Calls and API's Basics of OS design Virtual Machines
System Calls + The Plan Today... System Calls and API's Basics of OS design Virtual Machines System Calls System programs interact with the OS (and ultimately hardware) through system calls. Called when
CS420: Operating Systems OS Services & System Calls
NK YORK COLLEGE OF PENNSYLVANIA HG OK 2 YORK COLLEGE OF PENNSYLVAN OS Services & System Calls James Moscola Department of Physical Sciences York College of Pennsylvania Based on Operating System Concepts,
Getting Started with CodeXL
AMD Developer Tools Team Advanced Micro Devices, Inc. Table of Contents Introduction... 2 Install CodeXL... 2 Validate CodeXL installation... 3 CodeXL help... 5 Run the Teapot Sample project... 5 Basic
Kernel Types System Calls. Operating Systems. Autumn 2013 CS4023
Operating Systems Autumn 2013 Outline 1 2 Types of 2.4, SGG The OS Kernel The kernel is the central component of an OS It has complete control over everything that occurs in the system Kernel overview