Lec9-Interrupt.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Allgemeines Abkürzungsverzeichnis
Allgemeines Abkürzungsverzeichnis L. -
Understanding the Microsoft Office 2013 Protected-View Sandbox
MWRI PUBLIC UNDERSTANDING THE MICROSOFT OFFICE 2013 PROTECTED-VIEW SANDBOX Yong Chuan, Koh (@yongchuank) 2015/07/09 mwrinfosecurity.com | © MWR InfoSecurity MWRI PUBLIC MWRI PUBLIC Table of Contents 1. Introduction .................................................................................................................... 3 2. Sandbox Internals ............................................................................................................. 4 2.1 Architecture .............................................................................................................. 4 2.1.1 Interception Component ......................................................................................... 4 2.1.2 Elevation Policy Manager ........................................................................................ 4 2.1.3 Inter-Process Communication ................................................................................... 5 2.2 Sandbox Restrictions.................................................................................................... 6 2.2.1 Sandbox Initialization ............................................................................................ 6 2.2.2 File Locations .................................................................................................... 12 2.2.3 Registry Keys ..................................................................................................... 12 2.2.4 Network Connections .......................................................................................... -
Protected Mode - Wikipedia
2/12/2019 Protected mode - Wikipedia Protected mode In computing, protected mode, also called protected virtual address mode,[1] is an operational mode of x86- compatible central processing units (CPUs). It allows system software to use features such as virtual memory, paging and safe multi-tasking designed to increase an operating system's control over application software.[2][3] When a processor that supports x86 protected mode is powered on, it begins executing instructions in real mode, in order to maintain backward compatibility with earlier x86 processors.[4] Protected mode may only be entered after the system software sets up one descriptor table and enables the Protection Enable (PE) bit in the control register 0 (CR0).[5] Protected mode was first added to the x86 architecture in 1982,[6] with the release of Intel's 80286 (286) processor, and later extended with the release of the 80386 (386) in 1985.[7] Due to the enhancements added by protected mode, it has become widely adopted and has become the foundation for all subsequent enhancements to the x86 architecture,[8] although many of those enhancements, such as added instructions and new registers, also brought benefits to the real mode. Contents History The 286 The 386 386 additions to protected mode Entering and exiting protected mode Features Privilege levels Real mode application compatibility Virtual 8086 mode Segment addressing Protected mode 286 386 Structure of segment descriptor entry Paging Multitasking Operating systems See also References External links History https://en.wikipedia.org/wiki/Protected_mode -
A+ Certification for Dummies, 2Nd Edition.Pdf
A+ Certification for Dummies, Second Edition by Ron Gilster ISBN: 0764508121 | Hungry Minds © 2001 , 567 pages Your fun and easy guide to Exams 220-201 and 220-202! A+ Certification For Dummies by Ron Gilster Published by Hungry Minds, Inc. 909 Third Avenue New York, NY 10022 www.hungryminds.com www.dummies.com Copyright © 2001 Hungry Minds, Inc. All rights reserved. No part of this book, including interior design, cover design, and icons, may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording, or otherwise) without the prior written permission of the publisher. Library of Congress Control Number: 2001086260 ISBN: 0-7645-0812-1 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 2O/RY/QU/QR/IN Distributed in the United States by Hungry Minds, Inc. Distributed by CDG Books Canada Inc. for Canada; by Transworld Publishers Limited in the United Kingdom; by IDG Norge Books for Norway; by IDG Sweden Books for Sweden; by IDG Books Australia Publishing Corporation Pty. Ltd. for Australia and New Zealand; by TransQuest Publishers Pte Ltd. for Singapore, Malaysia, Thailand, Indonesia, and Hong Kong; by Gotop Information Inc. for Taiwan; by ICG Muse, Inc. for Japan; by Intersoft for South Africa; by Eyrolles for France; by International Thomson Publishing for Germany, Austria and Switzerland; by Distribuidora Cuspide for Argentina; by LR International for Brazil; by Galileo Libros for Chile; by Ediciones ZETA S.C.R. Ltda. for Peru; by WS Computer Publishing Corporation, Inc., for the Philippines; by Contemporanea de Ediciones for Venezuela; by Express Computer Distributors for the Caribbean and West Indies; by Micronesia Media Distributor, Inc. -
Chapter 3 Protected-Mode Memory Management
CHAPTER 3 PROTECTED-MODE MEMORY MANAGEMENT This chapter describes the Intel 64 and IA-32 architecture’s protected-mode memory management facilities, including the physical memory requirements, segmentation mechanism, and paging mechanism. See also: Chapter 5, “Protection” (for a description of the processor’s protection mechanism) and Chapter 20, “8086 Emulation” (for a description of memory addressing protection in real-address and virtual-8086 modes). 3.1 MEMORY MANAGEMENT OVERVIEW The memory management facilities of the IA-32 architecture are divided into two parts: segmentation and paging. Segmentation provides a mechanism of isolating individual code, data, and stack modules so that multiple programs (or tasks) can run on the same processor without interfering with one another. Paging provides a mech- anism for implementing a conventional demand-paged, virtual-memory system where sections of a program’s execution environment are mapped into physical memory as needed. Paging can also be used to provide isolation between multiple tasks. When operating in protected mode, some form of segmentation must be used. There is no mode bit to disable segmentation. The use of paging, however, is optional. These two mechanisms (segmentation and paging) can be configured to support simple single-program (or single- task) systems, multitasking systems, or multiple-processor systems that used shared memory. As shown in Figure 3-1, segmentation provides a mechanism for dividing the processor’s addressable memory space (called the linear address space) into smaller protected address spaces called segments. Segments can be used to hold the code, data, and stack for a program or to hold system data structures (such as a TSS or LDT). -
Paging and Segmentation Memory Addressing Memory Paging
Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: Available in the 80386 and up. Allows a linear address (virtual address) of a program to be located in any portion of physical memory. The paging unit is controlled by the microprocessors control registers: 31 12 11 0 CR4(Pentium and up) DE PVI PSE TSD MCE VME Page Directory Base Address CR3 PCD PWT Most recent Page Faulting Linear Address CR2 Reserved CR1 CR0 ET PE TS PG AM WP NE MP NW CD EM 1 Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: The paging system operates in both real and protected mode. It is enabled by setting the PG bit to 1 (left most bit in CR0). (If set to 0, linear addresses are physical addresses). CR3 contains the page directory 'physical' base address. The value in this register is one of the few 'physical' addresses you will ever refer to in a running system. The page directory can reside at any 4K boundary since the low order 12 bits of the address are set to zero. The page directory contains 1024 directory entries of 4 bytes each. Each page directory entry addresses a page table that contains up to 1024 entries. 2 Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: 31 22 21 12 11 0 Directory Page Table Offset Linear or Virtual Address 31 12 Physical Address P A U W D PCD PWT Page Directory or Page Table Entry Present Writable User defined Write through Cache disable Accessed Dirty (0 in page dir) The virtual address is broken into three pieces: P Directory: Each page directory addresses a 4MB section of main mem. -
Segmentation, Protected Mode
Copyright Notice CS 410/510 • These slides are distributed under the Creative Commons Languages & Low-Level Programming Attribution 3.0 License • You are free: Mark P Jones • to share—to copy, distribute and transmit the work Portland State University • to remix—to adapt the work • under the following conditions: Fall 2018 • Attribution: You must attribute the work (but not in any way that suggests that the author endorses you or your use of the work) as follows: “Courtesy of Mark P. Jones, Portland State University” Week 3: Segmentation, Protected Mode, Interrupts, and Exceptions The complete license text can be found at http://creativecommons.org/licenses/by/3.0/legalcode !1 2 General theme for the next two weeks Diagrams and Code • In a complex system … • There are a lot of diagrams on these slides • Many of these are taken directly from the “Intel® 64 and App App App App App IA-32 Architectures Software Developer’s Manual”, Operating System Operating System particularly Volume 3 Microkernel • There is a link to the full pdf file in the Reference section Hardware • There is also a lot of code on these slides • Remember that you can study these more carefully later if • Question: how can we protect individual programs from you need to! interference with themselves, or with one another, either directly or by subverting lower layers? • General approach: leverage programmable hardware features! 3 4 Taking stock: Code samples ... so far vram video RAM simulation vram.tar.gz hello boot and say hello on bare metal, via hello.tar.gz GRUB simpleio a simple library for video RAM I/O Segmentation bootinfo display basic boot information from (or: where do “seg faults” come from?) GRUB baremetal.tar.gz mimg memory image bootloader & make tool example-mimg display basic boot information from mimgload example-gdt basic demo using protected mode segments (via a Global Descriptor Table) prot.tar.gz example-idt context switching to user mode (via an Interrupt Descriptor Table) 5 6 BASIC EXECUTION ENVIRONMENT • General-purpose registers. -
Diving Into Ie10'
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX Mark Vincent Yason IBM X-Force Advanced Research yasonm[at]ph[dot]ibm[dot]com @MarkYason (v3) ABSTRACT With the release of Internet Explorer 10 in Windows 8, an improved version of IE’s Protected Mode sandbox, called Enhanced Protected Mode (EPM), was introduced. With the use of the new AppContainer process isolation mechanism introduced in Windows 8, EPM aims to further limit the impact of a successful IE compromise by limiting both read and write access and limiting the capabilities of the sandboxed IE process. As with other new security features integrated in widely-deployed software, it is just prudent to look at how EPM works internally and also evaluate its effectiveness. This presentation aims to provide both by delving deep into the internals and assessing the security of IE 10’s Enhanced Protected Mode sandbox. The first part of this presentation will focus on the inner workings of the EPM sandbox where topics such as the sandbox restrictions in place, the inter-process communication mechanism in use, the services exposed by the higher-privileged broker process, and more are discussed. The second part of this presentation will cover the security aspect of the EPM sandbox where its limitations are assessed and potential avenues for sandbox escape are discussed. Finally, in the end of the presentation, an EPM sandbox escape exploit will be demonstrated. The details of the underlying vulnerability, including the thought process that went through in discovering it will also be discussed. IBM Security Systems | © 2014 IBM Corporation DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX > CONTENTS |2 CONTENTS Contents ............................................................................................................................................................... -
Optimization Techniques for Memory Virtualization-Based Resource Management
SSStttooonnnyyy BBBrrrooooookkk UUUnnniiivvveeerrrsssiiitttyyy The official electronic file of this thesis or dissertation is maintained by the University Libraries on behalf of The Graduate School at Stony Brook University. ©©© AAAllllll RRRiiiggghhhtttsss RRReeessseeerrrvvveeeddd bbbyyy AAAuuuttthhhooorrr... Optimization Techniques for Memory Virtualization-based Resource Management A Dissertation Presented by Jui-Hao Chiang to The Graduate School in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy in Computer Science Stony Brook University December 2012 Stony Brook University The Graduate School Jui-Hao Chiang We, the dissertation committee for the above candidate for the Doctor of Philosophy degree, hereby recommend acceptance of this dissertation. Tzi-cker Chiueh { Dissertation Advisor Professor, Department of Computer Science Jie Gao { Chairperson of Defense Associate Professor, Department of Computer Science Rob Johnson Assistant Professor, Department of Computer Science Ted Teng Professor, Department of Technology and Society This dissertation is accepted by the Graduate School. Charles Taber Interim Dean of the Graduate School ii Abstract of the Dissertation Optimization Techniques for Memory Virtualization-based Resource Management by Jui-Hao Chiang Doctor of Philosophy in Computer Science Stony Brook University 2012 Memory virtualization abstracts the physical memory resources in a virtualized server in such a way that offers many resource man- agement advantages, such as consolidation, sharing, -
CIS 3207 - Operating Systems CPU Mode
CIS 3207 - Operating Systems CPU Mode Professor Qiang Zeng Spring 2018 CPU Modes • Two common modes – Kernel mode • The CPU has to be in this mode to execute the kernel code – User mode • The CPU has to be in this mode to execute the user code CIS 3207 – Operating Systems 2 Important questions • How are CPU modes implemented? • Why are CPU modes needed? • Difference between Kernel mode and User mode • How are system calls implemented? • Advanced topic: Virtualization CIS 3207 – Operating Systems 3 How CPU Modes are implemented • Implemented through protection rings – A modern CPU typical provides different protection rings, which represent different privilege levels • A ring with a lower number has higher privileges – Introduced by Multics in 60’s – E.g., an X86 CPU usually provides four rings, and a Linux/Unix/Windows OS uses Ring 0 for the kernel mode and Ring 3 for the user mode CIS 3207 – Operating Systems 4 Why are Protection Rings needed? • Fault isolation: a fault (e.g., divided by 0) in the code running in a less-privileged ring can be captured and handled by code in a more-privileged ring • Privileged instructions: certain instructions can only be issued in a privileged ring; thus an OS can implement resource management and isolation here • Privileged memory space: certain memory can only be accessed in a privileged ring All these are demonstrated in the difference between the kernel mode and the user mode CIS 3207 – Operating Systems 5 Kernel Mode vs. User Mode? • A fault in the user space (e.g., divided by zero, invalid access, -
CY 2550 Foundations of Cybersecurity Systems Security
CY 2550 Foundations of Cybersecurity Systems Security Alina Oprea Associate Professor, Khoury College Northeastern University March 26 2020 Announcements • Social engineering and ethics projects are due today • Forensics project will be released today, due on April 4 • Exploit project is the last one, due on April 17 • Final exam • Take home • Released on April 13 at 11:45am EST, due on April 14 at noon • Submitted through Gradescope • Questions on the material to test general understanding • Might include questions from the “Countdown to Zero Day” book 2 Systems Security Threat Model Intro to Computer Architecture Hardware Support for Isolation Security Technologies Principles 3 Memory 128 MB Memory Unsafety Ethernet/Wifi Hard Drive OS Infect the OS code with malicious code Problem: any process can read/write any memory Scan memory to find usernames, passwords, saved credit card numbers, etc. 0 4 Memory 128 MB Device Unsafety Ethernet/Wifi Hard Drive OS Problem: any process can access any hardware device directly Access control is enforced by the OS, but OS APIs can be bypassed Send stolen data to the thief, Read/write/delete attack other computers, etc. any file 0 5 Old systems did not protect memory or devices • Any process could access any memory • Any process could access any device Problems • No way to enforce access controls on Review users or devices • Processes can steal from or destroy each other • Processes can modify or destroy the OS On old computers, systems security was literally impossible How do we fix these in modern architectures? ISOLATION 7 Systems Security Threat Model Intro to Computer Architecture Hardware Support for Isolation Security Technologies Principles 8 Modern Architecture To achieve systems security, we need process isolation • Processes cannot read/write memory arbitrarily • Processes cannot access devices directly How do we achieve this? Hardware support for isolation 1. -
Western Region Technical Attachment DOS COMPATIBILITY UNDER OS/2
Western Region Technical Attachment No. 92-11 March 17, 1992 DOS COMPATIBILITY UNDER OS/2 A DOS compatibility feature is included in OS/2 version 1.21 which was implemented on MicroSWIS. Many sites have found that this feature does not properly run many DOS programs and, in some cases, can even crash the system. This Technical Attachment examines the technical issues surrounding DOS compatibility under OS/2; how it works, and why it doesn't always work. The 80286 Modes of Operation OS/2 Version l.x is written for an Intel 80286 processor. The 80286 processor has two modes of operation: real mode and protected mode. These processing modes can be thought of as two different computers packaged into one chip. The real mode computer assumes that one program is controlling the entire system and that no other programs exist. Thus, real mode programs are concerned only with their task and as.sume that the computer is entirely theirs to accomplish this task; a single task machine. Conceptually, the real mode of operation is any PC running a DOS program. The protected mode of operation was developed by Intel to execute multiple tasks. As the protected mode name implies, each task or program is isolated (protected) from every other program running on the system. Thus, if one program crashes, all other programs can continue executing with no ill effects. The operating system must implement these features of the 80286 chip. OS/2 Version l.x implements the full 80286 capabilities. (DOS provides a minimal implementation of protected mode with extended memory (above 1 MB) addressing.) The concept that real mode and protected mode are two distinct computer systems reflects the actual design philosophy behind the 80286 chip.