Unit II : Memory Management
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Allgemeines Abkürzungsverzeichnis
Allgemeines Abkürzungsverzeichnis L. -
Understanding the Microsoft Office 2013 Protected-View Sandbox
MWRI PUBLIC UNDERSTANDING THE MICROSOFT OFFICE 2013 PROTECTED-VIEW SANDBOX Yong Chuan, Koh (@yongchuank) 2015/07/09 mwrinfosecurity.com | © MWR InfoSecurity MWRI PUBLIC MWRI PUBLIC Table of Contents 1. Introduction .................................................................................................................... 3 2. Sandbox Internals ............................................................................................................. 4 2.1 Architecture .............................................................................................................. 4 2.1.1 Interception Component ......................................................................................... 4 2.1.2 Elevation Policy Manager ........................................................................................ 4 2.1.3 Inter-Process Communication ................................................................................... 5 2.2 Sandbox Restrictions.................................................................................................... 6 2.2.1 Sandbox Initialization ............................................................................................ 6 2.2.2 File Locations .................................................................................................... 12 2.2.3 Registry Keys ..................................................................................................... 12 2.2.4 Network Connections .......................................................................................... -
Chapter 3 System Calls, Exceptions, and Interrupts
DRAFT as of September 29, 2009: Copyright 2009 Cox, Kaashoek, Morris Chapter 3 System calls, exceptions, and interrupts An operating system must handle system calls, exceptions, and interrupts. With a system call a user program can ask for an operating system service, as we saw at the end of the last chapter. Exceptions are illegal program actions that generate an inter- rupt. Examples of illegal programs actions include divide by zero, attempt to access memory outside segment bounds, and so on. Interrupts are generated by hardware de- vices that need attention of the operating system. For example, a clock chip may gen- erate an interrupt every 100 msec to allow the kernel to implement time sharing. As another example, when the disk has read a block from disk, it generates an interrupt to alert the operating system that the block is ready to be retrieved. In all three cases, the operating system design must range for the following to happen. The system must save user state for future transparent resume. The system must be set up for continued execution in the kernel. The system must chose a place for the kernel to start executing. The kernel must be able to retrieve information about the event, including arguments. It must all be done securely; the system must main- tain isolation of user processes and the kernel. To achieve this goal the operating system must be aware of the details of how the hardware handles system calls, exceptions, and interrupts. In most processors these three events are handled by a single hardware mechanism. -
Protected Mode - Wikipedia
2/12/2019 Protected mode - Wikipedia Protected mode In computing, protected mode, also called protected virtual address mode,[1] is an operational mode of x86- compatible central processing units (CPUs). It allows system software to use features such as virtual memory, paging and safe multi-tasking designed to increase an operating system's control over application software.[2][3] When a processor that supports x86 protected mode is powered on, it begins executing instructions in real mode, in order to maintain backward compatibility with earlier x86 processors.[4] Protected mode may only be entered after the system software sets up one descriptor table and enables the Protection Enable (PE) bit in the control register 0 (CR0).[5] Protected mode was first added to the x86 architecture in 1982,[6] with the release of Intel's 80286 (286) processor, and later extended with the release of the 80386 (386) in 1985.[7] Due to the enhancements added by protected mode, it has become widely adopted and has become the foundation for all subsequent enhancements to the x86 architecture,[8] although many of those enhancements, such as added instructions and new registers, also brought benefits to the real mode. Contents History The 286 The 386 386 additions to protected mode Entering and exiting protected mode Features Privilege levels Real mode application compatibility Virtual 8086 mode Segment addressing Protected mode 286 386 Structure of segment descriptor entry Paging Multitasking Operating systems See also References External links History https://en.wikipedia.org/wiki/Protected_mode -
A+ Certification for Dummies, 2Nd Edition.Pdf
A+ Certification for Dummies, Second Edition by Ron Gilster ISBN: 0764508121 | Hungry Minds © 2001 , 567 pages Your fun and easy guide to Exams 220-201 and 220-202! A+ Certification For Dummies by Ron Gilster Published by Hungry Minds, Inc. 909 Third Avenue New York, NY 10022 www.hungryminds.com www.dummies.com Copyright © 2001 Hungry Minds, Inc. All rights reserved. No part of this book, including interior design, cover design, and icons, may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording, or otherwise) without the prior written permission of the publisher. Library of Congress Control Number: 2001086260 ISBN: 0-7645-0812-1 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 2O/RY/QU/QR/IN Distributed in the United States by Hungry Minds, Inc. Distributed by CDG Books Canada Inc. for Canada; by Transworld Publishers Limited in the United Kingdom; by IDG Norge Books for Norway; by IDG Sweden Books for Sweden; by IDG Books Australia Publishing Corporation Pty. Ltd. for Australia and New Zealand; by TransQuest Publishers Pte Ltd. for Singapore, Malaysia, Thailand, Indonesia, and Hong Kong; by Gotop Information Inc. for Taiwan; by ICG Muse, Inc. for Japan; by Intersoft for South Africa; by Eyrolles for France; by International Thomson Publishing for Germany, Austria and Switzerland; by Distribuidora Cuspide for Argentina; by LR International for Brazil; by Galileo Libros for Chile; by Ediciones ZETA S.C.R. Ltda. for Peru; by WS Computer Publishing Corporation, Inc., for the Philippines; by Contemporanea de Ediciones for Venezuela; by Express Computer Distributors for the Caribbean and West Indies; by Micronesia Media Distributor, Inc. -
Chapter 3 Protected-Mode Memory Management
CHAPTER 3 PROTECTED-MODE MEMORY MANAGEMENT This chapter describes the Intel 64 and IA-32 architecture’s protected-mode memory management facilities, including the physical memory requirements, segmentation mechanism, and paging mechanism. See also: Chapter 5, “Protection” (for a description of the processor’s protection mechanism) and Chapter 20, “8086 Emulation” (for a description of memory addressing protection in real-address and virtual-8086 modes). 3.1 MEMORY MANAGEMENT OVERVIEW The memory management facilities of the IA-32 architecture are divided into two parts: segmentation and paging. Segmentation provides a mechanism of isolating individual code, data, and stack modules so that multiple programs (or tasks) can run on the same processor without interfering with one another. Paging provides a mech- anism for implementing a conventional demand-paged, virtual-memory system where sections of a program’s execution environment are mapped into physical memory as needed. Paging can also be used to provide isolation between multiple tasks. When operating in protected mode, some form of segmentation must be used. There is no mode bit to disable segmentation. The use of paging, however, is optional. These two mechanisms (segmentation and paging) can be configured to support simple single-program (or single- task) systems, multitasking systems, or multiple-processor systems that used shared memory. As shown in Figure 3-1, segmentation provides a mechanism for dividing the processor’s addressable memory space (called the linear address space) into smaller protected address spaces called segments. Segments can be used to hold the code, data, and stack for a program or to hold system data structures (such as a TSS or LDT). -
Intel 64 and IA-32 Architectures Software Developer's Manual
SYSTEM ARCHITECTURE OVERVIEW Physical Address EFLAGS Register Code, Data or Linear Address Stack Segment Control Registers Task-State CR4 Segment Selector Segment (TSS) Task CR3 Code CR2 Register CR1 Data Stack CR0 Global Descriptor Task Register Table (GDT) Interrupt Handler Segment Sel. Seg. Desc. Code Current Interrupt TSS Seg. Sel. TSS Desc. TSS Stack Vector Seg. Desc. Interrupt Descriptor Task-State Segment (TSS) Table (IDT) TSS Desc. Task Code Interrupt Gate LDT Desc. Data Stack Task Gate GDTR Trap Gate Local Descriptor Exception Handler Table (LDT) Code Current TSS Stack IDTR Call-Gate Seg. Desc. Segment Selector Call Gate Protected Procedure Code XCR0 (XFEM) LDTR Current TSS Stack Linear Address Space Linear Address Dir Table Offset Linear Addr. Page Directory Page Table Page Physical Addr. Pg. Dir. Entry Pg. Tbl. Entry 0 This page mapping example is for 4-KByte pages CR3* and the normal 32-bit physical address size. *Physical Address Figure 2-1. IA-32 System-Level Registers and Data Structures Vol. 3 2-3 SYSTEM ARCHITECTURE OVERVIEW 31 22 21 20 19 18 17 16 15 1413 12 11 10 9 8 7 6 5432 1 0 I V V I A V R N O O D I T S Z A P C Reserved (set to 0) I I 0 0 0 1 D C M F T P F F F F F F F F F P F L ID — Identification Flag VIP — Virtual Interrupt Pending VIF — Virtual Interrupt Flag AC — Alignment Check VM — Virtual-8086 Mode RF — Resume Flag NT — Nested Task Flag IOPL— I/O Privilege Level IF — Interrupt Enable Flag TF — Trap Flag Reserved Figure 2-4. -
Chapter 1: Introduction
Access Control in Practice CS461/ECE422 Fall 2009 1 Reading • Computer Security – Chapter 15 2 Outline • Evolution of OS • Object Access Control – Access control lists – Capabilities 3 In the Beginning... • The program owned the machine – Access all power of the hardware – Could really mess things up • Executives emerged – Gather common functionality • Multi-user systems required greater separation – Multics, the source of much early OS development 4 Protecting objects • Desire to protect logical entities – Memory – Files or data sets – Executing program – File directory – A particular data structure like a stack – Operating system control structures – Privileged instructions Access Control Matrix • Access Control Matrix (ACM) and related concepts provides very basic abstraction – Map different systems to a common form for comparison – Enables standard proof techniques – Not directly used in implementation 6 Definitions • Protection state of system – Describes current settings, values of system relevant to protection • Access control matrix – Describes protection state precisely – Matrix describing rights of subjects – State transitions change elements of matrix 7 Description objects (entities) o1 … om s1 … sn • Subjects S = { s1,…,sn } s1 • Objects O = { o1,…,om } s 2 • Rights R = { r1,…,rk } ⊆ • Entries A[si, oj] R subjects … • A[si, oj] = { rx, …, ry } sn means subject si has rights rx, …, ry over object oj 8 Practical object access control • Can slice the logical ACM two ways – By row: Store with subject – By column: Store with object -
Paging and Segmentation Memory Addressing Memory Paging
Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: Available in the 80386 and up. Allows a linear address (virtual address) of a program to be located in any portion of physical memory. The paging unit is controlled by the microprocessors control registers: 31 12 11 0 CR4(Pentium and up) DE PVI PSE TSD MCE VME Page Directory Base Address CR3 PCD PWT Most recent Page Faulting Linear Address CR2 Reserved CR1 CR0 ET PE TS PG AM WP NE MP NW CD EM 1 Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: The paging system operates in both real and protected mode. It is enabled by setting the PG bit to 1 (left most bit in CR0). (If set to 0, linear addresses are physical addresses). CR3 contains the page directory 'physical' base address. The value in this register is one of the few 'physical' addresses you will ever refer to in a running system. The page directory can reside at any 4K boundary since the low order 12 bits of the address are set to zero. The page directory contains 1024 directory entries of 4 bytes each. Each page directory entry addresses a page table that contains up to 1024 entries. 2 Systems Design & Programming Paging and Segmentation CMPE 310 Memory Addressing Memory Paging: 31 22 21 12 11 0 Directory Page Table Offset Linear or Virtual Address 31 12 Physical Address P A U W D PCD PWT Page Directory or Page Table Entry Present Writable User defined Write through Cache disable Accessed Dirty (0 in page dir) The virtual address is broken into three pieces: P Directory: Each page directory addresses a 4MB section of main mem. -
Downloads/Kornau-Tim--Diplomarbeit--Rop.Pdf [34] Sebastian Krahmer
CFI CaRE: Hardware-supported Call and Return Enforcement for Commercial Microcontrollers Thomas Nyman Jan-Erik Ekberg Lucas Davi N. Asokan Aalto University, Finland Trustonic, Finland University of Aalto University, Finland [email protected] [email protected] Duisburg-Essen, [email protected] Trustonic, Finland Germany thomas.nyman@ lucas.davi@wiwinf. trustonic.com uni-due.de ABSTRACT CFI (Section 3.1) is a well-explored technique for resisting With the increasing scale of deployment of Internet of Things (IoT), the code-reuse attacks such as Return-Oriented Programming concerns about IoT security have become more urgent. In particular, (ROP) [47] that allow attackers in control of data memory to subvert memory corruption attacks play a predominant role as they allow the control flow of a program. CFI commonly takes the formof remote compromise of IoT devices. Control-flow integrity (CFI) is inlined enforcement, where CFI checks are inserted at points in the a promising and generic defense technique against these attacks. program code where control flow changes occur. For legacy applica- However, given the nature of IoT deployments, existing protection tions CFI checks must be introduced by instrumenting the pre-built mechanisms for traditional computing environments (including CFI) binary. Such binary instrumentation necessarily modifies the mem- need to be adapted to the IoT setting. In this paper, we describe ory layout of the code, requiring memory addresses referenced by the challenges of enabling CFI on microcontroller (MCU) based the program to be adjusted accordingly [28]. This is typically done IoT devices. We then present CaRE, the first interrupt-aware CFI through load-time dynamic binary rewriting software [14, 39]. -
Segmentation, Protected Mode
Copyright Notice CS 410/510 • These slides are distributed under the Creative Commons Languages & Low-Level Programming Attribution 3.0 License • You are free: Mark P Jones • to share—to copy, distribute and transmit the work Portland State University • to remix—to adapt the work • under the following conditions: Fall 2018 • Attribution: You must attribute the work (but not in any way that suggests that the author endorses you or your use of the work) as follows: “Courtesy of Mark P. Jones, Portland State University” Week 3: Segmentation, Protected Mode, Interrupts, and Exceptions The complete license text can be found at http://creativecommons.org/licenses/by/3.0/legalcode !1 2 General theme for the next two weeks Diagrams and Code • In a complex system … • There are a lot of diagrams on these slides • Many of these are taken directly from the “Intel® 64 and App App App App App IA-32 Architectures Software Developer’s Manual”, Operating System Operating System particularly Volume 3 Microkernel • There is a link to the full pdf file in the Reference section Hardware • There is also a lot of code on these slides • Remember that you can study these more carefully later if • Question: how can we protect individual programs from you need to! interference with themselves, or with one another, either directly or by subverting lower layers? • General approach: leverage programmable hardware features! 3 4 Taking stock: Code samples ... so far vram video RAM simulation vram.tar.gz hello boot and say hello on bare metal, via hello.tar.gz GRUB simpleio a simple library for video RAM I/O Segmentation bootinfo display basic boot information from (or: where do “seg faults” come from?) GRUB baremetal.tar.gz mimg memory image bootloader & make tool example-mimg display basic boot information from mimgload example-gdt basic demo using protected mode segments (via a Global Descriptor Table) prot.tar.gz example-idt context switching to user mode (via an Interrupt Descriptor Table) 5 6 BASIC EXECUTION ENVIRONMENT • General-purpose registers. -
Diving Into Ie10'
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX Mark Vincent Yason IBM X-Force Advanced Research yasonm[at]ph[dot]ibm[dot]com @MarkYason (v3) ABSTRACT With the release of Internet Explorer 10 in Windows 8, an improved version of IE’s Protected Mode sandbox, called Enhanced Protected Mode (EPM), was introduced. With the use of the new AppContainer process isolation mechanism introduced in Windows 8, EPM aims to further limit the impact of a successful IE compromise by limiting both read and write access and limiting the capabilities of the sandboxed IE process. As with other new security features integrated in widely-deployed software, it is just prudent to look at how EPM works internally and also evaluate its effectiveness. This presentation aims to provide both by delving deep into the internals and assessing the security of IE 10’s Enhanced Protected Mode sandbox. The first part of this presentation will focus on the inner workings of the EPM sandbox where topics such as the sandbox restrictions in place, the inter-process communication mechanism in use, the services exposed by the higher-privileged broker process, and more are discussed. The second part of this presentation will cover the security aspect of the EPM sandbox where its limitations are assessed and potential avenues for sandbox escape are discussed. Finally, in the end of the presentation, an EPM sandbox escape exploit will be demonstrated. The details of the underlying vulnerability, including the thought process that went through in discovering it will also be discussed. IBM Security Systems | © 2014 IBM Corporation DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX > CONTENTS |2 CONTENTS Contents ...............................................................................................................................................................