OPERATING SYSTEMS SECURITY HOMEWORK

CPU & BASIC COMPUTING HARDWARE Homework 1

Topics

• CPU and systems inspection utilities
• CPU Z utility download
• CPU Z utility installation
• CPU utility use for CPU and system bus inspection.
• System hardware auditing and report generation, (documentation).
• Windows CLI system auditing commands.
• CPU microcode alteration

Question 1.1 - Dump your registers in a text file. Present register dump that file and find your CPU bus data width, (Hint read: Look for Data width)

Question 1.2 - Read your cpuz.txt file and find what instruction sets does your CPU support (can execute, can understand)? (Hint: Look for Data width)

Exercise 1.3 -

• What is the purpose of MMX CPU instruction set (Assembly) command CPUID?
• What was the first CPU capable of executing this instruction?
• Does cpuz.exe utility use the result of this command?

Exercise 1.4 -

• Which Intel Pentium CPU has been upgraded by SSE instruction set, (Was not capable of understanding SSE)?
• When was SSE instruction set extension introduced?
• What is your processor's CPUID code?

Question 1.5 - What is the name of your CPU? Show the screen shot indicating your CPU name.

Question 1.6 - How large were transistors used to manufacture your CPU in nano meters [nm]?

Question 1.7 - Read cpuz.txt and find the following:

• What is your CPU core internal speed?
• What is the rated external system bus speed?
• How many times is internal CPU (core speed) bus speed larger than external system bus speed?

Question 1.8 -

• Does your CPU have L1 cache memory inside?
• If yes, how large is the internal L1 cache memory of your CPU?

Question 1.9 -

• What speed does Windows utility system.exe report?
• Does it report internal CPU speed or external data bus speed?

Question 1.10 - Execute all listed control panel tools/utilities from the command prompt and document each with the screen shots shown in the previous slide.

Question 1.11 -

• Identify all peripheral connectors on your hardware system and explain their purpose.
• Where is keyboard device controller located?

Question 1.12 -

• Identify and itemize all I/O bus slots on your system.
• What device may be connected via I/O bus slots?

Question 1.13 -

• Go to msdn2.microsoft.com site and find the page on CPU microcode update driver.
• You should see a page as shown on the next slide
• Describe what is the purpose of the "Intel Microsoft Update driver"

Question 1.14 - Describe properties of Microcode Update Device.

ZERO PROTECTION OPERATING SYSTEMS Homework 3

Topics

• DOSbox MS-DOS system emulator
• Installation of virtual MS DOS
• User interface MS-DOS command line shell
• Utilities for real memory inspection- mem and debug
• Utility application for text processing
• Tool for system inspection
• Devices, drivers, device I/O buffers and memory
• Performance testing or benchmarking

Exercise 1: Setting up MS-DOS emulator

Exercise 2: Starting DOSbox MS-DOS emulator

Exercise 3: Command shell

Exercise 4: mem.exe is a utility

Question 1: mem.exe and UI shells

• Test mem.exe utility in cmd.exe, COMMAND.COM and DOSbox UI shells. Test all option switches.
• Does the same name utility represent the same program?
• Does meme.exe work the same way?

Exercise 5: Mounting drive/volume

Exercise 6: .com is a type of executable program

Question  2: C:\> "prompt"

• Consider UI shell command line prompting text string "C:\>". string C:\> .
• a) What does "C:" identify?
• b) What does character "\" stand for?
• c) Is character ">" true prompt character?

Exercise 7: Running nested apps

Exercise 8: debug.exe memory manipulation utility

• Tools are applications like utilities but are not necessary, "must have", "used by most" or delivered packaged with the OS software.
• Memory manipulation utility debug.exe has its own user interactive command shell and prompt:

Question  3: Top page of the map

• Location ffff:ff00 is virtual map top page.
• What MS-DOS programs are located near 1M What MS DOS programs are located near 1M address?

Question  4: Bottom of the map

a) What should be the data near 0 address?

b) Location 0000:0000 is virtual 0 location. Can debug write there. Try E command?

Question 5: debug.exe is DOS app

a) Can debug.exe read over 1M limit?

b) What is exact decimal value of ffff:ffff address?

Exercise 9: "System inspection" 

Question 6: Interrupts 

a) How many interrupt numbers does DOS support?

b) How many interrupts does Windows XP support?

c) How many interrupts does Linux support?

Question 7: Memory types

a) How many memory types are recognized by this tester tool?

b) What is the difference between the extended and expanded memory?

c) Can DOS application program access extended memory?

d) Is extended memory protected from DOS applications?

Question  8: I/O device buffers

• MS-DOS CS and DS occupy a number of distinct real 1M BIOS a number of distinct real memory segments.
• The only write protection possible was hardware ROM media protection.
• Can any application running below 640k write over DOS CGA/EGA video buffer?

Question 9: Driver enumeration?

a) What code is used to identify sub-drivers in this family of video drivers?

b) When and why is this particular code used?

Question 10: Lines and columns

a) How many lines L=? and columns C=? is character display capable of showing?

b) How many characters has one screen frame?

c) If MGA monochrome video buffer uses 2B per display character what is the size of the buffer?

Question 11: Mouse driver data

a) Does mouse click generate an interrupt?

b) How many bytes of input data does one mouse click generate?

c) Where are mouse generated bytes of input data saved in memory map?

Question 12: Keyboard driver

a) Where do you think in memory map is keyboard driver located?

b) Does keyboard "click" generate interrupt?

c) How many bytes of input data does character F1 depressed generate?

Question 13: Console device  

• Names of devices console CON keyboard STDIN and character display device STDOUT are names of devices and of associated files.
• Are CON, STDIN and STDOUT device driver files?

Question 14: Hardware performance 

a) How are performance evaluation tool programs called?

b) Is there any difference between the tool and utility program?

VIRTUAL MEMORY AND VIRTUAL OPERATING SYSTEMS EXERCISE

Topics

• Introduction
• Physical & virtual memory
• Swap space
• Virtual memory adjustment
• Single program virtual memory
• Removing swap paging file (PF)
• Tracking swap PF percentage usage
• OS limits on physical memory usage

Exercise 1: Windows msinfo32 utility

• Run standard Windows msinfo32.exe utility
• System board memory is scattered all over the real memory map

Question 1 -

• Inspect the general screen on your system and determine the following parameters:
• Total physical memory?
• Available physical memory?
• What is the size of total determine the following parameters:

Question 2

Inspect the general screen on your system and determine the following parameters:

• Total virtual memory?
• Available virtual memory?

Question 3 - Inspect the general report screen of msinfo32 utility shown below and answer the following questions:

• Is total physical memory larger here than total virtual memory parameter?
• Does it sound like a paradox?

Question 4 - Inspect the general screen on your system and determine the following

• Total swap page file space size?
• Name and location of the swap page file?

Exercise 2: Swap file

• The XP page file is a hidden file pagefile.sys. It is regenerated at each boot.
• Show the screen shot of your system page file?

Question 5 -

Attack that would start endless count of concurrent programs with large data segments could inflate swap space and consume free storage space.

- Does such attack appear as denila of service attack or DOS?

- What services would be denied with such an attack?

- Windows pagefile.sys growth is limited. What is the maximal swap page files size allowed in your system?

Exercise 3:  VM problems & tuning

Sometimes system either has too many programs running at once (too many concurrent programs running at once, (too many concurrent processes)

- System just does not have enough of free physical memory.

- Swap space is full and no more programs can be loaded.

Question 6 - What is the reason of the following Windows message: "Windows - Virtual Memory Minimum Too Low!"

Question 7 - Can swap page file be placed on any drive C:, D: or E:?

Exercise 4: Inspecting program's memory

When trying to investigate problematic behavior of a running program inspecting memory of a running program, inspecting  memory behavior may be a good idea.

Exercise 5: Using system monitor

Inspect how much page file (PF) does your system use? system use?

You should first find out how much memory you're using, and how much of it is on your disk.

One accurate way is by monitoring the %Usage Peak counter in the System Monitor tool (The peak usage of the page file instance in percent):

Question 8: Monitoring page file usage

• What system parameters are monitored now?

Question 9 - What is your PF usage peak [%]?

Question 10 - Search the Web and find out why Windows XP x32 cannot use and report more than 3 5GB of x32 cannot use and report more than 3.5GB of physical memory.

Question 11 - Problem: My Task Manager shows I have 2.99 GB of physical memory when I just installed GB of physical memory when I just installed 2×2GB sticks in my notebook. How can I get it back?

Exercise 6: Logging PF usage

Question 12 -

a) What is your exact PF size?

b) What is your exact peak PF usage?

Attachment:- Assignment Files.rar