Operating Systems

1. Operating Systems Recitation summary What you should know for the exam

2. You should know • System/API calls and their parameters discussed at the class or used in hw assignments • (e.g. CreateFile creates/opens file depending on a parameter) • Some details on Windows system internals we discussed • (e.g. object reference counting, memory management, file system) • Windows Networking Tools • (e.g. use ipconfig to find out my ip address) • Purpose and capabilities of networking protocols we have discussed • (e.g. Dns protocol is used to resolve symbolic name into numeric ip)

3. System Calls • No need to memorize exact details • But ,you are expected to know • Approximate name (exact for important function) • What it does (behavior) • Effect of most important parameters • Usage Pattern

4. Subjects • Win32 Types and Objects, Unicode Strings • Files • Processes • Threads • Process/Thread Synchronization • Virtual Memory • Memory Mapped Files • Dynamic Link Libraries • Networking and Windows Net Utilities • Sockets Programming • Windows Security • Structured Exception Handling

5. 1. Win32 types, objects, Unicode • Reference Counting and CloseHandle • Handle Permissions and Security • Signaled State of an object • LPTSTR, TCHAR, DWORD • L”aa”, _T(“aa”) • GetLastError()

6. Handle to a kernel object is an index into the process handle table, and hence is invalid in any other process Handle table entry contains the system-space address (8xxxxxxx or above) of the data structure; this address is the same regardless of process context Although handle table is per-process, it is actually in system address space (hence protected) Event Object Handle Table HandleCount = 1 ReferenceCount = 1 Process B Handle Table 1.1 Handles, Pointers, and Objects System Space Process A handles index

7. Event Object Handle Table HandleCount = 1 ReferenceCount = 0 HandleCount = 2 ReferenceCount = 0 HandleCount = 3 ReferenceCount = 0 HandleCount = 3 ReferenceCount = 4 DuplicateHandle Thread (in a wait state for the event) Process B Handle Table Note: there is actually another data structure, a “wait block”, “between” the thread and the object it’s waiting for 1.1 Handles, Pointers, and Reference Count Process A System Space handles index

8. 2.Files • CreateFile • ReadFile • WriteFile • SetFilePointer • FindFirstFile • FindNextFile • CloseHandle/FindClose • GetFileSize

9. 2.1 CreateFile • HANDLE WINAPI CreateFile( __in LPCTSTR lpFileName, __in DWORD dwDesiredAccess, __in DWORD dwShareMode, __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, __in DWORD dwCreationDisposition, __in DWORD dwFlagsAndAttributes, __in_opt HANDLE hTemplateFile );

10. 2.1 CreateFile

11. 2.2 SetFilePointer • DWORD WINAPI SetFilePointer( __in HANDLE hFile, __in LONG lDistanceToMove, __inout_opt PLONG lpDistanceToMoveHigh, __in DWORD dwMoveMethod );

12. 2.2 SetFilePointer

13. 3.Processes • BOOL WINAPI CreateProcess( __in_opt LPCTSTR lpApplicationName, __inout_opt LPTSTR lpCommandLine, __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, __in BOOL bInheritHandles, __in DWORD dwCreationFlags, __in_opt LPVOID lpEnvironment, __in_opt LPCTSTR lpCurrentDirectory, __in LPSTARTUPINFO lpStartupInfo, __out LPPROCESS_INFORMATION lpProcessInformation );

14. 3.Processes • CreateProcess • GetProcessExitCode • TerminateProcess • WaitForSingleObject

15. 3.1 CreateProcess

16. 4. Threads • CreateThread • TerminateThread • WaitForSingleObject

17. 4.Threads • HANDLE WINAPI CreateThread( __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, __in SIZE_T dwStackSize, __in LPTHREAD_START_ROUTINE lpStartAddress, __in_opt LPVOID lpParameter, __in DWORD dwCreationFlags, __out_opt LPDWORD lpThreadId );

18. Thread Thread Thread Thread Single and Multithreaded Processes code data files code data files registers stack registers registers registers stack stack stack single-threaded multi-threaded

19. Thread States • Five-state diagram for thread scheduling: • init: The thread is being created • ready: The thread is waiting to be assigned to a CPU • running: The thread’s instructions are being executed • waiting: The thread is waiting for some event to occur • terminated: The thread has finished execution interrupt quantum expired init terminated admitted schedulerdispatch exit ready running waiting I/O or eventcompletion waiting for I/O or event

20. 4.1 CreateThread

21. Process Control Block (PCB) Process ID (PID) Parent PID • This is an abstract view • Windows implementation of PCB is split in multiple data structures … Next Process Block PCB List of open files Handle Table Image File Name Thread Control Block (TCB) List of ThreadControl Blocks Next TCB Program Counter … Registers …

22. CPU Switch from Thread to Thread Thread T1 Thread T2 Interrupt or system call executing Save state into TCB1 ready orwaiting Reload state from TCB2 Interrupt or system call ready orwaiting executing Save state into TCB2 Reload state from TCB1 ready orwaiting executing

23. 5.Synchronization • CreateEvent/SetEvent • CreateMutex/ReleaseMutex • CreateSemaphore/ ReleaseSemaphore • InitializeCriticalSection/DeleteCriticalSection • WaitForSingleObject/WautForMultipleObjects • GetLastError()

24. 5.1 Events • HANDLE WINAPI CreateEvent( __in_opt LPSECURITY_ATTRIBUTES lpEventAttributes, __in BOOL bManualReset, __in BOOL bInitialState, __in_opt LPCTSTR lpName ); • BOOL WINAPI SetEvent( __in HANDLE hEvent );

25. 5.2 Mutex • HANDLE WINAPI CreateMutex( __in_opt LPSECURITY_ATTRIBUTES lpMutexAttributes, __in BOOL bInitialOwner, __in_opt LPCTSTR lpName ); • BOOL WINAPI ReleaseMutex( __in HANDLE hMutex ); If a thread already owns a mutex =>WaitForSingleObject does not block

26. 5.3 Semaphores • HANDLE CreateSemaphore( LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, LONG lInitialCount, LONG lMaximumCount, LPCTSTR lpName ); • BOOL ReleaseSemaphore( HANDLE hSemaphore, LONG lReleaseCount, LPLONG lpPreviousCount );

27. 5.4 Critical Section • void WINAPI InitializeCriticalSection( __out LPCRITICAL_SECTION lpCriticalSection ); • void WINAPI EnterCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection ); • void WINAPI LeaveCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection ); • void WINAPI DeleteCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection );

28. 6. Virtual Memory • VirualAlloc/VirtualFree • VirtualLock/VirtualUnlock • SetProcessWorkingSetSize

29. 6.1 Allocation • LPVOID WINAPI VirtualAlloc( __in_opt LPVOID lpAddress, __in SIZE_T dwSize, __in DWORD flAllocationType, __in DWORD flProtect ); • BOOL WINAPI VirtualFree( __in LPVOID lpAddress, __in SIZE_T dwSize, __in DWORD dwFreeType );

30. index physical page number (“page frame number” or “PFN”) index x86 Virtual Address Translation PFN 0 1 31 0 2 Page table selector Page table entry selector Byte within page 3 4 CR3 5 physical address 6 7 8 9 10 11 12 Page Tables (up to 512 per process, plus up to 512 system-wide) Page Directory (1024 entries) Physical Pages (up to 2^20)

31. Virtual Address Translation • The hardware converts each valid virtual address to a physical address virtual address Page Directory Virtual page number Byte within page Address translation (hardware) Page Tables if page not valid... page fault (exception, handled by software) Translation Lookaside Buffer Physical page number Byte within page a cache of recently- used page table entries physical address

32. 6.1 Allocation

33. 6.2 Lock Memory • BOOL WINAPI VirtualLock( __in LPVOID lpAddress, __in SIZE_T dwSize ); • BOOL WINAPI VirtualUnlock( __in LPVOID lpAddress, __in SIZE_T dwSize );

34. 7.Memory mapped Files • CreateFileMapping • MapViewOfFile/UnmapViewOfFile

35. Shared and Private Pages Process A Process B • For shared pages, multiple processes’ PTEs point to same physical pages 00000000 Physical Memory 7FFFFFFF 80000000 C0000000 C1000000 FFFFFFFF

36. 7.1 CreateFileMapping • HANDLE WINAPI CreateFileMapping( __in HANDLE hFile, __in_opt LPSECURITY_ATTRIBUTES lpAttributes, __in DWORD flProtect, __in DWORD dwMaximumSizeHigh, __in DWORD dwMaximumSizeLow, __in_opt LPCTSTR lpName );

37. 7.1 CreateFileMapping

38. 7.2 MapViewOfFile • LPVOID WINAPI MapViewOfFile( __in HANDLE hFileMappingObject, __in DWORD dwDesiredAccess, __in DWORD dwFileOffsetHigh, __in DWORD dwFileOffsetLow, __in SIZE_T dwNumberOfBytesToMap ); • BOOL WINAPI UnmapViewOfFile( __in LPCVOID lpBaseAddress );

39. 8.Dynamic Link Libraries • LoadLibrary/FreeLibrary • GetProcAddress • __declspec(dllexport), __declspec(dllimport) • DllMain

40. Address Binding Sourceprogram • Addresses in source programs are symbolic • Compiler binds symbolic to relocatable addresses • Loader binds relocatable addresses to absolute addresses Binding can be done at any step: • i.e., compiler may generate absolute code (as for MS-DOS .COM programs) other object modules Compiler orassembler Compiletime Object module Systemlibraries Linkageeditor loadtime Loadmodule dynamicallyloadedsystemlibraries loaderr In-memorybinarymemoryimage executiontime(run time)

41. 8.1 Run-Time • HMODULE WINAPI LoadLibrary( __in LPCTSTR lpFileName ); • FARPROC WINAPI GetProcAddress( __in HMODULE hModule, __in LPCSTR lpProcName );

42. 9.Net Utilities • Ipconfig • Ping • Tracert • Route • Arp • Nslookup • Netstat

43. 9. Opening Browser • Plug Network Cable->Broadcast DHCP to config • Type address->use dns server to translate • Have destination IP->use routing table to find next hop • Have IP of next hop->use arp table/protocol to translate destination IP into MAC address • Connect on TCP port 80 and send HTTP GET request • Wait for ack, resend if needed • Obtain HTML content , disconnect and show to a user

44. 10.Sockets Programming • Socket • Bind • Listen • Accept • Connect • Send/Recv • Closesocket

45. 10. Socket Functions

47. 11.Security • OpenProcessToken • LookupAccountSid • GetTokenInformation • ACL/ACE format/purpose

48. 11. OpenProcessToken BOOL WINAPI OpenProcessToken( __in HANDLE ProcessHandle, __in DWORD DesiredAccess, __out PHANDLE TokenHandle ); BOOL WINAPI GetTokenInformation( __in HANDLE TokenHandle, __in TOKEN_INFORMATION_CLASS TokenInformationClass, __out_opt LPVOID TokenInformation, __in DWORD TokenInformationLength, __out PDWORD ReturnLength );

49. 11. ACL/ACE

50. 12.Structured Exception Handling • __try • __except • GetExceptionCode()