计算机系 信息处理实验室 Lecture 4 System Mechanisms (2)

计算机系 信息处理实验室 the Inside of Windows Contents Trap dispatching The executive object manager Synchronization System worker threads Local procedure calls (LPCs)

计算机系 信息处理实验室 the Inside of Windows Object manager EXPERIMENT Exploring the Object Manager

计算机系 信息处理实验室 the Inside of Windows Uniform approach towards: Object protection (C2 security) Charging Object naming Object retention and garbage collection Object access (via handles) Standard object attributes Standard object methods

计算机系 信息处理实验室 the Inside of Windows Executive Objects Process Memory Section Event Timer Object directory Queues Thread File Semaphore Symbolic link Port (registry) key

计算机系 信息处理实验室 the Inside of Windows Executive objects that contain kernel objects

计算机系 信息处理实验室 the Inside of Windows Object Structure

计算机系 信息处理实验室 the Inside of Windows Object properties OM deletes object when: #open handles drops to zero #knl refs drops to zero Obj names Support identification, finding, sharing Hierarchic (per machine) name space Symbolic links, e.g. “ C: ”

计算机系 信息处理实验室 the Inside of Windows Type Objects Process objects and the process type object

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the Type Objects

计算机系 信息处理实验室 the Inside of Windows Type Object Attributes Type name Pool type Default quota Access types Generic access rights mapping Synchronization Methods

计算机系 信息处理实验室 the Inside of Windows Object Methods Open--When an object handle is opened Close--When an object handle is closed Delete--Before the object manager deletes an object Query--name When a thread requests the name of an object, such as a file, that exists in a secondary object domain Parse--When the object manager is searching for an object name that exists in a secondary object domain Security--When a process reads or changes the protection of an object, such as a file, that exists in a secondary object domain

计算机系 信息处理实验室 the Inside of Windows Object Handles & Process Handle Table

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing Open Handles with Nthandle

计算机系 信息处理实验室 the Inside of Windows Structure of a handle table entry

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the Handle Table with the Kernel Debugger

计算机系 信息处理实验室 the Inside of Windows Handles and reference counts

计算机系 信息处理实验室 the Inside of Windows Synchronization Mutual exclusion one, and only one, thread can access a particular resource at a time Critical sections

计算机系 信息处理实验室 the Inside of Windows Kernel Synchronization Kernel critical sections For single-processor Simple operating systems: disable all interrupts 2K: raising the processor's IRQL For a multiprocessor spinlock

计算机系 信息处理实验室 the Inside of Windows Using a spinlock

计算机系 信息处理实验室 the Inside of Windows Executive Synchronization Dispatcher objects WaitForSingleObject WaitForMultipleObjects A thread in a Win32 application can synchronize with a Win32 process, thread, event, semaphore, mutex, waitable timer, I/O completion port, or file object Executive resources available only to kernel-mode code aren't accessible from the Win32 API

计算机系 信息处理实验室 the Inside of Windows Waiting on a dispatcher object A thread can synchronize with a dispatcher object by waiting on the object's handle

计算机系 信息处理实验室 the Inside of Windows Selected kernel dispatcher objects

计算机系 信息处理实验室 the Inside of Windows

计算机系 信息处理实验室 the Inside of Windows Wait data structures

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Looking at Wait Queues

计算机系 信息处理实验室 the Inside of Windows System worker threads Three types Delayed worker threads Critical worker threads hypercritical worker threads

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Listing System Worker Threads

计算机系 信息处理实验室 the Inside of Windows Windows 2000 Global Flags NtGlobalFlag Initialize Gflags.exe allows you to view and change the system global flags

计算机系 信息处理实验室 the Inside of Windows Local procedure calls (LPCs) An interprocess communication facility For high-speed message passing An internal mechanism available only to Windows 2000 operating system components

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing LPC Port Objects

计算机系 信息处理实验室 the Inside of Windows

计算机系 信息处理实验室 the Inside of Windows

计算机系 信息处理实验室 the Inside of Windows “Internal” IPC between address spaces, e.g. Transport for local RPC Calls to Win32 subsystem Variants: n <= 256 bytes done inband n > 256 bytes via shmem section n > shmem section – addr-to-addr copy Typically client-server Client connects to servers well-known LPC port Server opens new port and tells client its address

计算机系 信息处理实验室 the Inside of Windows LPC 端口的使用