Basic Windows Stuff
Basic Windows Stuff
Basic Windows Stuff
[edit section]Win 9x
GDI 16bit, Kernel 32bit VMM 32bit Memory Manager WDM Windows Device Manager BIOS Post -> Real Mode (io.sys) -> Protected Mode (vmm32.vxd) -> rest Ifshlp.sys 16bit file access Setver backwards compatibility CTRL alters startup Primary partition 1 logical drive (OS) Extended partition many logical drives Fdisk Format Setup /d (if corrupt) /ir (no mbr update) /il (Logitech C mouse) /ih (scandisk) /in (no network steps) /id (no disk space check) /is (no scandisk)
/s (system disk) /q (quick) /mbr (fixes mbr) /f (floppy size) /u (unconditional) /autotext (totally automatic)
Setuplog.txt
Detlog.txt (Detected hardware) Msdos.sys autoscan 0,1 (prompt),2 (auto) bootfailsafe Safe mode display bootmulti 0,1 bootwin 0 (dos),1 (win) bootgui Dos, 9x bootmenu No menu, menu bootdelay n bootmenudefault 1-8 (startup menu) Attrib r h s msdos.sys (read, hidden, system) Drivers = protected mode bootwarn Safe mode warning message bootkeys Enables F keys network Safe mode w/network support logo Text, logo loadtop Command.com to conventional
Kernel Mode Isolates Hardware, Processor, IRQ, Exception Handling HAL Hardware Platform Support
VDM Virtual Dos machine. Isolates application in a DOS-like environment Uses ntvdm.exe<ref>Ntvdm is 16 bit</ref>, ntio.sys, ntdos.sys. Instruction execution unit (Non-intel processors) Windows On Windows processes wowexec.exe (win 3.1 emulation), wow32.dll (dll emulation), krnl386, user.gdi. Rest are similar to 3.1 versions. Hard for 16bit app to communicate out of ntvdm to a 32bit app. Domain logical group of computers PDC Primary Domain Controller SAM Security Accounts Manager (database) BDC Backup Domain Controller (Backup of SAM) HCL Hardware compatibility list NTHQ NT Hardware Qualifier RISC Reduced Instruction Set Chip (Fat16)
[edit section]Setup
Winnt.exe Setup from 16bit Winnt32.exe Setup from 32bit
Runs command after GUI bit Source of files Temporary file directory Unattended install Creates uniqueness database file Creates a directory
Dualboot Win9x running on a Fat16 drive. Set 2nd OS to Fat16, use same directory for programs. Boot.ini <- edit OS loading menu as needed. System Partition Hardware specific files. Ntbootdd.sys SCSI boot if BIOS off. (Among other files)
[edit section]Booting
Preboot POST Boot Ntldr, ntldetect, ntoskrnl. Hardware detection Kernel Load Ntldr, ntoskrnl, low device drivers, HAL (NTLDR handover before HAL) Kernel Init Kernel takes over. High device drivers Logon Starts local security. Screg.exe Boot disk location d:\i386\winnt32.exe /ox ERD Emergency Repair Disk (run -> rdisk) Ntvdm.exe running 16bit applications. Separate one for each app.
directly accesses hardware wont run. VXD. LKGC Last known good configuration (hkey_local_machine\hardware)
[edit section]Win 2k
Server - 4gb max RAM, 2 processors max Advanced Server 2 computers combined, 64gb RAM, 8 processors Datacentre 16/32 processors Has USB, PnP support. NTFS, EFS (Encrypted File system), 32bit Fat32. Has MMC Microsoft Management console OnNow Hibernation Workgroup Simple collection of computers sharing files and printers Domain Share a security database
Use Win2k readiness analyzer tool Winnt32 /checkupgradeonly RIS Remote installation service CD Network Setup Manager Winnt (16), winnt32.exe (32) Setup from shared network folder. Need i386 directory Uses answer files. * Fully automated, user specified
* GUI attended text part automated Disk Duplication Sysprep.exe, 3rd party imager used Single location. Risetup.exe Needs DNS, DHCP, Active Directory Rbfg.exe remote bootdisk Needs PXE, preboot execuation environment
RIS
Installation modes
utostart, winnt32.exe
Bootstrap Mbr to memory. 1st sector to 0x700h. Loads ntldr OS Drivers Kernel Services Logon Ntdetect.com, boot.ini, bootsect.dos. 32bit mode. Minuture NTFS/FAT loads boot.ini (ARC path problem if this fails). ARISC (Advanced RISC). Checks for ntoskrnl, HAL, video drivers. Checks Currentcontrolset. Loads drivers & logo. Initialises ntoskrnl. Hal, Bootvid, creates hardware hive. Calls session manager. Runs boot programs. Sets up paging file. Loads console logon and services controller. Clone control set to LKGC
Directory Services Restore Restores sys vol, active directory service database Debug mode Serial cable logs on another PC (com2). Component Object model.
[edit section]Win XP
Home, Pro (2x CPU), 64 More reliable, system restore. Better 3d icons, 48x48 Account switching, help from support site
Internet firewall, connection sharing WMP 9, movie maker, scanner/camera Network, remote desktop, IEEE 802.11b Fat16 NT Fat32 9x NTFS Dualboot with 2k Domain membership not in Home Upgrade
p wizard
98/ME upgrade need to do convert d:/fs:ntfs Dualboot Different partition. Select "I want to choose" prevents format.
List of OSes
Bootcfg /rebuild Replaces it Bootcfg /add Format /diskpart Has basic security only Appends it
uter Manage Connect to Computer & Event logs Microsoft Management Console (MMC)
ditor
fig/win/system editors
i network
as .syd Edit
river needed
ochrome Extract.exe
e) /L (Target) Format Format c:, or from MMC/CMC/shortcut /fs:ntfs NT4, 2k, XP /v:label 11 chars /q /c /x Quick Compressed NTFS Dismount /F:size FDD size
/T:tracks Tracks per size /s /b /c Adds system files Adds space for /s Check/verify clusters
/A:size cmd.exe
ivation. /system32/cmd.exe
older
s open after file run Rd Remove directory (rmdir) Attrib a (a = backup archive bit) Ver/setver
es name of OS
E] Deletes from table [/QUIET] No message Mem * /c list of programs in memory * /d Details of memory areas /debug * /f lists free /free (9x) * /m Module eg: command.com (9x) * /p dir /p idea Autoexec.bat * echo Echoes commands on screen * mode Port settings etc * path Search path for executables * pause * prompt how c:\ displayed * rem comment
* set set blaster stuff more (/p idea) * Diskcopy a: a: /v (verify) * Xcopy Delete/Rename * del/erase * del /p (one by one, no recycle) * deltree * ren/rename
Partitions Primary
ision of extended. 23 max, 12 recommended. Boot Any partition with a startup file. System Primary with a startup file (Active Primary) Creation
b, use fdisk.
Defrag
ogram Summary)
aplog.exe, applog.dtm
ackup.exe
ntbackup.exe
.log if selected
/v FAT displays paths. NTFS cleanup message /c No cycles (NTFS) /r Recover /L Max logfile size
/x Forced Dismount
6,32k clusters. More space Security. Up to 2Tb. Partition size change irrelevant
sion
roper clusters
[edit section]Conversion
16 to 32, 16 -> NTFS
applications at hkey_local_machine\system\currentcontrolset\control\SessionManager\CheckBadApps400
cvt.exe)
e Name (LFN)
s fragmented
s Advanced Compress
exe
press, /u decompress
Data Recovery Agent (Authorized admin who can also decrypt file)
[edit section]Permissions
-Based permissions
defaults
[edit section]Drivers
ardware (PnP)
EVICE=A:\CDTECH.SYS /D:MSCD001
e Driver (Others)
no interaction, sigverif.txt created File Protection in 2k, XP totally blocks some drivers
Panel System Hardware Driver Signing ME may work in XP (WDM Windows Driver Model). Older, no.
Invalid VXD Dynamic link call from IFSMGR Msdos.sys c/g Msconfig shows boot problems ASD Automatic Skip Driver (Use safe mode)
New device not working Safe mode Failed to start device MMC event viewer
mode driver fight (SB card configured differently in Dos and Windows)
AM conflict
e Ram/cache
ient32 on an Office 97 PC
GA mode
[edit section]ASD.exe
e on IRQ routing
[edit section]Troubleshooting
[edit section]Dr.Watson
g or Watson001.log in win\drwatson
me
ERD
e, makeboot32.exe
m partition
[edit section]Configsafe
creation. Periodic/random
eneration
websites etc
microsoft.com
XP Performance information
al settings, no problem. Green ? Driver not the one designed but works
vice to uninstall
[edit section]WinMSD
sd
cs & Report
print, or .txt)
min tools diagnostics * /a complete report * /s summary report System report BIOS/cpu * /f send to file * /p send to printer Environment variable problem
Services " Startup values/errors Transport hardware MAC and protocols Drivers All drivers Further Misc stuff
el all documents
OS but not windows, Properties advanced Print directly to printer and device manager
ew cable or computer
[edit section]BSOD
K_MODE_EXCEPTION_NOT_HANDLED Bad device or driver config REGISTRY_ERROR INACCESSIBLE_BOOT_DEVICE UNEXPECTED_KERNEL_MODE_TRAP BAD_POOL_HEADER NTFS_FILE_SYSTEM KERNEL_DATA_INPAGE_ERROR NMI_HARDWARE_FAILURE Driver/SCSI terminator/Boot virus Memory problem Most recent change causing problem HDD corruption OS failed to read kernel data from page file HAL cant find error. Corrupt memory. Parity/non parity RAM mix
g peripheral device
s given
virus
function
Trojan Horse Appears as legit. Does expected task as well as bad. Cannot replicate. Logic Bomb Worm Macro Boot sector Secretly in host until trigger Self replicating virus. Doesn't need trigger Scripts. Application specific. MSword one wont do bad in MSexcel. Infects other MSWord (say) files
phic Changes replicated version Conceals itself (returns good copy of boot sector if queried)
CDs etc
en email attachments
d file check.
o disabling option
kups
virus monthly
ices/Services
vels/permissions
Key_" take data from many of the 5 hives. HKEY_LOCAL_MACHINE HKEY_USERS_DEFAULT HKEY_CURRENT_USER HKEY_CURRENT_USER data, specific to PC. Associated with HKEY_CLASSES_ROOT, CURRENTCONFIG andDYN_DATA. (98 system.dat, NT Sam/Security/Sys/Hardware) Profiles. (98 User.dat, NT default) 98 stored on startup. NT Account needed
HKEY_LOCAL_MACHINE\software\classes HKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_LOCAL_MACHINE\config HKEY_DYN_DATA Dynamic info. 9x, stored in RAM.
xe
menu Import/export/network
2.exe NT,2k
urity,options,window
t into Regedit
pairs/regback
ecovery console.
unctions of DOS io.sys and msdos.sys. Helps initial interaction between OS and PC hardware
ext file. Config info for io.sys. Windows directory, does both windows or dos mode.
starts applications
hardware control. Break, buggers, device, files (max), install, rem, stack (interrupts). Sends info to io.sys files.
toring info for device deivers about how DOS applications are to be handled
rmation on config & wallpaper, data, fonts. Info usually stored in registry, here too for compatibility.
S sections.
Timeout/default OS selection
List of OS, optional switches. /basevideo Loads in VGA /noguiboot No graphic on boot Driver display when loading
/crashdebug Only if Kernel error /sos /debug /debugport Port select /maxmem
selected OS
for ease
st XMS (Extended)
panded) can make large amount of memory available. 64k EMS window. Loaded here, then transferred to expanded. 32mb through a card. emm/himem in 9x. 9x internal stuff more efficient
Dos Protected Mode interface). Many programs in XMS. Creates Virtual Machines mode. OS allocated resources.
areas/amounts shown)
b OS (Kernel memory)
d User memory
er sends data to processor. Caching program reads whats next before its needed, loads to RAM. (faster)
Automated caching.
kgroups
ory (AD). All objects. Domain Controller (DC). Centralised. Do not need to know location of resource. Multiple, grouped domains. ~Millions of objects possible
N/modem/serial/parallel/USB/infrared
d Properties
connect different network types (and PSTN) efficient, efficient delivery (good for Internet) addressing scheme
fice Protocol
or without SMTP
POP/IMAP receive
heading/sender
e and forward"
[edit section]HTML
rkup Language
</xxx>
[edit section]HTTPS
server
[edit section]SSL
ape
Hello" information on RSA etc, and two random numbers. Client number and SSL session
Hello" confirms.
[edit section]Telnet
emulator. Logon to remote device and run program 23
[edit section]FTP
chonline.com
Password)
r) Bootstrap Protocol
DHCP message requesting IP DHCPDISCOVER Reply with DHCPOFFER. From many servers, computer picks one. DHCPREQUEST DHCPACK DHCPNAK ARP Request Accepting offer. "Lease ID cookie" IP address committed Completion of process If process fails Checks if IP address already used. If so, DHCPDECLINE sent.
Allocation without DHCP server (Win 98+). If APIPA cant find DHCP it uses 169.254.0.1 to 169.254.255.254. These aren't used on the Internet
[edit section]DNS
domain names, IP addresses, protocol/port numbers, oversee stable operation of root DNS servers.
[edit section]WINS
Internet Naming Service names to IP addresses (NetBios names to IP addresses)
DNS names
a request, computers respond with their IPs. Will not work through routers.
gisters name & IP with WINS server. Multiple WINS servers in a big network, synchronizing their data tables. B-Mode Broadcasts for NetBIOS
P-Mode
M-Mode Tries B mode then P mode H-Mode Tries P mode then B mode
ifier = 192.168.0.0
10.1
[edit section]IPX/SPX
model
s, datagram based IPX (Internetwork Packet Exchange) routes packets through network for transparency SPX (Sequenced Packet Exchange) ensures packets are in correct sequence NCP (Netware Call Protocol) satisfies application requests (e.g. security, synchronisation) NLSP (Netware Link Service Protocol) reduces bandwidth wasted by RIP RIP (Routing Information Protocol) dynamic exchange and updating of routing info SAP (Service Advertising Protocol) SAP table. allows servers to advertise themselves every 60sec. Stored on each server and router.
have unique node address 48bit value from MAC must be prevented
[edit section]Appletalk
nded Labelled 1-1024, one Zone. Many numbers, done on Cable Range.
Apple PM, printer, software. Socket in Node Cables, with many nodes
What the admin decides will be included. ADSP (Appletalk Data Stream Protocol) Duplex. Ensures delivery of data AEP (Appletalk Echo Protocol) Determines if node can be accessed and length of time for packet to get there AFP (Appletalk Filing Protocol) App/Pres layer. Permits application to work with files on servers and sharing. ASP (Appletalk Session Protocol) Transport/Session layers. Asymmetric, Session of OSI. Establishes sessions between client and server ATP (Appletalk Transaction Protocol) Sequencing, resending lost packets DDP (Datagram Delivery Protocol) Network layer. Forwards packets between sockets. Relies on others. LAP (Link Access Protocol) Data Link layer. Selects from and switches hardware. RTMP (Routing Table Maintenance Protocol) Keeps routing table and determines best way to forward frame ZIP (Zone Information Protocol) Lets apps get the zone name and network details ETHERtalk, TOKENtalk, LOCALtalk, FDDItalk. Various implementations.
[edit section]NetBEUI
de of NetBIOS
n a LAN. No routing.
OS frame. Better than NetBEUI. Better than 254 session, 8 bit NetBIOS.
Rate Interface
devices
routes to devices
Rate Interface)
ypted
otprint"
atellites
/NIC
ent to Network OS
AN
ased lines, continuous or intermittent connectivity. LANS, a combination of wired & wireless
tches, Leased.
t Preferences Advanced Select "Enable Java" and "Enable native object scripting"
[edit section]Firewalls
ection technology"
wn
CP shown
sends DHCPREQUEST
/all
successful, its shown. /? Gives list of commands /displayDNS Displays cache contents /flushDNS Purges cache /showclassID
FConfig
[edit section]Ping/Tracert
h TTL changing. TTL=1. Error generated, sent back with IP, result given.
TTL=n
<ip>"
[edit section]NSLookup
xx>" (A) 32bit IP4 address Canonical Name (CNAME) Alias DNS Mail Xchanger (MX) Message Routing Name Server (NS) Responsibilty for Zones "Authoritative" Pointer (PTR) Location in DNS space Start of Authority (SOA) Mailbox, serial number etc. Service (SRV) Single DNS Domain. Designating Backups.
.com
sharing.
bine with NTFS permissions. If the two are not the same, the more restrictive is used.
[edit section]Miscellaneous