sysconfig-1 計算機概論 for 外文系交大資工系蔡文能 [email protected] System...

sysconfig-1 計算機概論 for 外文系

交大資工系蔡文能

[email protected]

System Configuration&

Tips

系統設定

sysconfig-2 計概蔡文能

Agenda

• OS Review– Program execution.– Bootstrapping

• Booting Windows / DOS / Operating System• System Configurations( 系統個人化設定 )

– Config BIOS– Config Shell– Config OS + 網際網路選項

• 開始設定 …• Windows Registry

– Using regedit


電腦硬體五大單元計算 2+3=?單晶片微電腦 = CPU + Memory

ALU + CU 合稱 CPU

人會如何做 ?

電腦如何做 ?


Program Execution(The machine cycle )

Machine cycle1.Fetch

Retrieve next instruction from memory (as per program counter) and then increment

program counter

2. DecodeDecode bit pattern in

instruction register

3. Execute

Perform action requested by instruction in

instruction register

JUMP Instruction B25816

sysconfig-5 計概蔡文能Auto 變數佔用 STACK 區 memory

•Auto 變數就是沒寫 static 的 Local 變數

CPUIP

SP

Instruction Pointer

Stack Pointer

系統區

系統區

程式 + 靜態data

HEAP 堆積STACK

9876

.

9875.

...

0

21Fetch, Decode, Execute

電腦如何運作 ? How it works?


Software

• Operating Systems (OS)– Kernel

• OS components

– Shell – Examples: Linux, Windows XP, Vista, Windows 7.0

• Programming languages – Algorithms + Data Structures = Programs– Compiler vs. Interpreter

• Software engineering• Data Base Management System (DBMS)


Types of software

Applications software Performs tasks specific to the machine’s utilization. Generally transportable ( 即容易換到別的系統 )

System Software Performs tasks common to computer systems in general Startup Software (Bootstrap Loader)

POST- Power On Self TestBIOS- Basic Input/Output System (Subroutines)

Operating Systems vary based on the hardware they’re used on

Utility Software --


Types of System Software

Operating System (OS)Shell ( also known as Command Interpreter )Kernel

Utility software– Kind of System Software– providing fundamental activities, yet not included with OS– “extend” the OS

What is the difference between them?– Distinction between applications and utilities is often vague

( 不明確的 , 不清楚的 )– Distinction between OS and utilities is also vague


The shell as an interface between users and the operating system


Command Shell examples


Graphical ShellGUI – (pronounced "goo-ee")

• The Graphical User Interface – features of the GUI…

• Users work with on-screen pictures called icons and with menus rather than keyed-in.


What does Shell can do?

• Read Command from the user and take some action(s)Internal commands (and the Aliases)External commands

• Current directory ?– Unix vs. DOS/Windows ?

• Path– Command path

– Data path


Short cut on Desktop ( 桌面上的捷徑 ) • 按 mouse 右鍵新增捷逕填入命令


Short cut on Desktop ( 桌面上的捷徑 ) (cont.)• 造網址 short-cut: 填入網址 • 造 DOS short-cut: 填入 cmd ( 註 : win98 填

command)

• 可以修改 DOS short-cut 之屬性– 在該捷徑的 Icon 上按 mouse 右鍵選內容– 可改啟動命令及參數– 可改 Shell 之 path, 字型 , 外觀等屬性– Demo


OS can have many different Shells

• Defines interface between OS and users– Windows GUI (Graphical User Interface)– UNIX command line (Command driven)– UNIX users can choose among a variety of shells

• sh is the “Borne shell”

• csh is the “C shell”

• tcsh is an enhanced “C shell”

• ksh is the “Korn shell”

• bash is “Borne Again Shell”

– Shell programming (Batch file/Script file)


TheThe Unix Unix Operating SystemOperating System

Copyright © 2004 Rick Kephart

• Unix was developed initially around 1969 at the AT&T Bell Laboratories – AT&T Unix

• Later another, slightly different, version of Unix surfaced at UC Berkeley – Berkeley Unix

• In general, AT&T Unix focused on kernel functions while Berkeley Unix focused on networking capability

• Unix pioneered the X-window display system


OS Loading

• How does OS loads in the first place?

• There’s something called a bootstrap loader, which is stored in ROM and brings the necessary pieces of OS from the disks’ boot sector, which know how to load the OS further, and transfers control to it.

• Then all the other parts of OS and device drivers are loaded.

註 : 目前大都用 Flash memory 快閃記憶體代替 ROM


Getting it started (Start up the computer)

• When the computer is started, the control unit branches to a fixed memory location; e.g. initial PC value hardwired. (e.g., CS:IP = 0xffff:0000)

• The fixed location is a ROM address that contains a small bootstrap loader.

• The bootstrap loader may be comprehensive enough to load the nucleus of the OS (kernel); Otherwise, it loads a loader program that does so.

• Once bootstrap phase is done, any program can be run by loading it in memory and loading its initial address in the PC (fetch-decode-exec algorithm)


The Booting process (Bootstrapping)

• For a computer to start running…– Booting – starting a computer by loading the kernel– Bootstrap Loader program – the initial program

• Code stored in ROM that is able to locate the kernel, load it into memory, and start its execution

• Initialize all aspects of the system – CPU registers, device controllers, memory contents

• Two step process: a simple bootstrap loader fetches a more complex boot program from the boot sector in disk, which in turn loads the kernel

– PC, Sun Solaris


Bootstrapping

• Cold boot vs.warm boot(does not retest the system)


Bootstrapping flow Diagram

Boot Sector

NTLDR

NT/2000/XP Install

NTOSKRNL

BIOS / POST

MBR

Found NTLDR ?

FDISK

yes

FAT: “Couldn't find NTLDR”

NTFS: “A Kernel file is missing”

No

Switches to Protected mode and enables paging

Reads boot.ini

Loads & executes ntdetect.com

Reads the Registry

Loads device drivers

Found ntoskrnl.exe & hal.dll ?

yesNo

“Windows NT could not start because the following file was missing or corrupt : filename”

Contains read-only NTFS code; passes the structure and format of the logical drive to NTLDR

BIOS = Basic Input Output System POST = Power On Self Test

MBR = Master Boot Record

Windows system


Booting Windows (1/2)Booting Windows (1/2)


• In the case of Windows NT, 2K and XP, the BIOS transfers control to a program called ntldr which loads the OS

• During the operation of the startup BIOS, the Intel-x86 is in real mode ( 真實模式 )

• The ntldr transfers the x86 CPU into protected mode and creates a file system and then initializes other systems – e.g. video


Booting Windows (2/2)Booting Windows (2/2)


• Windows Allows the user to force Windows to boot into Safe Mode ( 安全模式 )

• In safe mode Windows operates with basic files and drivers and optionally without networking

• Several safe mode options exist: – Safe Mode without networking

– Safe Mode with networking

– Safe mode with only command line access

• Safe Mode is most useful in debugging. • Safe Mode is entered by pressing F8 during boot


Booting DOS/WindowsBooting DOS/Windows


特洛伊木馬 (Troy) 病毒攻擊原理

• 特洛伊木馬是一個惡意程式，它駐留在目標電腦裡，可以隨電腦自動啟動並在某一連接進行偵聽，其實只是一個使用連接進行通訊的網路客戶 /伺服器程式 (Client/Server)。對於特洛伊木馬，被控制端就成為一台伺服器。

• 網路 Client/Server模式的原理是一台主機提供伺服器 (伺服端 )，其他主機 (客戶端 )接受伺服器的服務。作為 Server的主機一般會開啟一個或多個預設的連接埠 (port)並進行監聽(Listen)，如果有客戶端向伺服端的這一連接埠提出連接請求 (Connect Request)，伺服端上的相對應程式就會自動執行，來回覆客戶端的請求。


特洛伊木馬隱身方法 (1/3 )

• 木馬程式會想盡一切辦法隱藏自己，主要途徑有：在工作程序中隱形：將程式設為「系統伺服器」可以偽裝自己。當然它也會悄無聲息地啟動，木馬會在每次使用者啟動時自動載入伺服器端。

• Windows系統啟動時自動載入應用程式的方法，「木馬」都會用上，如： win.ini、 system.ini、註冊表等等都是「木馬」藏身的好地方。 – win.ini檔案，在 [WINDOWS] 下面，「 run=」和

「 load=」是可能載入「木馬」程式的途徑，一般情況下，它們的等號後面什麼都沒有，如果發現後面跟有路徑與檔案名稱不是您熟悉的啟動檔案，電腦就可能中「木馬」了。當然也得看清楚，因為好多「木馬」，如「 AOL Trojan木馬」，它把自身偽裝成command.exe檔案，如果不注意可能不會發現它不是真正的系統啟動檔案。


特洛伊木馬隱身方法 (2/3 )

• Windows系統啟動時自動載入應用程式的方法，「木馬」都會用上，如：win.ini、 system.ini、註冊表等等都是「木馬」藏身的好地方。 – system.ini檔案中，在 [BOOT]下面有個「 shell=檔案名稱」。正確的檔案名稱應該是「 explorer.exe」，如果不是「 explorer.exe」，而是「 shell= explorer.exe 程式名」，那麼後面跟著的那個程式就是「木馬」程式，就是說已經中「木馬」了。


特洛伊木馬隱身方法 (3/3)

• 在註冊表 (registry) 中的情況最複雜，使用 regedit指令開啟註冊表編輯器，在點擊至：「 HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \Current Version \Run」目錄下，檢視鍵值中有沒有自己不熟悉的自動啟動檔案，副檔名為 EXE，這裡切記：有的「木馬」程式產生的檔案很像系統自身檔案，想使用偽裝矇混過關，如「 Acid Battery v1.0木馬」，它將註冊表「 HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft\Windows\CurrentVersion\Run」下的 Explorer 鍵值改為 Explorer =「 C:\WINDOWS\expiorer.exe」，「木馬」程式與真正的 Explorer之間只有「 i」與「 l」的差別。當然在註冊表中還有很多地方都可以隱藏「木馬」程式，如：「 HKEY_CURRENT_USER＼ Software＼ Microsoft＼ Windows＼ CurrentVersion＼Run」、「 HKEY_USERS＼ Software＼ Microsoft＼ Windows＼ CurrentVersion＼ Run 」的目錄下都有可能，最好的辦法就是在「 HKEY_LOCAL_MACHINE＼ Software＼ Microsoft＼ Windows＼ CurrentVersion＼ Run」下找到「木馬」程式的檔案名稱，再在整個註冊表中搜尋即可。


善用 netstat –a | more 查看


冰河木馬病毒清除法 ( 清除木馬冰河v1.1 )• 開啟 registry 註冊表 ( Regedit 或 regedt32 ) • 點擊目錄至：　　 HKEY_LOCAL_MACHINE\

SOFTWARE\Microsoft\Windows\CurrentVersion\Run• 搜尋以下的兩個路徑，並刪除之　　 " C:\windows\system\ kernel32.exe" 　

　　　 " C:\windows\system\ sysexplr.exe" 　 • 關閉 Regedit 或 regedt32• 重新啟動到 MSDOS 方式刪除以下兩隻木馬程序

後重新啟動 C:\windows\system\ kernel32.exe C:\windows\system\ sysexplr.exe


冰河木馬病毒清除法 ( 清除木馬冰河v2.2 )開啟 registry 註冊表 ( Regedit 或 regedt32 ) 點擊目錄至 : 　　 HKEY_LOCAL_MACHINE\

SOFTWARE\Microsoft\Windows\CurrentVersion\Run 搜尋 ? 　　因為伺服器程序、路徑用戶是可以隨意定義，寫入註冊表

的鍵名也可以自己定義。你可以察看註冊表，把可疑的文件路徑刪除。　　

重新啟動到 MSDOS 方式　　刪除於註冊表找到可疑之相對應的木馬程式重新啟動 Windows 　


如何防止安裝完系統就中毒 ?

• 不接網路 !

• 安裝已經過 patch 的 OS– 何謂 patch ? ( 補釘 )

• 躲在 NAT 後面安裝– NAT : Network Address Transfer ( 以後與網路有關的

課 )– 申請來的 IP address 給 NAT device 用– 家用路由器 , 頻寬分享器 , …– 自己電腦的網路設定選自動取得 IP


系統個人化設定

• Config BIOS

• Config Shell

• Config OS

• Windows Configuration– 開始設定– Config.sys, autoexec.bat ( rc files in Unix)– Win.ini, system.ini (ini files in DOS/Windows)– Registry ( 註冊表 )

江湖一點訣


Config BIOS ( 開機設定 )

• 通常在開機時按 Del 鍵進入 BIOS 設定– RAM– Chipset 設定– Peripheral Devices and Resource Allocation

• Legacy

• PnP

– Booting 開機 devices 順序– …

• PnP (Plug and Play) Devices ?


Plug and Play Hardware (1/2)Plug and Play Hardware (1/2)


• Every PC contains a number of hardware components that must all work together

• Each component may need to have its own:– Interrupt ID– RAM that only this device writes to DMA– ROM address (where it’s own BIOS resides)– RAM buffer address (used to pass data to/from this

address)– PnP Identification code


Plug and Play Hardware (2/2)Plug and Play Hardware (2/2)


• The component cooperation depends on each device being correctly configured

• Each time a component is added or taken away, the configuration must be changed

• Plug and Play is a standard – agreed upon by the various hardware manufactures – that allows a computer to accomplish this automatically

Why　Do　We　Need　Plug　and　Play　?


How Does Plug and Play Work (1/2)How Does Plug and Play Work (1/2)


• Plug and Play compatible BIOS locates all potential components that are Plug and Play compatible and collects information about each PnP device– Each component contains a unique identifier as part of

it’s on board ROM– Each component defines what resources it needs and

what range of resources it will accept– BIOS transfers this configuration information to the

operating system so that the appropriate drivers can be configured


How Does Plug and Play Work(2/2)How Does Plug and Play Work(2/2)


• The Windows configuration manager completes the PnP installation by:– Assigning Resources (e.g. interrupt ID)– Managing conflicts – Locates a device driver for each component– Asks user for driver if it is not found

• Note that once a device is configured the information is stored within the device itself


System Requirements for PnP(1/2)System Requirements for PnP(1/2)


• System Hardware– Chipset and Bus controllers must be capable of supporting

PnP• Peripheral Hardware

– The devices being added must also be capable of supporting PnP

• System BIOS– The system BIOS starts the PnP process

• Operating System– The PnP compatible OS completes the PnP process


System Requirements for PnP(2/2)System Requirements for PnP(2/2)


• A PnP BIOS typically allows you to specifically designate which IRQ #’s and DMA channels are available for PnP control

• The BIOS configuration options typically are:– PCI/PnP – Allowed to be assigned by PnP– ISA/Legacy – “off limits” to PnP assignment

• Typically the following resources are PCI/PnP– IRQs – 3,4,5,7,9,11,12,14 and 15– DMA Channels – 0,1,3,5,6 and 7


Device Configuration StorageDevice Configuration Storage


• A PnP device need only be configured once• This configuration information is stored in a

dedicated part of the non-volatile CMOS memory• The data stored in this memory is called the

Extended System Configuration Data (ESCD)• Both the BIOS and the OS use this data area to

store and read configuration information about devices


User Configuration for PnPUser Configuration for PnP

• When PnP is available, the BIOS allows you to specifically designate which IRQs and DMA channels are available for PnP control

•The configuration is typically specified as:

PNP/PCI Configuration



Config GUI Shell (1/6)

在“開始” (Start)之上用滑鼠右鍵按下後選

--- 內容

--- 開啟所有使用者


Config GUI Shell (2/6)

• 選“內容”


Config GUI Shell (3/6) 螢幕保護程…


Config GUI Shell (4/6) 外觀 …


Config GUI Shell (5/6) 設定值 …


Config GUI Shell (6/6) 資料夾選項


Windows update ( 更新 patch OS)


Config the OS

在“我的電腦”

上用滑鼠按右鍵 ,

然後選 “內容

”


硬體


進階 (1/4) – 效能視覺效果


進階 (2/4) – 效能進階

關於虛擬記憶體請看後面 slides


進階 (3/4) – 啟動及修復


進階 (4/4) – 環境變數


系統還原 (1/3)


系統還原 (3/3) – 回到從前


自動更新


Evolution of OS Memory Mgt.Evolution of OS Memory Mgt.


關於虛擬記憶體 (1/3)


Windows Virtual MemoryWindows Virtual Memory


• With this model, an application or device driver indicates that it needs memory, but it does not have to tell Windows which physical or which memory addresses it wants

• Memory is allocated in 4K segments or pages• Windows assigns a certain number of pages to an

application or device driver that needs memory• Windows virtual memory manager handles managing

the memory addresses used for each page and can choose to store these pages in RAM or in the hard drive in the swap file named Pagefile.sys



Windows Memory ManagementWindows Memory Management


x86 Page Table



Windows 開機相關設定

• OLD configurations– Config.sys

– Autoexec.bat

• Win.ini• System.ini• Boot.ini

• Registry


開始設定控制台


新增或移除程式


網際網路選項 (1/3)


開始設定控制台


控制台系統管理工具服務


Using msconfig.exe

dir msconfig.exe/s/p

Win.ini


SYSTEM.INI

啟動


服務 (Services)


排定工作 (crontab in Unix system)


電源管理


Working with the Windows XP Registry

• Registry– The hierarchical database of system configuration

data essential to the health and operation of a Windows XP system

– Contains most of the control and functional settings for Windows XP core elements, services, and native applications


Windows Registry Overview

• The Registry is divided into keys and subkeys– Each Registry key is similar to a bracketed heading in an .ini file and

represents a top-level container in the Registry hierarchy– Each key must contain at least one or more lower-level keys called

subkeys• The Registry is divided into five main keys

– Keys contain one or more subkeys– Any subkey can contain one or more subkeys– Any subkey can contain one or more value entries

• Value entry– Named parameter or placeholder for a control setting or configuration

data

• Value– Actual piece of data held by a value entry


Data types used in Windows Registry

• The data type of a value entry informs the Registry how store the value

• The data types supported by windows 2000:– REG_BINARY– REG_DWORD– REG_SZ– REG_MULTI_SZ– REG_EXPAND_SZ– REG_FULL_RESOURCE_DESCRIPTOR– REG_DWORD_LITTLE_ENDIAN– REG_DWORD_BIG_ENDIAN– REG_LINK


HKEY_LOCAL_MACHINE (1/3)

• Contains the value entries that control the local computer

The HKEY_LOCAL_MACHINE key



• HKEY_LOCAL_MACHINE\HARDWARE– Container for data related directly to physical

devices installed on a computer

• HKEY_LOCAL_MACHINE\SAM– Hive that contains data related to security

– The Security Accounts Manager (SAM) database is stored in this key



• HKEY_LOCAL_MACHINE\SECURITY– Container for the local security policy

• HKEY_LOCAL_MACHINE\SOFTWARE– Container for data about installed software and

mapped file extensions

• HKEY_LOCAL_MACHINE\SYSTEM– Container for the information required to boot

Windows system


HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT contains file extension and com object settings and associations


HKEY_CURRENT_CONFIG

• Container for data pertaining to hardware profile currently in use

The HKEY_CURRENT_CONFIG/ key is maintained in Windows XP for backward compatibility


HKEY_CURRENT_USER

HKEY_CURRENT_USER contains data for whichever user is currently logged onto the system


HKEY_USERS

HKEY_USERS contain data for any user who has ever logged onto the system, plus a default user profile


Registry Editors

• regedit– 16-bit Registry editor

• regedt32– 32-bit Registry editor

• reg– Special command-line utility that users, programs,

or the operating system can use to access, inspect, create, or modify Registry keys


Using regedit / regedt32


Command Line Registry Editor -- Reg.exe

Reg.exe is a command-line utility that permits users, batch files, or programs to operate on the Registry


Tips to using Registry Editors

• Precautions when making changes to in the Registry:– Back up all important data on the computer before

editing the Registry– Making a distinct backup of all or part of the Registry– Reboot the machine before editing the Registry– Perform only a single Registry modification at a time– Reboot immediately after each change to force full

system compliance


Registry Size Limitations

• The Registry is stored in active memory for quick and easy accessibility while the operating system is functioning– Resides in the paged pool portion of memory

• This means it can be swapped out to disk when not in use

• As your system ages and configurations evolve over time, many changes will accumulate in the Registry, causing its size to increase

• The initial size of the Registry on a Windows XP Professional system is around 10 MB

• To prevent the Registry from consuming too much memory, Windows XP imposes the Registry Size Limit (RSL)


Registry Storage Files (1/2)

Explorer listing of the …\system32\config folder shows various Registry file types and instances


Registry Storage Files (2/2)• Four extensions used by the Registry storage files

to identify the purpose or function of the file:– No extension– .alt– .log– .sav


Registry Fault Tolerance• If the Registry becomes corrupted or destroyed, Windows

XP cannot function or even boot• Several mechanisms have been established to prevent the

Registry from becoming damaged or to repair minor problems automatically

• The fault tolerance of the Registry is sustained by its structure, memory residence, and transaction logs– Flush

• Copy procedure to update the files on the hard drive with the new settings stored in the memory-resident version of the Registry

– Transaction logs• Files wherein the systems records edits, changes, and

alterations to the Registry


Ways to Create Reliable Registry Backups

• Most Windows XP backup applications include support for full Registry backups

• Regedit can be used to save all or part of the Registry to distinct files

• Make a copy of the %systemroot%\WINDOWS-\system32\config and %systemroot%\WINDOWS-\repair directories manually

• Employ the Microsoft Windows XP Professional Resource Kit tools Reg.exe or Regback.exe


Restoring the Registry

• You have several options for restoring the Registry, depending on the method used to make a backup

• Windows XP itself attempts to maintain a functional Registry• Use %systemroot%\system32\restore\rstrui.exe• Last Known Good Configuration (LKGC)

– State of the Registry stored in one of the control sets when the last successful user logon occurred

• If the LKGC fails to restore normal system functions, you have only two options:– Use your backup software to restore the Registry files– Reinstall Windows XP, either fully or as an upgrade


echo %path% echo %systemroot%


Windows XP Professional Resource Kit Registry Tools

• Some of the key utilities include:– Regdump.exe– Regfind.exe– Compreg.exe– Regini.exe– Regback.exe– Regrest.exe– Scanreg.exe


系統設定

謝謝捧場[email protected]

蔡文能

Thank　You!Thank　You!

System Configuration

& Tips

sysconfig-1 計算機概論 for 外文系交大資工系蔡文能 [email protected] System...

Documents

Transcript of sysconfig-1 計算機概論 for 外文系交大資工系蔡文能 [email protected] System...

sysconfig-1 計算機概論 for 外文系 交大資工系 蔡 文 能 [email protected] System...

Documents

Transcript of sysconfig-1 計算機概論 for 外文系 交大資工系 蔡 文 能 [email protected] System...

sysconfig-1 計算機概論 for 外文系交大資工系蔡文能 [email protected] System...

Transcript of sysconfig-1 計算機概論 for 外文系交大資工系蔡文能 [email protected] System...