Processes and Threads

When ever we turn pages of a book written on Microsoft Windows operating system or we read through web sites explaining the same we always get to hear these terms.. Processes.. Threads ?

Let me start with a question..  Can processes RUN ? My view is, it cant. :-)

Lets look at the defenition for the term Process provided in the 2003 Server resource kit help.

Process

A process is a running instance of an application or executable file, along with all the system resources that have been allocated to that instance. In general, a process is equivalent to a single application or service; for example, Microsoft Word runs in the Winword.exe process.
 

Thread

Each process is composed of a set of threads. A thread is a unit of work that runs simultaneously with other units of work on the computer; each process must have at least one thread.

Threads represent the basic unit of execution in an operating system. When a thread starts, the operating system Memory Manager allocates enough physical memory and page file space to allow the thread to run. While a thread is running, it can request additional memory to enable it to complete its task. When a thread ends, it releases the memory it was using back to the Memory Manager for reallocation.

So its thread that is run.. :-)

WINSXS directory in Windows Vista: What is it and why is it so large?

Of the many blogs that I read daily, the Core Team Blog  really interests me.

The below article on WinSxS is explains a lot about vista changes.

You may read full the article  @ http://blogs.technet.com/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx

Effort is to capture some core points :

• Vista is no more an INF described OS. It uses componentization.
• A component in Windows is one or more binaries, a catalog file, and an XML file that describes everything about how the files should be installed.
• All of the components in the operating system are found in the WinSxS folder. The WinSxS is called Component Store quite often.
• The WinSxS folder is the only location that the component is found on the system, all other instances of the files that you see on the system are “projected” by hard linking from the component store.
• there is only one instance (or full data copy) of each version of each file in the OS, and that instance is located in the WinSxS folder.  
•  Looked at from that perspective, the WinSxS folder is really the entirety of the whole OS.

The bulleted points above explains why the folder is big initially. Further to this, the article explains the reason, why the folder grows with time.

•  In previous versions of Windows the atomic unit of servicing was the file, in Windows Vista it’s the component. 
• When Microsoft updates a particular binary, theyrelease a new version of the whole component, and that new version is stored alongside the original one in the component store.
• The higher version of the component is projected onto the system, but the older version in the store isn’t touched. 
• This is the reason for the component store to grow so large.
• Not every component in the component store is applicable, meaning that not every component should be projected onto the system.  For example, on systems where IIS is available but has not been installed, the IIS components are present in the store, but not projected into any location on the system where they might be used.
• So a single Post SP1 GDR package that contains an update to one component will end up installing four versions of that component in the WinSxS folder

Why the older components are not removed from the component Store ?

• The reason for this is to make the system more reliable.
• The component store, along with other information on the system, allows us to determine at any given time what the best version of a component to project is.
• That means that if you uninstall a security update we can install the next highest version on the system – we no longer have an “out of order uninstall” problem.

Still I am short of space.. Can I reduce the size of this folder ?

• The only way to safely reduce the size of the WinSxS folder is to reduce the set of possible actions that the system can take – the easiest way to do that is to remove the packages that installed the components in the first place.
•  This can be done by uninstalling superseded versions of packages that are on your system.
• Service Pack 1 contains a binary called VSP1CLN.EXE, a tool that will make the Service Pack package permanent (not removable) on your system,  and remove the RTM versions of all superseded components.

Reusing Joseph's - Author of this article - words to conclude this "So yes, the WinSXS folder is very large, and it will continue to grow as the OS ages. "


PS: The C:\Windows\winSxS folder on my Vista system is 5.6 GB :-)

What are the differences between Windows Updates, Automatic Updates, and Microsoft Updates?

I always get confused with Windows update, Microsoft update and Automatic Update. Today we ( Rejin, Vipin and I ) had a small debate on  this.. It helped.. It helped to add to confusion.. :-)

I googled on it for some time and landed on this document. Even though not so elaborate, the following MS article expains it a bit.

http://www.microsoft.com/windows/downloads/windowsupdate/FAQ.mspx

An excerpt below:

"While Windows Update provides you with updates specifically for Windows, Microsoft Update expands the service to download and install updates for other Microsoft software, such as Microsoft Office and Windows Live. Automatic updating is a feature that allows you to set your PC to automatically download and install updates using either service, making it easy and convenient for you to keep your Windows PC current. "

In short :

Windows Update :  Manual, the user needs to browse to the site.
Microsoft Update  :  Manual, allows additional updates (office, windows live)
Automatic Update : This is automatic. Can happen from an intranet WSUS Server or Microsoft Server.

To configure the system for proper Automatic update
Check the following Registry Key

H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P O L I C I E S \ M I C R O S O F T \ W I N D O W S \ W I N D O W S U P D A T E \ A U


UseWUServer  REG_DWORD                1

If the above registry key is "1" it is pointing to  an intranet server. If this value is "0" it will point to Microsoft server for downloads.

The internal servers can be defined at

H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P O L I C I E S \ M I C R O S O F T \ W I N D O W S \ W I N D O W S U P D A T E

WUServer                REG_SZ  http://yourservername/
WUStatusServer    REG_SZ  http://yourservername/

Cloud Computing..

Today afternoon my friend, Binoy, called me up and asked about Cloud Computing.  I was taken by surprise by this question. Even though I heard about it many times, I couldn't explain it properly.

When I came back to desk, the first thing I did was to google about Cloud Computing..

The explanations are messy in most of the documents and to be very frank I am still reading docs to get a clear picture.

To my understanding, in Cloud Computing architecture:

1. You have a minimal configuration system with good enough internet connectivity.
2. You do everything else on internet. Be it document creation, mail and everything.
3. You effectively pay for the hardware and the services you use..

Now I am ready to take a blame on me if any of these statements are wrong. This is rather a premature document.

http://virtualization.sys-con.com/node/632257
http://webtrends.about.com/od/enterprise20/a/cloud-computing.htm
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9006439

Task Manager - A detailed Analysis

I have been on a date the whole day... Yes... A date with Windows Task Manager.. 

My effort here is to list out some simple terms that I read really carefully today. Coz I had very less room for an understanding issue today..  we hear these terms day after day.. yet we forget..

Lets run through the important Task Manager terms.

First, open up the taks manager. How ? 

Ctrl+Shift+Esc  OR Ctrl + Alt + Del and select Task managaer OR Right click on taskbar and select Task manager OR Start -> Run-> Taskmgr

Clck on Processes Tab in Task Manager
Select  the below referenced columns  (View -> Columns )

Processes Tab Explanation

CPU Time	The total processor time, in seconds, used by the process since it was started.
CPU Usage	The percentage of time the threads of the process used the processor since the last update.
Memory Usage (Working Set )	The amount of main memory, in kilobytes, used by the process.
Memory Usage Delta	The change in memory use, in kilobytes, since the last update. Unlike System Monitor, Task Manager displays negative values.
Nonpaged Pool	The amount of memory, in kilobytes, used by a process. Operating system memory that is never paged to disk. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk.
Paged Pool	The amount of system-allocated virtual memory, in kilobytes, used by a process. The paged pool is virtual memory available to be paged to disk. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk. The paged pool includes all of user memory and a portion of system memory.
Peak Memory Usage	The peak amount of physical memory resident in a process since it started.
Virtual Memory Size ( Private Bytes)	The amount of virtual memory, or address space, committed to a process.

Reference: http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/prork/preb_mon_nbcl.mspx?mfr=true

IPv6 Address configurations

Just thought of summarizing some key points about IPv6 ( Internet Protocol Version 6 ).

Key points about IPv6

• It has been designed to replace the age old, reliable IPv4.
• IPv4 has been very good. Has done its job.. It just cant take the current load.
• IPv6 is efficient and more secure.

Let me start with asking you guys a question ?

How do we assign an IPv6 address. Read on :-)

 
Address configuration.

stateful Address Configuaration

• Address configuration with DHCP

Stateless Address Configuration :

• Hosts automatically configure themselves.
• Addresses derived from prefixes advertised by local routers
• The presence of a router is not mandatory

IPv4 had the concept of Unicast Broadcast and Multicast. For unicast and Multicast, the explanation remains the same. There is no broadcast as such in IPv6. A good news.. :-) Less network chaos..

 Address types

 Unicast Addresses

A unicast address identifies a single interface

The following types of addresses are unicast IPv6 addresses:

Global unicast addresses

·         equivalent to public IPv4 addresses.

·         globally routable and reachable on the IPv6 portion of the Internet.

·         The three high-order bits are set to 001. The address prefix for currently assigned global addresses is 2000::/3

Local use Unicast Addresses.

There are two types of local-use unicast addresses:

·         Link-local addresses.

·         Automatically configured.

·         Always begin with FE80

·         Comparable to IPv4 APIPA ( Automatic Private Internet Protocol Addressing )

·         The scope of a link-local address is the local link.

·         Site-local addresses.

·         Equivalent to the IPv4 private address space (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16).

·         Not routed on internet.

·         A site is an organization network or portion of an organization's network that has a defined geographical location (such as an office, an office complex, or a campus).

·         Not automatically configured. Must be assigned either through stateless or stateful address configuration processes.

·         Always begin with FEC0

 

Unique local IPv6 unicast addresses

·         Designed to replace site-local addresses with an address that is private to an organization, yet unique across all of the sites of the organization.

·         All unique local addresses have the address prefix FC00::/7

·         Unique local addresses have a global scope but their reachability is defined by routing topology.

·         Organizations will not advertise their unique local address prefixes outside of their organizations or create DNS AAAA entries with unique local addresses in the Internet DNS.

 

Special addresses

·         Unspecified address

·         Unspecified address (0:0:0:0:0:0:0:0 or ::) is only used to indicate the absence of an address.

·         Equivalent to the IPv4 unspecified address of 0.0.0.0.

·         The unspecified address is never assigned to an interface or used as a destination address.

·         Loopback address

·         The loopback address (0:0:0:0:0:0:0:1 or ::1) is used to identify a loopback interface, enabling a node to send packets to itself.

·         Equivalent to the IPv4 loopback address of 127.0.0.1.

 

Compatibility Addresses

·         IPv4-compatible address

·         The IPv4-compatible address, 0:0:0:0:0:0:w.x.y.z or ::w.x.y.z (where w.x.y.z is the dotted decimal representation of an IPv4 address), is used by IPv6/IPv4 nodes that are communicating using IPv6.

·         When the IPv4-compatible address is used as an IPv6 destination, the IPv6 traffic is automatically encapsulated with an IPv4 header and sent to the destination using the IPv4 infrastructure.

·         IPv4-mapped address

·         The IPv4-mapped address, 0:0:0:0:0:FFFF:w.x.y.z or ::FFFF:w.x.y.z, is used to represent an IPv4-only node to an IPv6 node.

·          It is used only for internal representation.

·         The IPv4-mapped address is never used as a source or destination address of an IPv6 packet.

·         6to4 address

·         The 6to4 address is used for communicating between two nodes running both IPv4 and IPv6 over an IPv4 routing infrastructure.

·         The 6to4 address is formed by combining the prefix 2002::/16 with the 32 bits of a public IPv4 address, forming a 48-bit prefix.

 

 

Multicast Addresses

·         In IPv6, multicast traffic operates in the same way that it does in IPv4.

·         Always begins with “FF”.

·         Multicast addresses cannot be used as source addresses or as intermediate destinations in a Routing extension header.

Solicited Node Address.

·         Replaces the IPv4 ARP mechanism.

·         The solicited-node address facilitates the efficient querying of network nodes during address resolution.

·         The solicited-node multicast address is comprised of the prefix FF02::1:FF00:0/104 and the last 24-bits of the IPv6 address that is being resolved.

·         By using the solicited-node address, very few nodes are disturbed during address resolution.

 

Anycast Addresses

·         An anycast address is assigned to multiple interfaces.

·         Packets addressed to an anycast address are forwarded by the routing infrastructure to the nearest interface to which the anycast address is assigned.

What I heard from Anirban today

We, (I and Anirban) always enagage in small discussions on life.. sports ( I remain a listener most of the time)... Music.. and stuff like that..

This is what he said today.. And I immediately liked it...

"You should never make a decision when you are angry nor should you make a promise when you are very happy."

How to enable user environment debug logging in retail builds of Windows

To troubleshoot issues with user log on and Group policy issues, enabling tracing of log on activity is helpful.

Make the following changes to enable tracing.

Use Registry Editor to add or to modify the following registry entry:
Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: UserEnvDebugLevel
Type: REG_DWORD
Value data: 10002 (Hexadecimal)
UserEnvDebugLevel can have the following values:
NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000
The default value is NORMAL|LOGFILE (0x00010001).

Note To disable logging, select NONE (0x00000000).

You can combine these values. For example, you can combine VERBOSE 0x00000002 and LOGFILE 0x00010000 to get 0x00010002. Therefore, if UserEnvDebugLevel is given a value of 0x00010002, LOGFILE and VERBOSE are both turned on. Combining these values is the same as using an OR statement.
0x00010000 OR 0x00000002 = 0x00010002
Note If you set UserEnvDebugLevel to 0x00030002, the most verbose details are logged in the Userenv.log file.

The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created. This action occurs when a user logs on locally or by using Terminal Services, and the Winlogon process starts. However, because the size check only occurs when a user logs on, the Userenv.log file may grow beyond the 300 KB limit.

The 300 KB limit cannot be modified.

Windows XP SP3 and IE7 - The unistallation puzzle

Case 1 : You have IE7 on XP SP2. Install XP SP3 on top of it.  You wil not be able to unistall IE7 and revert to IE6 unless you un-install XPSP3.

Case 2. : You have IE6 on XP SP2. Install XP SP3. Then install IE7. If this configuration is followed IE7 can be unistalled and reverted to IE6 with out uninstalling SP3.

Below is an excerpt from IE Blog:

" If you choose to install XPSP3, Internet Explorer 7 will remain on your system after the install is complete. Your preferences will be retained. However, you will no longer be able to uninstall IE7. If you go to Control Panel->Add/Remove Programs, the Remove option will be grayed out.

This behavior is by design and here is why. When we install IE7 on Windows XP SP2, we backup the existing IE6 files in an uninstall directory.  Those IE6 files are the ones that shipped on XPSP2 plus all the security updates you’ve installed while using IE6. Windows XP SP3 contains a newer version of the Internet Explorer 6 files. If you have XPSP3 on your system and uninstall IE7, your system would revert to the backed up (older) version of the IE6 files rather than the newer XPSP3 version. You would end up in a mixed file state in Windows where most files would be the upgraded XPSP3, except for the IE6 files restored when uninstalling IE7. This state is not supported and is very bug prone. To ensure a reliable user experience, we prevent this broken state by disabling the ability to uninstall Internet Explorer 7.

If you must uninstall IE7 after you have upgraded to XPSP3, then you have to first uninstall XPSP3, and then uninstall IE7. After this series of uninstalls, you will be reverted back to a XPSP2, and a stable version of IE6, so feel free to upgrade to XPSP3 again.

If you install IE7 after you install XPSP3, then you will be able to uninstall IE7 at any point and be reverted to the newer IE6 version that ships in XPSP3. The restriction on uninstalling only applies to when you install a Windows Service Pack release on top of a standalone IE release.

Keeping this in mind, you might want to uninstall IE7, upgrade to XPSP3 and then install IE7 again so you can uninstall IE7 in the future if need be."

http://blogs.msdn.com/ie/archive/2008/05/05/ie-and-xpsp3.aspx

 

Autorun Vulnerability. Are we really safe ?

If the latest National Cyber Alert System document from US-CERT can be believed, the W32.Downadup worm issue is even more serious as the Microsoft work around of disabling Autorun through registry is not disabling it completely.

An excerpt from the document is provided below:

Impact
By placing an Autorun.inf file on a device, an attacker may be able to automatically execute arbitrary code when the device is connected to a Windows system. Code execution may also take place when the user attempts to browse to the software location with Windows Explorer.

Solution

Disable AutoRun in Microsoft Windows

To effectively disable AutoRun in Microsoft Windows, import the following registry value:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"
To import this value, perform the following steps:

Copy the text
Paste the text into Windows Notepad
Save the file as autorun.reg
Navigate to the file location
Double-click the file to import it into the Windows registry
Microsoft Windows can also cache the AutoRun information from mounted devices in the MountPoints2 registry key. We recommend restarting Windows after making the registry change so that any cached mount points are reinitialized in a way that ignores the Autorun.inf file. Alternatively, the following registry key may be deleted:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
Once these changes have been made, all of the AutoRun code execution scenarios described above will be mitigated because Windows will no longer parse Autorun.inf files to determine which actions to take.

I haven't personally tested any of these work arounds. Will be adding up here as I dig more in to this.

References :

http://www.cert.org/blogs/vuls/2008/04/the_dangers_of_windows_autorun.html

Nick Browns blog: Memory stick worms - <http://nick.brown.free.fr/blog/2007/10/memory-stick-worms>
 

Processor Technologies: Dual Core Vs Hyper threading.

Hyper Threading Technology enables Partially Parallel execution.

The Multi Core Technology enables Truly Parallel execution.

Latest processors from intel delivers great processing capability with its Multi-Core Hyper Threading design.

So which one is good. I would say Multi Core.. And if you have Hyper Threading available on the same processor.. Even better.

A very good demo explaining these technologies is available @
 
www.intel.com/technology/product/demos/multi/demo.htm

Multi Core Technology

Combines two or more independent processor cores in one physical package. Processors run at the same frequency and share up to  L2 cache and Front Side Bus (FSB).


Intel Documentation : www.intel.com/technology/computing/dual-core/

"The Intel dual-core processor consists of two complete execution cores in one physical processor. Imagine that a dual-core processor is like a four-lane highway—it can handle up to twice as many cars as a two-lane road without making each car drive twice as fast."

Intel multi-core technology enables each core to run at a lower frequency, dividing the power normally given to a single core.


Hyper Therading Technology

To improve performance in the past, threading was enabled in software by splitting instructions into multiple streams. With today's Hyper-Threading Technology (HT Technology)¹ you get thread-level parallelism on each processor resulting in more efficient use of processor resources–higher processing throughput–and improved performance.

www.intel.com/technology/platform-technology/hyper-threading/

Secured Socket Layer - SSL

Secured Socket Layer is a Secure Shell (SSH) is a protocol for secure remote login and other secure network services over an insecure network.

It has 3 major componets:

The Transport Layer Protocol - Authentication, confidentiality and Integrity. Generally runs over TCP/IP

The User Authentication Protocol - Authenticates the client-side user to the server.

The connection Protocol - multiplexes the encrypted tunnel into several logical channels.  It runs over the user authentication protocol.

The SSL protocol that you should enable depends on the server configuration too.

To change the SSL Configuration in Internet Explorer : Tools - >Internet Options - > Click on Advanced Tab

                                                                                 

 

Command mode Device manager ? Yes.. The Devcon.exe

DevCon is a command-line tool that performs the following device management functions on local and remote computers:

• Display. DevCon can display the following properties of drivers and devices on local and remote computers:
  • Hardware IDs, compatible IDs, and device instance IDs. These identifiers are described in detail in Device Identification Strings.
  • Device setup classes
  • The devices in a device setup class
  • INF files and device driver files
  • Details of driver packages
  • Hardware resources
  • Device status
  • Expected driver stack
  • Third-party driver packages in the driver store
• Search. DevCon can search for installed and uninstalled devices on a local or remote computer by hardware ID, device instance ID, or device setup class.
• Change. DevCon can change the status or configuration of Plug and Play devices on the local computer in the following ways:
  • Enable a device
  • Disable a device
  • Update drivers (interactive and noninteractive)
  • Install a device (create a devnode and install software)
  • Remove a device from the device tree and delete its device stack
  • Rescan for Plug and Play devices
  • Add, delete, and reorder the hardware IDs of root-enumerated devices
  • Change the upper and lower filter drivers for a device setup class
  • Add and delete third-party driver packages from the driver store
• Restart. DevCon can restart a local device, reboot the local system on demand, or reboot the local system if required for another DevCon operation.

Data Execution Prevention (DEP). What is it ?

Data Execution Prevention (DEP) is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system.

The primary benefit of DEP is to help prevent code execution from data pages. Typically, code is not executed from the default heap and the stack. Hardware-enforced DEP detects code that is running from these locations and raises an exception when execution occurs. Software-enforced DEP can help prevent malicious code from taking advantage of exception-handling mechanisms in Windows

There are two types of DEP:

• Hardware-enforced DEP enables DEP for both kernel-mode and user-mode processes. It must be supported by the processor and the operating system.
• Software-enforced DEP enables DEP only on user-mode processes. It must be supported by the operating system.

DEP is supported by Windows XP with SP2, Windows Server 2003 with SP1, and Windows Vista, and later versions of Windows.

On 32-bit versions of Windows, hardware-enforced DEP requires PAE, which is supported by all Windows operating systems that support DEP. When DEP is enabled on a computer with a processor that supports hardware-enforced DEP, Windows automatically enables PAE and ignores the boot parameter values that disable it.

Configuring Windbg to use MS Symbol server.

Using the MS Symbol Server for windbg and other tools

The Microsoft Symbol Server is built by using the SymSrv technology (SymSrv.dll) that is provided with the Debugging Tools for Windows package. SymSrv builds a local symbol cache for fast, automatic symbol resolution.

It is as simple to use the Symbol Server as it is to use the appropriate syntax in your symbol path. Typically, the syntax takes the following format:

SRV*your local symbol folder*http://msdl.microsoft.com/download/symbols

where your local symbol folder is any drive or share that is used as a symbol destination.


More information : KB311503

Auto Complete Feature in command mode

You have the auto completion feature in Windows XP and Windows 2003 ( I am not aware of other versions..). use CTRL+D  and CTRL+F to enjoy this cool feature.
Reg keys:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor]
"AutoRun"=""
"CompletionChar"=dword:00000040
"DefaultColor"=dword:00000000
"EnableExtensions"=dword:00000001
"PathCompletionChar"=dword:00000040

Want to change the keys?.. change the CompletionChar key and PathCompletionChar key

List of currently loaded drivers.

Want to extract a list of drivers that are currently active ? Try this.

C:\WINDOWS\system32>driverquery.exe /v |more

You could use device manager or registry to find the information about the drivers and you can even manage them.

GFLAGS Overview

GFlags Overview

GFlags (gflags.exe), the Global Flags Editor, enables and disables advanced internal system diagnostic and troubleshooting features. You can run GFlags from a Command Prompt window or use its graphical user interface dialog box.

Use GFlags to activate the following features:

Registry

Set system-wide debugging features for all processes running on the computer. These settings are stored in the GlobalFlag registry entry (HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Session Manager\ GlobalFlag). They take effect when you restart Windows and remain effective until you change them and restart again.

Kernel flag settings

Set debugging features for this session. These settings are effective immediately, but are lost when Windows shuts down. The settings affect all processes started after this command completes.

Image file settings

Set debugging features for a particular program. These settings are stored in a GlobalFlag registry entry for each program (HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Image File Execution Options\ ImageFileName\ GlobalFlag). They take effect when you restart the program and remain effective until you change them.

Reference and Further information : Microsoft MSDN Article

Where ?

Forgot  the command  that you executed last  week ?  And now only thing you remember is the first one or two characters of the executable... 

Try this.



                            

Y:\>where not*
C:\Windows\System32\notepad.exe
C:\Windows\notepad.exe
C:\Windows\NOTES-INSTALL.LOG

To search for all files  starting with "not"

 Note: The command is not available in Windows XP Version

sigverif.exe - The File Signature Verfier

The sigverif.exe can help you figure out if you have some drivers/files that are not digitally signed.


                                        

To Start signature verification: Start -> Run -> sigverif

Click on the "Start" button.  The verification results are stored in the log file. The location of the log file can be configured by clicking the Advanced button.

Running a command shell under SYSTEM context

To start a command shell under system context, you could try these.

Get the current system time by

C:\>time
The current time is: 12:48:58.03
Enter the new time:

Now enter the following commands to create a scheduled task that will run at 12:50, which will interact with console and the command to execute is "cmd.exe". End result you get a command prompt in SYSTEM Context.

C:\>at 12:50 /interactive "cmd.exe"
Added a new job with job ID = 1

You could do the same thing by the psexec command from Sysinternals ( now a part of Microsoft )

To download: http://live.sysinternals.com/

C:\Documents and Settings\Administrator>"C:\Backup\Tech Resources\Tech\Sysintern
alsSuite\psexec.exe" /?

PsExec v1.94 - Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec executes a program on a remote system, where remotely executed console
applications execute interactively.

Usage: psexec [\\computer[,computer2[,...] | @file][-u user [-p psswd]][-n s][-l
][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...
] cmd [arguments]
     -a         Separate processors on which the application can run with
                commas where 1 is the lowest numbered CPU. For example,
                to run the application on CPU 2 and CPU 4, enter:
                "-a 2,4"
     -c         Copy the specified program to the remote system for
                execution. If you omit this option the application
                must be in the system path on the remote system.
     -d         Don't wait for process to terminate (non-interactive).
     -e         Does not load the specified account's profile.
     -f         Copy the specified program even if the file already
                exists on the remote system.
     -i         Run the program so that it interacts with the desktop of the
                specified session on the remote system. If no session is
                specified the process runs in the console session.
     -l         Run process as limited user (strips the Administrators group
                and allows only privileges assigned to the Users group).
                On Windows Vista the process runs with Low Integrity.
     -n         Specifies timeout in seconds connecting to remote computers.
     -p         Specifies optional password for user name. If you omit this
                you will be prompted to enter a hidden password.
     -s         Run the remote process in the System account.
     -u         Specifies optional user name for login to remote
                computer.
     -v         Copy the specified file only if it has a higher version number
                or is newer on than the one on the remote system.
     -w         Set the working directory of the process (relative to
                remote computer).
     -x         Display the UI on the Winlogon secure desktop (local system
                only).
     -priority  Specifies -low, -belownormal, -abovenormal, -high or
                -realtime to run the process at a different priority. Use
                -background to run at low memory and I/O priority on Vista.
     computer   Direct PsExec to run the application on the remote
                computer or computers specified. If you omit the computer
                name PsExec runs the application on the local system,
                and if you specify a wildcard (\\*), PsExec runs the
                command on all computers in the current domain.
     @file      PsExec will execute the command on each of the computers listed
                in the file.
     program    Name of application to execute.
     arguments  Arguments to pass (note that file paths must be
                absolute paths on the target system).

You can enclose applications that have spaces in their name with
quotation marks e.g. psexec \\marklap "c:\long name app.exe".
Input is only passed to the remote system when you press the enter
key, and typing Ctrl-C terminates the remote process.

If you omit a user name the process will run in the context of your
account on the remote system, but will not have access to network
resources (because it is impersonating). Specify a valid user name
in the Domain\User syntax if the remote process requires access
to network resources or to run in a different account. Note that
the password is transmitted in clear text to the remote system.

Error codes returned by PsExec are specific to the applications you
execute, not PsExec.

l

The beauty of Banana..

 

To capture this beauty, you need to have;

• A decent enough digital cam. You could even  borrow one as I generally do !!
• One Nendran type banana ( http://www.ficciagroindia.com/production-guidelines/fruits/banana/Varieties.htm )
• A sharp knife to cut the banana in small pieces.
• Ghee.
• Sugar.
• A Microwave oven to cook it a bit. Please go ahead with any other innovative ideas to heat it a bit.
• A plate from your dinner set collection.
• A dining table to place it on.

Once you are finished with the photo session, you could eat it too !!!

Blogs that I follow...

I keep reading blogs that come my way.. Of course when ever I have some free cycles..

Here are some of the actively tracked ones.

Word of the day: http://www.thefreedictionary.com/_/WoD/rss.aspx   - Yeah.. I am weak in Englissssssssssh

Channel 9 : http://channel9.msdn.com/Feeds/RSS/    - For those cool MS Videos..

Ask the Core Team: http://blogs.technet.com/askcore/rss.xml  - For those who like to read %$%$#@#  too often..  ( The blog at times is as understandable as this description)

Mark's Blog :  http://blogs.technet.com/markrussinovich/rss.xml   -  He is like Dronacharya  if I can compare myself  to ekalavya.. Hope it wont cost me a finger.

Crash Dump Analysis : http://www.dumpanalysis.org/blog/index.php/feed/  -  If you want to break your head with hexadecimal digits..

Fun with ANSI.SYS

Ever thought of making the CMD shell more colourful..

Lets have some fun.

Open the C:\Windows\System32\config.NT

Remove "REM" before the "DOSONLY" line

add the below line towards the end of the file.

device=%SystemRoot%\system32\ansi.sys

Save the file.

Open up a cmd shell

Type command at the prompt ( Note: its command, NOT cmd)

Type the following command at the prompt

C:\Windows>prompt $e[5;3143m    $e[5;37;47m   $e[5;37;42m        $_$e[0;37;40m$P$G

Did you like it ?  Yes.. I Love my country !!!!

Have Fun !!

How do I map an IP address with a name locally

open up "hosts" file located under C:\windows\system32\drivers\etc



Now you know what to do ? Now give a nick name to  your frequently Pinged/telnetted /RDPd server :-)

BTW wondering what is "::1" at the end of the host file ? You will get to know about it more in my forth coming IPv6 posts. Yes Its IPv6 address :-)

How do I find MAC address ?

Finding MAC Address (Hardware address, Physical Address) is pretty easy.

Try the command.

C:\>getmac

If you want to know the MAC address of a system whose IP you are aware of,  you could try this.

C:\> ping <destination ip>

If you are able to ping successfully then issue

C:\> arp -a

          

Windows XP and IP v 6

IP (Internet Protocol) Version 6 is not enabled by default on Windows XP.

The Windows XP follows a dual stack model for IPv6 support. ie the IP 4 stack and IP 6 stackcan co-exist.

Here is how you can enable IP v 6 on an XP installation.

C:\> ipv6 install

My Experiments with CMD - The FOR Command

I am really an admirer of "FOR" command.
 
The possibilities with For command are end less :-)

To generate a simple ping sweeper

 

Imagine you have to monitor 10 systems for its availability through "ping" command.

Say the systems are in the IP range 10.0.0.1 to 10.0.0.10

C:\> For %i in (1,2,3,4,5,6,7,8,9,10) do ping 10.0.0.%i

It starts pinging the IPs one by one. :-)
 

 Ping sweeper Version II

Now lets change the way we define the set..

C:\> For /L %i in (1,1,10) do ping 10.0.0.%i

Lets analyze (1,1,10) a bit more. Its (start,Step,end). So play it around further !!!

To ping from 10 to 1 it would be

C:\> For /L %i in (10,-1,1) do ping 10.0.0.%i
 

 

 Ping sweeper Version III

Lets play around with the way we defined "set" further.

Lets create a text file containing the following text and name it as list.txt.

10.0.0.1 ;
10.0.0.2 ;
10.0.0.3 ;
10.0.0.4 ;
10.0.0.5 ;
10.0.0.6 ;
10.0.0.7 ;
10.0.0.8 ;
10.0.0.9 ;
10.0.0.10 ;

 

              Now try this.

C:\> For /F "eol=;" %i in (list.txt) do ping %i

It is still a ping sweeper and now the list of systems to be sweeped is taken from the text file speficied.
 

My Experiments with CMD - The windows Console Shell

It is easy to invoke a cmd shell from windows.  Click Start -> Run and  type in "cmd"

• The cmd shell can be considered an old MS DOS System.

If you say, hey I know this and every one else know this, I would say yes.. we all know this.. Now lets explore the cmd shell in forth coming posts :-)

"My Experiments With" Series

Thought of capturing my experiences in various domains like Windows Internals, Scriping, Security and more..

Watch out :-)