CPU Architecture, Memory Architecture

I. Overview

CPU (Central Processing Unit) ArchitectureLet's examine its structure, based on the design method. CISC (Complex Instruction Set Computer), RISC (Reduced Instruction Set Computer)We will explore the differences between them. We will introduce the concept and types of registers in CPU architecture. Memory ArchitectureLet's examine its structure. MMU (Memory Management Unit)Their roles and responsibilities Virtual memoryWe will examine the connection structure. We will also look at how the developed program functions. DebuggerI will explain the concepts and the practical aspects I learned during the training. Assembly languageAccording to their instructions and Opcode, OperandThey discuss it.

Ⅱ. CPU Architecture

1. CPU (Central Processing Unit)

CPU (Central Processing Unit)It plays a crucial role in a computer as the central processing unit, responsible for memory, interpretation, calculation, and control. The focus of our study is not on how to build a CPU, but rather on understanding its operational structure and how to interpret its program structure. Therefore, let's focus on the relevant aspects, starting with: Stored-program conceptIt is important to understand this concept. Modern computers all operate using this method, which was devised by John von Neumann. This method involves storing applications in memory (a type of storage) and having the CPU execute instructions one at a time. The results of each execution are then stored back in memory, and the next instruction is retrieved and executed. This process is repeated indefinitely.

2. CISC (Complex Instruction Set Computer), RISC (Reduced Instruction Set Computer)

So, how does the CPU implement the stored-program concept? In essence, CISC and RISC design approachesThis is the case, as shown in the table above. While capable of executing complex and variable-length commands, and offering good compatibility, it is relatively slow. They are relatively expensive and have a classic design. Commonly found on desktop computers are Intel and AMD processors. RISC refers to These instructions are simple and execute fixed-length commands, resulting in faster processing. They are also relatively inexpensive and consume less power. Therefore, the main chips commonly found in smartphones, such as those from ARM, MIPS, and GPUs, are used.

※ It's helpful to understand the difference between a processor and a process. A processor refers to physical devices like the CPU and GPU, while a process refers to a running program (application).

"To install an operating system like Windows, you need a CPU based on the CISC architecture. However, MacBooks use a CPU based on the RISC architecture, so it's not possible to use Windows in the standard way."

3. Registration

As mentioned earlier, the CPU operates based on the stored-program concept. Therefore, depending on whether it uses CISC or RISC architecture, how does the CPU actually store programs, execute instructions (data), and then store the results?

That's located inside the CPU. Registration That's because a register is a versatile storage space. 32-bit General Purpose Registers (8 total)Wow Segment Register: 6 x 16-bit, Program Status and Control Register (32-bit, 1), Instruction Pointer, 32-bit, 1 unitIt consists of the following elements.

① General-purpose register

It serves as a general-purpose register for storing various values.

※ However, as will be discussed later, a stack is a LIFO (Last In, First Out) structure. Data is added last and removed first.

② Segment Register

This indicates the location of the currently executing instruction. It represents the memory address where the program's data is stored.

③ Program Status and Control Register

※ When using the Zero Flag (ZF), the comparison operation not only performs standard arithmetic comparisons but also checks if the results are the same. If the results are the same, the ZF flag is set to 1; otherwise, it's set to 0. This allows modification of the code's conditions by manipulating this register.

④ Instruction Pointer

Similar to how the IP address of a network is used as an identifier for a server, the program provides the address of the code it will execute (the specific command). In the case of 32-bit, it's EIP; in the case of 64-bit, it's RIP.

※ By modifying the IP address, you can freely control the program's operation. RCE (Reverse Engineering): This process, often referred to as "reverse engineering," involves analyzing the original source code of an existing program to understand its functionality. This technique is frequently used in hacking and malware development.

※ Vulnerability assessment: An attacker exploits vulnerabilities in the code by modifying it at will, causing errors and malfunctions. This can lead to a "blue screen of death" in Windows or error messages in general applications. Vulnerability assessment involves identifying these weaknesses.

※ During CPU processing Big-endianEgg Little-endianThis is the difference between big-endian and little-endian. Big-endian is a system where numbers are processed from the highest value to the lowest, similar to how we write numbers. Little-endian, on the other hand, processes numbers from the lowest value to the highest. While big-endian is easier for humans to read, it is slower than little-endian because the CPU needs to perform a conversion. Generally, CPUs are designed to work with little-endian.

Ⅲ. Memory Architecture

1. Memory

Typically, this refers to the area where the CPU performs its functions. RAMYou can simply refer to it as "SSD." It is faster than traditional hard drives and also follows the Von Neumann architecture, similar to a CPU. However, due to its limited resources, it is volatile. Previously, it was inefficient due to its single-tasking nature, meaning that other programs could not run while one program was in progress, leading to wasted processor resources. However, even with a single CPU MultitaskingModern multitasking is now possible thanks to scheduling techniques that allow for efficient management of multiple tasks.

* Command to view the list of running processes in Windows "task list"This PID value changes randomly each time the program is executed.

The scheduling mechanism allows for parallel processing, but how is this possible given that both the CPU and RAM are limited resources?

Immediately Virtual memory That's the key. As you can see in the picture, we first create a virtual memory, not actual physical memory. This virtual memory makes it appear as though each of the programs (applications) – A, B, and C – are occupying their own separate memory spaces, just like in physical memory. So, how does physical memory get used?

As shown in the image below MMU (Memory Management Unit)This is because MMU (Memory Management Unit) maps virtual memory to actual physical memory. As the CPU executes a process, it accesses memory through the MMU. Each time you access a memory location, the virtual memory address is mapped to the corresponding physical memory address.I will explain it.

※ While it may seem like only RAM is used, in reality, both RAM and the hard drive are utilized. In Windows, you can find the settings under: Settings > System > About (at the bottom) > Advanced system settings (in the middle) > Advanced tab > Virtual memory.

So, let's now examine the actual method of operation. As is commonly stated, DRAMIt is a storage area for multiple values within the Stack, Heap, code area, and data area, but not limited to DRAM. SRAMThere is one. SRAM (Static Random Access Memory)It functions as a type of fixed memory. DRAM (Dynamic Random Access Memory)When program A, among the various programs stored (as shown in the photo: A, B, C), is the first to run, the CPU registers are initially allocated to it. However, when program B runs, the registers are then reassigned to the existing registers. In other words, Switching (Context Switching)SRAM is a fast and expensive component, so systems with a large amount of SRAM demonstrate excellent performance in multitasking. In essence, all programs running in the physical memory of DRAM are stored (in multiple virtual memory locations), and when a task needs to be performed, the SRAM switches to execute it simultaneously (multitasking).

Additionally, this multitasking task, as mentioned earlier, Scheduling techniquesThis technique involves using a single processor (CPU, GPU) to alternate between running different programs (processes, applications). TDM (Time Division Multiplexing)There is one.

TDM randomly determines which virtual memory to activate at each time interval. The order in which virtual memories are activated changes, and it hides the physical memory from the programs that are actually running (even though they are allocated to physical memory). And PageThis virtual memory address space exists as a distinct, fixed-size area.

If I were to develop a software application using C, Compile => Linker (purpose code .obj) => File system (executable files, EXE, etc.) => (Loader: Allocates memory for the application's executable file in the kernel and memory) They operate in a specific order.

You may find it easier to understand by looking at the image. C is a language that directly manages memory, making it easier to understand how memory space is allocated and how addresses are mapped. Many applications are developed in C, and the Windows executable file (EXE) is created through a compilation and linking process, resulting in the various applications we use. The header section of the executable file contains information related to program execution, such as modules, IAT (Import Address Table), EAT (Export Address Table), and memory.

※ While C is not the only language, the compilation process involves... ObstructionThe compiler adds code to handle tasks such as database integration, network connections, testing, and setting environment variables. It also automatically adds code for functions that are not yet implemented or for controlling hardware.

Ⅳ. Debugger

DebuggingWhile this might seem familiar, it involves identifying and fixing errors, often referred to as "bugs," in the operation of a computer. This can include various types of executable files in Windows. EXE, SCR, DLL, SYS They all have backs. PE (Portable Executable) format or structureThese files are commonly found in Windows systems. PE (Portable Executable) files define the structure of an executable file, and you'll often encounter EXE files. SCR files, which may seem unfamiliar, are executable files for screen savers, and DLL (Dynamic Link Library) files typically include KERNEL32.dll. SYS files are related to drivers. Finally, BAT and PS1 files are used for scripts that can be executed in Windows. These scripts are often created using automated coding techniques.

※ When conducting vulnerability assessments, scripts specific to the operating system are commonly used. For example, imagine installing a separate program on the customer's server. Is that feasible? Naturally, we cannot arbitrarily interfere with the customer's computer, so it's not possible. While not always the case, it's generally the approach.

※ KERNEL32.dll contains all the functions for the Windows application interface, and many applications dynamically reference this kernel for use. More detailed information can be found on the Microsoft website.

Windows Kernel-Mode Kernel Libraries - Windows drivers

※ The presence of files related to the SYS driver is due to the fact that Windows cannot directly access drivers; instead, it must access them through a driver API.

Let's delve a bit deeper into DLL files. In Windows, DLL files are... IAT (Import Address Table)Egg EAT (Export Address Table)This is how it works: DLLs are created as small modules containing multiple functions and classes for maintenance purposes. The IAT (Import Address Table) within the DLL file lists the functions from which the module needs to execute, and the EAT (Export Address Table) references these functions from external DLL files, allowing the program to use them. After use, the DLLs are released.

There are various debugging tools available, and the one I recently learned about is GHIDRA, Cheat Engine, HxD, OllyDbg, PEview, IDA It has a built-in debugger. The debugger tool can also be used as a hacking tool. For example, HxD displays PE files in hexadecimal format, while OllyDbg was used for practicing code analysis during the lab session.

The characters might be too small to be easily seen. The red sections represent program code that executes using assembly language instructions.This is a place where you can see [it]. The yellow area on the right is the "Register" section., The purple area on the right side represents the "stack" area.Finally, The purple area in the lower left corner represents a memory dump. It is a component.

Using the PEview program 'IMAGE_OPTIONAL_HEADER', 'SECTION .rdata'This provides various information related to the program's execution. Once I've learned the basics, I'll start by noting down the key points in both scenarios. PE Headerwhich are specified, the PE header contains general information related to execution (such as drivers, DLLs, and memory address information). A key aspect to pay attention to in the 'IMAGE_OPTIONAL_HEADER' is "Entry Point Address"Wow "Image Base"'Address of Entry Point' refers to the starting point of the code after the executable is mapped into memory. 'Image Base' is the address used as a reference when the image is allocated in memory. Typically, for an EXE, the Image Base is 0x0040000, and for a DLL, it's 0x10000000. Therefore, the sum of these two values represents the program's starting point. Furthermore, "Foundation of Code"This indicates the starting point of the code section (the entire code). Typically, "Address of Entry Point" and "Base of Code" are the same. Finally, "Number of Data Directories"This indicates the number of data directories. The "SECTION .rdata" section contains the IAT information described above.

In addition to the programs I've already used, there are others that I haven't had a chance to explore, so I need to learn more about them.

Using this debugger tool to analyze the executable file. Assembly languageI understand that, but for now, OpcodeWow OperandThere are also OpCodes, which are instructions related to the actual execution of operations.

There are various types of these commands. The operand refers to the data that the operations will be performed on, and it may or may not be present. In other words, the operand can be thought of as the target of the operation, such as a register, memory address, or reference value.

Review

The first class on understanding and using the application has begun. Since it's an online class, the focus was primarily on theoretical concepts, which, frankly, are quite challenging. Furthermore, due to the need to condense the learning material into a single semester, I found myself needing to study further based on the information and keywords provided for this blog post, which took over 3 hours. I still have a lot to learn, so I need to put in more effort.