2.1 Computers and Programs

When Alice, the owner of Alice’s Arts, writes a letter on her laptop, she runs a word-processing program. When doing calculations, she uses a spreadsheet. When searching for information on the web, she uses a browser. She chooses programs to do the jobs she has at hand.

Attackers also use the tools at hand. They make the computer run a program to perform the work of the attack. Sometimes an existing program will do the job. Other times they have to provide a new program. It’s a matter of directing the computer to the right sequence of instructions.

Everything a computer does, right or wrong, results from running a computer program. As the computer’s owner, Alice tries to keep it under control by telling it to run the right programs: the right operating system, the right browser, the right word processor, and so on. Although attackers sometimes trick a program into misbehaving, they may also provide their own programs to do the work.

Computer security depends on keeping control of the computer. We try to prevent attackers from redirecting the computer to run their attack programs.

When we look at a computer’s operation at the most basic level, all programs look more or less the same. A program contains sequences of machine instructions. Most of the instructions are absurdly simple arithmetic operations, or they rely on the result of simple arithmetic. This is true in mundane programs like word processors, as well as the innermost workings of operating systems. It is also true for the most dangerous programs run by attackers.

The Motherboard

If we rip open a computer and dig through the cables and enclosures, we find a flexible plastic board covered with multicolored metallic traces, physical wires, and integrated circuit packages. This is the motherboard (FIGURE 2.1). It contains the central processing unit (CPU), covered by a heat sink or other cooling mechanism. The CPU runs the programs that make the computer work.

A photograph of the motherboard used in a desktop is shown.

FIGURE 2.1 The working insides of a computer.

Left: © iStockphoto/Thinkstock; Middle: © P©ter Gudella/Dreamstime.com; Right: Courtesy of Dr. Richard Smith.

Elsewhere on the motherboard, we will often find one or more daughterboards containing the random access memory (RAM) in a row of integrated circuits. In some systems, the RAM also may have heat sinks or extra cooling. Most of the time, computer programs involve the CPU and RAM exclusively.

Computer Dissection

As with most things, dissect only discarded computers. Do not dissect a working computer without special instructions and guidance. It’s very, very easy to damage a computer while dissecting it.

The best candidate is a discarded desktop or tower computer; it usually has a single large motherboard similar to Figure 2.1. Laptops are harder to dissect because parts are much smaller, and the outer casings are made to be hard to remove.

Be sure to remove the computer’s power cord and leave the computer unplugged for a few days before dissecting. This ensures that any stray charges have dissipated. Portable devices rely on a battery for power, so remove the battery instead of the power cord.

After removing the outer casing, the motherboard is visible beneath the hard drives, power supply, and other assemblies. Remove those items to see the entire motherboard. Do not try to disassemble the power supply.

Replacing the CPU or RAM

Many computers are designed to accept a variety of CPUs and RAM sizes. Such computers have published instructions for how to open the computer and locate these components. Follow such instructions exactly. Accidents or carelessness may damage the computer.

2.1.1 Input/Output

The remainder of the motherboard is filled with input/output (I/O) circuits. These circuits provide the electronics that connect other components to the computer. These include keyboards, mice, video displays, hard drives, printers, and so on. The I/O circuits let the CPU give commands and share data with the I/O devices. In some cases, the circuits can copy data directly between the devices and the computer’s RAM.

The video card contains the circuits to draw images on the computer’s video display. Modern computers rely heavily on the video card to rapidly arrange and draw images and text appearing on the display. The video card is itself a high-­performance computer, designed specifically to rapidly display data on the screen. Some computer systems are specially designed to process video graphics; the video cards in such computers often have more raw computing power than the CPU itself.

Sprinkled on the motherboard, especially along the edges, are connections for different types of cables. A small number of large, relatively thick pins connect to the computer’s power supply; the remaining pins are much smaller and connect to I/O devices. Some I/O devices are installed inside a computer’s case, often to reduce electronic interference. These devices connect through standard cables or other connectors:

  • ■   PCIe (Peripheral Component Interconnect Express)—a wide parallel connector that attaches a daughterboard containing I/O circuits to the motherboard. Video cards may be attached via a PCIe connector.

  • ■   IDE (Integrated Drive Electronics)—a wide, flat “parallel” cable that connects high-speed devices like hard drives and compact disk (CD) drives to the motherboard. This appears inside older computers.

  • ■   ATA (Advanced Technology Attachment)—another name applied to IDE connections.

  • ■   SATA (Serial ATA)—a narrow, flat cable that connects similar devices, but is easier to handle than a parallel ATA cable.

Many I/O connectors appear on the motherboard’s edge. These connect to peripherals outside the computer’s case, including video displays, keyboards, mice, external hard drives, and so on. The computer may also connect to modern household multimedia equipment, like televisions (TVs) and sound systems. These use widely available audio and video connection cables. Computer-specific peripherals attach through one or more of the following connections:

  • ■   USB—connects primarily to lower-speed equipment like keyboards, printers, and mice, although it also connects to high-speed external hard drives. Typical USB devices use the traditional USB connectors. Many of these support USB versions 1 or 2. A traditional-looking USB plug with a blue connector inside supports USB 3.0 or 3.1.

  • ■   USB-C—the latest USB standard uses a reversible, general-purpose connector.

  • ■   eSATA (External SATA)—a SATA cable specifically designed to connect to devices connected outside of the computer’s protective case.

  • ■   DisplayPort—an early digital video interface that still appears on some equipment.

  • ■   Thunderbolt—a high-speed cable that combines the PCIe and DisplayPort interfaces for connecting to external devices.

  • ■   Firewire or IEEE 1394—an older technique for connecting to high-speed devices. It may still be found on older video cameras and hard drives. The acronym “IEEE” refers to the Institute of Electrical and Electronics Engineers, the professional society that standardized the Firewire interface.

  • ■   HDMI (High-Definition Multimedia Interface)—a cable that connects to a digital video display, like a flat-screen display, and to a sound system.

  • ■   DVI (Digital Video Interface)—similar to the HDMI cable, but not containing an audio signal for a sound system.

  • ■   VGA (Video Graphics Array)—a cable that connects to older video displays, including analog video monitors with “picture tubes.”

  • ■   10-, 100-, 1000 baseT—a wired connection to a local area network. This is also called an Ethernet connection. We examine these further in Chapter 10.

When we talk about computer hardware, the word bus refers to a computer connection that allows us to attach several separate components. A USB is obviously a bus because the word appears in its name. The IDE, ATA, and SATA connections are also buses. Video connections don’t tend to use buses. The PCI connection is considered a bus, even though it manages a small number of hardware connectors in the back of the computer.

Parallel Versus Serial Wiring

Wires are cheap inside a computer. When we connect a CPU to RAM, the motherboard uses a set of parallel wires to transfer addresses and data between them. Each wire carries one bit of data or one bit of address belonging to a location in RAM. The CPU often handles data and addresses “in parallel” because the circuits work on all the bits in a word at a time. When we run wires in parallel to connect two endpoints, we call it a ­parallel connection. Older hard drives used “ribbon cables” to make a parallel link between the drive controller and RAM; the upper cable in FIGURE 2.2 is a parallel ATA cable.

An illustration compares the Older parallel ATA cable and the Newer serial ATA cable. The older parallel cable is represented as a broad cable while the newer serial ATA cable is represented as a narrow cable.

FIGURE 2.2 Older and newer ATA cables.

Courtesy of Dr. Richard Smith.

It is cheaper and more convenient, however, to run a single wire. This provides a serial connection. Most modern computers use SATA cables instead of the wider, parallel ones. Although parallel cables could be faster in theory, improved circuitry yields a significant performance improvement with SATA connections.

Persistent Versus Working Storage

Modern CPUs contain a lot of internal RAM. Mobile devices may even use a “computer on a chip” that includes the entire RAM required. Laptop and desktop computers run larger and more elaborate programs that use a lot of RAM. This storage is usually separate from the CPU. When a laptop or desktop’s CPU contains RAM, it often serves as “cache memory” that speeds up the CPU.

RAM serves as working storage. It contains the programs and data the computer uses immediately. When Alice shuts down her laptop, power stops flowing to the CPU and RAM. Data and programs start to disappear when the RAM loses its power source. If we interrupt computer power even briefly, crucial data may be lost. Computers always assume the RAM is empty when power first appears, even if power was removed for only moments. Working storage carries information temporarily while the computer works on it.

When Alice edits a spreadsheet, she always saves it in a file; thus, her work remains in persistent storage that won’t lose its contents when powered off. Most computers today use two types of persistent storage:

  1. Hard drive: stores data as magnetized dots on a spinning disk. A hard drive relies on mechanical components that are vulnerable to physical shocks.

  2. Flash memory: stores data by trapping electrical charges inside an integrated circuit. Today, these are more expensive than hard drives in terms of cost per bit stored. Flash memory retrieves data much faster than a hard drive.

Both techniques can reliably store data for years. Both are also dramatically slower than RAM. Modern computers often use a mixture of different storage types to construct a “storage hierarchy.” Within the hierarchy, small amounts of the fastest storage reside near cores that execute instructions inside the CPU. Large amounts of the slowest storage reside at the far end of the hierarchy to store permanent files. Here is a traditional arrangement:

  • ■   Hard drives store files permanently.

  • ■   A smaller “flash drive” provides temporary storage for often-used files.

  • ■   RAM stores programs and data used by the CPU.

  • ■   CPU cache storage contains instructions and data awaiting execution by the CPU.

Newer systems omit the magnetic hard drive and use a large flash drive for all permanent storage. Flash drives are sturdier because they have no moving parts. Hard drives remain popular because they provide much higher storage capacity at a lower price.

Read-only memory (ROM) is another type of persistent storage. Originally, ROMs consisted of hard-wired storage areas that were manufactured to store specific data, programs, or both. Computer programs stored in ROM are often called firmware. Modern flash memory evolved from early techniques to construct “erasable” ROMs.

The BIOS

Another important part of the motherboard is the Basic Input/Output System (BIOS). The BIOS isn’t actually a circuit; it is firmware stored in a special flash memory. When we turn on the computer’s power switch and the computer starts up, the BIOS is the first program to run. Normally, the BIOS loads the operating system software into RAM from the computer’s hard drive and starts it running. The process of loading and starting the computer’s software is called bootstrapping, or simply booting.

2.1.2 Program Execution

Every program relies on the CPU to execute its machine instructions. There is a storage location inside the CPU called the program counter (PC) that keeps track of where a program’s next instruction resides. To execute the instruction, the CPU retrieves the instruction from RAM, performs the instruction, and updates the PC to point to the next instruction.

FIGURE 2.3 shows what happens when we execute a typical instruction. As the PC contains 103, the CPU retrieves the instruction stored in RAM location #103. The instruction stored there says “ADD 702.” The number 702 selects a RAM location whose contents are added to the CPU’s running total. Location 702 contains the value 2273, while the CPU contains a running total of 3516. After executing the instruction, the CPU’s running total is 5879. Once the CPU is finished with the instruction at location 103, it moves on to location 104 and executes the instruction there.

An illustration depicts the steps in the execution of an instruction.

FIGURE 2.3 Executing a machine instruction in a computer.

Left: Courtesy of Dr. Richard Smith; Right: © iStockphoto/Thinkstock

Usually, the next instruction is in the next sequential location in RAM. However, the CPU can use the results of arithmetic and other operations to change the program counter. This gives the program a way to change what happens when it encounters new data. When a computer program uses an if, then, while, for, do, or another loop or conditional test, the instructions in RAM tell the CPU to change the contents of the PC.

In Figure 2.3, we encounter some notation we will use in this text. We use parallelograms to indicate data stored in RAM. We use an oval to indicate a running program. We call a running program a process.

Separating Data and Control

Within RAM, we separate programs into two parts: a control section that contains the instructions, and a separate data section that contains the program’s data (FIGURE 2.4). This distinction makes it easier to run programs reliably and efficiently.

An illustration shows the two sections of a running program – Control section and Data section.

FIGURE 2.4 Separate control and data sections.

The CPU itself doesn’t always distinguish between control and data sections in RAM. If the program counter points to the data section, it retrieves instructions from there. Likewise, an instruction could treat parts of a control section as data. In practice, however, such mix-ups usually arise from a programming error or a security problem.

Although these examples show one instruction and one numeric value fitting comfortably into a single memory location, modern RAM doesn’t work that way. Each location in RAM stores a single byte—eight bits of data. Although this is enough to store a typical character typed on a keyboard, most machine instructions require 2 or more bytes. If the instruction includes the RAM address of its data, then the instruction must set aside enough space for that address. If the program’s RAM uses 4 gigabytes or less, then the RAM address alone requires 32 bits, or 4 bytes. Regardless of the instruction size, the CPU always updates the program counter to skip over an entire instruction after its execution.

2.1.3 Procedures

Modern computer programs often consist of thousands and even millions of instructions. To tame this complexity, most programs are organized into hundreds or thousands of relatively short procedures. When one part of the program needs a task performed, it will often call upon a separately written procedure to perform that task.

That procedure itself may, in turn, call other procedures to perform smaller parts of the task. When a procedure finishes its work, it returns to the one that called it, allowing the caller to finish its own work. In other words, the calling procedure tells the called procedure to start running. Once the called procedure is finished, it returns to the point where the calling procedure left off.

When one procedure calls another, however, the computer must keep track of where the first one left off. To do this, the CPU saves the contents of the program counter in RAM. This serves as the return address, the location at which the CPU resumes the calling procedure. When the called procedure reaches its end, it picks up the saved return address and reloads it into the program counter. This resumes the calling procedure at the point where it left off.

The Stack

Each procedure may call other procedures. The program’s data section must store the return address for each procedure that calls another, in addition to each procedure’s working storage. In practice, this data is stored in RAM on a stack, a last-in, first-out data store. The stack provides a simple, structured way to give temporary storage to a procedure, including a place to save the return address. The stack is part of the program’s data section.

Buffers

Although most computer instructions involve arithmetic of some sort, not all data is strictly numerical. A great deal of processing involves blocks of text or other structured data, or “raw” unprocessed data that is being moved between I/O circuits like those for network connections.

A network router is responsible for directing network traffic on the internet (see Chapter 11). A busy router for a large site transfers vast amounts of data while trying to actually “look” at as little of it as possible. The router tries to spend all of its time giving commands to the network I/O circuits. When it spends time looking at the data inside a network message, it delays the message’s delivery.

When the router’s I/O circuitry receives a network message, the data is read into an area in RAM. An area in RAM used for moving data is called a buffer. At most, the router looks at a few bytes at the beginning of the buffer and then it tells a network interface to transmit the buffer’s contents across another network. Buffers always reside in a data section. If the buffer is used only inside a particular procedure, then the buffer will probably reside on the stack.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset