Working with Microsoft Windows and Other Operating Systems

The Portable executable file format is the format of executables, object code and DLL’s (Dynamic Link Library) in Microsoft Windows Operating system. It is the standard of how executable files are organized within file system in Microsoft Windows. The Portable executable file format was designed for Windows NT 3.1 that released in 1993. Many of its features are inherited from COFF (Common object file format) used in Unix Operating systems. It consists of header and sections; headers are rules that tell windows loader how the section should be mapped and loaded into memory. The section are nothing but the data or content. Different sections hold different kind of data for example code section contains executable code while bss (Block Started by Symbol) sections contains uninitialized data. Portable executable file could be used in a way to dent the security of computer, therefore great care should be taken while downloading and running Portable executable files. In our work we develop a static malware analysis tool called ‘Portable Executable File Analysis Framework (PEFAF)’ using data mining techniques. A collection of 8 thousand benign and 7 thousand malicious files were used in this work. We extracted 60 features, analyzed them and found that 34 of them are significant for the detection of malware threats. Based on these 34 indicators our tool classifies input file into malicious or non-malicious.

Dr Paulino Ruiz-de-Clavijo from Universidad de Sevilla in Spain talks about the research behind his Letter ‘NanoFS: hardware-oriented file system’ on page 1216. Dr Paulino Ruiz-de-Clavijo During my higher education as a computer engineer I have always been interested in low-level programming and digital electronic circuits. In 1999 I started my PhD research at the University of Seville and the National Microelectronics Centre - CSIC, which I completed at the ID2 research group of the University of Seville. That period allowed me to start working with reprogrammable devices; FPGAs in particular. This technology fascinated me because it opened up the possibility to reuse my knowledge and experience in software programming to develop hardware using hardware description languages (HDLs), and I found the hardware-software codesign a great field to explore. The research in our group involves the wide field of hardware-software codesign and reconfigurable hardware. Our work is mainly focused on the design of digital embedded systems and SoC (system on chip) on FPGAs and the design of application-specific peripherals for SoC. Relating to SoCs, we have worked with open platforms like the LEON and OpenRISC soft-core microprocessors. In our group we have also developed hardware for industrial projects like a SNTP synchronisation platform based on FPGA and a frequency synchroniser for OFDM systems. We have developed a new file system called ‘nano file system’ (NanoFS) which is specially tailored to be implemented in hardware. It has been designed from scratch keeping in mind the hardware implementation limitations. The main objective is to be able to do file system operations just with digital circuits while keeping a minimum hardware footprint. The approach keeps the high level file system features and it can be used in both low level embedded systems and high-level operating systems. An all-hardware file system reader core is presented in our Letter which has been successfully implemented and tested in a low-range FPGA device. It can be included in custom designs to read data from files stored in external storage media. Most file systems are designed with two overall objectives: to be optimal for the storage medium and/or to be optimal when implemented in software. Our proposal is a hardware-friendly file system suitable for embedded systems. The file system can be used without an operating system or before the operating system is booted. File systems like FAT or EXT2 are widely used in electronic devices and SoC. The layouts of these traditional file systems are intended to be managed with software algorithms. When these algorithms are translated to HDL, a large amount of resources are necessary. There have been a few initiatives to develop file systems for embedded systems to solve these problems that simplifies data structures and improves some software routines. These file systems are written in C and supply an API for some microcontrolers but are not designed to achieve a hardware implementation. Some custom designs in hardware require dynamic configuration, such as the network configuration, calibration parameters, etc. In previous work we developed a SNTP synchronisation server designed as a full hardware solution to improve the precision. To try different configurations of these servers, we had to reprogram the FPGA device. We thought that a data file in a file system that could be accessed directly from the device hardware would be a faster and more flexible method to achieve that. We created NanoFS to solve the problems we found when we tried to access other file systems from hardware. Currently, from a software perspective, a dedicated file manager application is used to access the file system. We are working to improve a Linux native driver for NanoFS so we can access the files right from the operating system. At this moment the driver works in read-only mode. We are also migrating the file manager to the MS Windows platform. From the hardware perspective, we are developing some new hardware cores with write support. We plan to test the write support module with current solid state disks to measure the performance. Further applications we have planned to use the new file system are: data acquisition systems; boot loaders for embedded systems; and FPGA dynamic reconfiguration.

NOTE: The first page of text has been automatically extracted and included below in lieu of an abstract Using Programming Projects in an Operating Systems Course as a Capstone Software Engineering Experience Computer Engineering Technology students at the University of Dayton take two fundamental programming courses teaching the basics of algorithmic problem solving along with the VBA and C++ syntaxes. These courses develop a strong programming foundation for the students; however, they lack the ability to introduce software programming within larger software systems. The final course related to software development is a required operating systems course. This course contains three fundamental goals: to develop the students’ understanding of key operating system concepts, to increase the students’ software engineering capabilities, and to introduce the students to the internal workings of the Linux and Windows operating systems. The operating systems course relies heavily on software programming exercises as a key instrument in teaching students the framework and applications of modern operating systems. The unique aspect of this approach is that the programming projects are designed not as standalone activities, but instead as individual components of a larger software system. Therefore, each programming project focuses not just on learning new syntax related to operating system concepts, but also in how these concepts are relevant to the software system being developed. Students develop programs for both the Microsoft Windows and Linux operating systems, working heavily with their associated application programming interfaces and investigating processes, threads, synchronization, input and output, and scheduling issues. A complete course overview and synopsis of the software programming projects will be presented along with student performance and comments from an end of the semester survey. Introduction The Computer Engineering Technology (CET) Program at the University of Dayton (UD) was started in 1999 and included two software programming courses. These courses predominately focused on teaching the fundamentals of software programming and the syntax associated with the VBA and C++ languages. Likewise, to satisfy the ABET outcome requirements for computer engineering technology programs, the ETC Program at UD also required a new 3 credit lecture course entitled “Concepts & Applications of Operating Systems” to be taken during the students’ Junior year of study.1 This course was structured to provide students hands-on exposure to the internal workings of modern operating systems. During the 2004/2005 academic year, the material being taught in the software programming was evaluated. In accordance with the Computing Curricula 2001 (CC2001) report by the Computer Society of the Institute for Electrical and Electronic Engineers (IEEE-CS) and the Association for Computing Machinery (ACM), the two software programming courses being taught fell within the traditional imperative-first approach. This approach starts students off with software programming activities without any real preparations.2 After careful review, it was found that the student population being served needed to be taught the algorithmic thought process prior to the syntax as many of the students had no prior exposure to software programming and were struggling more with defining the problem solutions than with the specific syntax being taught.3 A modified algorithms-first approach from CC2001 report was applied to these courses. Instead

In this study, calculations necessary to solve the large scale linear progra mming problems in two operating systems, Linux and Windows 7 (Win), are compared using two different methods. Relying on the interior-point methods, linear-programming interior point solvers (LIPSOL) software was used for the first method and re lying on an augmented Lagrangian method-based algorithm, the second method used the generalized derivative. The performed calculations for various problems show the produced random in the Linux operating system (OS) and Win OS indicate the efficiency of the perfo rmed calculations in the Linux OS in terms of the accuracy and using of the optimum memory.

The reliability of cyber forensic evidence acquisition is strongly influenced by the underlying operating systems, Windows, macOS, and Linux - due to inherent variations in file system structures, encryption protocols, and forensic tool compatibility. Disk forensics, one of the most widely used techniques in digital investigations, faces distinct obstacles on each platform. Windows, with its predominantly NTFS and FAT file systems, typically supports reliable disk imaging and analysis through established tools such as FTK Imager and Autopsy/Sleuth Kit. However, encryption features frequently pose challenges to evidence acquisition. Conversely, Linux environments, which rely on file systems like ext4 and XFS, generally offer greater transparency, yet the transient nature of log retention often complicates forensic analysis. In instances where anti-forensic strategies—such as encryption and compression— render traditional disk forensics insufficient, memory forensics becomes crucial. While memory forensic methodologies demonstrate robustness across Windows and Linux platforms forms through frameworks like Volatility, platform-specific difficulties persist. Memory analysis on Linux systems benefits from tools like LiME, snapshot utilities, and dd for memory acquisition; nevertheless, live memory acquisition on Linux can still present challenges. This research systematically assesses both disk and memory forensic acquisition techniques across samples representing Windows and Linux systems. By identifying effective combinations of forensic tools and configurations tailored to each operating system, the study aims to improve the accuracy and reliability of evidence collection. It further evaluates current forensic tools and highlights a persistent gap: consistently assuring forensic input reliability and footprint integrity. By integrating static analysis with temporal performance evaluations, this study emphasizes the importance of developing standardized forensic procedures to ensure the integrity and admissibility of evidence across diverse platforms. Establishing such standardized methodologies is imperative to maintaining the credibility and reliability of cyber forensic investigations in heterogeneous operating system environments.

The Intium RJS System makes use of screensavers to perform CPU scavenging for grid computing. This article shows how to automate the installation of the IRJS screensaver. The manual installation of the IRJS screensaver, presented in parts 1 and 2 of this series, has been automated to ease installation. A Java Web Start application has been created to complete the installation of the screensaver for Windows and Unix/Linux platform. This application performs an operating system identification and proceeds to download, install, and configure the screensaver files. The installation of the screensaver is a function of the OS, due to differences in screensavers support. Our three previous papers showed how to create screensavers in Java for Windows, Linux and Mac operating systems.

The file system is one of the most critical components of the operating system. Almost all applications running in the operating system require file systems to be available for their proper operation. Though file-system availability is critical in many cases, very little work has been done on tolerating file system crashes. In this paper, we propose Membrane, a set of changes to the operating system to support restartable file systems. Membrane allows an operating system to tolerate a broad class of file system failures and does so while remaining transparent to running applications; upon failure, the file system restarts, its state is restored, and pending application requests are serviced as if no failure had occurred. Our initial evaluation ofMembrane with ext2 shows thatMembrane induces little performance overhead and can tolerate a wide range of file system crashes. More critically, Membrane does so with few changes to ext2, thus improving robustness to crashes without mandating intrusive changes to existing filesystem code.

The use of the Microsoft windows operating system as a basis for integrated security systems provides a pathway to lower development and training costs while increasing commercial hardware compatibility. However, the historical view of Windows as a high-overhead, low-stability operating system has tended to limit the number of Windows-based mission-critical automation systems relative to the more conventional embedded micro-controller or Linux-based approaches. This paper documents the use of the Windows operating system for mission critical control of an active denial security technology. The advantages offered by Windows are weighed alongside the risks. We examine specific technical risks to long-term application stability including memory leaks, page faults and stack pointer corruptions. The risks and benefits of using third-party software libraries to accelerate the development and implementation of control systems are evaluated. The trend towards the use of managed versus native code is examined along with its associated impact on application stability and testing methods. Specific counter-measures aimed at reducing the incidence of operating system instability and application fault are discussed including the use of memory analyzers, inter-locking application threads, state-based persistence recovery objects and watchdog timers. We detail some techniques for effectively employing these countermeasures toward the production of highly stable Windows-based control systems. We conclude by presenting the stability performance of a government-developed remotely operated weapon system during recent testing and qualification.

Mobile code---executable programs that get copied from computer-to-computer via e-mail, web browsers, etc.---is a popular way to stage malicious attacks against users. The Windows operating system is often the target of such attacks, in part because of its ubiquity and in part because of the vast functionality it provides. Some of this functionality, like executable e-mail attachments and scripting, provides opportunity for mobile code to cause significant damage to a host system. One obvious solution is to disable such features in Windows. However, many users find such features a convenient and productive way to conduct their business. Thus, techniques that can protect against mobile code without sacrificing functionality are needed.But even disabling functionality such as scripting will not provide complete security; it only catches the most sophomoric exploits. All operating systems, including Windows, are vulnerable to malicious use at their lowest level of operation: executing compiled code. Mobile programs, just like local programs, can access operating system components in ways that damage a users' data or render their computer useless. These programs can be written in system-level languages such as C and assembly, which are capable of compiling OS components directly into their binaries and writing directly to interrupt vectors. Disabling such functionality will mean an operating system that simply doesn't work.This paper investigates techniques to protect Windows-based systems from malicious mobile code while minimizing functionality loss. Our solution involves writing a layer of protective code that is able to detect mobile code running on a system and then monitors its behavior. Behaviors deemed benign are allowed to execute; behaviors deemed malicious are either shutdown, quarantined or logged (so that restoration procedures can be constructed). We describe new techniques for identifying. monitoring and neutralizing malicious mobile code. We demonstrate the techniques by testing our vaccine against a number of the most notorious Windows viruses and worms. Further, we demonstrate how our solution maintains functionality while minimizing false positives during execution of benign programs.

There is a general assumption that one must purchase costly antivirus software products to defend one’s computer system. However, if one is using the Windows Operating System, the question that arises is whether one needs to purchase antivirus software or not. The Windows operating system has a market share of 31.15% behind Android with a market share of 41.56% worldwide amongst all the operating systems. This makes Windows a prime target for hacking due to its large user base. Windows 11 a recent upgrade to the Windows operating system has claimed to have taken its security to the next level. There is a need to evaluate the capability of the Windows 11 default security against antivirus evasion tools. This research investigated the capability of Windows 11 default security by evaluating it against 6 free and open-source antivirus evasion tools: TheFatRat, Venom, Paygen, Defeat Defender, Inflate and Defender Disabler. The criteria for the selection of the antivirus evasion tools were free and open source and recently updated. A research lab was set up using Oracle VirtualBox where two guest machines were installed: a Windows 11 victim machine and the Kali Linux attacking machine. The antivirus evasion tools were installed on the Kali Linux machine one at a time to generate a malware and pass it to the victim machine. Apache web server was used in holding the malicious sample for the Windows 11 victim machine to download. A score of 2 was awarded to an antivirus evasion tool that successfully evaded the Windows 11 security and created a reverse connection with the attacking machine. From the research results: TheFatRat had a 25% evasion score, Venom had 20% while the rest had a 0% evasion score. None of the payloads generated with the antivirus evasion tools was able to create a connection with the Kali Linux attacking machine. The research results imply that the default Windows 11 security is good enough to stand on its own. A third-party antivirus solution will only supplement the already good protection capability of Windows 11.

Greenhouse gas abatement via repurposing computers

The File Allocation Table (FAT) file system is widely used file system in tablet personal computers, mobile phones, digital cameras and other embedded devices for data storage and multi-media applications such as video imaging, audio/video playback and recording. The FAT file system is not power fail-safe. This means that, the uncontrolled power loss or abrupt removal of storage device from computer/embedded system causes the file system corruption. The TFAT (Transaction safe FAT) file system is an extension of FAT file system to provide power fail-safe feature to the FAT file system. This paper explores the design methodologies of cluster allocation algorithms of TFAT file system by conducting various combinations of file system operations in Windows CE (Compact Embedded) 6.0 Operating System (OS). This paper also records the performance bench-marking of TFAT file system in comparison with FAT File system.

TCP-SYN attack is one of the commonly used DDoS attacks aimed at bringing down a computer system connected to Internet. There has been an increased targeting of Windows end-users and servers. The attackers and intruders are leveraging easily identifiable network blocks to target and exploit Windows end-user servers and computer systems. In order to provide some level of security and protection against security attacks, the Microsoft's Windows XP operating systems were designed with an additional level of security. The initial Microsoft's windows XP without service pack2 (SP2) provided windows firewall with some security features. The later version of Microsoft's windows XP with SP2 intends to provide enhanced security features to prevent and mitigate the adverse effect of security attacks on the host computer systems. In this experimental paper, we set out to conduct real TCP-SYN attacks on computer systems in a controlled lab environment and measure the effectiveness of Microsoft's windows XP without SP2, and with SP2 in preventing TCP-SYN attacks. The Windows firewall (without SP2) was found to be not effective against the TCP-SYN attacks. However, the later version of Microsoft's Windows XP with SP2 was found to significantly help mitigate the adverse effect of the TCP SYN attacks on Windows based computer systems.

Protocols for sensor networks are commonly coupled to the specific operating system (OS), for instance TinyOS, involving some drawbacks. First, programmers must learn OS architecture, programming guidelines, sometimes a new programming language, etc. Second, protocols run on the specific OS only, i.e. on the hardware supported by the OS. Third, only selected network simulators, mostly provided by OS, can execute the OS-coupled code.To tackle the problems with interoperability we examined the idea of cross-platform protocol development for sensor networks, i.e. software running on several OSs, and share our experience in this paper.Our primary cross-platform MAC protocol runs on two OSs and on a hardware platform supporting the C programming language. To achieve interoperability we decoupled MAC from OS calls and provided a hardware abstraction layer (HAL) for each OS. We discovered that such an approach does not result in a significant penalty in terms of occupied memory (e.g. smaller by 3 kB than the TinyOS dedicated version) and consumed energy (additional overhead smaller by three orders of magnitude from total tx energy).

Early type-safe operating systems were hampered by poor performance. Contrary to these experiences we show that an operating system that is founded on an object-oriented, type-safe intermediate code can compete with MMU-based microkernels concerning performance while widening the realm of possibilities. Moving from hardware-based protection to software-based protection offers new options for operating system quality, flexibility, and versatility that are superior to traditional process models based on MMU protection. However, using a type-safe language-such as Java-alone, is not sufficient to achieve an improvement. While other Java operating systems adopted a traditional process concept, JX implements fine-grained protection boundaries. The JX System architecture consists of a set of Java components executing on the JX core that is responsible for system initialization, CPU context switching and low-level domain management. The Java code is organized in components which are loaded into domains, verified, and translated to native code. JX runs on commodity PC hardware, supports network communication, a frame grabber device, and contains an Ext2-compatible file system. Without extensive optimization this file system already reaches a throughput of 50% of Linux.