Tracing a hacker Written by: Paperghost [paperghost@vitalsecurity.org]- 24/02/2005

http://www.bleepingcomputer.com/tutorials/tutorial99.html

Sometimes, it's just not enough to simply know that there's a Trojan or Virus onboard. Sometimes you need to know exactly why that file is onboard, how it got there - but most importantly, who put it there.

By enumerating the attacker in the same way that they have enumerated the victim, you will be able to see the bigger picture and establish what you're up against. But how can you do this? Read on...

## Connections make the world go round ##

The computer world, at any rate. Every single time you open up a website, send an email or upload your webpages into cyberspace, you are connecting to another machine in order to get the job done. This, of course, presents a major problem, because this simple act is what allows malicious users to target a machine in the first place.

# How do these people find their victim?

Well, first of all, they need to get hold of the victim's IP Address. Your IP (Internet Protocol) address reveals your point of entry to the Internet and can be used in many ways to cause your online activities many, many problems. It may not reveal you by name, but it may be uniquely identifiable and it represents your digital ID while you are online (especially so if you're on a fixed IP / DSL etc).

With an IP address, a Hacker can find out all sorts of weird and wonderful things about their victim (as well as causing all kinds of other trouble, the biggest two being Portnukes/Trojans and the dreaded DoS ((Denial of Service)) attack). Some Hackers like to collect IP Addresses like badges, and like to go back to old targets, messing them around every so often. An IP address is incredibly easy to obtain - until recently, many realtime chat applications (such as MSN) were goldmines of information. Your IP Address is contained as part of the Header Code on all emails that you send and webpages that you visit can store all kinds of information about you. A common trick is for the Hacker to go into a Chatroom, paste his supposed website address all over the place, and when the unsuspecting victim visits, everything about your computer from the operating system to the screen resolution can be logged...and, of course, the all important IP address. In addition, a simple network-wide port scan will reveal vulnerable target machines, and a war-dialler will scan thousands of lines for exposed modems that the hacker can exploit.

So now that you know some of the basic dangers, you're probably wondering how these people connect to a victim's machine?

## Virtual and Physical Ports ##

Everything that you recieve over the Internet comes as a result of other machines connecting to your computer's ports. You have two types; Physical are the holes in the back of your machine, but the important ones are Virtual. These allow transfer of data between your computer and the outside world, some with allocated functions, some without, but knowing how these work is the first step to discovering who is attacking you; you simply MUST have a basic knowledge of this, or you won't get much further.

# What the phrases TCP/UDP actually mean

TCP/IP stands for Transmission Control Protocol and Internet Protocol, a TCP/IP packet is a block of data which is compressed, then a header is put on it and it is sent to another computer (UDP stands for User Datagram Protocol). This is how ALL internet transfers occur, by sending packets. The header in a packet contains the IP address of the one who originally sent you it. Now, your computer comes with an excellent (and free) tool that allows you to see anything that is connected (or is attempting to connect) to you, although bear in mind that it offers no blocking protection; it simply tells you what is going on, and that tool is NETSTAT.

## Netstat: Your first line of defence ##

Netstat is a very fast and reliable method of seeing exactly who or what is connected (or connecting) to your computer. Open up DOS (Start/Programs/MS-DOS Prompt on most systems), and in the MSDOS Prompt, type:

netstat -a

(make sure you include the space inbetween the "t" and the "a").

If you're connected to the Internet when you do this, you should see something like:

QUOTE

Active Connections Proto Local Address Foreign Address State TCP macintosh: 20034 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT TCP macintosh MACINTOSH: 0 LISTENING TCP macintosh MACINTOSH: 0 LISTENING TCP macintosh MACINTOSH: 0 LISTENING

Now, "Proto(col)" simply means what kind of data transmission is taking place (TCP or UDP), "Local address" is your computer (and the number next to it tells you what port you're connected on), "Foreign Address" is the machine that is connected to you (and what port they're using), and finally "State" is simply whether or not a connection is actually established, or whether the machine in question is waiting for a transmission, or timing out etc.

Now, you need to know all of Netstat's various commands, so type:

netstat ?

You will get something like this:

QUOTE

Displays protocol statistics and current TCP/IP network connections. NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval] -a Displays all connections and listening ports. -e Displays Ethernet statistics. This may be combined with the -s option. -n Displays addresses and port numbers in numerical form. -p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP. -r Displays the routing table. -s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default.

Have a play around with the various options, but the most important use of these methods is when you combine them. The best command to use is

netstat -an

because this will list all connections in Numerical Form, which makes it a lot easier to trace malicious users....Hostnames can be a little confusing if you don't know what you're doing (although they're easily understandable, as we shall see later). Also, by doing this, you can also find out what your own IP address is, which is always useful.

Also,

netstat -b

will tell you what ports are open and what programs are connecting to the internet.

## Types of Port ##

It would be impossible to find out who was attacking you if computers could just access any old port to perform an important function; how could you tell a mail transfer from a Trojan Attack? Well, good news, because your regular, normal connections are assigned to low, commonly used ports, and in general, the higher the number used, the more you should be suspicious. Here are the three main types of port:

# Well Known PortsThese run from 0 to 1023, and are bound to the common services that run on them (for example, mail runs on channel 25 tcp/udp, which is smtp (Simple Mail Transfer Protocol) so if you find one of these ports open (and you usually will), it's usually because of an essential function.

# Registered PortsThese run on 1024 to 49151. Although not bound to a particular service, these are normally used by networking utilities like FTP software, Email client and so on, and they do this by opening on a random port within this range before communicating with the remote server, so don't panic (just be wary, perhaps) if you see any of these open, because they usually close automatically when the system that's running on them terminates (for example, type in a common website name in your browser with netstat open, and watch as it opens up a port at random to act as a buffer for the remote servers). Services like MSN Messenger and ICQ usually run on these Ports.

# Dynamic/Private PortsRanging from 49152 to 65535, these things are rarely used except with certain programs, and even then not very often. This is indeed the usual range of the Trojan, so if you find any of these open, be very suspicious. So, just to recap:

QUOTE

Well Known Ports 0 to 1023 Commonly used, little danger. Registered Ports 1024 to 49151 Not as common, just be careful. Dynamic/Private Ports 49152 to 65535 Be extremely suspicious.

## The hunt is on ##

Now, it is essential that you know what you're looking for, and the most common way someone will attack your machine is with a Trojan. This is a program that is sent to you in an email, or attempts to bind itself to one of your ports, and when activated, it can give the user your passwords, access to your hard drive...they can even make your CD Tray pop open and shut. At the end of this Document, you will find a list of the most commonly used Trojans and the ports they operate on. For now, let's take another look at that first example of Netstat....

QUOTE

Active Connections Proto Local Address Foreign Address State TCP macintosh: 27374 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT TCP macintosh MACINTOSH: 0 LISTENING TCP macintosh MACINTOSH: 0 LISTENING TCP macintosh MACINTOSH: 0 LISTENING

Now, straight away, this should make more sense to you. Your computer is connected on two ports, 80 and 27374. Port 80 is used for http/www transmissions (ie for all intents and purposes, its how you connect to the net, although of course it's a lot more complicated than that). Port 27374, however, is distinctly suspicious; first of all, it is in the registered port range, and although other services (like MSN) use these, let's assume that you have nothing at all running like instant messengers, webpages etc....you're simply connected to the net through proxy. So, now this connection is looking even more troublesome, and when you realise that 27374 is a common port for Netbus (a potentially destructive Trojan), you can see that something is untoward here. So, what you would do is:

QUOTE

1) run Netstat , and use: Netstat -a then Netstat -an So you have both Hostnames AND IP addresses.

## Tracerouting ##

Having the attacker's IP is all well and good, but what can you do with it? The answer is, a lot more! It's not enough to have the address, you also need to know where the attacker's connections are coming from. You may have used automated tracerouting tools before, but do you jknow how they work?

Go back to MSDOS and type

QUOTE

tracert *type IP address/Hostname here*

Now, what happens is, the Traceroute will show you all the computers inbetween you and the target machine, including blockages, firewalls etc. More often than not, the hostname address listed before the final one will belong to the Hacker's ISP Company. It'll either say who the ISP is somewhere in there, or else you run a second trace on the new IP/hostname address to see who the ISP Company in question is. If the Hostname that you get back doesn't actually seem to mention an actual geographical location within its text, you may think all is lost. But fear not! Suppose you get a hostname such as

http://www.haha.com

Well, that tells us nothing, right? Wrong....simply enter the hostname in your browser, and though many times you will get nothing back, sometimes it will resolve to an ISP, and from there you can easily find out its location and in what areas they operate. This at least gives you a firm geographical location to carry out your investigations in.

If you STILL have nothing, as a last resort you COULD try connecting to your target's ISP's port 13 by Telnet, which will tell you how many hours ahead or behind this ISP is of GMT, thus giving you a geographical trace based on the time mentioned (although bear in mind, the ISP may be doing something stupid like not having their clocks set correctly, giving you a misleading trace. Similarly, a common tactic of Hackers is to deliberately have their computer's clock set to a totally wrong time, so as to throw you off the scent). Also, unless you know what you're doing, I wouldn't advise using Telnet (which is outside the parameters of this tutorial).

## Reverse DNS Query ##

This is probably the most effective way of running a trace on somebody. If ever you're in a chatroom and you see someone saying that they've "hacked into a satellite orbiting the Earth, and are taking pictures of your house right now", ignore them because that's just bad movie nonsense. THIS method is the way to go, with regard to finding out what country (even maybe what State/City etc) someone resides, although it's actually almost impossible to find an EXACT geographical location without actually breaking into your ISP's Head Office and running off with the safe.

To run an rDNS query, simply go back to MS-DOS and type

netstat

and hit return. Any active connections will resolve to hostnames rather than a numerical format.

# DNS

DNS stands for Domain Name Server. These are machines connected to the Internet whose job it is to keep track of the IP Addresses and Domain Names of other machines. When called upon, they take the ASCII Domain Name and convert it to the relevant numeric IP Address. A DNS search translates a hostname into an IP address....which is why we can enter "www.Hotmail.com" and get the website to come up, instead of having to actually remember Hotmail's IP address and enter that instead. Well, Reverse DNS, of course, translates the IP Address into a Hostname (ie - in letters and words instead of numbers, because sometimes the Hacker will employ various methods to stop Netstat from picking up a correct Hostname).

So, for example,

298.12.87.32 is NOT a Hostname.
mail6.bol.net.au IS a Hostname.

Anyway, see the section at the end? (au) means the target lives in Australia. Most (if not all) hostnames end in a specific Country Code, thus narrowing down your search even further. If you know your target's Email Address (ie they foolishly sent you a hate mail, but were silly enough to use a valid email address) but nothing else, then you can use the Country codes to deduce where they're from as well. You can also deduce the IP address of the sender by looking at the emails header (a "hidden" line of code which contains information on the sender)...on Hotmail for example, go to Preferences, and select the "Full Header's Visible" option. Alternatively, you can run a "Finger" Trace on the email address, at:

www.samspade.org

Plus, some ISP's include their name in your Email Address with them too (ie Wanadoo, Supanet etc), and your Hacker may be using an email account that's been provided by a Website hosting company, meaning this would probably have the website host's name in the email address (ie Webspawners). So, you could use the information gleaned to maybe even hunt down their website (then you could run a website check as mentioned previously) or report abuse of that Website Provider's Email account (and thus, the Website that it goes with) to

abuse@companynamegoeshere.com

If your Hacker happens to reside in the USA, go to:

www.usps.gov/ncsc/lookups/abbr_state.txt

for a complete list of US State abbreviatons.

## List of Ports commonly used by Trojans ##

Please note that this isn't a complete list by any means, but it will give you an idea of what to look out for in Netstat. Be aware that some of the lower Ports may well be running valid services.

UDP: 1349 Back Ofrice DLL
31337 BackOfrice 1.20
31338 DeepBO
54321 BackOfrice 2000


TCP: 21 Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash
23 Tiny Telnet Server
25 Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2 0.17A-0.30
31 Hackers Paradise
80 Executor
456 Hackers Paradise
555 Ini-Killer, Phase Zero, Stealth Spy
666 Satanz Backdoor
1001 Silencer, WebEx
1011 Doly Trojan
1170 Psyber Stream Server, Voice
1234 Ultors Trojan
1243 SubSeven 1.0 - 1.8
1245 VooDoo Doll
1492 FTP99CMP
1600 Shivka-Burka
1807 SpySender
1981 Shockrave
1999 BackDoor 1.00-1.03
2001 Trojan Cow
2023 Ripper
2115 Bugs
2140 Deep Throat, The Invasor
2801 Phineas Phucker
3024 WinCrash
3129 Masters Paradise
3150 Deep Throat, The Invasor
3700 Portal of Doom
4092 WinCrash
4567 File Nail 1
4590 ICQTrojan
5000 Bubbel
5000 Sockets de Troie
5001 Sockets de Troie
5321 Firehotcker
5400 Blade Runner 0.80 Alpha
5401 Blade Runner 0.80 Alpha
5402 Blade Runner 0.80 Alpha
5400 Blade Runner
5401 Blade Runner
5402 Blade Runner
5569 Robo-Hack
5742 WinCrash
6670 DeepThroat
6771 DeepThroat
6969 GateCrasher, Priority
7000 Remote Grab
7300 NetMonitor
7301 NetMonitor
7306 NetMonitor
7307 NetMonitor
7308 NetMonitor
7789 ICKiller
8787 BackOfrice 2000
9872 Portal of Doom
9873 Portal of Doom
9874 Portal of Doom
9875 Portal of Doom
9989 iNi-Killer
10067 Portal of Doom
10167 Portal of Doom
10607 Coma 1.0.9
11000 Senna Spy
11223 Progenic trojan
12223 Hack´99 KeyLogger
12345 GabanBus, NetBus
12346 GabanBus, NetBus
12361 Whack-a-mole
12362 Whack-a-mole
16969 Priority
20001 Millennium
20034 NetBus 2.0, Beta-NetBus 2.01
21544 GirlFriend 1.0, Beta-1.35
22222 Prosiak
23456 Evil FTP, Ugly FTP
26274 Delta
30100 NetSphere 1.27a
30101 NetSphere 1.27a
30102 NetSphere 1.27a
31337 Back Orifice
31338 Back Orifice, DeepBO
31339 NetSpy DK
31666 BOWhack
33333 Prosiak
34324 BigGluck, TN
40412 The Spy
40421 Masters Paradise
40422 Masters Paradise
40423 Masters Paradise
40426 Masters Paradise
47262 Delta
50505 Sockets de Troie
50766 Fore
53001 Remote Windows Shutdown
54321 SchoolBus .69-1.11
61466 Telecommando
65000 Devil
## Summary ##
I hope this tutorial is useful in showing you both how to secure yourself against unwanted connections, and also how to determine an attacker's identity. The Internet is by no means as anonymous as some people think it is, and although this is to the detriment of people's security online, this also works both ways....it IS possible to find and stop even the most determined of attackers, you just have to be patient and keep hunting for clues which will help you put an end to their exploits.

Have I been Hacked?

One of the top questions I see on numerous message boards is "How do I go about seeing if I have been hacked?" http://www.bleepingcomputer.com/tutorials/tutorial24.html

I am writing this Tutorial for these people. In this tutorial I will show you how to determine if your Windows NT, XP, or 2000 box is hacked and how you can go about cleaning up the files they may have left behind. This tutorial should show you how to detect most hacks, but there are other methods that will be much harder to detect and will require a greater degree of knowledge in detecting them. In my experience, though, most of the hacks that are done in mass, especially by the script kiddies will be detectable through these methods.

Almost all the utilities that I will use in this Tutorial are freeware and downloadable. I have also included in the next section a list of these programs and their locations. Please note that this tutorial primarily focuses on Windows XP, 2000, and NT as some of these utilities do not work on the earlier versions of Windows. Some of the discussion in this tutorial may be advanced to some users. Please feel free to message or email me if you have some questions or suggestions.

The utilities you will need for this Tutorial are as follows:

Fport

This is a console utility that is run from the command line. When you run it, it will list all listening TCP/UDP ports on your system and the program that is using those ports.

TCPView

This is a similar program to Fport, but shows it in a graphical interface. This program not only shows listening ports, but also established and pending connect and closing connections. Some people prefer this more.

Process Explorer

This program will list all open processes and delineate between the parent processes and the processes that are spawned by the parent. This is a very useful program.

PSTools

This is a collection of console command line tools that can list open processes, kill processes, as well as many other useful functions.

NTFSDOS

This is only necessary if you have NTFS Volumes. This program will allow you to create a boot disk that enables you to read any NTFS Volumes that you have on your computer. The only drawback to this program is that you need the commercial version to actually delete/write to these volumes, as the free version is Read Only. There are more advanced alternatives, which I will give below.

Dos/Windows Boot Disk ?
http://www.startdisk.com/ or http://www.bootdisk.com/bootdisk.htm

These sites enable you to create boot disks in which you will boot the computer.

Filealyzer

This tool adds a windows explorer shell extension to your right click on a file. When you use Filealyzer on that file you will be able to see a lot of information about the file. Information such as whether it?s a packed exe (save that for another tutorial) or the version information. What I use it for is the hex dump and then the ability to list the strings found in the binary file. From the strings you can gain a lot of useful information as to what the program does or is.

Dameware NT Utilities

This program allows you to remotely administer a computer/group of computers. I was hesitant to put this on as it is not freeware, but it is such a great utility.


Why would someone want to hack me?

There are many reasons why someone would want to hack your computer. From my experience the most common reasons are as follows:

1. Setup a FTP Server (Pubstros) to distribute copyrighted material.
2. Setup an IRC client/bot that is used to DDOS other computers, flood IRC users, scan/hack other computers, and to distribute copyrighted material as a Fileserv.
3. Use your computer to scan others or hack into other computers. This gives them a degree of anonymity.

How can I tell if I have been hacked?

Almost every remote hack involves leaving a program behind that will allow them to get back into your computer regardless of whether or not you fix the security problem that let them into your computer in the first place. The only time a hacker does not leave something behind, is if they are hacking your computer for specific information or an item. Almost 99% of the time this is not the case.

The programs that they leave behind are IRC clients that they can control from a channel on an IRC Server or a Backdoor/Trojan.

Since these clients or Trojans must listen and wait for connections from the hacker, they must listen on a TCP or UDP port. With that in mind, the tools that I list above come into play. Using Fport or TCPView will allow you to see what TCP/UDP ports are open and listening on your computer and what program is using those ports.

To see what programs are running and are listening on TCP/UDP ports you would use Fport or TCPView.

For example, lets say a hacker uses the RPC/DCOM exploit that came out recently to get a command shell to your computer. They download and install SubSeven on your computer. As many installations of SubSeven use the default TCP Port 27374 it makes it very easy to spot this Trojan running on your computer.

By running Fport you would see the following (Formatting is a little messed up here):

FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com

Pid Process Port Proto Path
636 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe
4 System -> 139 TCP
4 System -> 445 TCP
660 svchost -> 27374 TCP C:\WINDOWS\System32\s.exe

From looking at this output you can see that you have a program in the directory c:\windows\system32 called s.exe. Right off the bat, that file name looks suspicious let alone the port it is listening on.

You would then go into task manager, kill the process, and then delete the file. You should look around some more and see if there are any other files that have the same creation date, as hackers generally leave more than 1 file behind.

If you cannot kill the process via task manager, then you would want to check the services and see if the program is running as a service. If it is, stop the service, and then try to delete the file.

You can also see if you can find out how the program is being started on boot up. I find this is generally in the registry for non-services. The key is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

There are other registry entries, especially for services, that can load a program on startup. You can launch regedit and search for the filename and see what comes up.

Other places to look for where programs can be launched at startup are:
Autoexec.bat
Winstart.bat
Win.ini
System.ini
The Startup folder.

What if Fport or TCPView says there is a program running but I cant find it!!!?!?

First thing is to make sure you have the options set to see all hidden files and system files. If you are doing a directory listing from a command prompt, make sure you use the /a flag with the dir command to see hidden files.

If you still can not see the files, then cleaning up a hack in this scenario is much harder as a Root Kit is generally hiding the Trojan/Backdoor. Root Kits are programs that allow you to hide registry entries, service entries, processes, directories or filenames. Though more common in Unix hacks, they are starting to become more prevalent in Windows based hacks as well.

Don?t worry though, there are still ways to detect these Root Kits and clean them up. Since these Root Kits are running as processes on the hacked machine, they only stop the hacked machine from seeing the registry entries, directories, files, processes or services. The Root Kit does not affect other machines looking at the files or drives.

There are a few ways to connect to your machine or drives in order to see the files:

One way is to just share your C: drive and connect to your machine from another computer. That remote computer can be another Windows Computer, or my favorite, using Linux and it?s smbclient program.

When connected through another computer you can see all the files and directories that are normally hidden, sort by date, and see the files that should not be there.

If you need to remove registry entries you can connect to the registry remotely from another computer using Dameware NT utilities, or use another program like it. Due to the fact that you are connecting to your computer from another computer, where the Root Kit is not affecting what you see, you will be able to see all hidden objects.

If you do not have another computer at your disposal you should make a bootable disk and boot off that disk. You will then be unaffected by the Root Kit and be able to delete files at your whim.

If your volumes are NTFS volumes, it can be a little harder. You can use a bootable CD that contains a linux distrubitions such as the following:

http://trinityhome.org/trk/
http://fire.dmzs.com/

Both of these distributions offer NTFS support and forensic utilities. You can also use the NTFSDOS program that I reference above. That is a great program, but the functionality really increases when you have a licensed version of it. When you have the licensed version of it you are able to make a bootable floppy and all the NTFS drives are mounted and visible, but now you can also write to it instead of only being able to read from it.

Other Hacks? And are they detectable?

What I have covered so far are the more generic hacks that are used. They are the most common and can be detected with the methods above. This tutorial, though, can not cover all possible hacks and ways to detect them. I will give a brief summary on some other types of hacks, but will not go into removing these types of hacks, as they can be a tutorial unto themselves. A simple google search can provide that information.

Alternate Data Streams: Alternate Data streams were introduced into NTFS volumes to support the Macintosh Hierarchical File System and are widely undocumented. With the use of Alternate Data Streams or ADS, a hacker can hide files, even executables, and make them almost invisible to the operating system and therefore yourself. There are tools out there such as LADS that will enable you to see ADS files, but they will not delete them. Luckily, even if a executable Internet application is hidden using ADS, fport will still detect them. They will show up as :somefilename or somefilename:somefilename2.

Kernel and Device Driver hacks: An experienced hacker may have the knowledge to actually patch/intercept system drivers, device drivers, or system calls. This will enable them to issue commands to the OS as Ring0 or at a "Operating System Kernel Security Level". If hack like this occurs, usually the best situation is to backup your data and reinstall the OS. This is because if they have such access to the box, then you really can not be sure what else has been compromised.

Conclusion

Ultimately, if you feel you have been hacked the decision is yours to try to clean up the box and continue using it, or to reinstall the OS. In some situations you can definitely clean up the hack and continue using the box, but in others the safest bet may be to do a reinstall. That must be a judgement call you make on your own.

Interview questions on 8086 hardware

Hardware Interview Questions

What are the three main types of connection used by Bluetooth?

Single slave, Master slave, Scatternet

What is Piconet?

Answer -A collection of devices connected through Bluetooth technology in an adhoc fashion.

A network of devices connected in an ad hoc fashion using Bluetooth technology. A piconet is formed when at least two devices, such as a portable PC and a cellular phone, connect. A piconet can support up to eight devices.

Which technology is used in Bluetooth for avoiding interference?

Frequency hopping is the technology used in Bluetooth.

Which microprocessor accepts the program written for 8086 without any changes?

8088 is that processor.

What does EU do?

Execution Unit receives program instruction codes and data from BIU, executes these instructions and store the result in general registers. (bus interface unit (BIUs) means for interfacing a user with said network to transmit and receive message signals therebetween )

Which Segment is used to store interrupt and subroutine return address registers?

Stack Segment in segment register is used to store interrupt and subroutine return address registers

Which Flags can be set or reset by the programmer and also used to control the operation of the processor?

Trace Flag, Interrupt Flag, Direction Flag.

What is meant by cross-compiler?

A program runs on one machine and executes on another is called as cross-compiler

Give examples for Micro controller?

Z80, Intel MSC51 &96, Motorola are the best examples of Microcontroller.

What are the different functional units in 8086?

Bus Interface Unit and Execution unit, are the two different functional units in 8086.

Logic calculations are done in which type of registers?

Accumulator is the register in which Arithmetic and Logic calculations are done.

What is the position of the Stack Pointer after the POP instruction?

The address line is 02 greater than the earlier value.

What is the position of the Stack Pointer after the PUSH instruction?

The address line is 02 less than the earlier value.

Which is the tool used to connect the user and the computer?

Interpreter is the tool used to connect the user and the tool.

What is SIM and RIM instructions?

SIM is Set Interrupt Mask. Used to mask the hardware interrupts. RIM is Read Interrupt Mask. Used to check whether the interrupt is Masked or not.

Which Stack is used in 8086?

FIFO (First In First Out) stack is used in 8086.In this type of Stack the first stored information is retrieved first.

What are the various segment registers in 8086?

Code, Data, Stack, Extra Segment registers in 8086.

What is the Maximum clock frequency in 8086?

5 Mhz is the Maximum clock frequency in 8086.

Give example for Non-Maskable interrupts?

Trap is known as Non-Maskable interrupts, which is used in emergency condition.

Give examples for Maskable interrupts?

RST 7.5, RST6.5, RST5.5 are Maskable interrupts

Which interrupts are generally used for critical events?

Non-Maskable interrupts are used in critical events. Such as Power failure, Emergency, Shut off etc.,

http://www.kyapoocha.com/sitemap/

http://www.intelligentedu.com/it_training_materials_and_books/free_database_design_training_materials.htmlhttp://www.programmerworld.net/books/oracle.htm

http://www.geocities.com/oracletricks/plsql/

http://java.about.com/

http://www.freetechbooks.com/forum-13.html

hacking sites and tutorial from internet

http://www.governmentsecurity.org/articles/WirelessTaping.php
http://www.governmentsecurity.org/articles/HackingIISTutorial.php

http://www.expertsforge.com/Security/
http://www.iwar.org.uk/hackers/resources/digital%20rebels/articles/unixhck.txt

http://www.hackszine.com/blog/archive/electronics/
http://www.snpx.com/cgi-bin/snpstore.cgi

collection of Internet links on Hacking and cryptography usesd to test the software aginst the virus programming

This summary is not available. Please click here to view the post.