Linux Link

ln command by default creates a hard link which is a file that share the same inode as the original file it links to.

Soft link (symbolic link) is a newer link type that addresses some disadvantage of hard link.  It can link to a directory.  It can like to entry in another file system.  It can link to an entry that does not exist currently (e.g. a file that is created from time to time).

When cd to a directory using symlink, the shell builtin pwd will display the name of the symlink that link to but /bin/pwd (utility) will display the destingation directory.  When you cd to .. it will return to the directory that holding the symlink.

Linux file and directory permissions

 To execute shell script, you mean r+x to the script file.  To execute a binary, you just need x.

The "+" after the permission indicated if the file has an ACL

Numbers to represent rwx is 1/2/4.  Or (add) the number to create composite permissions.  For example, 700 means 1+2+4 for owner and 0 for group/other.

Setuid/setgid change the permission x to s in the listing.  Set these permissions by specifying a 4th digit.  For example. 2700 or 4700 sets the setgid or setuid respectively.  "1" is to set the sticky bit to the program.

Kernel will not execute a script with setuid/setgid on.

Execute permission in directory indicated if the user can cd into the directory and access file that he has been permitted to.  If user has x but no r for a directory, he cannot display the directory file content (i.e. list of files in directory) using ls command.

Using ACL has overhead and should not enable ACL on system directory and files.  Not all file utility preserve ACL by default.  Destination filesystem may or may not support ACL.  In addition, the filesystem must be mounted with ACL enabled (default no ACL). 

ACL grant access to other user or group beside the owner's.  Beside ugo. ACL has a role called "mask" which specified the effective (maximum) permission ACL permitted for the directory or file.  Any ACL specified more than mask's will not be effective (i.e. denied).  Mask is usually set to the max permission allowed and individual ACL rule is more restrictive than mask's.

Registry tools

REGEDIT is a GUI tool to see and manipulate registry entries. 

REG.EXE is a CLI tool

REGINI is a CLI that can use a text file containing REG commands as input 

POWERSHELL has command to manipulate registry

.reg file

This is an exported registry file in text format. It is not the registry file itself. Content can be import into the registry. 

KHLM subkeys

SAM AND SECURITY

the former contains info that used to connect the pc to the domains it entitled to, including the local domain. The latter contains the security policy download from connected domain

SYSTEM

contain windows config, drives connected and file system info

SOFTWARE

contains info for windows installation and softwares installed. It is organised by vendor 

Registry structure

The registry is organized into 5 groups or sections. 

HKCR (class root) section keep info about registered software, OLE object class id and file associations

HKCU (current user) contains config options for the currently signed-in user like disvknlocation of the user folders, control panel settings and app config settings. 

HKLM (local machine) contains setting for the pc. It co tains the sub key files - SAM, security? System and software. Another file Hardware is created each time the pc starts containing detected plug and play hardware. This key also contain the files Components and BCD which contain boot configuration data. 

HKU (user) contain settings and options for the currently sign in user.

HKCC (current config) contains info gathered for the current session and will be discarded when season ends. 

HKEY_PERFORMANCE_DATA is not visible to Reddit. It contains performance data of the current session. It is discarded when the session ends

Windows registry

First introduced in windows 95, registry is to consolidate ini files in windows 3.1. There are 5 main registry files residing in ststem32\config directory. 

SAM security access manager

Security

Software

System

User diff (used for OS upgrade)

Each user has its own registry files as well in the %userprifile% directory. They are 

ntuser.dat contain customisation for software and UsrClass.dat contains com related info specific to the user. 

Registry is managed by configuration manager in kernel. It has journaling to protect from corruption. 

Linux command

When you enter characters, the driver will buffer the character until a RETURN. If you enter control character, the driver will take action immediately. For example, control h/w/u will cause the driver to erase a character, word or line. Once RETURN is entered, the driver will forward the entered text to the shell for processing.  The shell parses the command line and looks for the command. If the command is a path (absolute or relative), it will not search the PATH. The arguments are pass to the command and not processed by the shell. The first word in the line may not be the command word. It can be a redirection etc. special character will be processed by the shell. 

Android file systems

/boot contains the kernel and ram disk. 

/system contains the rest of the Linux system. 

*/recovery contains Viber for recovery mode 

/data contains application data

*/cache contains frequently access data and logs

*/misc contains miscellaneous setting for the device. 

/sdcard contains info of data in sd card 

SELinux

Security enhanced Linux is a feature in Android. Discretionary access control DAC means application can ask for permission from user. Thus helped malware. Mandatory access control MAC ensure app work in isolation, included those running as root, and not able to corrupt the OS and device.  SELinux is used to enforce MAC. 

Trusted Executive Enviroment

TEE is an isolated area usually a separate processor which can guantee the security of data stored in it. When the cpu need to access these data, it delegated the operation to TEE. 

Android architecture

Android Inc was a start up and bought over by Google. Android uses a Linux kernel with the drivers for the phone hardware. The next higher layers are the HAL hardware abstract layer which expose the hardware to the upper layers. 

The next layer is the Android native library written in c it c++. WebKit, sqllit, media framework, c run time and OpenGL etc.  The Android runtime layer support the java app. 

Android translate the java byte code into dalvik byte code which is more optimised for low memory and processing. The dalvik byte code then run in a dalvik vm. The .class files are also consolidated and changed to  a single.dex. 

Earlier version of Android use JIT compiler in dalvik which translate segment of code which is used repeatedly (called traces) into machine code. Later version uses ahead of time AOT compilation which compile the whole byte codes to native code in ELF form during app installation. 

The next upper layer is the Java API framework which support the applications. 

IOS operation modes

Normal mode is when iPhone was started in the usual way, going through a secure boot chain. The boot ROM contains the apple root CA public key is used to verify the next stage low level boot loader (LLB) is signed by apple or not before executing it. LLB finishes its work and load the second stage boot loader, iBoot, which load the iOS kernel

Recovery mode is entered if  any stage in the secure boot chain fails. The iPhone requires an upgrade or restoration to exit from recovery mode. 

Device Firmware Upgrade (DFU)  is entered when boot ROM cannot verifies or loads LLB. In DFU, a different boot sequence will be used. Boot ROM runs iBSS, a modified version of iBoot. It in turn runs iBEC that loads the kernel which loads the RAM disk. 

IOS

iOS is derived from OS X. The latter is open sourced but the former is proprietary. 

IOS architecture consists of 4 layers. Cocoa Touch layer implementation the ui for application and provide support for touch based input and multitasking. 

The media layer provide graphic, audio and video framework. 

The core derives layer provide fundamental services for application such as location, iCloud and social media services. 

The core OS layer provide networking , memory management, POSIX threading, filesystem etc. 

iPhone partition

The system partition is about 3G large. It is mounted read only. It changes to RW when being upgrade and itune reformat and rewrite it.  The user partition is mounted RW 

Apple filesystem

Hierarchical file system (HFS) has 512 bytes size blocks. The blocks are numbered within a volume (physical medium). A number of blocks are grouped into an allocation block. HFS uses 16bits value to track these allocation block which make its max size of 64K allocation blocks 

HFS+ uses 32 bits to address allocation block. It also introduced journaling, compression, dynamic resizing and fragmentation. 

APFS is. 64-bit filesystem. It supports cloning and snapshot (read only) using copy on write. 

Link count

The link count of a directory or file in Linux refer to the number directory reference table o the inode from all the directories in the inode table. This include .. in a child directory. 

The exception is for the root inode with an extra 1 link count because this is the superblovk pointer to the root inode 

QR code

Quick response code is designed to be readable in high speed comparing to barcode. QR code has special position detection pattern at 3 comers so that the code can be read 360 degeee. Applications can detect the QR code 20 times faster than bar code. 

QR code position pattern at 3 corner allows it to be easily derived if its position, size and inclination. It also has timing pattern running from one position detection pattern to another,and alignment patterns as smaller square within the code grid. 

Schmitt trigger

Noise will be transferred to output when mapping through a transfer function because noise cause the signal to cross the threshold more than once. Transfer function is not symmetric such as the rising and falling of signal follow a different transfer functions. The difference between the 2 transfer function added buffer to the noise and thus increased noise resistance   Gate that include hysteresis was invented by Schmitt. The cost for Schmitt trigger gate is more expensive to produce because they are more complex. 

Vacuum tube

Vacuum tube has a cathode and an anode. When heat applies to the cathode, electrons become free to move and is collected at the anode. A grid placed between the cathode and anode and manipulating the grid turns vacccum tube into a switch

Electromechanical relay

A relay is a device that use electromagnet to move a switch. As magnetic is created by passing electricity through a wire coil, the magnetic force attract a level to either break or complete a circuit to give an output based on the design. 

Mechanical relay is slow, noisy and can wear out. A bug trapped in a rely give the term bug in computer. 

Transfer function

A transfer function is a graph that map values if input to output. The steepness of the function graph “amplify” the input and becomes the output. The transfer function in real world is not linear. The toe and shoulder of the graph are termed as cut off and distortion respectively. The steepness of the curve in the middle section is called gain. The design of the mechanism is to make sure the input stay in the stable (linear) middle portion of the graph. 

Bash spawn new bash

When executing a script, a child bash process (shell) is spawned. The child shell inherits the environment variables from the parent. The child shell sources $HOME/.bashrc for further customisation. 

Bash set up

Init runs multiple getty to listen on connection (console, network, modem). When a connection comes in, getty display the login prompt to get the userid entered. Getty spawns login program to display the password prompt. User enter password and login checks the credentials. Login then run the shell specified in etc/password for the user. 

The first hash shell is launched with login flag on. It execute the /etc/profile which set up the basic environment for everyone. Then it looks into $HOME and  execute one of .bash_profile, .bash_login and .profile to set up the personal environment. These files source $HOME/.bashrc. All these files set up environment variables. 

When the shell is logged out, ~/.bash_logout is sourced 

Journal control

In the systemd framework, the process to manage logs is called systemd-journal. The benefit of using this is that it can merge all log into one place including kernel logs. Use command journalctl to display the log messages. 

Printk

Kernel cannot access the c lib for printf and has its own functionally equivalent version called printk. Printk writes to a ring buffer, a memory buffer that wrap around. Com and dmesg read and display the content in the ring buffer.  Redhat writes the messages in the ring buffer to /var/log/messages. 

The standard message for printk is to prefix a severity level (alias to a number) to aid filtering. The default (or if not specified) is 4 which equivalent to warning. 

A set of pr_* macros (eg pr_emerg) embeds the printk call make it more handy to emit kernel messages. Pr_debug willl emit the message only if Debug is defined or go nothing. 

Decision Tree

The key is to make the program to learn from the data and generate a decision tree automatically. The approach is via supervised learning with label data sets. It took effort but can benefits others when the learning is completed.  

Detecting error only in transmission

(1) simple checksum - calculate a checksum based on the text. This can detect one error but not two and above. It is because 2 error can result in the same checksum  

(2) staircase checksum is calculated by multiplying each byte with a sequence number and then take the checksum of the text. Using simple checksum and staircase checksum together can detect 2 errors in the text. When one or both checksum cannot be matched, it indicated there could be 1 or 2 errors. 

Detecting and correcting error in transmission

(1) retransmit multiple times (based on the error rate if the line) and for each byte, pick the pattern that appear most. Based on probability, the right pattern would be picked but there is no guarantee. 

(2) encode each byte with additional bits. The received bits can match against the encoding pattern.  The closest matching pattern is the transmitted byte. This is how hamming code works. 

(3) two dimensional parity ones the text in 2 dimensional block. Then take a checksum across the row and down the column. This allows to pinpoint the byte that has changed (error). The byte can be recomputed from the vertical and horizontal checksum. In reverse. 

Extended SQL Trace

Oracle traces 2 types of events - database calls (eg EXEC, PARSE, FETCH etc)  and OS calls made. 

Database call entry - name of the calll, cursor handle id, c = cpu time in usec, e =2.718 elapsed time, p = bin of oracle block, cr + consistent mode call made,  cu = current mode call made, ms = no of misses from the lib cache, r = no row returned, dep = depth of the call (is the call a child of another call), og = optimised goal number (all, first, rule, choose), plh = plan hash value, tim = timestamp of the entry ( made at end of the call).

System call always identified by the word WAIT and follow by the cursor handle id, nam = descriptive name of the syscall, ela = elapsed time of the call, file #, block #, blocks = number of blocks returned, obj # = oracle object number, tim = timestamp when this entry is logged (when the call conpleted. 

Tabula Recta

Substation cipher encrypt a message by substituting a character with another this mixing up the original message. A polyalphabetic substitution replace the same character by more than 1 alphabets so making it harder to break. Tabula recta uses a matrix of alphabets and a key phrase. To encrypt, the message is aligned with the secret key which is used an index to look up from the aplhabet matrix the corresponding character to substitute with. The key shorter than the message is repeatedly used. Another trick is to expand the key. The key can be an excerpt of text from a book that is as long as the message. 

Random surfer algorithm

In a search engine, a query will identify a group of pages. The pages are ranked by many factors. One of them is how many hyperlinks reference this page indicating the popularity and thus the relevance. 

Another consideration is if the page linking to the target page is more authoritative than other page pointing to another target page. In other words, not all links are equal weigh.  Computer is not able to discern which referencing page is more authoritative  

The random surfer algorithm use to assign an authoritative score for each page to be further use in the ranking stage. It is simulating a person surfing by following a random link on a page to another page.  He surf a random number of page and then restart the process from the base page again. The random behaviour reduce the effect of loop and also simulating the popularity of a page.

Diffe-Hellman Key Exchange

Each party choose a separate secret number for themselves 

Both parties agreed on a common base number and a modulus.  The modulus must be a large prime number  the base must be a primitive root of the modulus (when the base is raised to a certain power successively, the reminder will cover all numbers within the modulus boundary.   

Each party calculate base raise to the power of their secret number then derive the modulus. Each party send the result to the other. 

Each party raise the reminder from the other party to the power of their secret number. The reminder is calculated and thus become the share secret.  

Search Engine Indexing

Each word on a web page is placed on an index. In addition, the relative position of the word on a page is also stored (for example, first word is 1 and the second word is a 2). 

The word location can be used to support phrase searching (mult-word sequence). It also allow the search engine to estimate the relevance of a page to the query. The closer the distance between words on a page, the more relevant is the page to the query. 

Beside the content, search engine also index html tags to support search for specific part of document like “cat in the title”

Lossy Compression (image and audio)

Lossy compression works by ignoring details in the original file. The image is divided into a smaller block (say 8x8 bytes). The content in each block is analyzed and replaced by a smaller format. For example, if the block contain the same color, it is replaced by one number. If the block is dominant by a certain color, it is replaced by that color. If there is a gradient, it is replaced by a range. 

Lossless Compression

General rule is to replace a long pattern with shorter pattern. It could be replacing a long repeating string with instruction to copy from the previous position with length  or it could be replacing most frequent character from 2 bytes to 1 byte encoding but rare characters either more encoding bytes.

Trapdoor Function

An investable function that is easy to compute the output from its inputs but difficult to derive the inputs from the output. An example is that two co-prime numbers multiply to give a product but is difficult to derive the 2 factors. Co-prime are 2 numbers that does not have a common factor. A trapdoor function is essential for asymmetric encryption. 

Training with multiple GPU

Model parallelism has a to build a pipeline of GPU. Each GPU handles a layer of the model. This is used when the model is too big to fit on a single GPU memory. The efficiency is affected with bubble in the pipeline when data passing through GPU at different speed  

Data parallelism is used if the model can fit on a single GPU.  Data us the divided into mini-batch to run in ea h GPU.  Gradients are computed and combined to adjust the weighs  

Tensor parallelism is to map different part of the model to multiple GPU. It is different from model parallelism such that portion of layers and not the entire layer is map to a GPU  Input is split to feed into different GPU based on the mapping boundary  

Speech Synthesis

Three steps to synthesis speech from text.  First break down the text into words. It involve reducing ambiguity by normalizing elements like numbers, dates, times, abbreviations and special characters etc into words. Try w second step is to break down words into phonemes (distinct unit of sound). The third step is to synthesize sound. 

There are 3 types of technics to generate sound. Concatenative is to string up pre-recorded sound. Formant is to add a combination of synthesized frequencies and shapes using model. Articulatory synthesis models human vocal tract to generate sound. 

Multimodal

It refers to the capability of a model to accept more than 1 types of input, for example text and picture. 

Emergent Abilities

It refers to the capabilities exhibited by a model which is not explicitely programmed into. It is like a bonus emerging from the final model. For example, abilities to summarize, or doing arithmetics are such capabilities. 

Prompt Engineering

A discipline to craft input given to LLM that will increase its accuracy and coherence. It is to modify the output by manipulate the input using specific words or format.

Chain of thought prompting ask the model to generate intermediate steps before the final output. 

Few-shot and zero-dot prompting is used to trigger chain of thought prompting. 

Self-consistent promoting involved asking the question multiple time 

Knowledge prompting is to provide additional info to the model with the prompt 

Fine tuning LLM

Fine tuning is to train a pre-train model on specific task so sharpen the response on such niche area. This can be done by training part of the model (kept rest unchanged). 

Training LLM

The model is tweaked to maximise the likelihood of the training data (maximum likelihood estimation). 

Autoregression is to predict the next word in sequence. Masked training is to mask out part of sentence and let the model to fill in the blanks. 

NSP next sentence prediction let the model to predicts whether a pair of sentence appear consecutively in the training corpus. This let model to fine tune narrative flow and coherence. 

The training cost is high but the inference cost is less about 4.5 to 1

Tokenization

Tokenizarion is to dissect the text into smaller units. The unit must not always be word. It can be a character, a phrase or symbols. Tokenization enables us to grapple the complication of language (vocabulary, format, grammar etc). This allows significant reduction in compute and memory resources required for the model. 

Different model build may use different Tokenization methods - rule based, statistical or neural. The number of token affect the computation required by the model to process. Therefore, the charge by model is based on number of token input. 

Attention

Attention mechanism is like placing bookmarks on a lengthy text. The bookmark enables one to keep track of important or significant portion of the text which can be used to produce output later in time. By focusing on these parts of inputs, the output become more accurate and contextual. 

Self attention is a variant that capture relationships between different part of input sequence, regardless of their distances in the text. 

68000 implemented instruction

Motorola 68000 CPU sees an instruction with $A oxide as an unimplemented instructio which is similar to a software interrupt mechanism. It akins to a supervisor call instruction in other CPU. The data portion of the instruction contain the routine number to pass control to. A flag indicate if it is for the OS or ROM.  The routine number is an index to dispatch table that contains. The address of the routine. 

Serial protocol

UART can be used to connect 2 nodes using 2 wires - control and data. The control like start and stop transmission between the nodes. 

I2C is from Philips. It is a master slave set up on a bus. The node got control of the bus becomes the master. It sent out the address of the slave it wants to communicate with, the node (read or write) and follow by data transmitting in the wire. The address are configured in each device connoted to the bus either built in or via jumpers etc  

SPI came from Motorola. It is also a master slave set up but the master is usually a more intelligent controller and slaves are less intelligent peripheral devices. Master select the space via a CS (chip select) wire that connect to a specific slave. Therefore the master controller may have more than 1 CS wire to multiple slave. Master is also responsible to generate the clock signal to support the transmission (sampling the wire for data). There is also a daisy chain confirmation possible to allow the master to communicate to multiple slaves via one CS wire but the implementation is complex, data need to pass through all slave sequentially during transmission and not all device support this configuration. There are 2 data wires. One to transmit era from master to slave and one for the reverse. 

Generative AI

Gen AU create new data that is similar to that inputs. Output from gen AI can also transform the I’m out into different domain (eg changing an image for night to day) or changing its style (from picture to cartoon).

Gen AI understands the distribution of features for inputs and sample the distribution ( based on probabilities) to create new data. 

Discriminative AI

This type of AI algorithm that classify or distinguish class of target objects objects. It is applied in areas include NLP (sentiment classification, topics classification), re commendation (predicts user preference) and computer vision. 

Discriminative AI tried to identify the “line” that separate different classes in the feature space. 

Large Language Midel

LLM is trained with lots of text and is used to predict the next word or sentence based on input (prompt) and the previous interaction in the session. The older RNN loop back the output to generate newer output but it has limited “memory” than LLM. 

Given input, LLM compute a probability distribution of the next word spanning the entire language corpora. This approach is used on sentence level as well to output a coherent and contextually amenable output. 

GAN types

GAN generate image randomly which is unpredictable. By using an additional condition vector to indicate the class of image we like to the graining, we can get GAN to generate specific class of image we wanted. This is called conditional GAN. 

A controllable GAN is  a GAN that we can use the random vector to influence part of the image. For example, change the image hair color, gender etc through altering the value of the input vector. This is equivalent of mapping the vector space to the image space. The input vector may need much more values (dimension) to make the out put more controllable. It is because in a low dimensional vector, one value change may affect multiple feature of the image. This is called entanglement. A higher dimensional vector is more likely to minimize the correlation of 1 value to many features in the image space 

Random vector input for GAN

The input vector contains random value samples from a normal distribution. In other words, the value close to the mode will s more likely to be used than those value distant from the mode. The vector, called the noise vector, is equivalent to encoding of real data (image). 

Training GAN

(1) generate a batch of images with the generator. The initial image will not noise and easily distinguished by the discriminator. 

(2) grab a batch of real images. Marked the combined batch with label 0 or 1 for fake or real images. 

(3) feed the batch to the discriminator. Using back propagation to adjust the weighs and bias of the discriminator so that it can learn to recognise the real image  

(4) freeze the weigh and bias for the discriminator. Create a batch of fake image from the generator. Label these image as real and use the output from the discriminator to anjust the weigh and bias of the generator through back propagation and gradient descent for the complete model (discriminator toward generator)

(5) repeat the training until the discriminator cannot discern the fake picture from real (ie the out out is about 0.5. 

GAN

Generative adversarial network is used to generate image from an input vector of random value. GAN comprises of 2 neural networks - genarator used to create innate and a discriminator used to rate how real the image generated is. 

The image created by generator is fed to the discriminator with real images. The output from the discriminator s used to train the generator so that it eventually generate image that the discriminator could not differentiate form real ones.  Training us via back propagation to adjust the weighs and bias  

Once the model is grained, the discriminator is discarded. The generator is used to generate artificial images 

CNN architecture

A CNN consists of multiple layers of convolution and pooling. A convolution layers uses a set (multiple kernels) to learn from its input. The output is fed into the pooling layers which has no weigh and bias like the convolution layer as it has nothing to learn. Pooling later submarines the output of a convolution layer by dividing the input matrix into a set of 2x2 grid and extract the maximum value from each grid cell. This reduce the spatial extent of the input which feed into the next convolution layers  

The final convolution layer feed into a conventional neural network called the dense layer to give the final output