Concurrent Garbage Collector

 It uses multiple threads to perform GC. Concurrent means the collector can run simultaneously with application threads. Therefore the system must have enough cpu for best result. Compaction still stop the application threads. 

Serial Garbage Collector

It uses a single thread to perform GC. It is best use for a system with single cpu (container) or mainly for batch. It is also used in client ends. 

GC and heap

Steps include scan the heap, mark those objects that are in used and compact the heap. Heap is divided into young and old generation. The young region contains the eden and a several survival spaces. The minor GC clean up the young region. It stops all active threads for a short moment due to the smaller size of eden. The full GC is triggered when the tenure space is full. 

AOT compilation

Ahead of time compiler create a share library (so) format  for JVM to load at start up time. This intended to shorten the start up time of system. The optimisation is C1 level. The code can be recompiled to c2 level later. 

Java OSR

Compilation in java is fine asynchronously. Java code will continue to be executed via interpretation while the compilation is queued to compile. Once compilation is done, the compile code will replace the Java’s code o. The stack so that the next execution of the code path will use the compiled code instead. This is called on stack replacement. For example, if the code to be compiled is a loop that keep on running. You cannot wait to replace the java  code by compiled code until the loop execution ends which may never happened. OSR enable the compiled code to run as soon as the compilation is done. 

Java tier compilation

Java has 2 compilers - C1 abs C2. C1 originated from client jvm and C2 from server jvm. C1 is more aggressive in the sense that it started to compile code earlier than C2. C2 observes the execution longer before compilation and generated more optimised code than C1. This made sense in the past as client code tends to run shorter and thus earlier compilations will be beneficial. Server side code tends to run longer and a more optimized code is beneficial in long run. 

Presently, jvm uses both C1 and C2 compiler. It is called tiered compilation. Code will be first compiled with C1 and hotter code will then recompile with C2

Java code cache

When the code cache is filled up, Iava JIT compilation would stop. This could affect performance as hot code will remained being interpreted. 

DOS Partition

DOS format disk into 4 primary partitions. There is a boot flag field in the partition to indicate to the boot loader ito boot from this partition. Some bootloader may not follow this convention (eg. unix) and has their one way to identity the partition to boot. 

If there is a need to have more than 4 partitions (drives in Windows term), multiple logical partitions can be defined in a primary partition. However, the windows boot loader will not be able to see and boot from logical partitions. 

BIOS booting

 When computer is powered on, the processor will clear all registers and set the CS and IP to a fixed address in the BIOS for x86. BIOS read the first sector (512 bytes) from the boot device and jump control to it. The code in the first sector is part 1 of the boot loader. It will read in the part 2 of loader which exists in the next 31K of the partition (or volume). Part 2 will then jump to part 3 of the loader which exists in the OS partition which in turn load the kernel. 

The OS partition can be in a separate partition on the disk. 

Process hollowing

RunPE attack replaces the actual load module when the process is created and before it starts to execute. The attacker suspend the process during CreateProcess call, locate the load module load address via PEB and rewrite it to point to the malicious code that has already mapped into the address space. It then fixes up the thread context and resume the process so that the malicious code hijacked the process. 

Windows TEB

For a multi-thread applications, each thread must has its own stack. The stack address and size are stored inTEB. In a 33 bits system, the FS segment register pointed to the TEB and in a 64 bit system, GS segment register is used 

The ExceptionList field points to the SEH, structure exception handling, chain set up in the program to try and catch exceptions. This not applicable to 32 bit system. 

Section Headers

The header structure (IMAGE_SECTION_HEADER,contains information for the loader so that it knows how to locate the section in the PE file, which memory address to load these sections to and how large memory need to allocate for them. 

PointeToRawData contains the offset of the corresponding section data in the file. 

SizeOfRawData gives the size or end point of the section. 

VirtualAddress gives the relative offset the section to be placed in memory. 

VirtualSizr indicates the memory block to allocate for the section. 

Characteristics indicates the protection attribute for the section in memory (read, write, execute). These attributes are not mutually exclusive and can added together. 

NT Header - Optional Header

This structure is added by the linker. 

ImageBase contain the memory address to load the text action in memory determined at compile time (0x400000 or 0x800000 by default).

SizeOfMemory is the size of memory to allocate to holds anll the sections above the ImageBase address when the program is load. 

SizeOfHeadet contains the size of DOS, NT and Sectii in on headers combined. 

AddresssOfEntryPoint points to the beginning of the text action. 

File alignment indicate the byte alignment of each section in the PE file. For example, if the value is 0x200, a section of 10 byte will padded to a section size of 0x200 bytes. A section of 202 bytes will padded to a size of 0x400 bytes 

SextionAlignment field bdicate the section alignment when loaded into memory and default to 0x1000 in 32 bits. 

DataDictionary field is a table containing the starting point and size of 15 program details - export directory, import directory, resource directory, exception directory, security directory authentication code,base relocation table, debug directory, x86 specific data, global pointer offset table, thread local storage (TLS), load configuration directory, bound import directory in headers, inport address table, delay load import descriptor, COM runtime descriptor. 

NT Header - File Header

This is the file header of the COFF produced by the assembler after the compiler translate the C/C++ code to assembly language. 

The Machine field indicate the machine code type such as x86, x65 or ARM. 

TimeStamp contains the date time stamp when the compilation was executed. 

SizeOfOptionLHeader contains the size of the the Optional Header structure that follows. The value is fixed to either 0xE0 for 32.bit or 0xF0 for 64 bit. 

Characteristic field indicates the type of load module - is it 32 bit, a DLL or an executable. 

Window Portable Executable

The compiler generate an object file in COFF format.   The linker modify the COFF to produce the PE file structure 

The PE file starts with a DOS header with the magic number MZ. The .e_Ifanew field contain the RVA, relative virtual address, of the NT header in the PE file. 

NT header contain the File Header which the .NumberOfSection field co rain the number of sections produced ed by the compiler.  Following the File Header structure fire is the Optional Header structure produced by the linker in the last stage of compilation. 

After the NT header is an array of section headers each describe the sections (e.g. text, data etc) produced by the compiler  th actual sections is placed after this array  

C++ Reference

A reference is an alias to another variable.

int b = 1;

int &a = b;

a = 2

b will have a value of 2

If & is used to the left side of "=", it is used to represent the address of variable.

A constant reference means one cannot use the reference to change the value that it points to

const int &a  = b

a = 2 generates an error

HAProxy health check

Layer 4 health check is to establish a TCP connection with backend server at regular interval.  Optionally, one can specify the number of check failure before HAProxy marked the specific backend down.  It can also specify a different interval to check for server up to resume.  This allows a fast fail and slow start configuration.

Layer 7 health check uses HTTP OPTION call to check if backend is processing HTTP request.  A 2xx or 3xx response indicate server is up.  Some http server may not accept OPTION call.  One can configure to use HEAD call for check.

One can also monitor the client traffic on the top of the polling type interval health check.

Health check can be defined end to end.  For example, an app server depends on the database server to be available.  If the database server is down, the service in the app server will be impacted.  In this case, HAProxy can define the app server is depending on database server.  If the database server failed health check, HAProxy can disable the app server. 

Routing in HAProxy

An ACL defines a condition that can be used in HAProxy to route requests satisfying the ACL to a group of special backend. 

The condition can be the full or partial matching part of  url, the search parameter in the url, the hostname part of the url, header value, http verb etc. 

beside routing, HAProxy can also send back redirect response to the client (301, 302 ..etc)

HAProxy

 It is a reverse proxy to load balance traffic to the backend servers. It t operates on either tcp (layer 4) or http (layer X ) mode. To the backend servers, the. Kirby become the proxy. Therefore proxy can be configured to add the client ip by adding it as extra http headers. 

ACL can be used ti define a condition which in turn used in other statement to filter (limited) if a connection is to be forwarded to the backend. 

A HAProxy can be set up to forward different traffic received (interface and port) to different set of backend 

CSS Class

HTML element can define a class attribute.  The class name can be referenced in CSS by prefix it with a dot.  For example, the following refers to the class named "big-text"

.big-text {font: 15}