IT Systems Concepts

7/29/2019 IT Systems Concepts

1/52

Basics of Forensics


2/52

The Memory and the processor Address and data buses

The stored program concept

Format of instructions The processor mechanism

Software Programming

Breaking sequence

A Black Box model of the PC


3/52

Information is data arranged in a meaningfulway for some perceived purpose


4/52


5/52

Two black boxes showinga processor and amemory connectedtogether by two arrowed

lines.

They are separatedbecause they are most

likely to be implementedas using two differentelectronic chips processor chip and

memory chip

MemoryObjects = data

Rules = program

Processor

Processor and Memory


6/52

and are connectedtogether by flexible cables

(tracks on a PCB) whichare made up of severalwires in parallel. Suchmultiple connections are

called buses

MemoryObjects = data

Rules = program

Processor

Processor and Memory


7/52


8/52

The heart of a computer is the centralprocessing unit or CPU.

This device contains all the circuitry that thecomputer needs to manipulate data andexecute instructions.

The CPU is amazingly small given theimmense amount of circuitry it contains.

The circuits of a computer are made of gates.


9/52

Gates, however are also made of another tinycomponent called a transistor,

and a modern CPU has millions and millionsof transistors in its circuitry.

The CPU is composed of five basiccomponents: RAM, registers, buses, the ALU,and the Control Unit.


10/52

RAM: this component is created fromcombining latches with a decoder. Thelatches create circuitry that can rememberwhile the decoder creates a way for individual

memory locations to be selected.


11/52

Registers: these components are specialmemory locations that can be accessed veryfast. Three registers are : the InstructionRegister (IR), the Program Counter (PC), and

the Accumulator.


12/52

Buses: these components are the informationhighway for the CPU. Buses are bundles oftiny wires that carry data betweencomponents.

The three most important buses are theaddress, the data, and the control buses.

address bus has a single on it indicating a

one-way of data & data bus has two arrowsindicating two way transfer of data


13/52

ALU: this component is the number cruncherof the CPU. The Arithmetic / Logic Unitperforms all the mathematical calculations ofthe CPU. It is composed of complex circuitry.

The ALU, however, can add, subtract,multiply, divide, and perform a host of othercalculations on binary numbers


14/52

Control Unit: this component is responsiblefor directing the flow of instructions and datawithin the CPU. The Control Unit is actuallybuilt of many other selection circuits such as

decoders and multiplexors. In the diagramabove, the Decoder and the Multiplexorcompose the Control Unit.


15/52

In order for a CPU to accomplish meaningful work,it must have two inputs: Instructions or rules and

Objects or data.

Rules are ordered sequences of instructions thatare to be interpreted by the processor and whichwill cause it to carry out a series of specific actions(Instructions tell the CPU what actions need to be

performed on the data).

Such sequence of rules are called programs


16/52

Instructions/rules are represented with binarycodes like data.

CPU makes no distinction about the whether it isstoring instructions or data in RAM.

This concept is called the stored-program concept

Black box- 1st memory contains not only thebinary patterns the data, but also the binarypatterns that represent the rules(programs)


17/52

Let us consider the form one such instructionor rule might take 2 consecutive bytes inmemory

0 0 0 0 0 1 0 1 1 1 0 0 0 1 0 1

The doingcodeDothis thing

The imperative verbSubtract

The usingcodeUsing this thingThe passive noun

the thing in byte 197


18/52

The first byte the doing code[do this thing]

The second byte the object on which thedoing code action is to be done

00000101 subtract

11000101 decimal 197

In many cases the value of the second bytewill be starting place in memory where theobject to be manipulated resides that is it will

be the memory byte address. The two byte pattern may therefore be

interpreted as an instruction or rule thatstates : subtract the thing in byte 197


19/52

In reality many suchdoing codes are availablecollectively called asorder code for theprocessor. Typical

examples include add a byte,

subtract a byte,

multiply a byte,

divide a byte,

input a byte,

output a byte,

move a byte,

compare a byte

Action Doing code

Load a byte 00000001

Store a byte 00000010

Add a byte 00000100

Subtract a byte 00000101


20/52

The idea of modern computer was first expoundedby John Von Neumann (1945)

The idea that instructions are held sequentially inthe memory and that the processor executes each

one in turn from lowest to highest address inmemory, unless otherwise instructed.

For this the processor maintains a record using theinternal counter register or sequence control

register or the program counter This is a small area in the memory that stores the

information about the next instruction theprocessor is about to execute


21/52

Processor will undergo a series of steps to execute. For eg: fetch, interpret, update, execute

The process is called fetch-decode-execute cycle.

Almost similar to a four stroke internal

combustion engine : fetch, interpret, update andexecute

Fetch step : - instruction is transferred frommemory to Instruction Register along the data bus

Unique bit patterns that make up the machinelanguage are extracted and sent todecoder/interpreter


22/52

Decoder/interpreter- recognizes which operation thebit pattern represents and activates the correct circuitryto perform the operation involves reading frommemory, storing data in memory, activating the ALU toperform a mathematical operation

Upon completion of its preparation to performinstruction the processor will then enter the updatestep. In this step the processor begins its program

counter so that it is ready for next instruction insequence.


23/52

Execute the action defined in the interpret stepis applied to the object defined in the interpretstep

To do this additional register as a scratchpad

for interim results and this is sometimes knownas an accumulator or general purpose register

After this the processor repeats the cycle with

the fetch step once again.


24/52


25/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

doing using

31

Counter gp

Processor

Looking Inside


26/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

doing using

31

Counter gp

Processor

Looking Inside


27/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

doing using

31

Counter gp

Processor

Looking Inside


28/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

doing using

31

Counter gp

Processor

Looking Inside


29/52

Four steps fetch, interpret, update, execute

Modern processors Pentium 4 appox. speedof operations can be 10,000MIPs2

The processor is connected to the mainmemory using the two buses the addressbus and the data bus; the third bus thecontrol bus concerned with control activitiessuch as the direction of data flow on the data

bus and the general timings of eventsthroughout the system.


30/52

The counter register in the processor holds

the address-where in the main memory, thenext instruction that the processor is toexecute the can be found. In this eg : 31

The doing and using registers are set ofinstruction registers used by the processor tointerpret the current instruction

The group register is the general purposescratchpad register


31/52

The in-built control mechanism of the cycle

clockwise through the four steps- fetch,interpret, update, execute

The rate at which the processor cycle isexecuted is controlled by system clock an thismay be running at many millions of cyclesper second


32/52

1. Fetch value of counter register decimal 31 is placed on

address bus by the processor & sent across tomemory in binary by means of eight parallelconnections

The memory is now requested to transfer copy ofwhat is there in 31 and 32(i.e., pattern of instruction)to the processor

Copies of 2 bytes are passed across the data busone after the other back to the processor

The processor upon receiving puts these in doingand using register


33/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

00000001 00000011

doing using

31

Counter gp

Processor

31

Processor puts 31 on address bus


34/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

00000001 00000011

doing using

31

Counter gp

Processor

31

Memory sends copies of bytes 31 and 32


35/52

Note : The handshaking process is a typical

way in which various parts of computersystem interact with one another

The request - sent across address bus

The results - returned across data bus


36/52

2. Interpret The patterns in the doing and using registers have

been interpreted as instructions Load a byte

The doing code 00000001 to be load a byte and

The using code 00000011 as the address of byte 3 The next processor moves on to execute step


37/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

load 3

doing using

31

Counter gp

Processor

Interpret as load byte 3


38/52

3. Update Here 2 has been added to the register so that it

holds the address of next instruction in sequence 33


39/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

load 3

doing using

33

Counter gp

Processor

Update counter to 33


40/52

4. Execute The instruction load byte 3 is carried out by the

processor

A copy of the using register (decimal 3) is placed onthe address bus by the processor and sent across tomemory in binary

This request the memory to transfer the processorover the data bus

The processor upon receiving places the value

01010011 in the general purpose register This completes the execution

The processor moves to next step of fetching thenext instruction


41/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

load 3

doing using

33

Counter gp

Processor


3


42/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

load 3

doing using

33 01010011

Counter gp

Processor

Memory sends copy of byte 3


43/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

load 3

doing using

33 01010011

Counter gp

Processor


33


44/52


45/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

00000101 00000100

doing using

33 01010011

Counter gp

Processor

Memory sends copies of bytes 33& 34

33


46/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

Subtract 4

doing using

35 01010011

Counter gp

Processor


4


47/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

Subtract 4

doing using

35 01000100

Counter gp

Processor


4

0101011 00001111 = 01000100


48/52


49/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

00000010 00000101

doing using

35 01000100

Counter gp

Processor


35


50/52

01010011 00001111

Byte 3 Byte 4

10011011

Byte 5

00000010 00000101

Byte 35 Byte 36

00000101 00000100

Byte 33 Byte 34

00000001 00000011

Byte 31 Byte 32

Memory

Fetch

interpret

update

execute

Store 5

doing using

35 01000100

Counter gp

Processor

Processor puts5 on address bus

5


51/52

This time the processor receives a byte. The processor achieves this by using the third

bus that is the control bus by setting aspecial write enable signal on that third bus

write action rather than a read action The process then goes on


52/52

Memory and Processor Address and data buses

Format of Instructions

The stored program concept

The processor mechanisms

Documents

IT Systems Concepts