Sunday, 22 November 2020

Describe the four clauses in the syntax of a simple SQL retrieval query.

 Question: 4.4. Describe the four clauses in the syntax of a simple SQL retrieval query. Show what type of constructs can be specified in each of the clauses. Which are required and which are optional?

Solution:

  1. SELECT
  2. FROM
  3. WHERE
  4. ORDER BY
  5. Limit

SELECT

List of attribute names to be received by the query

FROM

The tables that these attributes with be retrieved from

WHERE

Conditional boolean expression to identify certain tuples to be retrieved (optional)

ORDER BY

Attribute list to order the result by (optional)

LIMIT BY 

This is used to limit the number of rows (optional)

How does SQL allow implementation of the entity integrity and referential integrity constraints

 Question: 4.3. How does SQL allow implementation of the entity integrity and referential integrity constraints described in Chapter 3? What about referential triggered actions? 

Solution: 

Entity integrity

Referential integrity

Entity integrity constraints

In the entity integrity constraint, it states that no primary key value can be NULL because. Primary key value is used to identify the individual tuples in a relation. And having NULL values for the primary key implies that we cannot identify some tuples.

Referential integrity constraints

It is specified between two relations and is used to maintain the consistency among tuples in the two relations and referential integrity constraints states that, a tuple in one relation that refers to another relation and must refer to an existing tuple in that relation.

Referential triggered actions

Schema designer can specify an alternative action to taken when a referential integrity constraint is violated by attaching a referential triggered action clause to any foreign key constraint.

List the data types that are allowed for SQL attributes.

 Question: 4.2. List the data types that are allowed for SQL attributes. 

Solution:

Numeric data types

Integer numbers

  • INT
  • INTEGER
  • SMALLINT
  • BIGINT

Floating-point (real) numbers

  • REAL
  • DOUBLE
  • FLOAT

Fixed-point numbers

  • DECIMAL(n,m)
  • DEC(n,m)
  • NUMERIC(n,m)
  • NUM(n,m)

Character-string data types

Fixed length

  • CHAR(n)
  • CHARACTER(n)

Varying length

  • VARCHAR(n)
  • CHAR VARYING(n)
  • CHARACTER VARYING(n)

Long varchar

Large object data types

Characters:

CLOB

CHAR LARGE OBJECT

CHARACTER LARGE OBJECT

Bits

BLOB

BINARY LARGE OBJECT

Boolean data type

Values of TRUE or FALSE or NULL

DATE data type

Ten positions

Components are YEAR, MONTH, and DAY in the form YYYY-MM-DD

How do the relations (tables) in SQL differ from the relations defined formally

Questions 4.1. How do the relations (tables) in SQL differ from the relations defined formally in Chapter 3? Discuss the other differences in terminology. Why does SQL allow duplicate tuples in a table or in a query result?

Solution:  SQL allows a table to have more than one tuple that are identical in all their attribute values while others don't

The reasons why SQL allows duplicate tuples are

  • Duplicate elimination is an expensive operation
  • User may want to see duplicate tuples in the result of query

Sunday, 26 July 2020

remove number 12 from the array below

Q: Which of the following represents the method used to remove number 12 from the array below?
var values=[2, 4, 6, 10, 12]
a. values.remove(at: 4)
b. values.remove(at: 12)
c. values.append(12, at: 5)
d. remove("12")

Solution: values.remove(at: 4)

The above statement is used to remove the element 12 from array by using remove(at:index) method. 12 is at the index 4 , therefore at: 4 is used

The output will be 2 4 6 10 after removing 12.

Constant, Private Data Members

Question: Do not use C++ strings (or the string library) anywhere in the Routes application, in this v.1 or in any future versions. Let's get some experience using C strings. Also, the overhead is way less in this application using C strings.

Write Routes.1.cpp, to design and test a class that represents a leg of a route between two adjacent cities. Here are the specifications for the Leg class:

1. Constant, Private Data Members

Write three private data members: the starting city, the ending city, and the distance (in miles) separating the two.

Use constant, read-only pointers to store the city names as C strings. There will be no need to ever make copies of the names -- no strcpy . Names will be declared and stored in the main program, so all that needs to be stored in the Leg object are the memory locations of those C strings.

For the distance, use any numeric data type of your choosing -- you decide on whole numbers vs floating point. It will never change, so it needs to be constant.

2. Constructor Function(s)

Include one constructor with three parameters -- the start and end cities and the distance separating them. Do not include a default constructor! There can be no "generic" or uninitialized Leg. Each Leg is very specific and constant and unchanging.

3. Getter Function(s)

Write two getters -- one to return the distance and another to produce nicely formatted output.
The output getter would have one parameter -- an ostream reference, so that output can be directed to any stream-oriented source. The "nicely formatted output" should look something like this: "Leg: San Francisco to San Jose, 20 miles" but you decide on the exact appearance.

  • The declaration of the Leg class should be like,

4. An Array Of Leg Objects

In the main program declare an array of 40 or more Leg objects, each connecting two cities of your choice. They can be any pairs of cities that you choose, but follow these rules:

  • Do not make 40 legs where each new leg starts where the preceding leg ends. That is, do not make one long list of legs following Interstate 80 from San Francisco to New York City. Instead choose major cities across the United States, connecting adjacent cities.
  • Do include at least one set of 5 legs that do form a "route" when taken end-to-end. For this to happen you'll need to spell and case the end city of one leg exactly the same as the start city for some other leg so that they "connect".
  • Use sizeof to get the size of the Leg Objects array

It's okay to estimate the distances between cities -- exactness of your numbers will not be checked. But be reasonable!

5. Sort By Distance

In the main program write a nested-for-loop sorting code block, sorting the Leg objects in the array from shortest distance to longest. This will require swapping of objects, which will require an assignment operator function in the Leg class. Because there are constant data members, you should write an assignment operator function just because it's good programming practice -- but in this case, it's required because of the swapping.

6. Output

In a loop in the main program, call the output getter on each object in the array. The output should be arranged shortest to longest, because the sorting code block should be before the output code block in the main program. Refer to sample output from Files, Assignment5Part1.pdf

Actions

7. Do Not Add To The Public Interface As Specified

Do not add getters, setters, constructors, destructors, friends, or statics to a class, other than the ones specified. If a public function name is given in the specification, spell and case it exactly. If parameters are specified, write them exactly as specified -- do not add or remove parameters or change their type.

Do not add public data members unless specified. Public variables will never be specified, although public constants might be (in a future lab assignment). If that happens, name and case them exactly as specified.

Private members don't matter -- unless specifically told not to, you may add private functions and data.

My code:

#include <iostream>
#include <iomanip>
#include <string>

using namespace std;

class Leg
{
	const char* const startCity;
	const char* const endCity;
	const double distance;
	
	public:
	Leg(const char* const, const char* const, const double);
	Leg& operator=(const Leg&);
	double getDistance() const;
	void output(ostream&) const;
};

int main() 
{
	double arr[40];
	for(int i = 0; i < 40; i++)
	{
		arr[i] = rand() % 39 + 1.45;
	}
	Leg a[ ]={
		Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[2]),Leg("Albuquerque","Alexandria", arr[3]),
		Leg("Allentown","Amarillo", arr[4]),Leg("Anaheim","Anchorage", arr[5]),Leg("Ann Arbor","Antioch", arr[6]),
		Leg("Apple Valley","Appleton", arr[7]),Leg("Arlington","Arvada", arr[8]),Leg("Asheville","Athens", arr[9]),
		Leg("Atlanta","Atlantic City", arr[10]),Leg("Augusta","Aurora", arr[12]),Leg("Austin","Bakersfield", arr[12]),
		Leg("Baltimore","Barnstable", arr[13]),Leg("Baton Rouge","Beaumont", arr[14]),Leg("Bel Air","Bellevue", arr[15]),
		Leg("Berkeley","Bethlehem", arr[16]),Leg("Billings","Birmingham", arr[17]),Leg("Bloomington","Boise", arr[18]),
		Leg("Boise City","Bonita Springs", arr[19]),Leg("Boston","Boulder", arr[20]),Leg("Bremerton","Brighton", arr[21]),
		Leg("Brownsville","Bryan", arr[22]),Leg("Buffalo","Burbank", arr[23]),Leg("Cambridge","Canton", arr[24]),
		Leg("Cape Coral","Carrollton", arr[25]),Leg("Cary","Cathedral City", arr[26]),Leg("Cedar Rapids","Champaign", arr[27]),
		/*Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1])*/
		 };
		 const int SIZE = sizeof(a) / sizeof(a[0]);
		 for (int i = 0; i < SIZE; i++)
		 {
			 for (int j = i + 1; j < SIZE; j++)
			 {
				 if (arr[j] < arr[i])
				 swap(arr[j], arr[i]);
			 }
		}
}

double getDistance()
{
	return distance;
}

Leg& Leg::operator=(const Leg& copyThis) 
{
	if (this != &copyThis) 
	{
		const_cast<double&>(this->distance) = copyThis.distance;
		const_cast<const char* &>(this->startCity) = copyThis.startCity;
		const_cast<const char* &>(this->endCity) = copyThis.endCity;
	}
	return *this;
}

Solution:

#include <iostream>
#include <iomanip>
#include <cstdlib>

using namespace std;

class Leg
{
	const char* const startCity;
	const char* const endCity;
	const double distance;
	public:
	Leg(const char* const, const char* const, const double);
	Leg& operator=(const Leg&);
	double getDistance() const;
	void output(ostream&) const;
};

// constructor
Leg::Leg(const char* startCity, const char* endCity, const double distance): startCity(startCity), endCity(endCity), distance(distance)
{
}

// return the distance
double Leg:: getDistance() const
{
	return distance;
}

// assignment operator
Leg& Leg::operator=(const Leg& copyThis) 
{
	// avoid self assignment
	if (this != &copyThis) 
	{
		const_cast<double&>(this->distance) = copyThis.distance;
		const_cast<const char* &>(this->startCity) = copyThis.startCity;
		const_cast<const char* &>(this->endCity) = copyThis.endCity;
	}
	return *this;
}

// output the Leg object details to out
void Leg:: output(ostream& out) const
{
	out<<"Leg: "<<startCity<<" to "<<endCity<<", "<<fixed<<setprecision(2)<<distance<<" miles"<<endl;
}

int main()
{
	double arr[40];
	// create an array of random distances
	for(int i = 0; i < 40; i++)
	{
		arr[i] = rand() % 39 + 1.45;
	}
	// create an array of Leg objects
	Leg a[]={
		Leg("Aberdeen","Abilene", arr[1]),
		Leg("Akron","Albany", arr[2]),
		Leg("Albuquerque","Alexandria", arr[3]),
		Leg("Allentown","Amarillo", arr[4]),
		Leg("Anaheim","Anchorage", arr[5]),
		Leg("Ann Arbor","Antioch", arr[6]),
		Leg("Apple Valley","Appleton", arr[7]),
		Leg("Arlington","Arvada", arr[8]),
		Leg("Asheville","Athens", arr[9]),
		Leg("Atlanta","Atlantic City", arr[10]),
		Leg("Augusta","Aurora", arr[12]),
		Leg("Austin","Bakersfield", arr[12]),
		Leg("Baltimore","Barnstable", arr[13]),
		Leg("Baton Rouge","Beaumont", arr[14]),
		Leg("Bel Air","Bellevue", arr[15]),
		Leg("Berkeley","Bethlehem", arr[16]),
		Leg("Billings","Birmingham", arr[17]),
		Leg("Bloomington","Boise", arr[18]),
		Leg("Boise City","Bonita Springs", arr[19]),
		Leg("Boston","Boulder", arr[20]),
		Leg("Bremerton","Brighton", arr[21]),
		Leg("Brownsville","Bryan", arr[22]),
		Leg("Buffalo","Burbank", arr[23]),
		Leg("Cambridge","Canton", arr[24]),
		Leg("Cape Coral","Carrollton", arr[25]),
		Leg("Cary","Cathedral City", arr[26]),
		Leg("Cedar Rapids","Champaign", arr[27])
		/*Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1]),Leg("Akron","Albany", arr[1]),Leg("Albuquerque","Alexandria", arr[1]),
		 * Leg("Aberdeen","Abilene", arr[1])*/
	};
	const int SIZE = sizeof(a) / sizeof(a[0]);
	// sort the leg objects in ascending order based on their distance
	int min;
	for(int i=0;i<SIZE-1;i++)
	{
		 min = i;
		 for(int j=i+1;j<SIZE;j++)
		 {
			 if(a[j].getDistance() < a[min].getDistance())
			 min = j;
		 }
		 if(min != i)
		 {
			 Leg temp = a[i];
			 a[i] = a[min];
			 a[min] = temp;
		 }
	}
	// display the sorted order of Leg objects
	for(int i=0;i<SIZE;i++)
		a[i].output(cout);
	return 0;
}
//end of program


Output:


Tuesday, 14 July 2020

Compute the sum of odd numbers

Q: Compute the sum of odd numbers up to a given odd number n.
Input: n
Function: oddsum(n) = 1 + 3 + ...+ (n-2) + n.
Output: oddsum (n)
Examples: oddsum(3) = 4, oddsum(5)=9; oddsum(7)=16.
You may assume the number n is odd.
Use the iterative algoithm such as;
      sum = 0;
      counter = 1;
      while (counter <= n) {
          sum =sum + counter;
          counter= counter + 2;
      }

Solution:

#include <iostream>
using namespace std;

void oddsum(int n)
{
	int sum = 0; // variable initialized to compute the sum
	int counter = 1; // variable to counter loop
	while (counter <= n)
	{
		sum = sum + counter;
		counter = counter + 2;
	}
	cout << "The sum is " << sum;
}

int main()
{
	int n;
	cout << "Enter a number: ";
	cin >> n;
	oddsum(n);

	return 0;
}

Screenshot




Thursday, 2 July 2020

Autopsy Training Quiz

Q1: What are the two different ways that you can deploy Autopsy?
Solution:
"Desktop/Single-User" and "Cluster/Multi-User"

Q2: What are two benefits of utilizing a multi-user Autopsy deployment?
Solution:
+ Allows for "Auto-Ingest" mode, where new media is automatically analyzed 24 x 7 by multiple nodes
+ Analysis can be faster (if you have fast hardware)

Q3: True or False: One of the primary reasons for having the Central Repository is that it allows you to easily access metadata from past cases
Solution:
True

Q4: True or False: You can store hash sets in the Central Repository that can be shared by everyone in the lab.
Solution:
True

Q5: What are the two types of databases supported by a Central Repository deployment?
Solution:
+ SQLite
+ PostgresSQL

Q6: Step 1 of the Basic Investigation Autopsy Workflow is to make a Case. True or False: Step 2 to add a data source to the case.
Solution:
True

Q7: True or False: You can have multiple versions of Autopsy installed on an endpoint at the same time
Solution:
True

Q8: True or False: Running on OSX or Linux requires more manual steps that are outlined in Running_Linux_OSX.txt.
Solution:
True

Q9: True or False: For all Autopsy releases prior to Autopsy 4.15, the Central Repository is enabled by default.
Solution:
False

Q10: What are the minimum resources needed for a multi-user Autopsy deployment?
Solution:
Central Shared Storage and 2 Servers

Q11: True or False: Autopsy needs to be installed on each examiner's computer, whether using a single-user or multi-user deployment
Solution:
True

Q12: True or False: Autopsy supports Machine Translation integration from Google and Microsoft
Solution:
True

Q13: True or False: In a multi-user cluster, all examiners need to have access to the case directory at the same path (i.e. \\server\cases\ or Z:\Cases)
Solution:
True

Q14: Autopsy is able to ingest the following data sources directly:
Solution:
+ Disk Image or VM file
+ Logical files

Q15: True or False: When adding a data source to Autopsy, in-depth analysis on the data is automatically performed
Solution:
False

Q16: True or False: The Autopsy case database stores a full copy of every single file contained within a data source
Solution:
False

Q17: Autopsy supports many volume systems, including:
Solution:
+ DOS
+ BSD
+ GPT

Q18: Autopsy supports many file system formats, including:
Solution:
+ FAT32
+ YAFFS2
+ HFS+
+ Ext4
+ NTFS

Q19: Orphan files in Autopsy are stored under the $OrphanFile folder. What is an orphan file?
Solution:
A deleted file that no longer has a parent folder.

Q20: What types of disk images are currently NOT NATIVELY SUPPORTED by Autopsy
Solution:
+ Bitlocker
+ RAID

Q21: True or False: When adding "Local Files and Folders" to a case in Autopsy, file times are added to the database
Solution:
False

Q22: True or False: When adding an E01 file to a case within Autopsy, the E01 file is automatically validated upon import
Solution:
False

Q23: How many volumes does the disk image have?
Solution:
6

Q24: What is the name of the unallocated space file in vol1?
Solution:
Unalloc_3_0_1048576

Q25: What file system is in vol7?
Solution:
NTFS

Q26: What is the database called?
Solution:
autopsy.db

Q27: Roughly how big is the case database (in megabytes)?
Solution:
250MB

Q28: The Tree Structure within Autopsy has five (5) top-level nodes, including:
Solution:
+ Data Sources
+ Results
+ Tags

Q29: If you want to immediately see all picture files after adding a data source, you should use the View that uses Extension or MIME type?
Solution:
Extension

Q30: Grouping the tree by data source can be useful when:
Solution:
You have data sources from several suspects in the same case.

Q31: True or False: A red icon under the "S" (Score) column under the Table in Autopsy means that the file is corrupted and cannot be recovered
Solution:
False

Q32: True or False: The "Text / Strings" content viewer contains only words are found in a standard English dictionary
Solution:
False

Q33: True or False: By selecting any item within the "Table", you can then type in a search term that looks for matching results within that column
Solution:
True

Q34: What actions are available to a user when right clicking on a file within Autopsy?
Solution:
+ Extract File(s)
+ Open in External Viewer

Q35: True or False: The "Other Occurrences" content viewer area allows you to see if the file existed in a previous case.
Solution:
True

Q36: True or False: The "Application" content viewer allows users to render html files as they were viewed in a web browser
Solution:
True

Q37: True or False: Video Triage is a free download from "autopsy.com" that allows users to see screen captures of portions of a video file without having to actually play back a video
Solution:
True

Q38: True or False: The "Timeline" interface shows events and file data sorted by file size
Solution:
False

Q39: By extension, how many databases are there?
Solution:
Fifty nine (59)

Q40: What is the size of the largest database?
Solution:
5242880 bytes

Q41: Are there any databases by MIME type yet?
Solution:
No, because file types have not been yet determined.

Q42: Select the names of the files between 200MB and 1GB in size:
Solution:
+ $BadClus:$Bad
+ Winre.wim
+ chrome.7z

Q43: What are the two types of Ingest Modules utilized by Autopsy?
Solution:
+ File Ingest Modules
+ Data Source Ingest Modules

Q44: True or False: Ingest modules can run in parallel
Solution:
True

Q45: Autopsy prioritizes files so that important ones are analyzed first. The priority order is:
Solution:
User Folders, Program Files and other root folders, Windows folder, Unallocated space

Q46: What are some of the "official" ingest modules that are included with the download of Autopsy?
Solution:
+ Email
+ Hash Lookup

Q47: Which of the following are types of data that will be stored as a Blackboard artifact?
Solution:
+ Hash Hit
+ Encryption Detected

Q48: A Blackboard artifact is a _____ and ______ pair
Solution:
Type, Value

Q49: True or False: The "Hash Lookup" can calculate the MD5 hash of a file.
Solution:
True

Q50: What are some reasons on why a user would run the "Hash Lookup" module?
Solution:
+ To include MD5 hash values in reports
+ To identify notable ('known bad') files

Q51: What hash set formats does Autopsy currently support
Solution:
+ EnCase
+ NIST NSRL
+ md5sum

Q52: What two places will show you the files in the case that were found in a hash set?
Solution:
+ Ingest Inbox
+ In the Hashset Hits part of the tree

Q53: To make your own hash set from scratch, you'd choose which button from the Options -> Hash Sets panel?
Solution:
New Hash Set

Q54: To add a hash set that a colleague shared with you, you'd choose which button from the Options -> Hash Sets panel?
Solution:
Import Hash Set

Q55: True or False: An index allows Autopsy to lookup hash values faster.
Solution:
True

Q56: Where should you get the pre-indexed version of the NIST NSRL?
Solution:
From the Autopsy site

Q57: True or False: If a hash set is stored on the Central Repository then only one user can access it
Solution:
False

Q58: How many total hits are found under the “Hashset Hits” results after running the Hash Lookup Ingest Module?
Solution:
Six (6)

Q59: What are the filenames of the hash hits?
Solution:
"RN.jpg" and "f_000239"

Q60: Question: How many total ".jpg" files are in the folder “Pictures” where the notable hash hit was found?
Solution:
Seven (7)

Q61: What type of file does the MIME type "application/octet-stream" designate?
Solution:
Unknown type

Q62: What types of data can be stored in EXIF data?
Solution:
+ Camera Type
+ Geolocation coordinates of where the photo was taken
+ Date and Time of when a photo was taken

Q63: The Exif module extracts:
Solution:
A subset of Exif data that is most often relevant to an investigation

Q64: The Embedded File Extractor ingest module has the ability to extract files from:
Solution:
+ Compressed files, such as RAR, ZIP, 7Z, etc.
+ Images from PDF documents
+ Images from Office documents

Q65: True or False: The Embedded File Extractor ingest module will flag a file if it is password protected
Solution:
True

Q66: True or False: If a ZIP file has a password, you can supply the password by right clicking on the file.
Solution:
True

Q67: The Email Module searches for and processes email from known email file types, including:
Solution:
+ MBOX
+ PST
+ EML

Q68: True or False: You can make rules for the Interesting Files module to automate your checklist of applications to always look for (such as BitCoin and Cloud Storage).
Solution:
True

Q69: The Encryption Detection Module detects files that may be encrypted by looking for what characteristics?
Solution:
High entropy, multiple of 512 bytes, no distinguishable file type

Q70: True or False: The Plaso module is enabled by default
Solution:
False

Q71: The Virtual Machine Extractor module will:
Solution:
Detect virtual machine files (vmdk, vhdi, etc.) and add them back in as a data source

Q72: The Data Source Integrity module will do what to a disk image:
Solution:
Calculate its hash value

Q73: Under the “Exif Metadata results, how many photos were taken with an iPhone 7 Plus?
Solution:
One (1)

Q74: Under the “Exif Metadata results, how many photos were taken with a BLU R1 HD?
Solution:
Fifteen (15)

Q75: Under the “Exif Metadata results, how many photos were taken with a Samsung Galaxy S8?
Solution:
Zero (0)

Q76: What is the MIME type listed for the file “D3D11_Default.shader-db.bin”?
Solution:
application/octet-stream

Q77: What is the file size, in bytes, for the file “D3D11_Default.shader-db.bin”?
Solution:
594728

Q78: Are there extension mismatch results?
Solution:
Yes

Q79: What are some common file types with unexpected extensions?
Solution:
png

Q80: Was veracrypt.exe found on the system?
Solution:
Yes

Q81: Was the executable file "truecrype.exe" found on the system?
Solution:
No

Q82: What types of user activity does the "Recent Activity" module extract?
Solution:
+ Web Activity (Bookmarks, Cookies, etc.)
+ Installed Programs
+ Recycle Bin Analysis

Q83: True or False: The Recent Activity module can be configured by a user to only parse out certain types of data
Solution:
False

Q84: The Recent Activity Module automatically parses browsing history for what web browsers?
Solution:
+ Chrome
+ Internet Explorer
+ Edge
+ Safari
+ Firefox

Q85: True or False: The Recent Activity module creates a deleted file entry in the location where a file in the Recycle Bin originally existed
Solution:
True

Q86: True or False: Web Form Autofill data extracts name and value pairs that are entered into web forms
Solution:
True

Q87: What open source tool does Autopsy rely upon to perform analysis of Registry Hives?
Solution:
RegRipper

Q88: What are some attributes of connected USB devices that can be extracted using RegRipper?
Solution:
+ Device Model
+ Device Make
+ Device ID

Q89: True or False: You can access the raw RegRipper output in the Reports part of the tree.
Solution:
True

Q90: How many web bookmarks are listed?
Solution:
Five (5)

Q91: What URL is a suspicious bookmark given the dognapping?
Solution:
ransomizer.com

Q92: What month and year are the cookies associated with the domain “youtube.com” from?
Solution:
November 2019

Q93: What is the Value associated with the Name “identifier” under Web Form Autofill?
Solution:
antirenzik@gmail.com

Q94: Under "Web History", what is the day associated with the Google Search "how to treat a dog bite"?
Solution:
November 12, 2019

Q95: Under "Web History", what day is associated with the Google Search "how to make a ransom note"?
Solution:
November 5, 2019

Q96: Under "Web History", what is the date (in YYYY-MM-DD format) associated with the Google Search "hostage negotiation tactics"?
Solution:
2019-11-05

Q97: What was likely original name of the file "$RFC5YC5.txt", that is currently located in the Recycle Bin?
Solution:
VCPW.txt

Q98: Under Accounts, what is the username associated with the Twitter account found on the device?
Solution:
AntiRenzik

Q99: True or False: A text index is an organized collection of words and the files that contain them.
Solution:
True

Q100: Autopsy uses what open source search enginge for text indexing?
Solution:
Apache Solr

Q101: Due to shortcomings by a majority of widely available extraction tools, Basis Technology wrote a custom text extractor for what data type in order to process things such as comments and Javascript?
Solution:
HTML

Q102: True or False: The more encodings and languages that you add for strings extraction, the less false positives that you get
Solution:
False

Q103: True or False: Autopsy will normalize text within the index to make all searches case insensitive
Solution:
True

Q104: Once you have a text index, you can perform all of the following types of searches:
Solution:
+ Exact matches
+ Substrings
+ Regular expressions

Q105: True or False: Substring match is the default text match search within Autopsy
Solution:
False

Q106: When viewing an individual file that contains a keyword search hit, that keyword is ...
Solution:
Highlighted

Q107: True or False: Keyword lists can be exported and imported.
Solution:
True

Q108: There are references to a document with renzik. What is the name of the file?
Solution:
in order to ensure that renzik is treated properly.docx

Q109: How many hits are there for “Renzik” in NTUSER.DAT?
Solution:
Ten (10) - (Four (4) on one page, Six (6) on another)

Q110: What type(s) of data from past cases are stored in the Central Repository?
Solution:
+ MD5 hash values
+ Wifi SSID

Q111: True or False: There is one row in the Central Repository for every instance of a property
Solution:
True

Q112: True or False: USB devices will never be flagged if they were previously seen
Solution:
False

Q113: True or False: The correlation engine module extracts and calculates data, such as hash values
Solution:
False

Q114: The Correlation Engine module has two basic features, which are
Solution:
Query Central Repository, to see if items in current case were previously seen, and adding data to Central Repository

Q115: True or False: The Correlation engine module can be configured to generate alerts based on the existence of previously seen data.
Solution:
True

Q116: True or False: The Correlation Engine module does not rely on other modules obtain data that is inserted into the Central Repository
Solution:
False

Q117: What was the created date (in YYYY-MM-DD format) of the file "IMG_20191024_155744.jpg" on the media card?
Solution:
2019-10-24

Q118: How many total .jpg files are in the folder where the interesting file is located on the media card?
Solution:
Five (5)

Q119: Was the file "IMG_20191024_155744.jpg" seen in any other folders/and or directories on the hard drive? If so, what was the name of the other file(s)?
Solution:
Yes, "f_00022e"

Q120: What types of data are currently able to be extracted and parsed from an Android device?
Solution:
+ Call Logs
+ WhatsApp

Q121: True or False: Android Analyzer only parses data from native Android applications. It cannot parse any third party Android applications
Solution:
False

Q122: True or False: Autopsy cannot acquire data directly from an Android device
Solution:
True

Q123: What types of artifacts can be created by the Android Analyzer?
Solution:
+ Messages
+ GPS Points

Q124: Select the three main areas of the layout of the timeline interface.
Solution:
+ Filters
+ Events
+ Files and Content

Q125: True or False: The timeline feature allows an analyst to view a graphical representation of time based events that occurred on a system
Solution:
True

Q126: True or False: The timeline interface extracts data does not rely on other modules to extract time stamps
Solution:
False

Q127: What are the three "Views" that an analyst can choose from to display timeline data?
Solution:
+ Counts
+ Details
+ List

Q128: True or False: The default scale of the "counts" view is linear.
Solution:
False

Q129: True or False: In the Details View, you "Expand" a cluster to see more details.
Solution:
True

Q130: An analyst can ______ clusters to bring them to the top of the Details view.
Solution:
Pin

Q131: In the List View, the letter "A" under Event Type stands for ________?
Solution:
Last Accessed

Q132: In the List View, the letter "B" under Event Type stands for ________?
Solution:
Born Date

Q133: The "Law Enforcement Bundle", a free add-on provided by Basis Technology, provides access to which of the following databases?
Solution:
+ C4ALL
+ Project Vic

Q134: Image Gallery folders are prioritized based on ________
Solution:
Density of hash hits and number of images in folder

Q135: True or False: A purple dashed line around an image indicates that it was taken with an iPhone
Solution:
False

Q136: True or False: The Image Gallery provides an infinite scroll bar of thumbnails
Solution:
False

Q137: What is the name of the button that will take an analyst to the next group of Image Gallery photos?
Solution:
Next Unseen group

Q138: True or False: The C4ALL database with MD5 hashes are provided by Basis Technology
Solution:
False

Q139: How can Autopsy integrate with Project Vic?
Solution:
By importing hash values into hash sets named based on their categories.

Q140: True or False: Accounts in Autopsy have both a "type" and a unique "identifier"
Solution:
True

Q141: True or False: The Communications Interface is oriented around data types, and not accounts
Solution:
False

Q142: A special account that is created by Autopsy for a data source when it doesn't know what account was used is called a _______ account
Solution:
Device

Q143: What are two modules that the Communications Interface relies upon to extract communication-related data?
Solution:
+ Android Analyzer
+ Email

Q144: Which of the following are Account Types that can be identified within the Communications Interface within Autopsy?
Solution:
+ Phone
+ Website
+ Facebook
+ Twitter
+ Email

Q145: True or False: By default, accounts are sorted by the number of relationships they have in the case.
Solution:
True

Q146: True or False: Tagging allows a user to reference a file or object to easily find it later
Solution:
True

Q147: Which of the following choices can be the name of a tag within Autopsy?
Solution:
+ Brian Carrier
+ Suspicious
+ Encryption
+ Kubernetes
+ Blockchain

Q148: True or False: When viewing a result (aka a Blackboard Artifact) you have the choice to tag either the result or its source file
Solution:
True

Q149: True or False: You can tag an image, but you cannot tag a specific region of an image
Solution:
False

Q150: True or False: In a multi-user environment, tags are associated with the examiner who made them
Solution:
True

Q151: Which of the following are valid comments that can be saved along with a Tag?
Solution:
+ Spy plane
+ Tornado
+ Shield
+ Arc Reactor

Q152: What is the name of the button that an analyst clicks within Autopsy to begin the report generation process?
Solution:
Generate Report

Q153: What are some benefits of a Portable Case?
Solution:
+ Self contained and all relevant files are located in the case folder
+ Can be shared with another user for review or assistance
+ Decrease the overall size of data to review

Q154: True or False: When creating an HTML Result report within Autopsy, an analyst cannot change the default image with their own agency/corporate logo
Solution:
False

Q155: When generating a KML report, what items can be contained within the final KML report?
Solution: + Thumbnails of EXIF images
+ EXIF artifacts
+ GPS Route

Saturday, 20 June 2020

Homework on Textbook Sections 5.4, 5.10, 5.7, 5.8, 5.13

For Questions 1 and 2
Suppose we have a processor with a base CPI of 1.3, assuming all references hit in the primary cache, and a clock rate of 1GHz. Assume a main memory access time of 150ns, including all the miss handling. Suppose the miss rate per instruction at the primary cache is 4%.
Question 1
What is the actual CPI?
Solution: 7.3

Question 2
How much faster will the processor be if we add a secondary cache that has a 10 ns access time and is large enough that the global miss rate to main memory is 1%?
Solution:
2.2813

For Questions 5 to 8
The RISC-V 32-bit architecture supports virtual memory with 32-bit virtual addresses mapping to 32-bit physical addresses. The page size is 4Kbytes, and page table entries (PTEs) are 4 bytes each.
Translation is performed using a 2-level page table structure. Bits 31:22 of a virtual address index the first-level page table. If the selected first-level PTE is valid, it points to a second-level page table. Bits 21:12 of the virtual address then index that second-level page table. If the selected second-level PTE is valid, it points to the physical page.

Question 5
How many bytes are required for the first-level page table?
Solution:
4,096

Question 6
How many bytes are required for a second-level page table?
Solution:
4,096

Question 7
If the entire virtual address space were allocated, how many bytes would be required for page tables?
Solution:
4,198,400

Question 8: If the following ranges of virtual addresses are allocated:

    0x00000000 to 0x011FFFFF
    0x10000000 to 0x1FFFFFFF
    0x7FC00000 to 0x7FFFFFFF

How many bytes would be required for page tables?
Solution:
290,816

Quiz on Textbook Sections 5.7, 5.8, 5.13

Question 1:
Match the following descriptions to the terms defined:

A technique that uses main memory as a “cache” for secondary storage
Solution: virtual memory

An address in main memory
Solution: physical address

An address that corresponds to a location in virtual space and is translated by address mapping to a physical address when memory is accessed
Solution: virtual memory

The process by which a virtual address is mapped to an address used to access memory
Solution: address translation

Question 2:
In paged virtual memory, a virtual address is divided into a virtual page number and an offset within the page. The virtual page number is translated into a physical page number. The physical page number is joined with the offset to form the physical address.
Solution: True

Question 3:
Where is the page table located, and how is it found?
Solution: Located in physical memory at an address given by the Page Table Register

Question 4:
If a page of virtual memory is not resident in main memory, how is the page accessed?
Solution: When translating the virtual address, the valid bit in the page table entry is found to be 0. An exception occurs, and the handler reads the page from secondary storage.

Question 5:
Why does a virtual memory system require a translation lookaside buffer (TLB)?

Solution: Without it, each virtual memory access would require two physical memory accesses, one for the page table entry and one for the translated location.

Question 6:
What is the purpose of the reference bit in a page table entry?
Solution: It is used to implement approximate LRU replacement, by being set whenever the corresponding page is accessed.

Question 7:
Some processors use hardware to deal with a TLB miss, with circuits that locate the required PTE in physical memory and read it into the TLB. Other processors raise an exception on TLB miss and require the handler to read the PTE into the TLB. RISC-V uses the second approach.
Solution: True

Question 8:
Cache memory and virtual memory operate in different ways, since cache relies on locality of reference, whereas virtual memory does not.
Solution: False

Question 9
Match the following descriptions of causes of misses with the terms defined:

A cache miss caused by the first access to a block that has never been in the cache.
Solution:
compulsory miss

A cache miss that occurs because the cache, even with full associativity, cannot contain all the blocks needed to satisfy the request.
Solution:
capacity miss
           
A cache miss that occurs in a set-associative or direct-mapped cache when multiple blocks compete for the same set and that are eliminated in a fully associative cache of the same size.
Solution:
conflict miss        

 Question 10
What is meant by the term "nonblocking cache"?
Solution:
A cache that allows an out-of-order processor to make references to the cache while the cache is handling an earlier miss.

Thursday, 14 May 2020

Quiz on Textbook Sections 5.4 and 5.10

Question 2: The average memory access time (AMAT) is the average time to access memory, considering both hits and misses, for various kinds of memory accesses.

Solution:


True

Question 4: Match the following descriptions to the terms defined:

Solution:

A cache structure in which a block can be placed in any location in the cache

fully associative cache

A cache that has a fixed number of locations (at least two) where each block can be placed.
set-associative cache

A cache that has a single location in which each block can be placed.
direct-mapped cache

Question 6: Least recently used (LRU) replacement refers to a scheme in which the entry in a set selected for replacement on a miss is the one that has been unused for the least time.

Solution:

False

Question 7: In a multi-level cache system, the miss penalty for the first-level cache is:

Solution:


The number of cycles required to access the second-level cache

Question 8: A dynamically-scheduled processor with out-of-order execution can hide cache-miss latency by executing other independent instructions while the missed word is read from memory.

Solution:


True

Question 9: Match the following descriptions to the terms defined:

Solution:

The property of a memory system that any read of a data item returns the most recently written value of that data item.

coherence

The property of a memory system that determines when a written value will be returned by a read.
consistency

Homework on Textbook Sections 4.7 to 4.11, 5.1 to 5.3

For Questions 1 to 5: In the following code sequence, we need to stall the RISC-V pipeline to resolve the load-use data hazard:

i1: ld   x8, 0(x$5)
i2: add  x9, x8, x10
i3: addi x9, x9, -1
i4: sd   x9, 0(x5)

Consider the cycle when i1 is in the EX stage, i2 is in the ID stage, and i3 is in the IF stage.

Question 1: What is the value of ID/EX.MemRead in this cycle?

Solution:


1

Question 2: What is the value of ID/EX.RegisterRd in this cycle?

Solution:


8

Question 3: What is the value of IF/ID.RegisterRs1 in this cycle?

Solution:


8

Question 4: What is the value of IF/ID.RegisterRs2 in this cycle?

Solution:


10

Question 5: Which instruction (i1, i2, i3, or i4) will be fetch by the IF stage in the next cycle?

Solution:


i3

Question 8: For the 2-bit branch predictor shown in Figure 4.61, label the states anti-clockwise from the bottom left as 0, 1, 2 and 3, as shown below.

Assume the initial state for a branch is state 0. A given branch has the following history (T = taken, N = not taken):

N, N, T, T, T, N, N

What is the state of the predictor after this history?

Solution:


1

For Questions 11 to 15: Consider a system using 28-bit addresses, with a direct-mapped cache of 32Kbytes and a block size of 64 bytes. The cache uses a write-through/no-allocate strategy without a write buffer.

Question 11: How many bits are required for the offset field of an address?

Solution:


6

Question 12: How many bits are required for the index field of an address?

Solution:


9

Question 13:

How many bits are required for the tag field of an address?

Solution:


13

Question 14: How many bits of storage are required for the cache, in addition to those for data storage?

Solution:

7,168


Quiz on Textbook Sections 5.1 to 5.3

Question 1: Match the following descriptions to the defined terms.

Solution:


The principle stating that if a data location is referenced then it will tend to be referenced again soon.
temporal locality

The locality principle stating that if a data location is referenced, data locations with nearby addresses will tend to be referenced soon.
spatial locality

Question 3: For a given level of a memory hierarchy, miss rate + hit rate = 1.

Solution:


True

Question 5: Match the following descriptions to the terms defined.

Solution:

One of thousands of concentric circles that makes up the surface of a magnetic disk.

track

One of the segments that make up a track on a magnetic disk.
sector

All of the tracks under the heads at a given point on all surfaces of a disk drive.
cylinder

The process of positioning a read/write head over the proper track on a disk.

seek

The time required for the desired sector of a disk to rotate under the read/write head.
rotational latency

Question 6: In a direct-mapped cache structure, each memory location is mapped to exactly one location in the cache.

Solution:


True

Question 10:  If a miss occurs in a direct-mapped write-back cache and the block to be replaced is not dirty, the block must still be written back to memory.

Solution:


False

Quiz on Textbook Sections 4.7 to 4.11

Question 1: In the following RISC-V instruction sequence executed in the 5-stage pipeline, which instructions use forwarded data?

i1:  sub  x2, x1, x3    # Register x2 written by sub
i2:  and  x12, x2, x5   # 1st operand (x2) depends on sub
i3:  or   x13, x6, x2   # 2nd operand (x2) depends on sub
i4:  add  x14, x2, x2   # 1st (x2) and 2nd (x2) depend on sub
i5:  sd   x15, 100(x2)  # Base (x2) depends on sub

Solution:


i2 and i3

Question 2: In the case of a load-use data hazard, how does the pipeline stall the instruction using the loaded data?

Solution:


It prevents update of the PC and IF/ID pipeline registers, and sets the control values for EX, MEM and WB to 0 in the ID/EX pipeline register.

Question 3: If branch computation is moved from the EX stage to the ID stage, forwarding paths are required from the EX/MEM and MEM/WB pipeline registers to the branch comparison logic in the ID stage.

Solution:


True

Question 4: Match the following descriptions to the correct terms.

Solution:

Prediction of branches at runtime using runtime information.

dynamic branch prediction

A small memory that is indexed using the address of the branch instruction and that contains bits indicating whether the branch was recently taken or not.
branch prediction buffer

A structure that caches the destination PC or destination instruction for a branch.

branch target buffer

A branch predictor with multiple predictions for each branch and a selection mechanism that chooses which predictor to enable for a given branch.

tournament branch predictor

Question 5: Which of the following events would cause an exception or interrupt in a RISC-V computer system?

Solution:


A request from an I/O device
An undefined instruction
An operating system request from a user program

Question 6: In a static dual-issue processor with 5 pipeline stages, what is the maximum number of instructions that can be in progress at any time?

Solution:


10

Question 7: Loop unrolling is a technique to get more performance from loops that access arrays, in which multiple copies of the loop body are made and instructions from different iterations are scheduled together.

Solution:


True

Question 8: Match the following descriptions to the defined terms.

Solution:


Hardware support for reordering the order of instruction execution so as to avoid stalls.
dynamic scheduling

A situation in pipelined execution when an instruction blocked from executing does not cause the following instructions to wait.
out-of-order execution

A commit in which the results of pipelined execution are written to the programmer visible state in the same order that instructions are fetched.
in-order commit

The buffer that holds results in a dynamically scheduled processor until it is safe to store the results to memory or a register.
reorder buffer

Question 9: Which of the following correctly describes the ARM Cortex-A8 processor?

Solution:


Dynamic multiple-issue, static in-order pipeline scheduling

Question 10: Which of the following correctly describes the Intel Core i7 920 processor?

Solution:


Dynamic multiple-issue, dynamic out-of-order pipeline scheduling

Homework on Textbook Sections 4.1 to 4.6

For Questions 1 to 11: Questions 1 to 11 deal with the processor datapath and control shown in Figure 4.17 of the textbook, executing the following instruction, located at address 0x0000000000204014 in the instruction memory:
sd x7, 0x18(x24)

Question 1: What is the value of the Branch control signal?

Solution:


0

Question 2:  What is the value of the MemRead control signal?

Solution:


0

Question 3: What is the value of the MemtoReg control signal?

Solution:


X

Question 4: What is the value of the ALUOp control signal, expressed in binary?

Solution:


00

Question 5: What is the value of the MemWrite control signal?

Solution:


1

Question 6: What is the value of the ALUSrc control signal?

Solution:


1

Question 7: What is the value of the RegWrite control signal?

Solution:


0

Question 8: What is the output value of the ALU Control block, expressed in binary?

Solution:


0010

Question 9: What is the output value of the ALU source multiplexer, expressed in hex?

Solution:


0X0000000000000018

Question 10: What is the value of the Zero output flag of the ALU?

Solution:

0

Question 11: What is the output value of the branch target adder, expressed in hex?

Solution:


0X0000000000204044

For Questions 12 and 13: Suppose the blocks in Figure 4.17 of the textbook have latencies shown in the following table.

 Block Latency
 PC read 20ps
 PC setup 15ps
 I-Mem 250ps
 Add 70ps
 Shift-left-1
 5ps
 Mux 20ps
 Regs read 150ps
 Regs setup 15ps
 Imm Gen 10ps
 ALU 100ps
 D-Mem 350ps
 Control 80ps
 ALU Ctrl 30ps

Question 12: What is the minimum clock period for this processor (in ps)?

Solution:


905

Question 13: Adding a multiplier to the ALU results in 100ps additional latency. However, it reduces the number of instructions needed in a program, since multiplications no longer need to be emulated in software. What fraction of the original instruction count must the reduced instruction count be to match the performance of the original processor?

Solution:


0.9005

For Questions 14 to 16: A 5-stage pipelined version of the RISC-V processor has the following latencies for the stages, including the overhead for pipeline registers between stages:

 IF ID EX MEM WB
 500ps 300ps 400ps 600ps 100ps

Question 14: What is the maximum clock frequency (in GHz) for this processor?

Solution:


1.67

Question 15: Suppose you can divide the IF stage into two stages, each with latency 300ps, but with a cost increase of 5%. Similarly, you can divide the MEM stage into two stages, each with 350ps latency, but with cost increase of 5%. If you are only allowed to chose one of these options, what would the resulting maximum clock frequency be (in GHz)?

Solution:


2

Question 16: If you are allowed to chose both options from Question 15 based on best cost/performance, decide whether to chose one or both options. What is the maximum clock frequency (in GHz) based on your choice?

Solution:


2.5

Question 20: In Section 4.5 of the textbook, on page 272, it is suggested that the hardware for branch processing (register comparison, target address calculation and PC update) all be included in the second stage of the pipeline (the ID stage). What is the speedup of this hardware change compared to the pipelined datapath using the ALU and adder in the EX stage and completing the branch in the MEM stage? Assume that branches account for 17% of instructions, as suggested on page 270, that no branch prediction is used, that the average CPI for all other instructions is 1.2, and that there is no effect on clock period.

Solution:


1.25

Quiz on Textbook Sections 4.5 and 4.6

Question 2: Suppose a single-cycle datapath has 4 major function units each with a latency of 200ps. A pipelined version of this datapath has one stage for each of the function units, with the same latencies. What is the speed up of the pipelined version compared to the single-cycle datapath?

Solution:


4

Question 3: Match the following descriptions to the defined terms.

Solution:


When a planned instruction cannot execute in the proper clock cycle because the hardware does not support the combination of instructions that are set to execute.

structural hazard

When a planned instruction cannot execute in the proper clock cycle because data that is needed to execute the instruction is not yet available.

data hazard

When the proper instruction cannot execute in the proper pipeline clock cycle because the instruction that was fetched is not the one that is needed; that is, the flow of instruction addresses is not what the pipeline expected.

control hazard

Question 4: For the following RISC-V code sequence:
ld    x7, 0(x3)
addi  x8, x7, 1
the RISC-V pipeline can use forwarding to completely eliminate stall cycles.

Solution:


False

Question 5: How many stall cycles are required the following code sequence executing in the RISC-V pipeline, assuming all required forwarding paths are included?
slli  x6, x10, 3
add   x6, x6, x18
ld    x20, 0(x6)
addi  x28, x20, -1

Solution:


1

Question 6:  Branch prediction reduces the effect of branch hazards by assuming a given outcome for a branch and proceeding from that assumption, rather than waiting to ascertain the actual outcome.

Solution: 


True

Question 7: What is the latency, in clock cycles, for the following instruction in the RISC-V pipeline, assuming no stall cycles?
andi  x30, x8, 0x0ff

Solution:


5

Question 9: Consider execution of a sd instruction in the RISC-V pipeline, with the instruction word being fetched in cycle n, and no stalls. In which cycle is the value of the MemWrite control signal determined, and in which cycle is it used?

Solution:


Determined in cycle n + 1, used in cycle n + 3

Question 10: The pipeline registers in the RISC-V pipeline contain control signal values for use in subsequent pipeline stages.

Solution:


True

Wednesday, 22 April 2020

Quiz on Textbook Sections 4.1 to 4.4

Q2: Why are multiplexers required, as shown in Figure 4.2? 
Solution: We cannot wire data lines from multiple sources together. Instead, we require a logic circuit element to select between the sources.

Q3: Match the logic design terms to their corresponding definitions. 
Solution:
Combinational element: The outputs depend only on the current inputs
State element: The outputs depend on current inputs and internal stored values
Edge-triggered clocking: All state changes occur on a clock edge
Control signal: Directs operation of a functional unit or selection by a multiplexer
Data signal: Contains information that is operated on by a functional unit

Q4: The register file is a state element that consists of a set of registers that can be read and written by supplying a register number to be accessed. 
Solution: True

Q6: The single-cycle datapath conceptually described in Section 4.3 must have separate instruction and data memories, because 
 Solution: the processor operates in one cycle and cannot use a single-ported memory for two different accesses within that cycle.

Q8: How does the datapath in Figure 4.17 determine the outcome of a beq instruction? 
Solution: The ALU subtracts the operands and asserts the Zero output if the difference is zero. That, ANDed with the Branch decode signal, controls the multiplexer to select the next PC value.

Q10: The clock cycle time for the datapath described in Section 4.4 is determined by the longest chain of functional units used for any instruction. All instructions thus take that amount of time to execute. For this reason, single-cycle implementations are the main form of processor used today. 
Solution: False 

Homework on Textbook Sections 2.9 to 2.14, 2.17, 2.19, 3.1 to 3.7, 3.9

Q1: Write a C function equivalent to the following RISC-V assembly language code.

clear: addi  x5, x0, 0
       addi  x7, x0, '-'
       jal   x0, L2
L1:    sb    x7, 0(x6)
       addi  x5, x5, 1
L2:    add   x6, x10, x5
       lbu   x28, 0(x6)
       bne   x28, x0, L1
       jalr  x0, 0(x1)

Solution: void clear (char s[]){
int i;
i=0;
while (s[i] != '\0'){
s[i] = '-';
i++;
}
}

Q2: What doubleword, in hexadecimal, is placed in register x8 by the following instructions?

    lui  x8, 0xA9344
    ori  x8, x8, 0x01C

Solution: 0xFFFFFFFFA934401C

Q3: What word, in hexadecimal, encodes the branch instruction in the following code sequence?

    beq   x9, x24, L1
    slli  x8, x7, 2
    add   x8, x8, x15
    ld    x8, 0(x8)
    sd    x8, 0(x23)
L1: addi  x7, x7, 1


Solution: 0x01848A63

Q4: Suppose the following code sequence is executed on two processors in parallel without synchronization:

ld   x6, 0(x10)  // load x
add  x6, x6, x6  // double x
sd   x6, 0(x10)  // store x

If the variable x is initially 8, what are the possible final values for x? Assume that memory only does one load or store at a time, and that a pending load or store waits until the memory is not busy.


Solution:  16 or 32
 
Q5: The swap procedure on page 135 of the textbook is called by the sort procedure in Figure 2.25 on page 139. By how much would the dynamic instruction count change per iteration of the inner loop if the swap procedure were inlined? 

Solution: 4 fewer instructions
 
Q6: Measurements of programs running on a processor show the following relative frequencies of execution and CPI values:
  • Arithmetic instructions: 50%, 1 cycle
  • Load instructions: 15%, 3 cycles
  • Store instructions: 10%, 2 cycles
  • Branch instructions: 25%: 2 cycles
The clock frequency of the processor is 2GHz.
Suppose we augment a processor’s instruction set by adding a load indexed instruction that forms the effective address by adding two register values. The new instruction allows a sequence such as:
add  rtmp, rs1, rs2
ld   rd, 0(rtmp)
to be replaced by a single instruction
ldx  rd, (rs1+rs2)   // Load from address rs1+rs2 to rd
20% of the loads in the original processor are preceded by add instructions such that the pair can be replaced by a ldx instruction in the new processor. The CPI for the ldx instruction is 3 cycles, but its inclusion slows down the clock frequency of the processor.
What is the minimum clock frequency in GHz required for the new processor to ensure its performance is at least that of the original processor? 


Solution: 1.963

Q7: Consider a 32-bit multiplier organized in a similar way to Figure 3.7 in the textbook. Suppose the time required for each adder is 4ns. How long (in ns) does the multiplier take to multiply two 32-bit operands? 
Solution: 20

Q8: Use the RISC-V instructions described in the textbook (Sections 3.3 and 3.4 and the green card) to write assembly language code for the following C statement. Assume all variables are of type int, with a, b, c and d in x10, x11, x12 and x18, respectively.
d = (a * b) % c;


Solution: mul x18, x10, x11
rem x18, x18, x12

Q9: Write the hexadecimal word for the IEEE 754 single-precision representation of the decimal +81.75. 

Solution: 0x42A38000

Q10: What decimal number does the hexadecimal word 0xBFF00000 represent as an IEEE 754 single precision floating point value? 

Solution: -1.875

Q11: Write RISC-V instructions for the following C statement, assuming the variables y and a are of type double and are in floating-point registers, x is an array of double with the base address in x9, and i is of type int in x18.
y = y + a * x[i];


Solution: 
Assumption: a is in f9, y is in f8 and f0 is used as temporary storage
slli x5, x18, 3
add x5, x5, x9
fld f0, 0(x5)
fmul.d f0, f9, f0
fadd.d f8, f8, f0