You don't know how to go- how to go with me! Hey! Oh, I got knocked down! Oh-ho-ho! Hello everybody and welcome to Primal Dominion! Something that's dinosaur related and isn't a park builder! Although there is a carousel in the background, that's an odd choice. So, this is kind of like Early Access. You can find it on Steam, however it has not released, and I want to say a big thank you today for allowing me access to this. And I love the title, Primal Dominion! I understand the Primal, but Dominion? I wonder if they could be using that from something else? No, they wouldn't do that, don't be silly. Okay, so let's go a new game! Do we look- oh? Hello? Mushy Mushy! Oi! Over here! Ooh, this looks cool. I got like Resident Evil vibes. I can't wait to get that. Dino Crisis? Oh, I can take it? Do I need to control it with this? Is it better with a controller? I bet it is, isn't it? I guess I can still use a controller. Is that easy? Oh, one hour later was that. Oh, look at me! Bo-no-no-no-no-no-no! Not too late. I shouldn't be too far now. Oh-ho-ho-ho! Oh my god. I just appreciate playing something dinosaur-related again. Isn't a park builder? My god. Okay, here we go. Just keep running. Where do I go? Do I want to go to the power junction? I- ooh. Whoa! Whoa! Oh, look, stuff! Blue things! Yeah, one of the guys sent me, like Arum. He's sent me stuff in the past. Some kind of interest to see. What's all this about? Smash open the door. Uh, was it... Oh! Right trigger to take. Why is that not working? Wait, okay, but... Okay, that's weird. So, right trigger doesn't actually work. I needed to use the mouse for it. Right, so we found some things. I don't know how to cycle through the weapons or... God knows what. Oh, I can jump! Look at me! Just what the doctor ordered. Off we go. Oh, I like it. I like this. Can I open this? Can I open this door? Yeah, I get it. What? Oh, Jesus! What? What did I do there? How'd I... How'd I... How'd I do that? I wanna know how to roll! Hold on. Controls. I'm on invisible menus, apparently. Oh, it's double tap! Hyah! Hyah! No, dinosaurs see me coming, so I can jump and go, Hey! Brilliant. Alright, guys. We must go and get the power on. I'm assuming there's nothing over there either. Okay, I like this. This is nice. It really gives me flashbacks of that Chris Pratt game that we never got. The old Grady third person. And I'm sure this is where it's inspired by, right?  Oh, I got it back to there. Okay. Oh, God! And something else. Whoa! 5G towers! Jesus! Why is it in here? Where the hell's the guns? That's the power. No. I'm not falling for that. I ain't falling for that. We need to find a weapon first, because I'm sure when I trigger that, something's gonna come out. There is stuff in here. Uh-huh. Oh. Hello. Don't mind me. I'm just gonna, apparently, uh, well, not take it, because I can't. I don't know why. Right trigger just doesn't work. Is it meant to be for mouse? Hey! Oh! Oh, look at- Woo-hoo! I'll take it. Oh, that's it. Yeah, equip that. Okay, so that's how I switch. I click. I scroll. So what's this? We got a glow stick. A gr- What? A gar- A gar- A gar- Oh, okay. Hunting rifle. I'm assuming that's good. Yes. Has gone. With how- I have 18 rounds of bullets. Whoa, I can run backwards. Chiggy. Are you ready, guys? Are you ready? I'm ready. The right trigger to use, but not really, because this game's weird. Yeah! I think we'll see raptors now, just think. I think we might do. Oh, the music stopped, guys. Okay, never mind. That doesn't open. Right. Onwards. Off we go! Oh, hold on. Ooh. Do we get an intro? Primal dominion. Oh, my God! We're in Jurassic Park 3! Jesus Christ! For die! Oh, my- There we go. Did it just- Did it just skid? Roll! Where'd he go? Scan. Where is he? Wait a minute. They ain't got nothing on family. I-I think I genuinely killed him. I don't- I don't- I do not know where he went. I think he's dead. All right, well, the music's telling me to- to stay, like, worried, so I guess we'll stay worried. Quickly! Step over the plant! Can I get through now? Ha-ha! Yes! Take all this stuff! More- I'm gonna- 130 odd rounds! Bloody hell! What's this? Was it- Oh, it's a key! Oh, Kagiwa. Gimme! Why can't I take- There we go. Need to get it exactly right. Right, well, I think I killed the raptor too quickly, it's not very happy with me. Unlock the gate. Okay, that's all I need to do. Okay. Du-du-duh- Dun-dun- Dun-dun- Dun-dun- Dun-dun- Unlock the gate. Yes! Use the key. Unlock, please. Yes. Door has been unlocked. Sweet. Oh, does it pause the game? Oi! I'm trying to click close! Let me close, dammit!  Yeah, it's like all my controls don't... Like, there you go. There it is, normal. Right? Um... Oh, no... Oh, for God's sake, it glitched all... Like, come on, guy! Well, they weren't... They weren't wrong saying I couldn't do it first time.  Can I click... Oh, can I click continue? Oh, it didn't save! Ah, bollocks. Oh, I'm gonna... For God's sake. Alright, guys, bear with me. I'll be right back. Oh, so that's what that is. That's a stamina bar. Oh, okay. Alright then!  Let it work out! Maybe this time I'll be able to just kill it in one shot. Come in! Oh, there... Oh, there he is. Okay. What is he doing? Ah, why'd you... Oh, he missed. Okay. Well, I don't actually have any health. Where are you going? Hello? Hello? Hello? We might need some extra bullets here, guys. Where is he? Where is he? Oh, so that's what happened. Oh, my God. The first time I played it, it just kept... It was running at the wall at the top. Woo-hoo! Can I roll over? Oh-ho-ho! Oh, skills! No, don't win that one. Ah, that's reload. He-hoo! Oh, my God, there's friggin' fall damage! Alright, we're gonna... We're gonna bust this place wide open, guys. You ready? Yo! Alright, okay. Hold on, guys. This might break the game. We're gonna click tab once. We're gonna take one of our million gazillion pain killers and then click tab. There you go. That's what should have happened. Now, it glitched here when I needed to use the key. Uh, unlock. Yay! It worked this time! Oh, yes. We're through, guys. We're through! Onto the next bit, the level, which I should have been able to do last time anyway. But, hey, oh, here we are.  This is what we do. We're action man. We run straight into the peril! Oh, no, there it is. Oh! I missed something. Oh, we got a friggin' rifle. Oh, heck yeah. Can I switch between? Oh, there you go. There you go. I got 50 rounds of this bad boy. Heck yeah! The music's starting! Who's got the tube? What? Who's shooting? Oh, my God! Wait, apparently you can see me. Oh, my God! Good job, game. Don't even show me where the friggin' enemies are. Just like, oh, yeah, there's a guy shooting you randomly. I was told, oh, by the way, this game's really hard. Yeah, it's really hard when you don't show me where the friggin' enemy is. Wait, what? Can we just call this guy Chris Pratt and pretend it's an official Jurassic World game? I'm a-comin'!  I have no idea where anybody is. And I don't know if my scanner even picks up anybody.  So I'm just gonna- Oh, God! Somebody's shooting! If we just keep running forward, he'll have to come from behind me! It's the perfect plan! Oh, to the Stegosaurs! Yeah! Let it work out! I think I've just ran past most of it, but that'll do. Ooh, birdies! Look at the nice music's playing, yeah. You've got, like... That's still playing, because I haven't killed the original guy who was supposed to be shooting at me. Oh, can we just listen to the music for a second? Oh, my God, it's like a Feebo dream, man. Oh, then let me load from last save. Please tell me it's saved at the Stegos, because good Lord. Oh, for God's sake.  Is that the incentive here? And that's your incentive, because you won't want this music to play. Oh, there he is! Ow. Oh, I hit somebody. That's something like that too, if I got shot by a bullet. Oh, no! Where's the other guy? Oh, there he is! There he is! Oh, I need to reload! I need to reload! Crush down! Crush down, we got this! Oh, hold on, hold on. He's decided not to. He's decided not to.  Did I kill him? He really decided not to go for me all of a sudden, and I can't tell where he is. Oh, look, he dropped stuff. Yes! Take the rounds. Hold on, guys. Shh! I need to take my meds. There we go, there we go. Just down those painkillers. Just him? Do you want me to take him? Take the man! There is no key card in your inventory. Oh, I need to go get a key card? Oh, is that what that guy had? Did he have a key card? Hopefully one of these is a key card, but I think these are all painkillers. Oh, my God, I'm loaded. This guy's addicted to painkillers. We must take the key card. Wait, what's this big green glowy thing? Is this the key- It's a key card! Give me the key card! Yes! Now we can go in here. Oh, we did it. That was it. Right, what's in here? I'm not cheap wrangler. Five millimetre bullets. More five millimetre bullets. And more five millimetre bullets. Oh, does it crash into one? Oh, I did. This was inevitable. I should, uh, I'll avoid stop talking to myself out loud. Oh, God, they're attacking! Oh, traffic sideways! You fall! We're being chased by stegosaurs! I think I broke it. Hold on. Can we even get out? Look at them go to this music. Look at them run. Oh, be free, my man. Be free! Oh, see? It wouldn't have even mattered. Oh, they got to this point. And I had to roll! All right, guys. What made that noise? Oh, God. Oh, geez. I think I'm okay to step here. Hold on. Let me just pop some pills. Is it dead? What's that? Oh, it is dead. All right. All right. This is it. This is going to be dinosaur alley now. Come on in! Where did he go? Hold on, guys. Let me just pop some more pain pills. You know what I should do? Instead of, like, shooting, what I should do is just try and dodge. I feel like that might be a better tactic. Oh, they can't keep up with me. I'm too quick. The hunter becomes the hunter today. No, that didn't work. Oh, I got him.  And I shot him in the head again. Uh, okay. Well... Another one? Oh, they... Yeah, there you go. I got him. Apparently, he didn't mind being shot in the head, which is quite nice. He doesn't know what to do. He's running rings around him. I'm rolling rings around him. He doesn't know what... I need to reload. I need to reload. You don't know what to do with yourselves. Am I dead? I'd like to get up, guys. God, I have to bug it off. God, it broke me back. I had to restart from the left side. I was just too skillful that it broke me back. Oh, can you just map the freaking painkillers to a different button? That would be way easier. I hate having to go to the freaking screen to do it. Oh, my God, there's another one. Oh, this is no good. Oh, no. Oh, you want to play that game?  Hold on, let me reload. I think I can get him. Hold on, let me switch. Let me switch to me or the gun. There it is. Now you don't stand a chance, but are you ready? Yeah! Yeah! Yeah! In the arse. Anyone else want to have a go? Oh, that's a straw. That is. You just got jumped to get up? Oh, so tactic, guys. Roll into the raptors. Roll into them. They'll have no idea what's going on. I'm going to switch weapon. I'm switching to this bad boy. Yeah, so I can pick it off at a distance. I'll see you.  It's a shame that, um... Oh, can I just use a mouse? Mouse is probably easier for this.   No, switch weapon. Dude, switch weapon. Thank you. There it is. Yes! Yes! There might be another one though. Ooh, it's quite tense. I like it. Should I just run? Runnin' around at the speed of sound. Oh-ho! There it is! Oh-ho! No! You don't set a chance! Boy! Look at my rolling skill! Oh, I've run out. Oh, let me reload. Let me reload. I got this. Ho-ya! Is there another one? Is there another one? We're got me! We're got me! I get it! I think we're okay. I'm pretty proud of that. Those are some amazing skills. Yeah! What? I think we did it. We made it, guys. We made it. Right. Let's have a look for any ammo. And there's probably a load of stuff to the right there. Oh, look. Army men's.  I mean... There we go. Where's the other guy going? Where'd the other guy go? This guy's coming as well. Look at him. I mean... I mean... There we go. Look, he runs all the way over and then he dies. There was another one, though. Did he just run into the van? I don't know what you guys were doing. How did you survive the raptors, eh? There's loads of fun. I actually really enjoy this. What's in here? Water! Water! Shoot it! Oh, it opened automatically. Oh, okay. Interesting. Interesting. Yes. Look. Look at all the stuff in here. All the goodies. So many peeps. How do I get in? Does it open automatically? Oh. Oh, there's Coke. We need Coke, guys. Oh, there's peeps everywhere. I want to take the Coke first. Soda. Oh, Soda, ne. Hold on, I need this weird rock thing. Whatever this is. Yes. Wait, they move? Who's banging? I feel like I can hear somebody banging. Wait, where is everybody? I keep on thinking that I'm about to, like, see somebody. But then there's no one in here. I can take this. Whatever this is. Oh, it's more ammo. Sweet. There a guy over here. See, he's looking right at me. Hey, dude. Oh, he's round the corner. Wait, is he just waiting in the toilet? No, it was nothing. It was nothing. Got you.  Woo-hoo-hoo. You want some? Ah! Oi. Oi. That's not fair. Okay, I see how it is. Oh, no, no. Wait, wait, wait. Oh, no, no. No, can you wait? No, no, wait a minute. Wait a minute. Wait, wait, wait, wait. Wait, wait. Can you wait? Just hold up, hold up. I need to get my gun out. Okay, um, it's this one. No, no, it's this one. So I equipped. There we go. Okay, now I think of a click tab. There we go. I'm ready now. Yes, there's a man in storage. Oh, good. I like the man in storage. Oh, he opened the door. And then he got stuck behind the door. Oh, bless. Oh, no, he's back now. Okay. There you go. Well, he didn't last two seconds there. He opened it. He wasn't the smartest tool in the shed. Can I have your ammo though? Stop. Oh, my God. He just didn't start it. He's like, oh, I killed him. Right. Assume the hiding position behind the door. Oh, like, Oi. Dude, I'm here. Come get us. He's coming. Are you ready? He's gonna... Oh, there's a few. Hey, dude. Dude, I'm here. Come on. Guys. Yes, you. Yeah, you're the chosen one. Are you ready? Oh, he's dead now. Join the parade. Oh, my God. Oh, my God. There's still a guy outside. Door. You forgot one. You forgot one. Hold on. There you go. No, no. You had it right. The hell? Gentlemen, we got him. I was up sale. I don't know how he did that.  That wasn't working. The games just was not happy with me doing that. So I'm just gonna, I guess, just wing it and just go through this way, which apparently was way easier. Oh, there's a guy stuck on a door there. I think he's stuck on this door. Yeah, there he is. Oh, no. Oh, yeah. Don't come through, guys. You don't need to come through. It's fine. What is this? I'm assuming this is of some sort of importance. So I'll take it. Oh, never mind. It was just bullets. Oh, brilliant. I think they're trying to pathfind. They're trying to get to me, but they're having a little bit of trouble. They keep on banging on. I don't think this is the soundtrack. This is just the game like the AI banging on the doors. Hold on. What does the journal say? That that's it. That's all I have to do. Just explore the facility. Yes, explore it, James. Explore. Time to run. They're gonna come for me. They're coming for me. Oh, oh my. They're all above. Jesus. How many? All right. Bye-bye. Oh, they're all going to where the sound is. Okay. So where my bullet gets fired, I run to. It doesn't matter what floor. They don't have good pathing. I just open you. You all right? Oh my God. He almost killed me. I need to heal quickly. Jesus. I thought I had that one down. Apparently I didn't. You ready? You're ready? Why are you not moving? Okay. Oh my God. Thank you. Jesus. Creemany. I hear them. Are they all above me? We will follow you. Always. Oh, more ammo. Heck yeah. Oh, what's this? Oh, it's a dead little raptor. They just chucked in a bin. Oh, that wasn't very nice of you. Now was it? Never mind. I haven't been this way before. Is that going to call any of them? Oh yes it does. Okay.  Thank you. Now to heal. Heal.  Are they all outside? Come on. I'm not coming all this way just to die. Jesus.  I'll take that though. Oh, that's the knife from the beginning. Oh, that's the thingy-mediggy. I know. Oh, look, an error code. This is a freaking copy of that. I thought it was a door opening. This is though. Dinosaur embryos, guys. Look, it's sticking out. These are like the titans. Oh, look, one escaped. Oh my God. Okay, so hold on. This is D2. Oh, God, the lag. Did I do it? Wait, it works now? I'm okay. I can get in now. Oh. Oh. Oh. Okay. Right. So we're in now. Apparently. Might as well just get some extra ammo, eh? Well, we're here. I die now. Oh my God. I hope I don't have to start all the way back again. Whoa! Guys! Progress! Hold on. Hold on. Hold on. Here we go. Let's draw them. Come on. Come on. You got very close, and then you didn't. There we go. There should still be another one though. I've just, you know what it is? I've been mowed down so much. I'm just terrified that, like, it'll just happen again. Like, I'll let my guard down, and before I know it, I'll be attacked. Okay, look. Power! Yeah? You see, that's what I'm scared. He knows exactly where I am. And he will shoot the floor. I'm in the dump, apparently. And I de- Oh God, I definitely don't need all these pain killers. But you know what? I'm going to take them. I'm going to take all of this. I've got a ghost following me, I think. I think that's what this is. I've got ghosties. I like the periodic table. Will you stop it? I'm trying to do stuff. Oh my God. Oh my God, what just happened?  Oh, oh Jesus. What's going on? The world has been changed.  Just a guy. Just a guy came towards me and was like, Ah, blah, blah, blah, blah, blah. And now it's raining inside the facility, apparently.   Oh, wait. Wait, what? We have to- Oh no. What do you think it is, guys? Think it's a copy? I'm trying to take it. But apparently I can't. Oh, hey. Oh, I guess I'll get in. There we go. Oh God. Oh God. Where is it? Oh, hello. T-Rex? Oh, I have to shoot you now, apparently. Uh, the tornadoes are brutal. Shoot the target. Both the slows- Okay. I mean, I'll try. Uh... Oh, this is fun, isn't it? We've got to shoot it in its face. Oh my God, it's like Dino Crisis 2 or like any sort of arcade game.  Actually, yeah, look at it.  Oh, that's not fair. You can't do- You can't take shortcuts. I feel like that was like an inside joke between one of the developers, like why do we have super slow- You know, it wouldn't help if you would all of a sudden randomly just slow down, you know? I love that the T-Rex is so far away. I don't even know where it is. I'm just shooting at the circles. Oh, there it is! Now I can see. Hey! Can I shoot you? Oh, wow, wow, that is- That is really not helping. You are- Oh, you are really close. Wow. Uh, I'm dead, apparently. Um, well, Gigi, that was- That was- That was loads of fun. Like, oh- Game was like- Yeah, you didn't- You didn't shoot the T-Rex enough. So therefore, you're dead. Wait, what? What? What? Ow! Don't shoot! Don't shoot! Apparently, I can do that. Hold on. I'm reloading. There's a guy coming out and shooting us. When the beginning came out and started shooting us while a cutscene was on.  Did that not work? Hold on let me reload. Let me reload.  Aren't you pretty? You look exactly like the T-Rex from Jurassic Park. Thank God that you run to a certain level And then you saw slow down. Oh Will you stop hopping on about the jeeps? Nobody cares. This is why no one liked you Clive like I just have to wait Don't know. There we go There we go reload. Oh, I think it automatically reloads it.   I need to reload hold on. Oh That's that's okay. Wait. I mean aim up that would help. There we go There we go. I've only got 72 bullets like can you stop like you haven't got me a chance to to shoot you Will you please? Will you stop? Can you stop? I'd love it if you stop. There we go I can't actually shoot you when you like that. It's gonna be a wrap of this video Because apparently it's friggin impossible But if you enjoyed that video leave a like good lord I got two and a half hours Freakin come through this and until next time. I'll see you cuties later. Bye. Bye


So you know it takes a lot to talk in front of all you guys and we got two noobs today. So let's give it up for Michael and Colin. So cheers if you got them. Whiskey. Alright welcome everybody. We're going to be talking today about barcodes and barcode scanner hacking. First quick introduction even though you probably don't care who we are. I'm Michael. I'm obsessed with barcode scanners. As you can see I have way too many of them. Colin? Hey I'm Colin. I do stuff on the web professionally. He's what we call a webmaster. So something we've kind of noticed and something we may take for granted is that barcodes are everywhere. You may not notice them in real life but they really will, they really kind of permeate everything we buy, everything we use. And you may think oh this is some obvious ones. Well there's a lot of non-obvious ones. Like there's three barcodes on that USPS label. There's one on Intel CPUs. There's some on most printers that print color. Even hospital wristbands. And as a result because those barcodes are everywhere it means the scanners are everywhere. And so these scanners are basically kind of hiding all over the place. If you go to almost any store you'll find them. If you go to an airport you'll find them. But they're really an attack vector. So before we get into that let's just talk a little bit about barcodes and kind of what they are. So normally they decode to text. These are just a couple of different types of barcodes called symbologies. You don't have to care about what they are. You just have to know that they decode to text. Some of them have restrictions like the UPC on the right where it can only decode to certain numbers. Some like PDA4 and 7 can hold a lot of data. And others like QR are really good at being viewed at weird angles. But the thing is these scanners are mostly the same. These manufacturers, this one, most of these are simple scanners and most of these are vulnerable to this attack. They sell, let me look at this, these are about like 10 years apart. They look exactly the same. The scanner, the equipment inside are pretty much, the controller inside is basically running the same software, the same features year to year. Most of them will act as an HID device. So they just act as a keyboard. They type in the keys and key by key they type the buffer out. So with all these barcode scanners everywhere, acting as keyboards, what can we do if we could change the text or send arbitrary keystrokes or do things like Windows QR? What could we do with proper permission in a legal sanctioned pen test? So it's not a bug. What this is. A lot of manufacturers will add special features in. Code 128, that's what that barcode right there. That was the one in the first slide. It says barcode underneath that but there's a hidden character. That one in the red right there, right up to the start code, is FNC3, which is our best friend in some of these examples. It tells the scanner, this isn't a normal barcode. This is a programming barcode. A lot of scanners support this. It is a little manufacturer specific. And if this is starting to sound familiar, it's because this is basically in-band signaling. If you guys haven't seen the blue box on the left, that's basically what this is, just modernized. We haven't learned our lessons from decades ago. So why does this programming exist that we can do this from? It mainly exists for legacy systems. So in this example, we have a legacy system we call Cyberdyne Cat ERP and we use it to track and herd our cats. A novel goal. It's a little too, it was made a long time ago and nobody wants to replace it. Nobody wants to modify it. It's way too expensive. It's probably Fortran or something. But we've been told to make it faster. So we want to make it faster with markets. This is actually a real fake example. There's actually a C-Shark program running in the background that we created just to show this off because I don't know how to program in Fortran. So here we have my cat Java. He's a domestic short here. He's born like 2005-ish. And our system wants those three inputs. And so normally we would have to look at the label on the cat, grab their name, type it in manually, press tab, type in the breed, press tab, type in the year, and finally we hit F12 to save. Well, it takes a lot of work. There's a lot of room for error and it's generally just kind of slow. So what if we solve that by barcoding our cats? Because how could that go wrong? So we create a barcode like the one on the upper right that says DSH, domestic short here 2005 Java. Now we've got this barcode. We can't modify the ERP app to know barcodes. It's just like I expect a keyboard and that's it. And so these rules that we generate, they're going to go a little bit like this. So first we've got a cursor and we've got a buffer of the actual scanned barcode. And you see we're starting it right before D or on D. So we just move the cursor forward a little bit. And now we move it forward seven characters. Seven characters are defined length for how big those two fields can be. And then the rest of the barcode is the cat's name. So you could have a name that's eight characters long, twelve characters long, doesn't matter. Now we're at this cursor point. We send that info and we press tab. And you see it types it for us and moves to the next field. Now we go back because the next field is DSH or breed, which is DSH. The cursor moved back to the front. We type in three characters and we hit tab. Again, it doesn't matter what those characters are, we're just typing three characters from the buffer. And then same thing, the cursor's already moved forward for us. So all I do is type four characters and we hit F12. And it saves it for us. So all you have to do is do one quick scan on this legacy system that nobody knows how to modify and we can actually automate that. That's why these rules exist. That's why manufacturers added them 20 or so years ago. And so we're back at that. We've put our barcode on our cat, which is a very successful endeavor I might add. And we're going to just do a scan. So this is what the scan looks like. Simple as that. It's extremely fast, a lot less error prone. But of course, we can make our own malicious rules. We can make our own malicious programming. So we can do all sorts of things. We can specify criteria for these rules. So we can say just do it on everything, do it on certain barcodes, ones that have a certain text in it, or certain symbologies like EPC. Or, and then once we're done with that, we can specify actions. So you can see here on the left, that is the, or the right, that is the actual programming barcode for that cat ERP system. So if you scan that with a scanner, it'll do that. A lot of these scanners can actually support multiple rules, as we'll see later. They do have a less size limit, but it's fairly expensive. You can't write a novel in PowerShell, like you can't write hundreds of characters, but you can get a lot in. These are some of the actions we can do, some of the ideas. So we can modify and replace text on the fly. We can just ignore text. So you scan something that doesn't actually give you any text. We can add extra characters in the end. We can do special keys like windows, control, alt. And we can just do nothing. We can soft break scanners by scanning a rule that says do nothing. And the scanner is dead until you reset it to defaults. There's a classic attack, you guys probably heard of it, of like, you know, the Walmart's where you put a sticker over the barcode or the different barcode for something cheaper, but it's super obvious like that. This is a digital equivalent of that. We can change those barcodes on the fly, make your $200 item ring up as 10 ducks. So this culminates in our tool called barcode. Barcode is an attack IDE developed by Colin in JavaScript. We build payloads in JSON and it makes it really easy to rapidly design them. So these barcode scanners, they don't give you a lot of feedback. If you give it something invalid, they just go, they give you a bad beep, instead of a good beep. And that's all. You don't have any feedback, there's no output, there's no logs. Trying to do these barcodes manually is possible, but literally spent the past year working on that. So this makes it easy for you guys to just write some JSON.  Ducky script, you know, it's kind of basic. This allows you to do a lot more, but this takes away all the complexity of doing those barcodes. And you don't have to decide for any manuals. Right now it supports more world symbol, which I think is like 40% of the market. Most other scanners support this like Honeywell, NCR, and it's open source on the MIT license. Here on the right, you can see just a simple, this is how we run calculator. So let's splish over the demo. First demo, run calc. So this is the barcone website, barcone.com, it's live right now. Quick homepage right there, and it takes us into a quick ID. First thing we're going to do is run calc. I know this text is a little small, but don't worry about it. So you see on the bottom, we have exclamation point calc. What we basically defined is a rule where if a barcode starts with exclamation point, we go press Windows key R, we press enter, and when we run, we type in that command and press enter. So this basically allows us to easily build new payloads by just having a simple rule. So as an example, let's scan it. This scanner is fresh. It's reset to defaults. Here's what it looks like just by itself. It types in exclamation point calc. And here's what happens if we scan that programming barcode. We hear it had a programming noise. Full screen calc, my favorite. So let's go and try another demo. Next one is run command. And so this is what the quick iteration looks like.  We can change all this text really easy on the fly. And so what we're going to do is we're just going to run this one. This one has two rules. We scan that. It programs it. And then next, let's launch command. And now we just have a command prompt open. We have extra barcodes so we can just type in that user. So we can actually type in text, you know, line by line. So you can actually have a list of one liners that you really love and just use them over and over again. And the quick iteration is stuff like this. You can go and say, you know, net user add. So you can just go click like that. Click run. Now we can type net user add. Next up, do the serial box demo. So right here we've got an unaltered box of s'mores. It's a little smashed from travel here from Dallas but it's got a barcode on the box. Simple UPC barcode. We're going to execute an attack with that barcode. So first let's demonstrate that we scan this. It types in a barcode. Next let's scan the programming barcode. There we go. Let's prep ourselves. We've already got my exploit running right here. Just waiting for a reversal. And so let's scan this barcode and see what happens. Oh, come on. You can do it. We had to change our web host to like 2 AM. And it's super slow right now but it's working. Just give it time. There we go. Now we can switch over to this other window. So that's all great. That's all serious. But you know, what if we just really want to play some video games? What if we're really feeling down for something more fun? So let's play some Tetris. So right here we'll scan this barcode. It can be a little tricky with the glare on the stage but there we go. Got that programmed. So we've got Tetris. Put that over here. And we've got photos. So basically we've invented the world's shittiest way to play Tetris. And finally let's just show off what we can do with a little bit of mayhem. So we'll go back to our brick payload. So there's the programming barcode on the top. So right now if I scan, you know, that barcode is going to scan serial box demo but if we scan this one simple programming barcode we're basically telling the scanner whenever you get a barcode just sleep for 20 seconds and then don't print anything. Any barcode. So let's try and scan the serial box again. If you can't tell this thing's not lighting up. It's just sitting there for 20 seconds doing nothing. It looks like it's powered off. The light's off. The button doesn't do anything. It'll just sit for 20 seconds and wait. And the only way to reset it is to go to the factory defaults which almost no one knows how to do. So once we give this a few seconds go through, it looks like it's dead. You scan this one barcode. It's basically a zombie for that 20 seconds. We've tried up to like one and a half minutes before we got bored. So now if we scan our store defaults we can go back and scan all the barcodes we want. But almost no one knows how to do that. And that whole thing about we find a lot of barcodes hiding everywhere? Well, first let's talk about this. So first can you turn it off? And the answer is yes. You can scan that barcode to disable bar programming barcodes. Can anyone guess how you turn them back on? So some considerations for a red team attack. This is really, this is an advanced attack. You can't just walk into a Walmart and just pull this up on your phone and hit enter and hope it like kind of exploits it. This is something that takes a lot of testing, a lot of recon, but it allows some windows into systems that normally you wouldn't be able to access. They don't have keyboards. They are controlled. You only have access to the barcode or maybe you're not even there. Maybe you send a package to the malicious barcode. One thing to think about, find the beeper hole and cover it up because the programming barcode is at least on simple scanners. They actually play at full volume. Some of you guys can even hear it in the audience. I have it taped over. But it's really loud. So just cover that up. Another good example is you can actually bring your own scanner. These things, almost all of these scanners have the same 10B, 10C connector, ethernet with two extra pins. And you can just slide in a screwdriver, unclick it, and bring your own scanner. Or steal a scanner and replace it and then test with that one.  One great thing, there's a great example in the next slide, even when the scanners are turned off, a lot of them are still powered. Most of these aren't actually doing anything but they're almost all still powered. So you can still program them even if the terminal is off. Another thing, laser scanners like this one from probably before I was born. Nope, not that early. This one's a laser scanner. The ones that have them like Walmart and encounter checkouts. This one's actually encounter. Right here. Spinning laser beam of death. Those ones won't work with phones. You've got to have a kindle, paper, something like that. And then we have some great ideas with, you can trick others to deliver these barcodes. For example, maybe you're at airport and you just airdrop someone and say, hi, I'm United Airlines. You know, have this scan this QR code for your free upgrade. That's actually the cat ERP code, but don't worry about it. Or you know PetSmart just sent a fake email to someone and hopefully they do it. Literally a minute after I walked off the plane at Vegas in the airport, came across that scene on the left. Unattended little coffee shop place. The machine's powered off. Everything's locked up. Probably the cash is gone. But we've got a powered scanner right there. No one's watching this and we can just go scan our barcodes all we want because you can program them. And then the one on the right is presented without comment from PISOs if anyone's been there. They even posed with their barcode scanner for me. They probably would have let me scan some barcodes if I'd ask. For the blue team, I don't have good news for you. As far as I know, there's no way to secure these scanners from programming. The only benefit you have is that some models may not support it. Some really old ones may not support it. All the new ones do. So you just have to assume that anything that has a barcode scanner attached is going to get hostile input. So these are the standard kind of stuff we've been talking about in security for a long time. Remove local admin, use endpoint protection, app control. I shouldn't be able to type Windows key R and get an admin command prompt, but a lot of times you can, especially on these unattended kiosks. And there are some good ideas about filtering malicious keys at the OS level. So you could just say, if this device has a scanner type, then don't allow any, like Windows keys or Superkeys. Or you can just enforce non-HID modes. These will transfer a serial port. You can use a barcode to change into a keyboard though. So you got to enforce that at UDev level. Anyways, we'll wrap it up with some special thanks to Terry Burton at Blip who made some last minute changes and helped us a lot. Mark Warren made the Blip and JS version. Hermit, thanks for the shirts. Doss Hackers, thanks for all your help and support. This talk was actually kind of born there. And thanks Cyberg for the travel and support. If anyone's looking for some interesting talks, related talks, these are some good examples. None of them really go into this depth of building a tool, but they give some great details about barcodes and how they work. And there is our site. There's the GitHub link. And your codes, trust me, they're safe.


Most people say that 2020 was the worst year of the last decade, and I won't outline all the bad things the media pushed into our feeds forcefully, but we'll only say that our ability to process all the news dumps we are receiving daily soon may be reaching a dangerous critical limit. And I've been doing some research and learned that our brain is indeed an amazing device, possibly the greatest computer we have at our disposal right now. Even if we haven't learned how to use it properly yet, but we do get closer every day. There's research out there telling me that the brain can actually store a lot of information. And comparing it with the storage capacity of a computer, research says that the brain can store up to 2.5 million GB. But the reality is that storage might not be our real problem. The problem is processing power. Imagine that time we wanted to buy a new smartphone and chose power over storage capacity, and the reason why our brain processing power matters and will soon reach a critical point is because our limited ability to perceive, read, process and then come up with a conclusion. And I was thinking about how the start of 2020 felt like a battle to avoid fake news and fake media, with the avalanche of information flooding our brain and also being emotionally taxing. We also forgot about time and space, as being fully immersed in the information stream created by our TVs, radios and the cherry on top, which is the internet, is something really hard to fight against. And if we are making computer analogies, we can go deep into the underground world of hacking and compare this situation with the hacking operation the news is trying to do on our brains and emotional states. Because this really feels like a DDoS attack. And in computing, a DDoS attack stands for Distributed Denial of Service, which is an assault on a computer network or a simple server. The aim of the assault is to disrupt the ongoing operation of that particular system. The attacker does this by flooding the poor target with a constant and steady flow of information traffic until the target breaks and collapses. And coming back to the physical impact in the real world, we can say that media is the hacker who's globally trying to do a DDoS assault operation on our minds and make us collapse and allow them in as well. So what can we do about it? Keeping up with what's happening on the news is becoming harder and harder. Over the years, social media has shortened our attention spans, making us more like golfers. And now the media is leveraging that and sending an avalanche of news out every day, knowing that we are not capable of keeping our focus on a particular piece for long. In the past, a mission to launch someone into space would have kept our news busy for weeks, but nowadays this can be easily conquered by a political scandal or a death, or even a new song. The best way to combat breaking news is by delivering more breaking news. It's flooding, but it's best. And the outcome is that people become overwhelmed on a macro level, with the strong fighting to avoid the news, and the weak yielding to the stream altogether and finally becoming part of it, part of the news machine. Because the weak will also help propagate the news without applying critical thinking to each piece, as the propagator's processing power is probably not enough to help him digest everything he receives. And constantly watching the news makes the user feel more insecure, anxious, stressed out, and even depressed. We suffer more in imagination than in reality.  And news exhaustion is a relatively new term that has found its place in our mental health manuals, but how can we fight back? First we should be more mindful about how we operate this meat machine we are rolling in called the human body, and also the human mind.  And I do understand the concept of fear of missing out, but this is something I think about more like a superpower, not being connected all the time. The second thing you can do is really understand that good news takes time to write. You cannot create a scientific paper filled with resources and accurate data on a daily basis. Hard work takes time and time is a commodity. And if we give ourselves enough time to process and comprehend a piece of news, either a well-crafted article or scientific paper, it is going to be more likely for us to apply critical thinking to it and come up with a conclusion. This will also push us one step closer to the real deal.  And I kind of miss the good old days where everything we had to pay attention to was the rogue Friday news dumps, i.e. releasing bad news or documents on a Friday afternoon in an attempt to avoid media inspection. Hopefully that the weekend will wash that out, and we can go on with our lives. But now we are getting those every single day. While life goes on, the human's brain adaptability to constant and multiple flows of news will soon require more and more processing power. And while we might have people like Elon Musk with initiatives like Neuralink trying to transform us into superhumans with highly improved cognition and unlimited connectivity, we still need to act on a micro and do our part in trying to limit and change our media and news. Consumption.


So thank you, Tomá, and thank you all of the organizers for doing this. And it is a real, real pleasure to be here and to celebrate Frank's change of color in the hair, right, around the years. So as many of you, I have also made the exercise to remember when we met for the first time. It was at the institute, really, of Artan's study. It was, well, I guess, time flies many years ago. And I happened to go there because Carlos was... We visited in Jamburgen, and Jamburgen had invited also Frank. I guess he wanted to learn about blow-up, and then why not invite Frank for that. Anyway, so it happened that he was there, and it was kind of a very nice, nice period. We made two little kids. He was, of course, a very, very nice and familiar. Wilhelm was there also, by the way. And so it was kind of a reduced group. It was not the kind of program that you have so many people around that at some point there are so many things happening that it's hard to speak to anybody. But we had the three of us. Wilhelm was around. I guess he would also appear, or was visiting, I don't remember. And so we talked a lot. And the memory I have of myself of that time is that definitely it was what I would call a linear guy. And Frank, of course, was a nonlinear guy. But anyway, we were managed to talk. I don't know in what language, because our English is kind of peculiar in our conversations. I always had the feeling that when Rebeca, his wife, listened to us and said, come on, what are these people saying? But anyway, so yeah, we talk a lot. And I guess we are still talking, right, Frank? And there's many years after, and so far so good. So anyway, I hope I move a little bit, not too much from this statement of being a linear guy. And also, I have the opportunity. I mean, this was really a time of celebration, so you can use big words or strong words. So I, well, I was brave enough.  I should speak out of this if I can, or at least I should be allowed to use these words. So it is not clear what is the meaning of a blow-up here, but it's part of the talk. And of course, probably you will wonder how is it possible to put all these things together, blow-up, and 1D cubic and less, but this is part of the talk. And also, and just to finish this slide, it is not just by myself, but part of the talk is also a survey of things we have been doing along the years. And in all this business, Valeria Vanica, who is in the audience also, is playing a fundamental role. Okay, so let's move forward. This I have kind of a summary, and the starting of the summary is the 1D cubic and less. It could be with a plus or with a minus. But interestingly, they are not the small solutions. But in any case, we can do it for either plus or minus, and they are not the rough solutions. So the main part of the talk, if you want the main new thing, is this theorem with Valeria Renato Lucca and Nicolaus Betkoff, that we uploaded in the archive like one month ago. In fact, this was just after my visit to Paris. I have become kind of a religious person, and one of my first commandments is to visit Paris at least one month a year since I met this guy and tried to keep this as much as possible. And I really want to use this opportunity not just to thank Frank, but also the community around Frank and in Paris, because for me it has been really before and after. All these things I'm going to talk about, it couldn't have been possible if I wouldn't have been invited by different people, different departments. In this city, in particular, one of the departments was this one, Sergei, and invited by Frank. Anyway, so this is, as I said, we put it in the archive, not so long ago. And this is the statement. So imagine I'm telling you the data time one, saying that if I multiply the data by dc to the minus i squared, ix squared over four, then what I get is kind of a nice four times p periodic function. And I assume h stands for the solve of space, and zero plus means that I assume just epsilon derivatives in L2. Then the solution blows up at t equals zero. Of course, this one here and this one quarter are related, as you will see in the proof. This is one possible way of describing the result. Another possible way could be let's assume that now I'm giving you the information in the Fourier side. So what I say is that the Fourier transform of the, say the condition of time one multiplied now by e to the ic squared. And again, this plus here, this one here and this one are related. Now, because you see you are using the Fourier transform, so there is this changes of two pi for pi, depending also on the definition. If you put a one half there, then your life could be easier. So the result is that if I do that, then I am claiming that this is a two pi periodic function. And again, I am assuming epsilon derivatives in L2, then the solution blows up at t equals zero. And this is, say, the first part of the talk. And the second part of the talk will be mainly things that we already knew how to prove, and this was with Valeria, that nevertheless the u can be continued for negative time as a geometric solution. And of course you have a lot of quotations in here. And the talk is really to try to explain what do I mean by these words, here, here, and here. And the reason why I'm going from one to zero is because we have already done the other way around, which is to start at zero with Valeria and go up to one. And in a sense, once you know that you can do it, it is easier from an analytical point of view at least what matters regarding the cubic NLS. But really the difficulty there is the geometric part. But when you construct the solution from one to zero, then the geometric part is essentially the same. So really the new thing is that you can go from one to zero. So this is the summary. And as I said, I guess I am allowed to use beautiful words. And if you learn something from these blow-up people, is that you have to look for, say, universal, right, profiles, or like story tones or things like that, that can tell you how things are growing up or whatsoever. So I wonder if these two examples are universal from any kind of point of view. The first one, I'm pretty sure of it. The second one, it is not so clear, although I think it is. So the first one is very easy. You give me a parameter a, which is a real number. And this is a function of x and t. And what I came is this is a solution of cubic NLS, of the equation I wrote in the previous slide. And now if I try to understand it in terms of the statement of the theorem, what happens is that I pass this guy here, and of course the log of one is zero. So this is essentially nothing but a constant, which is your free parameter. And then the conclusion is that first, you could think that you are dealing with some kind of self-similar solution, and it's almost true. There is a correction of the phase, which is due to the rotation in variance of the equation that Daniel insisted a lot in his talk. But it is not self-similar, but it's almost self-similar. And then, of course, the other conclusion is that this blows up in which sense that, well, you cannot define the solution at time zero. Why? Because when you pass this correction of the phase to the left, then you obtain a limit. So because this has a limit and this does not have a limit, then the solution cannot have a limit. So as simple as that. So if you want, this is my first notion that something is going on at time zero. This was an observation that Carlos, can you, Gustavo Ponte and myself did a long time ago, and it was more than related to the scalings. It was related to another group of symmetries of cubic NLS, which is very important, which is the so-called Galilean variance, of Galilean symmetry, which will appear in a minute. So this is the very first simple example. But I want to convince you that this example matters. And then I have to recall some very old and relevant results by Toroza Wabalt, the scattering of 1D cubic NLS. That is all we know that it was really very true because it was an open question for quite some time and the reason was that it was not the usual scattering. It has to be long range. And you can reformulate it as follows. You can start with a profile as good as you want and then you build up this guy, which is very similar to my first example, except that you have this amplitude and it depends on your profile left. And then what Othawa did was to construct solutions of this problem such that you have an error and the error goes to zero in appropriate topology when t goes to infinity. But of course another of the symmetries of cubic NLS is the scaling. So you can now play a little bit with the scaling. I say instead of starting with just with f, let's start with f lambda of xi direction. I'm sorry, direction. The reason why I'm using psi here, which is x over t is because really this is really more on the free level and the classical linear Schrodinger equation. This guy is really the Fourier transform of the initial conditions. So that's the reason why I'm calling this L. So now try to do the same in L. In lambda now you have a family of solutions. And at least formally this family of solutions converges really to epsilon A and A is nothing but f of zero. That really I prefer to understand it as the integral of the anti Fourier transform of f. And really this is the scattering behavior of a nice solution at time zero. So it doesn't matter what is the functional setting you start with, that if you want to construct things that are, say, well behaved with respect to scaling, you leave the class. EA has no decay at infinity. This is also very clear, for example, in modified KB, which is like a sister equation of cubic errors. So from this point of view I claim this DCI is a relevant solution. And it is non perturbative as Daniel insisted the other day because really it is a solution of a non-linear OD, which is this one. And it will be pretty clear in a minute why this is the right hand side. As you see there is no Laplacian here. Laplacian has been erased. But on the other hand you have a 1 over T that comes from somewhere. And then you have to deal with this guy. This is a non-linear guy. The only thing that modifies is the phase, not the amplitude, but it is there. All right, so now the second example is much, in a sense, is much more weird. Now I call it D, and D is standing for Dirac. From the Dirac comb, not for... Okay, so this Cm is just a constant. M eventually will have a meaning, a geometrical meaning, which is the number of sides of a regular polygon. But you can imagine it's just a constant. And then what I have here is nothing but just a Fourier series, which of course is very much related to the free evolution. And now what I have to tell you is that this will be kind of as before, it's a solution of the constant coefficient, the linear Schrodinger equation. But I have to modify it in order to fit with the non-linearity. So now what is the change of phase? It is you have, as before, the logarithmic correction with the amplitude to the square. And now you have a completely new y. And you have this R of M that will be clear in a minute what is the meaning of that. Observe that you are summing in the non-resonant set, which is typically called in this setting, which M is different from zero, so you're ready to integrate there in time and to obtain a synthetic expansion of this phase in terms of negative powers of t. So now that this is a solution in a sense, of course this is very weird because there is no notion of computing the absolute value squared of this guy. There is no way of speaking of that, so you have to make meaning of what you mean by dissolving the cubic NLS. So it's just the existence of a solution. This is something that we did, Valerio and I, with Bravin, and it was one year ago, I guess, or two years ago. So then the next computation I need you to pay attention to is simple, but it is important, which is the Poisson-Sovetian formula, right? So Poisson-Sovetian formula tells you that you can instead of if you put delta, this is the rad comb, that's the reason of the D. So what is the Fourier transform of this guy? It's nothing but this with t equals 0. So now to add in these frequencies, the only thing you have to do is to look at free evolution. So if you go from right to left, I guess you agree that this is true. But I'm sorry, but the next three lines are kind of important. So now you can say what is the solution? We know what is the solution. This is the free evolution, this is the delta, so this is the fundamental solution just translated in J. So you write it and this is it, okay? And now you make the expansion of the square and this is what you obtain, right? So you obtain something which is very reminiscent of the first example, right? It's nothing by the fundamental solution with one delta and you essentially obtain something very similar to that but now, well, it is at this location, x over 2t and the frequency is now 1 over 40, right? This is the version of the conformal transformation at the free level. So anyway, so the conclusion is that if I look at time one and don't pay too much attention at 4 pi, 2 pi and whatever, because quite likely they are not correct, let's assume that 2 pi is 1. So essentially what I have on the left is that it's at a given time, so I assume this is 1 and I am re-scaling and I am saying what is the solution. So time one is just this guy that of course is periodic but it is quite rough, right? So it is a distribution, that's what it is. So what we claim is that then what I wrote in the first line is a solution. So I guess that I need to tell you what is this R of m and by this eventually it will be the cardinality. So this is the cardinality of a set that measures the resonance set that because you are in 1D cubic analysis is extremely simple but that doesn't mean that the arithmetic function that is behind that is not important. So let's try to play a small modification of the previous game. The previous game was I put deltas in the integers, right? I look at the free evolution and now I put instead of the coefficient 1, I put a general coefficient a j that there is no reason why it's going to be constant so it has to depend on time. And I know from the very first example that I have to make a modification of the phase because otherwise I will not be able to find the source, right? So that this answer is so simple, it's nice and gives you some game which is a very simple idea is due to quita that I forgot to mention in the slide. So anyway, so now we reproduce what we are doing on the conjecture and this is what I am now more or less telling you how you go from time 0 to time 1, right? So you say let's assume that a j are given by, capital a j are given by some, let us call it Fourier coefficients and I look for a solution in a perturbative way where rj of t goes to 0. So and I know that this should be the answer or this should be called you want the right gauge. Anyway, so then because of precisely previous computation I have done in the, I mean the computation I have done in the previous slide, it turns out that if u is your unknown, it's much better to look at what is called the conformal transformation of the u that because essentially this is the lens transformation that Nicola was using before but when you don't have the harmonic oscillator so it's something that happens at the free level. And now what is the equation? u is the solution of cubic NLS and you wonder what is the equation for this new unknown v and this was precisely in the previous talk and it is the same as before but now it is non-autonomous you have the 1 over t that appear in the first study I wrote in the second slide of the talk. So in a few words, I want to find solutions of this type and the way of constructing it is instead of working with the u I work with the conformal transformation I do the computations and I end up with another cubic NLS which is essentially the same except that it is non-autonomous I have the 1 over t that of course is non-integral and that's the reason why these logs appear and also I am changing time so what was t between 0 and 1 now it's becoming t between 1 and infinity but imagine that tau is in between 1 and 2 you say come on then the v is going to be periodic and then you are looking for solutions in the v so quite likely you are in business and this is what happens so now you call Bourguin and say what he did and what he did was essentially this he looks for a solution of this problem in this way and renormalized with respect to the phase you expect to be the right one and you end up in an ODE system for the coefficients vj of tau and what is the relation between this vj of tau and the aj is very simple it's just this one okay so yes the equation depends on j this equation? yes in this aj is good because this aj is given yes but the sum is over j no it does not depend on j because when you do all this together what you end up is something which is periodic right so this is the way I am writing it is this the question? this is the sum ah the sum, the sum I'm sorry the sum is in j yeah the sum is in j this is nothing but a Fourier series but of course this is what Bourguin did you put your Fourier coefficient depending on time and try to solve for this new Fourier coefficient I think the question was the third line this one no no no ah sorry this is I'm sorry this is wrong yes yeah so this is what is what you have to put here okay yeah it is a fun, I'm sorry they are completely right I guess too many j's so instead of aj of t instead of aj you have to put some a of d a aj of t and you really this part of the business what is what you have to put here so it will be clear in a minute what I mean by this I guess it was too much copy paste so well anyway so this is the audio system you finish with and of course so it is a cubic nls you plug your Fourier series and you end up with an audio system for each Fourier coefficient and this is the j, okay I'm sorry so now that you fix the you want to compute what is the dynamics I mean the audio of the j Fourier coefficient then this is the guy you have to put here and it's because of the logarithmic correction of the face I wrote okay is it clear now good so well and then you of course I have clarified the 1 over t and this is the reason of the log correction of the face because you really want to kill this guy at zero otherwise you have a problem of course this is not a new idea in fact it's a new idea as far as the first time I saw it was with again trying to solve this kind of problem not in the 1d case but in higher so then if because you assume that bj at time 0 time 1 in this time infinity in this case is going to be a j square so this goes to 0 at time infinity with the power rate that I will allow you to integrate in time alright so this is it so now finally what is the and of course these are the the frequencies that appears because you have the log of t and you have the you have the bj here and you have the three other guys and then this comes with this particular expression and now what is the RM the RM is that remember that I started with j1, j2, j3 so this M is the difference the corresponding difference of the squares so you factorize and this is the resonance set which is has a very simple expression in the 1d case but it's better to write it this way you have given an integer that is written as in fact it's an even integer and now for all the pairs that this thing happens then you have to sum in this RM so really in the case in the example 2 the bj's are a constant right the bj's are a constant and then what you count is just the cardinality of this guy which is the number essentially the number of divisors of M which is an arithmetic simple function but that really the behavior the behavior of M is complex so then this is the second example so the second example is in the pre if I put all the bj's to be a constant then I can reduce it to a finite system that the only thing I have to do is to do the corresponding integral in time of 1 over t of this series that's the worst the reason of this so the theorem we prove is first goes from the statement of the theorem what says is that we go from 1 to 0 so I don't fix a priori the fj's right I don't know which disguise are and secondly that well I assume not all the Fourier coefficients are identically neither they are identically there is only one which is the first example 1 0 neither it is the second example which are all the Fourier coefficients are the same equal to a constant right so I want to do something in between and what I assume and the theorem states that I have a theorem as long as these a j's are in L2 epsilon a little L2 in this case because these a j's are the Fourier coefficients so h epsilon means that they are in L2 against an epsilon weight so this is the statement of the theorem so in this case of course the value at 1 it is precisely what I was saying it is just the Fourier series that I renormalize with respect to the phase because it's much easier to give the dynamics of the Fourier coefficient when it is written in this way alright so now let me start to convince you that this there is some kind of blow up here this is what I will try to explain in this slide because my functional setting is kind of peculiar let's put it this way so I have the free evolution and then of course what we know is that if I use Fourier transform then if I renormalize by the phase in time 1 i to the IC2 then right this guy is not changing time because all the modes are frozen by this phase so if I renormalize the phase nothing happens and in particular if I start with something which is periodic so it's something like this then it will remain periodic and in fact all the Fourier coefficients are the same and this is what we are starting with I start telling you that at time 1 this is periodic so what I expect is to work with not with u hat but with the corresponding renormalization of the phase and the first question is why is this going to be periodic I mean there is no reason that the periodicity of this guy will be stable because of the non-linearity well it turns out that it is and essentially this is one of the few examples if you try to do this in modified kdb you definitely are dead this does not happen and there is a very simple way of convincing yourself you write the equation for the omega that now will be an integral differential equation because you are in the Fourier side but you do you write your guys in terms of the Fourier transform and again you have the difference of the squares that factorize as before I did it before with the Fourier coefficients but now I do it with with psi and it is exactly the same factorization but definitely this is invariant under translations so if I change c1, c2 and c3 by the same amount this does not change at all so if I start with something which is periodic it is going to be periodic and this is really the solutions the framework we construct I could tell you what is the similar statement in the physical space but I guess I am getting out of time so better if I rush a little bit because otherwise I guess I will not tell many things so this is the theorem the theorem is that if I start with an initial condition at time 1 that is after the multiplication by the right phase is periodic then there exists a solution of the 1dq we can analyze that grows up infinitely in the following sense if I start with this frame this frame is broken at time 0 it remains in the continuous I mean the omega is still periodic it remains in the hs for the torus but this does not happen in t equals 0 it is not a question of size really the size of the Fourier coefficients are the supremum remains the same is a question of the phases so what we say is that the phase at time 0 has this logarithmic behavior where now of course the difficulty is to find what is this number what is the right choice you have to put in order to have a limit and that is the reason why this way back from 1 to 0 is more complicated and this is it this is my notion of law I have a structure and of course the L2 norm is preserved because this is not a question that I don't have a conservation law I do have a conservation law which is the L2 norm in the period so that means that the sum of the aj square is something that remains constant is a question that the phase blows up at every aj and at the phase space is exactly the same except that the phase will go to the delta and x-j but it will not have a limit unless you put this logarithmic correction right it's like I started with the modified direct comb I put not the same weights in all the deltas but these aj's and unless I make this modification of the phase in each j I will not have the limit so this is the precise statement ok so hence the theorem this is what I said before this theorem in a sense interpolates between the two examples you could wonder what happens if instead of the aj's being in L2 with epsilon weight it's in Llp quite likely there are things that you can do in this direction but at least with the smallness if you want to avoid the smallness you will have to work and really then the problem becomes just to have problems in the geometric side and of course the interesting thing is what happens when p equals plus infinity probably that is too much but there is a scenario within this setting that maybe could be affordable but I will not speak about this so now this is of course a notation that at some point was familiar to me after talking to Frank and you want to obtain some some blow up result then you have to keep track of the compact symmetries or the non-compact symmetries so which are the non-compact symmetries here are the translations in space and and time then you also have the validating variance but of course the translations in time are used to determine what is the blow up time this is where the translation in time is used otherwise also including the scaling I am in a framework which is invariant by these symmetries of course by translations because the question itself is translation invariant but also by the Galilean invariance because I am discovering my space precisely in Fourier side and I am saying it is a 2-periodic and also by scaling because I am starting with delta functions if you want at time 0 scaling invariance so this is one of the bonus of the result of course I have to fix some setting which is this persistent and also notice that my condition in physical space is L2 log I mean I am not assuming any kind of decay at infinity although it is true that I am fixing the structure right so it is an L2 log result alright so about the previous results of course as you can imagine this is a very old problem I started with Casenave and I am not writing the years because what likely I would be wrong so it is by Casenave and Casenave is with 2 S then the neighbor and Velo and of course Susumi for L2 again for L2 in the periodic case then about this there was a first result by Carlos Kenny Gustavo once and myself and this was for the focusing case and for the non-focusing and father was extended by Chris Colleander and Tao and there are many other important things in terms of the growth of solid norms and there is a huge literature on this and as far as I know these are the names then with respect to well postness and S here stands for the solid class and it is the the non-focusing solid class this is a hard problem and there was the first results by Koh and Tataru using the complete integrability then by Kilipe, Visan and Sang and then by Harrop, Kilipe and Visan that go all the way up to minus 1 half which is the critical exponent so all these results are sub-critical but of course the class is I mean it is huge because all the class of course it is not Galilean invariant but in this regime Galilean invariance penalizes you so it's something that you really have to deal with so and then but then there is another possible setting that is much closer to the Fourier analysis point of view which is to assume that that the Fourier transform lives in some LP that global in space and of course this is translation invariant which by is infinity so if you want the previous result can be said as a sub-space of this L infinity hat which is the way we typically call this space of where you can say that you have a global world-post mystery where this is local and then this was something that started with Anna Vargas and then Alex Gurnock really put it in this framework and the final result which is this one where that also includes the periodic case at the critical level is essentially the very much in the spirit of what I have told you so far is work with Valeria and Brabine and more recently and this is that he will defend in a few weeks a student of Valeria which is Gouvernin now about the proof I have essentially given you all the ingredients except that now I have to guess what is the the the question that Tomas was asking what is this guy and of course the lambda m is the same the RM is the same and now what is the first observation the first observation is that first you try to understand what is the dynamic of the action what can you say about the amplitude and it turns out that this is really nice so in fact you can integrate and this is of course the proof you can integrate this from one to infinity remember that tau changes the direction of time so you are going from one to infinity so this is your dynamical system and then what you can say is that that the integral of the right hand side is well defined at infinity but of course it is not absolutely convergent so it is an oscillator to integrate and I think this happens also at the usual QNLS and my impression is that we haven't paid too much attention to this fact because you see it is precisely in these oscillations in how so because this is integrable next slide what you can say is that you have a limit so at least you control the modulus of the guy you are looking for this limit then you do the previous trick and you subtract this part and then you take the leading order which is the ODE for each J and then you renormalize and you see that this guy has a limit what I am saying is that what I think is very interesting in the dynamics is in which sense this limit is what are the fluctuations and these fluctuations see this arithmetic function and this arithmetic function has some say stochastic properties which are not the usual ones they are much closer to properties like the one that are called so this was the selection this is what I was trying to say but for example you pick up this example and you try to analyze how are these fluctuations really you have this typical intermittent phenomena that I guess people say in weak turbulence like alright and here I mean you can measure things I am not saying just waving this is not just hand waving this was what I am trying to say so which are the relating systems the relating systems are the geometric flow of curves in 3D which is the so called binormal flow and Liya stands for localized induction approximation and then the two examples would be that I start with a curve in 3D that has a corner at times at x equals 0 so this is the corner so you have two vectors, you need vectors that are not the same and you have this line on the left, on the right and this line on the left this is one of the systems the second example which is when all the coefficients are the same if you make the right choice of the CM I was mentioning before and this is a delicate issue and I will extract a regular polygon so you are looking at the evolution of this geometric equation for starting with a regular polygon and I will show you a video in a minute and that you can expect to have a solution for this guys is something really not is something that I have never expected but fortunately enough Valeria call our attention we here is the Laos our attention of paper is as much where they do I mean they have theorems but they do in particular this numerical simulation of the evolution of a curve which is given by a square of a triangle numerically and then you start to believe that you can do math with that anyway so there is another related system which is now in the physical literature is related to what is called the Heisenberg change or the Landau-Liszi equation which is the one you obtain looking at the derivative with respect to x of the curve the tangent vector and this is it you differentiate formally here you immediately obtain this case so now we are dealing with guys these leaves in 3D these leaves the target of this is the unit sphere so I am speaking about systems and the connection is a very old and beautiful idea by Hasim Otto that if you take the evolution of the tangent vector and you use for example you can just use the frenet frame or the parallel frame and you call alpha and beta your curvatures you say your geometric quantities then you build up a complex function that amazingly solves this this cubic NLS but with the freedom of gauge you have the freedom always to use this capital A of t which is the one that allows me to in a sense forget about this this loss of information of the face so this is what I am trying to say that the geometric structures implies that the singularities of you are human are harmless and the solution can be continued as a geometric object but of course life is not that easy in fact there are part of the geometric object that does not survive which is precisely the frame of the normal vector and this you have to raise a blow up but again here you use model how are the beautiful words modulation here and then you will be able to do your business why because you identify the asymptotic profile which is given by a similar solution and now I need to say a few words about the self-similar solution because this is the one of the key objects so the self-similar solution with respect to scaling will be written in this way and what it is kind of interesting something that honestly I don't know why but this is what happens is that the simplest way of understanding this nonlinear profile is by looking at the Fourier transform and you have to do a nonlinear change of variable in the descent of this e to the ITC square I am modifying all the time so when you do and this is because eventually you are going to deal with the derivative of the tangent but this is the key guy, I mean you compute the Fourier transform and you do a nonlinear change of variable and this is your good and known and then you identify what is the the singularity is this OD which is a singular equation very simple so you have really linearized the problem of course you have also linearized the problem through the Frenet frame but this is this is the guy and this is something in particular and now your object which is this is the important object which is the derivative of the tangent vector the Fourier transform is nothing but this say the solution of this equation evaluated here in particular what happens and this is not easy this is where the difficulty comes that the information you have is one part I mean because eventually in order to continue the solution geometrically you have to find the information you lose in the phase from somewhere so this information has to be in the in the OD and it happens that at a frequency zero what you know essentially is they say the the angle of your solution the two lines at infinity but the renormalization of the normal vector I mean the modulation is an information that you have at infinity so you have to solve the matching problem which is you have same information at zero and I have to tell you precisely what happens at plus infinity and as you know this happens with very few equations in part of the literature this is like a hint that you are dealing with a completely integrable system that in fact it is the case the cubic analysis is a completely integrable system but the conclusion of all this is that the Fourier transform for some reason is playing a role so this is the dynamic I was saying so well this is this was done by Gerard and Schmetz and it was nothing too complicated they use a scheme of of bad key which was a very old scheme and it's in fact just finite differences and the only thing I wanted to insist is that amazingly you go up and up with the same guy this is there is no reason why this will happen but why I think that the similar solution is the universal thing is because you see when you close to the singularity in each corner what you see you have to believe me is the similar solution and the similar solution has the usual two scales of the Schrodinger equation which is the one given by the phase which is similar but then you have the other linear scale whichever the oscillations start to appear and of course because you are in a periodic setting all these waves start to interact and create very complicated things as the ones that you see here this is something that the Laothan and I put in the picture which is to illuminate what is the trajectory of a point and you see this guy which is pretty complicated and has is very famous is related to the to the so-called Riemann's no differentiable function so now I guess I am three minutes okay so to finish that really there are things that are happening which is so this is kind of a mixture of linear and nonlinear you are measuring in some kind of equilibrium with most of the dynamics is something that you recognize at the linear level this is a complicated dynamics that survives even with nonlinear interaction but there are facts that are not completely linear and there is some cascade of energy or some transfer of energy you don't want to use strong word which is more or less as follows first of all the natural quantity t is for the energy is this and you can write it in the conservation law so this is a natural energy but I was trying to convince you that you can understand the solution also in Fourier transform side and it turns out that you can identify this energy associated to this guy in the Fourier transform side as an scattering energy ok so this is really the energy of the system you see it in the Fourier transform side when you look far away at a given time in frequency but on the other hand even though you have the L2 conservation law there is some growth of is L2 in a very precise sense so I don't have the time to explain but anyway so what happens is really the Fourier modes even if I start with a very nice as I said the function v can be very nice the periodic function so it can be h infinity so it is not a question that it is not bounding at time 1 however when you look at the Fourier transform and you go to t going to 0 the Fourier transform blows up and this is some kind of say transfer of energy which is complementary to the well known of the IT and Honey-Pausadeur Esbetkov and Bezilia so let me finish just with a simple idea of the proof because the proof is mainly written in the Fourier and with this I finish so it is written in the Fourier side and of course here I am going to not be imprecise but at least to try to convince you where the new resonance comes from because it is a mixture of a non-local guy with a local guy so I start with the equation for the Frenet equation this is tx is the curvature but it is better to write it in this way using the complex notation and n is the complex vector that tells me how the coordinates of the normal vector are changing with time and of course this is symplectic you have to construct an orthonormal frame so then remember that you is essentially this guy times a nice function because it is periodic but it is nice, it can be as regular in fact I have started with just two Fourier modes negative one and one and it is very simple now we know how to do it in a quite straightforward way to say that t goes to two given vectors which are really frozen so then I can so then I have to imagine that you want to understand how we send what you are saying is that the derivative behaves as essentially at infinity because the problem is to make this integral finite at infinity is a given constant times a very well known guy so you are going to integrate it by parts and this is the role of the different scales in the Schrodinger equation that when you integrate by parts even though you have here the parabolic scaling when you integrate by parts you start with you end up with the hyperbolic scale and this is your basic integration by parts so you are going to take good powers of t here now t is in between 0 and 1 so I am in physical space but you have to pay with the distance of xa to one of your Fourier modes, imagine r is going to be the negative one so then you are going to plug this into here so this is what I am saying and it is going to be essentially this guy times what happens close to 0 this is part of the hand waving but at least it is pretty clear that after integration by parts this is what you are going to obtain and it is not so simple to say why I can now freeze the time in 0 but now if I take this in the upper equation and I wrote what is the u then immediately I see that I have created new modes which comes from the differences of the phases so the new modes are just the differences so if I only have two modes then I will only have a new mode which is the difference but it comes with a very precise frequency which is 1 over t so the Fourier transform this value x over 2t will be as big as this and of course x minus r now this is a key point that because you have more than one Fourier mode you lose the symmetry from left to right and then even though this was true for say in absolute value even then so that if you interact you are going to have the principal value because you have two corners then really you have this guy in this region and when you compute the coefficient which is precisely this will cancel this phase and you have to integrate 1 over x which gives you a log so this is the picture and with this I finished so I have the two corners then because of the self-similar solution I know that nothing happens in the self-similar region square root of t but as soon as I am far there I start to see all these oscillations you saw in the picture and they start to interact each other and then I scale t you start to have new modes that do not decay too fast and eventually give you a logarithmic connection and so let me just go to the last one ok it's clear what is there right so that's all so thank you Luisa do you have some questions or remarks so you started with regular polygon but you are here regular polygon well we have no idea even with a regular polygon the only thing we have is the candidate to the solution so example 2 is we say this is a solution in a very very weak way and then what we know when I put it in the computer and I look at the polygons that happens at the rational times fit with the evolution but we don't even know how to construct the curve for irrational times so this is we are working on that but this is because all these Fourier series I mean it's much harder than to deal with the Riemann's function Riemann's function at the end is absolutely integrable and all this Talbot effect a few experts here on this Talbot effect this it took quite a long time to understand Riemann's function and so now it's understood but the guy we have to deal with for constructing the curve for irrational times it has one less derivative so Riemann's function is 1 over j square and the one you have to deal with is 1 over j so this is much more delicate and of course you have to solve for a net frame for that so this is very much in the rough very rough path things but here you have a very good description in terms of Fourier series of what it is your curvature and torsion so then your question is now what happens if I have say something like this right of course you can do numerical experiments and then you see that essentially you can superpose this is the reason why I think that the regular polygons are kind of universal because it's like you have two different periods one is this and the other one is this one so you will generate like one for one period the another solution for the other period and then you have to look at the interaction like if you had two solitudes right so this quite likely can be doable but not yet other questions no one comment the comment is about the solution EA when you look at it in self-similar variable it's a penalty solution what do you mean by self-similar variables x by x over square root of t well it is not periodic it's e to the i x square this is the point that say the kind of strange behavior that's happening is that you are maybe if you look at the time you will have your p i s x square and this solution x in s it's periodic this is the solution I don't know I will say no no because you have time also we will explain later because I don't think I am understanding you and a second question sorry for this stupid question the parameter is in higher dimension because it seems that I would say I guess that maybe Daniel is agreeing with this the difficulty here is one dimension if you look at of course what happens in higher dimensions I am not saying that the higher dimensions are easier I mean the Schrodinger Mathems these people did in 2D was really to the force but I am speaking about something which is critical and also to understand this long range scattering and as far as I know this is a basic question that we don't understand yet we don't have a good threshold theorem of when you have scattering when you don't have for example all these solutions are huge so they are not as small and in a sense all the behavior is one of the long range scattering and this is because I am using the conformal transformation that kills the solitons of course but for me this is not clarified at all so definitely higher d is very interesting but I mean I have enough job here many things to do here ok, no more questions thank you again