Hey everyone, Shaber1000 here.  So I went in and Put some more movies on the car just in case We were pinned down by the rain again. It isn't raining yet. It rained a little bit earlier, but We're gonna have a fire. I did bring us all but Okay, the headlights went out on the car So anyway, it's kind of funny Something she got for me. So All right, guys Let's get into this camping trip So on the way back from visiting monkeys mom She said, you know, she's why I gotta see mom on the way back. You want me to get you one of those? One of those little tanks is this one's about empty. I Said yeah, get the smaller ones. They got them. Well, she messaged me and said, well, they got some big ones and I said that's fine This is what she comes back For this for those of you Don't know oh we saw two deer on the way and bright in this campsite Not just campgrounds can't say see the the top see the threads around there and Right there See the difference Nope, okay, so I needed one of these anyway for my torch They also work on which we do have her dad had a Well, we got it now a Lantern that takes one of these and they also do make some bigger stoves that will take this but Not that one Thank you mark. She's waiting on me to build a fire. All right. Let me get my tripod. Let's build a fire All right second verse same as the first That's crazy This campsites cursed we'll talk about that later now I know proof of that But I'm definitely saying it's cursed Come on.  I got some bamboo here month monkey found some bamboo earlier Well today this morning this afternoon whatever Didn't you muck? Yeah? We got our fire going So I guess it's gonna be story time again, and We'll just kind of try to go over everything The many reasons why I feel this place is cursed You know what I should have did what I should have used a piece of this and whittled you a flute Yeah, I'm serious. I can do that Very is started once it gets going We'll have story time That's an airboat here. There's like a bridge. They got to go over.  That's why it's But hurry it'll Weed it and I've got some water in there boiling right now for some of this stuff. So All right, and I'll be back with you. Maybe we'll tell a story We think We'll tell a story about why this place is cursed To me anyway, so This thing's pretty old That's a pioneer Let's tell monkey or I said, yeah, that's probably from Early 80s, maybe mid 80s. She said yeah, it's about right. I'm like How you know she said that? Her aunt and uncle bought that for her dad brand new and she said it was in the 80s So that's pretty cool. So that's something we'll we'll clean up and I wouldn't call it a restore But we'll clean it up. That's pretty cool focus Yeah, all right. Well story time then we're gonna have movie time. Well, I mean monkey are but I Can't show you guys because a copyrights, but Yeah Pretty neat Have to lower it down a little bit. We'll see Story time I believe this place is cursed Now I say I believe because It's supposed to be haunted. I have no proof or I can't prove it or disprove it as far as the curse goes I feel like it's cursed to me because Yesterday on our way out here He was on the way out one. I said we forgot the wood She's like, oh, no, you want to go back? I'm like, no, it's you know going to rain is getting dark. It's pushing four o'clock Let's just go out. I'll just cut some up. I forgot my souls So I forgot the wood forgot the saw. No big deal. You always forget something I don't or they ever forget anything. So we get out here Open up screen on my camera memory card late blinking. I knew immediately I left it in my computer At home She's like, oh, no, now what so I had an extra one. Thank goodness so we get out here and the Instant up screen house tent thing is it's not It gave me fit. So I didn't even film it. I wasn't I knew I was gonna have issues with that All right. Yeah, what else happened? Hmm Yeah, it it well, you know, I mean so The stove not working right. It's not atomizing the fuel. It's just squirting a steady shot of fuel. Wow Okay So hang on. So anyway, the stove Wouldn't atomize and so we try to take it apart, you know, if you saw the video So I didn't take it clear part, but I don't know if the nozzle in there. I'm not sure what's going on with that, but so I was like, man. So I did have you know, I did have a machete. I got a cut. I got like two or two Actually, I've got three axes one's a little one and got one that Brian and Marla sent me And then I got another one that came with my machete. So I was like, well, just use my machete and Chop up some wood.  I'm like, oh, yeah, cool Get it out and it was it's almost empty I think there might be enough to make her a cup of coffee in the morning, but it was almost empty. So Of course that little thing just does not heat up a cast iron stove or cast iron skillet very well, so Yeah, I mean our food got cooked. That was no problem, but it was just you know, it took a lot longer and it was late so And then just losing it losing everything you say something down. It's gone. We couldn't find nothing so We get to watch in our movie couldn't get Get the thing set up right finally we got it set up right and then it was fine for a while So then when I closed it back down, you know, so she wouldn't get cold and Rena wouldn't get cold So I could watch something We Let's see, how would we do first a thing across? Yeah, yeah, we did the thing across and and Have Bruno's mat that he lays on it keeps him cool in the summer It's okay, but you know the color was off, you know on the movies because the mats blue But that that was tolerable And it was just like man. It just it just wasn't right.  So you don't run the battery down I thought that's what was going on. Well found out tonight. It wasn't there's a spring inside There's I need a new end or I might have a heavier spring to put in there So it's starting to where it doesn't want to hold The positive pin out up against what it's supposed to in the socket, right? So you got it so every once while It shuts off and you got to start it up again that happened.   We watch movies. No problem And my knee just well started hurting actually Right before we got home, you know, and now I'm limping around my knees hurt I don't know what I did to it. I didn't like to twist it or anything It just it just started hurting and now it's gotten worse So So tonight, you know, I showed you the thing, you know, I ordered some propane and Of course they delivered the wrong stuff Something like oh man, that's all right. I'll just I'll build a fire, you know, so, you know, I got the fire going and everything and Finally got separate cook But so I built another little fire over in in the in the grill thing to boil the water and it just couldn't get hot enough Because we got this real thick pan Pot and so finally after me got done Oh, that was another thing to me.  I took forever to heat up Then to get the boiling so we'd have our macaroni and she's finally got it and see what else happened I Don't know I think that's about it strange full moon, too. You guys saw that so Couple noises Do all that was I seen him. He was Norma Dillo. Yeah, I think last night the door sound we was hearing out She in the morning when we leave I'll show you the other came around. I don't like I said I didn't hear anybody up there I don't know if there's somebody up there, but do anything I can figure I figure maybe somebody was up in the other Campground and going down. I think we might have been hearing the door of the porta-potty clothes and maybe it's not real far So that could have been it So I was going to do like a ghost hunt type thing then I eat but Somebody's down at the gate blaring music and you can hear him down there and stuff So I don't want that coming over, you know onto my mic when I'm trying to You know do something like that so So that might be an out we'll just have to see what my leg does Jesus, what was one thing after another? Oh her thing she couldn't find her damn Her blood thing for her insulin or tester couldn't find this They said to use her mom's today. Finally. She did find it after we got out here Just couldn't find nothing It's not raining now clear skies. Yeah, but they're cold. So that's why the car is running So I thought I'd let him warm up for we watched a movie so One thing though this car holds the heat on it. Oh, yeah, turn the heater on last night for 10 minutes It was swatting us out and then an hour later. I was like I wanted my fan. I Forgot it last night yesterday forgot it and So I brought it tonight, but it got hot last night had to keep opening the doors and I mean it wasn't hot outside. It got down in the low 50s. Didn't yeah, maybe it's cold Well, it's her it was cold, but he was sweating. I was I was sweating Mm-hmm. Yeah, so, you know, just like one thing and I ask her I never forget anything. Do I No, I mean once in a blue moon, I'll forget something But normally I don't I mean you always forget something when you're camping But I mean I normally don't forget anything because you know in fact, she always jokes with me I bring too much stuff so and for me to forget The fan the saws The wood my memory card, you know all in one go Yeah, Jesus So is the place cursed can't prove it, but I'll bet you can't disprove it But it seems like a curse to me Mm-hmm. All right, so that's my story time Hey Mike, what do you know about this place? Do weird things happen to you and your though we did get to hear the code ease time when we was pulling in about 1520 feet from our word this truck is sitting now when we pulled in tonight We saw two deer one was a little farther than the other but it ran across and then another one ran across And I saw that armadillo and we got to hear the code ease and we got to hear the owls, so But other than that, well, you know, we're not hungry. So that's good She's I'm not move she's doing it. Yeah, that's me. Well, please stop That's why I had to stop a minute ago Bruno's trying to get through this, you know, it's just like it's strange But Bruno loves it out here now back at the oak at oak hammock my favorite one Was she likes it too, but her favorites the river But my favorite one's okay. I'm like He don't like it there He gets out of the truck. He'll go get out of the truck go the bathroom Whatever hang out for a few minutes, but then Then he's either back in the truck or in the tent. He don't like it over there over here. He loves it As we let him run because no one's here, you know, so we let him run around here.  Yeah, I found some matches. I've been using matches and the fire, you know stick sticking it on That was another thing I'm gonna watch a movie. What's your dome on? Playing here. It's three clubs.  Yeah, I know I have to keep waking you up. I'm watching a movie If I had to do this again only this is different now. I folded up a Tablecloth and put up there because I had to close the door because monkey was cold because it's 50 degrees out, you know It's freezing earlier So I Had to come up with this and then the screen I was taking it down and it flipped and ripped a little bit on the corner, didn't Yeah Yeah, so my knee, you know told you about my knee don't know why I bit now I just walked around the back of the truck to go get Bruno some water And hit my right shin on the trailer hitch those things have hurt more people than firearms Saw a bear Mike have you seen bears in this area cuz it's like the second one I've encountered since I've been down in Florida he was Like right on the other side of that I was over here by the fire There's where the fire pit is Right there, so and I heard something walking. I thought maybe it was a deer So I snuck over there and I seen the back of him as a bear And so I stopped real quick and he kind of looked at me and then just went on about his way little or one This is where we got to put our stuff from back there up to here when we sleep back there Yeah Fun fun fun guys The moon is directly over my head now there are stars out, but you know, I don't know if you can see him or not But anyway I think I might watch one more movie since it's only three.  What you try to go to sleep by five I try to go to sleep by five But it doesn't always work no, why am I out of focus? Yeah, whoever's playing that music down at the gate that way They just stopped just not not too long ago so All right I might kick you on again if not I'll see you in the morning because we got to pack up and leave Monkey said we should stay another night and I'm like I would but We have to leave the morning if they changed the gatecode And we're back in here and I have to calm they'll be like were you supposed to be out yesterday? Which it would be tomorrow, but So But that's all right We're up fellow raindrop. That's weird. How can I feel raindrop is not cloud in the sky must be off of a tree? But yeah, so oh See how many he's doing Saturday and it's better Saturday or Sunday. We'll take a hike. Come on. Yeah, turn around smile at the camera. I Am very out of focus here. Are you? Yeah Focus I ain't gonna do my camera being out of focus, but no, it's not foggy at all I'll be back guys. Good morning everyone Getting ready to pack up monkeys. Just get Stuff organized there in the car Got the car running for Bruno You come outside. It's windy.  I'll show you the other spot right up It's kind of diagonal from here And I'll show you the little creek that actually runs Right right through here I'll show you this this is pretty cool how this tree is Not cool. That's pretty neat, huh? Still alive, but yeah Creek runs right through here We heard an airboat last night And then he gets kind of like swampy right over in that area there.  So pretty neat But we did see some wildlife That's cool. This is a nice place very pretty back in here. So Especially since it's not raining and sun's out And another cursed thing I forgot my drone twice Because I was gonna put my drone up this morning. I forgot it again yesterday All right Well, we're gonna get torn down. She's just getting organized now.  It's nice, but it's a pain. Yeah, but it is nice. Yeah You know shade and rain It's handy, but I think I'd like to find something a little bit better easier. Yeah, I mean too. Yeah It's just too hard. Oh, I couldn't even I'd give it to somebody if we got another one But I ain't selling that to somebody You know me I'm too honest I'd tell them look man, this thing's a pain to set up it's not bad tearing down, but It's not easy either It's like like these things here And what happens this is the second time we've had it set up look they start pulling out What's in there that little silver thing that's not supposed to be sticking out of there and The one right diagonal from it's the same way, so But yeah, it's handy It's just not handy to set up All right guys, I'll be back with him. We'll show you the creek and That other camping area up in there. Okay guys, so right across. There's the other camp area This is a shortcut out of here monkey found I didn't know it existed So we were just like Rate straight through there and we came up and then turn here instead of going out and then on to this This is like the main road Creeks right down there. We'll go but this is pretty cool. Let's see if it still works Needs a seal But yeah, it's still work if had new seal in it might just need prime you pour water in there Very good This is cool not for drinking I think it's that old It's not an antique no Yeah, you don't this is like for horses and Dishes and to wash yourself. It's non-potable So what the sign says? Yes, he's limping Bruno, where are you going? He just escaped Come on, get up in there Get in the back No, get in the back. Daddy's in the back I'm still recording. So here's the creek in the bridge Says no vehicles behind beyond this point We were up here on this bridge a few years ago when we hiked back in here didn't really hike it Was just more like a walk we took a walk back in here Okay, here's a vehicle bridge and this this part is for the airboats to come up on and I think if I can find it. I think I've got a video of a boat crossing here We were standing up here pointing that way and So that's how the boats get around But yeah, this is where we were gonna fish so we were Just right back in them trees there Just right back in them trees, so where we were camping at Yeah, I think I've got a video standing here with a birds crossing boat crossing here Did I YouTube it? I think you did You also if I can find it and put it up right now This is just too low for any boats to get under now. You can't take a regular boat across there. No Here's a biker Now we'll show you in the other campsite is up here on the right. Good morning. How are you? Good? but the other like I said is just Right on top the hill there to the right We kind of took a shortcut here But yeah, we were camping right over in there month. Yeah, yeah That's why it hurt that airboat Yeah, I'm like She said well, how come we don't see it trees trees She can't see the force for the tree I didn't even know it. I said why I told you I said the creek right over there Oh, yeah, and then we hear an airboat. She's like wow, that's close like the creek's right over there Yeah, it was it sound like see you can go to the left or right right up there. I'll show you This goes right around her Yeah, you can go to the left or right there after To the right kind of circles around the camp area heard a real weird noise over in here last night. I Told her I said man. I hope it's on the other side of this creek It was a it wasn't a how it wasn't a growl it wasn't a Coyote we heard the coyotes so I don't know what it was but it was The weirdest spookiest sound I've ever heard my life Yeah, all right, we're going to go up Where we was just sad just right up here just a few hundred feet. Can we drive over this? I don't know that sign. There's a sign up there says no vehicles be on this point So I don't I'm sure they don't mean that way cuz you can't go there anyway Some guessing up through here. I don't know. All right guys. I'll be right back That's pretty cool. I built ourselves a camper. That's awesome So this is that brings you right out down through there brings you right out by the bridge We was just at The last time we walked up in here, that's about where that woman she lives in her van Remember? Yeah It's probably that noise we heard down around here for the kids toys And this is pretty this was booked to as you can see there's only one person here That's why we went over to the other area. They don't really say which They they don't say much about which area That you're going to be in they just said They see you're going to tip back there But I was just going to tell them if that's where my horse was I was going to tell them we got 288 under the hood of this thing, but that's cool That's awesome Where we come out at right across there There's a porta-potty right there mama. Yeah, they put a fence around it. Yeah, but she could have went there This way we've already been that way. What do you mean what way?  Yeah I was close We went in there, but there was a guy in there, so I couldn't film it because I was driving so Yeah, there's not there's just a few in there not too many that this is really pretty through here Just filming That's it They have a Check-in station up here for deer and turkey. Yeah, Turkey didn't Know the hunt turkey and cages All right guys, I'm gonna end it here and because I showed you all this before and I say better do this thing But right in here is where we was going in and out to our camp our campsite Right here, that's where we were So there's a couple different ways to go there And we've got the porter party here And this is the check-in station here Got a map legend there. I got a cane crusher That's it Yeah Fish cleaning station No place to wash your hands. Yeah, okay at turkey and deer check station See the the boat winches. Yeah, that's what you hang your deer up on Yeah, we just went from right up on And I'll show you the main gate It's just right over this little knoll. It's nice back in here beautiful Now on out this road a little bit on the left What? What I don't know. I don't know what it is What was I saying? On out here a little bit On then to the left there's hiking trails. That's part of flying eagle Here's our here's the main gate. Here's the main gate. There's the kiosk. Oh look horsies We got some horses here Here I'll let you rule Cool, that's really neat. Now we get up here a little ways. It's not real far. I'll show you where like another It's part of flying eagle, but it's where you can go in and walk around and stuff to trails and things like that Didn't want Bruno Spooking them horses.  I haven't hunted in a while, but since well since I've been down here, but I mean that's You know, you can't come out here can't because the hunting thing But But this I don't know If this is another No, I don't see a blue lock. So this one there there must be trails up in here and Also, you can see the horse the horse prints There I'm betting that's where the horses came out. They're probably riding through here. So but yeah see There's trails up through here around in here I don't know what that creek is. So this is where we're at right here And See we were camping right here, but I don't see where the creek's at through here But we were camping right in here Yeah, right there on the E for equestrian for the equine So So the yeah, there's the creek right there Another spot over here. I'm not sure where that is says number nine But I don't know so there it is Flying Eagle preserve awesome Yeah, do not block D. So Yeah Maybe I hope that I'm let the hunters go back in there But yeah, it's it's nice back in here and then all that over there's private property Pretty cool. I'm on Yeah, all right guys, so this is gonna be my outro and Thanks for watching guys appreciate it. She better the myth man a legend Yeah I mean, it's beautiful, but I still say it's cursed for me. What do you think I? Said for me, what do you think?  Yeah All right guys. Yeah, sorry. I forgot to drone. I could put the drone up got some beautiful footage But forgot it two days in a row. All right Maybe we'll bring it out whether we hike or not. Maybe we'll bring the drone out this weekend some time and We'll say that you put it up in the air. Well, I I still fly my drone It's what I'm saying We can come out put the drone up right, I Don't know. All right guys. Thanks for watching. She better the myth man legend gone for now We'll see you guys the next one. Bye. Bye guys last one of the year Couple weeks we got another one coming up. Don't we well not a camping trip, but we got an adventure, huh? We're going to Fort Cooper so Which we're not we're just a couple miles of the crow flies from there. All right guys, we'll see you in the next one Bye. Bye and take care


In this presentation, we will take a look at the benefits of a flexible budget as compared to a fixed or static budget. Last time we took a look at the fixed or static budget and we compared the budget that we had to the actual numbers and then the variance or difference between them. And we determined that we had a favorable difference for the sales. We had a favorable difference for the net income and an unfavorable difference for many of the expenses. And that is what we would expect if we had a situation where the budget was based on a lower number of units, 10,000 in this case versus the actual number that was actually produced, 12,000. And that means that although we have a favorable difference in terms of sales and net income and an unfavorable difference in terms of the expenses, that is what we would expect given the fact that we had the higher production level, which is in essence a good thing. But these unfavorable differences don't really give us enough for us to go in and improve with. It's not enough information for us to go in and make decisions on how we can better our expenses or control our expenses better or budget better. And so in order for us to do that, we can take this information, break it out into a budgeted or a flexible type of budget. And then we can make this comparison based on 12,000 units, meaning we can adjust our budget as if it wasn't based on the 10,000, but 12,000 and therefore compare the budget to actual both being based on the same number of units being produced 12,000 and then look at our variances, which would be comparing the same thing, the same thing, apples to apples as they say, and give us some more information that we can then further possibly break down and make decisions on. To do that, we're going to take our standard type of income statement and break it out into a contribution margin type of income statement. So you see we have here the standard sales cost of goods sold is broken out by a category of what the expenses do for us, as opposed to the behavior of the expenses, the fixed and variable. So we're going to come up to a budgeted income statement that will be a contribution margin same bottom line 7,900, however, it'll be in a format of behavior.


So you talk a lot about money in your work, or at least in your earlier work, you've written about money often, and like scarcity in the sort of role with that. So why do you think artists and like art, so creative people, why do artists not make money? Like what is it with the, obviously there are some, you know, if you have a big blockbuster movie or book, they make money. But what is it about just the everyday art? Cause then it's like they're giving gifts. Most artists are gifting something for free. So I'm just curious your thoughts on this. Yeah. That has to do with what I call the cult of quantity and the economic system that's related to it, which is based on the exchange of commodities.  It's a quantitative measure. And when you, so, and it works really well if you are using it to exchange standardized things that you can reduce to a set of specifications. You know, I want to order 5,000 widgets from you and I want them at this weight and this level of purity, et cetera, et cetera. Like I can specify that and market competition can operate. But an artist, a true artist is creating something not just good enough to meet a set of quantitative specifications, but an artist is in service to the work itself and wants to make it, wants to fulfill that work regardless of the demands of the market, of the boss, of the art critic, of the customer, the market. Like there's, we can detect art that tries that. It's called a sellout when it's no longer in service to itself, but it's in service to something external. And that, but that's what lends it to commercialization.  You might get lucky. Like I'm not saying that just because something does well commercially means it's a sellout. But the converse is very often true. When it's not a sellout, it often does not do well on the market because you're not doing it for that. You know, do you consider yourself an artist? Yeah, I do. Yeah, sometimes I spend inordinate amounts of time on just one sentence because it just doesn't sound right. And so we're going to get the point, like anything that I could specify as its practical function. It works, you know, but it's just, it's not right, you know? So yeah, and yeah, I'm not doing it solely for aesthetic purposes. And in fact, the exporting of art onto aesthetics is a big problem. Art is not something separate from practical goals. It's in service to those goals. But not only that. And or you could say that the full service to the goal depends on things that are beyond our understanding. Like probably, if I write something that's really beautiful, that is more beautiful than it has to be. It probably actually serves what it has to be even better than I understand.


Vice President Yamio Oshinbajou has assured that all critical projects being executed by the federal government in Nanja Delta will be completed. He said these are a lecture and a word ceremony in Lagos. Oshinbajou was represented by his senior special assistant on Nanja Delta Affairs, a dobo yamu who talked about the government's new vision for the Nanja Delta region. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


You just mentioned Rainwater, but is, do you feel like mode three is more talented than Lil Wayne and Tupac? F*** no. F*** no. Rainwater shirt, what the f***?  Yeah, we on boss talk one on one, one on one. Yeah, we gon' talk.  Like that, and what I was saying earlier, like the Dallas shit's not fun no more. The DFW rap music, it's not fun. Not saying that people gotta come out here and beef and kill, because a lot of people blame me for that. Like I was the mediator. Yeah, I got a call and it was like, you the new Sean Cotton, man, something just happened.  But it's just like with, for example, and it just happened again, but like Rainwater, Charleston White Hat came on my platform and said something about Rain, right? And Rain called me, it was like, man, I gotta tell you about yourself. I'm like, damn, what? I'm thinking like a hundred different things, like what the fuck, like, how you gon' let Charleston go?  Right. Now, Do you want to come back on stage? Now Rain wants to come, and there's nothing wrong with it, because like I just told Charleston in my last interview, I don't want any false allegations on my platform if somebody can't come speak and defend themselves. Exactly. But then it turns into a messy thing for when people look at it being messy, when now everybody wants the last word and they keep coming back to your platform, and now you looking like the messy one because it turns into he say, she say. So it's like, nah, man, but like I said, I like what Halfpins doing, I like what Rain's doing. Are they seeing it out of the hour? That's cap. I think right now. Because you never know what Rain, man. I think Rain is talking to it like he always do. That's something that Big D taught me about Rain. He said he seen something in the bathroom, he calls it what he said. Man, Rain is this and Rain is targeting whatever he's targeting, and he's on a mission. That's all. And I learned from Big D that you just gotta take him for what he's doing and just let him go where he's going. I just think.  I don't know. I just think all this is fun, like the mixer, the mixer he did yesterday, it just makes, it brings stuff to life. It was a success too. Yeah. There was a lot of people in there. And it just, like I said, these artists in Dallas now will appear. It's not a lot of entertainment going on. Like when you had Yeyo, Mode 3, it was just niggas will go live. It was just a lot of content being made and people were, like a lot of personality being splashed around. Nowadays it's a lot of, like I don't agree with saying all artists suck though either. Like that's not something she said. That was something that was saying on a big platform like yours. Having a big platform, like you should never say stuff like that because people will get discouraged. But I mean, there's not a lot of artists with the full package. I'm gonna say that. Yeah, the thing is, I wanted to ask you another question about, you just mentioned Rainwater, but is, do you feel like Mode 3 is more talented than Lil Wayne and Tupac? F*** no. Rainwater. What? Rainwater's shirt don't f*** up, dawg. NBA Youngboy too. He had to get him too. He said NBA Youngboy was more talented than Tupac. It got more, not more talented, more established. That's what he said. Nah, he, nah, Mode 3, see Mode 3 was good because he could hit every angle. He could make love songs, heartbreak songs. He gonna tell you the good and the bad. He gonna tell you the consequences. Yeah, you can go kill somebody, but this will come with it. It's not just the one side stories. Man, Mode 3 was just a one-on-one, man. And I don't think we'll ever see an artist in the city with that type of backing.  Killing it. But it was like we grew with Mode 3. Like we seen Mode 3 f***ed up, Bummy wearing fake designer. Like we seen Mode 3 homeless, Saini was homeless, selling CDs. Like we're not gonna see that grind no more. And it's nobody's fault. Is this the stage we are in hip hop? The different generation. You can't sell CDs no more. I remember Mode 3 slingy CDs. So we'll never get to see, I don't think we'll ever get to see that type of growth anymore in the DFW, man. And that was, I remember I did the Dallas verse, everybody record. And I put all the Dallas rappers on one song. Fat Pimp, Lady Savage, everybody on one record. And I put Mode 3 at the end of the record, man.  I'm gonna ask you about them. I got to ask you another question too, cause I ain't gonna hold you too much longer. But what, man, do you think you give me a top five interviewers in just period? Top five interviews, viewers. Damn. In Texas, do you want to do Texas over there? No, period. Okay. Damn, gotta go Vlad, he OG. Vlad, that's the one you always uplift. And I ain't gonna lie, I like Vlad, man. I do be on Vlad a lot on here. I let people go in, but it be just because the culture is so parallel and mental.  But I'm like, man, but then- Slim Thug mentioned him the other day. Slim Thug just mentioned him. Like he catches a lot. Hell yeah, he catches some boulders here. He said, for stop going on Vlad, because who was talking about Boosie? They said Boosie, but he was just, I think he was in general with that statement. But you say Vlad because Vlad showed you the game. He showed everybody, a lot of people.  I watched what you was doing. I watched what, I watched Breakfast Club a lot. If you really think about it, I was like, I'm gonna beat Breakfast Club. That's who I want to try to lose. I'm going at Breakfast Club. But it was like, in a way from the South where our people were, but then this was an independent thing. And I think that's what made me different. But at the end of the day, man, just top five. I don't want you to try to get out of it, bro. It's really gonna be hard, because I mean- I need to top five, baby. I like what Nojumper's doing as far as, I like how he, it's a lot of people that, I like how, I don't know, I like Nojumper, man. It's a lot of shit that I don't agree with, but I like his format of, he brings a team on and now he's feeding a lot of different people. I like that. But they could, AD was over there, but that's my boy now, like I told you. I'm surprised they don't wreck out, is what I told AD a lot. Like, how do y'all, with the politics of what y'all dealing with up there, how do y'all be in the same room? But the business is business. I get it, but this thing could spill over easy. So that was a thin line right there. You just had one runoff on there. I just talked to AD earlier today.    So that was hard too. Yeah, I like Gilbert Arenas podcast. Gilbert Arenas, he has a Gilbert Arenas, that's what it's called, Superdope. Shit, shout out to million dollars worth of game too. Man, that's four, one more. But it's a lot though, like I'm on YouTube. My girl be like, man, you always on your, I'm just such a student. Like I'm just such a student on how can I get better? Better.  He had the voice. He was serious about it. He had the voice. I love that voice. He was serious about it. You know, me and him would talk about things like, how y'all be building a relationship because I tear relationships up. Yeah, because he wasn't good at that. I feel like, man, you keep, you keep her, like me and, like me and Phaser became tight, like after I interviewed him, he was trying to figure out like, you do that, man. But to hell, I think he did good with Nate Boone, which it ain't much, I mean, he did good with that. And the thing is with, man, like, we can talk about Big D all day, but after the Nate Boone interview, he was like, man, you should interview him.  He was like, nah, bro, you can do it.   Like, he had like a Vlad type of voice, like a real distinctive voice.  Cause they're out of Philly, right? Yeah, they're out of Philly. That's what it is. I forgot about that. Yeah, they're out of Philly. He wasn't even thinking about it. No, I thought about it now. I just, I just think they're consistent. I like Funny Marco. Funny Marco whole. That's what I'm saying. I don't really have- So is Funny Marco your number five? Cause you still- I don't really imagine- You gotta narrow it down. Who is your number five? Is St. Cheesy number five? Nah, I don't like to put myself in this. You can't braid yourself in that. Okay, I know he don't like to do that. Man, this is a lot, man. It's a lot of platforms. I would put Funny Marco number five because of his humble beginnings and slowly coming up in academics. I like academics a lot. DJ academic is dope. I've been watching him like, I've been watching, still haven't, I go look. I'm like, damn, this nigga here. Like some of the stuff, like the Saucy Santel thing through me. How about I talked about that one with the Chicago? He has to give the gab for sure.  And I think I can, but it's just like, he just has to give the gab in the way he really does his research and studies. I respect academics, man. I really like how he's carrying it. You think you could have hounded the Saucy Santel situation? You think you hounded it the right way? Man, this is, yeah. How do you hounder that? You gotta, like I just said, it's a LL with Saucy Santel because it's like, let's just say you beat him up.  Damn. Or you say something out of pocket, you get canceled like the baby. Canceled, right? There's no wins out of that. Yeah, we on boss talk one on one. One on one. Yeah, we gonna talk.


The main focus of this video is to acquaint you with the concept of play in its literary context. The main objectives of this video are to define a play, to explain the different types of drama and to discuss the theory of drama. To begin with quote-unquote play is not what you mean in the simple sense of the term that is taking part in game or sports. Play in its literary context means to act on a stage, to perform a role of a character. We can also say that a play is a dramatic composition that tells a story by means of dialogue and action to be performed on the stage. It is thus a dramatic presentation and its equivalent word is drama. In Greek language, drama also meant simply to act or perform, so the good old name for drama is play. Significantly, literary forms like stories and poems are written only for reading, but plays are designed for performance where words are written to be spoken by actors and heard by an audience. So it has both the aural and visual aspects. Places are the vehicles as well as the instruments for the playwrights. A playwright is also a maker of a script for the stage, that is a text. But that does not mean that it will not carry literary elements or aesthetic complexity. Let us note that a play should contain a story, usually of human conflicts and fully exists in production and should have its access to the theatre at the stage. A play cannot be conceived without an audience. The author has both actors and audience in view when he is panning his lines. No doubt it is a story or fiction or fact told to an audience, but it is in essence a story or fact interpreted before an audience by a body of actors. A play has thus a plot, characters, dialogue, an atmosphere and an outlook on life. Its full qualities are revealed in presentation on the stage before an audience. Now that you are familiar with the idea of a play or a drama, let us identify the different kinds of play. From the earliest times, drama has been broadly divided into two kinds namely tragedy and comedy. Tragedy is a sad or unlucky event in human life in the ordinary sense of the term. In drama, it deals with the tragic and dark side of life, aiming at inspiring the people with a sense of pity and awe. Generally speaking, tragedies are classified in two forms, classical and romantic. The former is based on Greek convention, the latter is based on its own standards. The word comic or comedy, as you know, is ordinarily used for something which is funny or laughable and deals with the lighter side of life. It has a pleasant atmosphere and is entertaining in some cases. You can see that there are some tragic situations, but ultimately there is happy ending. Some are again satirical. So satire and comedy are closely related. Like tragedies, comedies are also of several types. There are some romantic comedies as recognized by the critics like Shakespeare's romantic comedies. There are also comedy of humors, comedy of manners, sentimental comedies, black or dark comedies, etc. Apart from this, there are tragic comedies containing comic relief and at the same time possessing some potentially tragic background. Like all art forms, drama habits, conventions, principles and some theories. A play must deliver the whole message within a very few hours. A playwright has to exercise great economy in the handling of the plot, in the delineation of character, in use of words, rejecting all superfluous and unnecessary details. Only those essential materials are required which lead to the growth of dramatic characters and situations and which are conducive to the intended dramatic effect. So from the point of view of structure, a play must have some divisions. Let us discuss them in details. 1. Exposition This forms the introduction, explaining the circumstances or situation from which the action is to start. The exposition gives the audience an idea of when and where the action is about to take place, who are the characters involved, what is their relation with each other and what has taken place before the curtain goes up. The complication or rising action So after the exposition is developed, the play gradually involves in complication or in progress of the story, which must be resolved in the play itself. This is called the complication. The complication creates suspense. The action then proceeds to the point of greatest emotional impact which is called the climax. 3. Climax or crisis In the climax, it takes a turn for the better or worse according to the kind of play, tragedy or committee. So it is called then the denouement. So number 4 is denouement or falling action The falling action unravels the solution to the problems raised and helps the movement towards the resolution of the conflicts presented in the play, which is called resolution. So number 5 is solution or catastrophe Here the problem of the play is solved, outcome of the situation is made clear and the fate of the characters is decided. In case of comedy, it is solution and in case of tragedy, it is catastrophe. Additionally, as stated by W. Hudson in his book An Introduction to the Study of Literature, there is another minor division right after the introduction or exposition. According to him, there are certain conditions or certain relations of characters which are to be explained to the audience for better intelligibility and this distinguishes the introduction of the dramatic plot. This is called the initial incident. So what have you learnt in this video? Let us quickly revise. We have understood that the play is a dramatic composition that tells a story by means of dialogue and action to be performed on the stage. You must by now be able to categorize the different types of drama like tragedy, comedy, tragic comedy, etc. We have also reflected on the theory of drama and the structural division that includes exposition, rising action, climax, falling action and solution or catastrophe. Here are a few references which you may consult for your better understanding. Thank you.


is titled, dissecting modern 3G, 4G, cellular modems. This is by Harold Welter and Holger Freyter. And that was totally mispronounced, sorry about that. Freyter. We saw in the previous presentations on Smart Cities that there's a lot of IoT that doesn't need to communicate. And while there's ZigBee and LoraWan and other protocols, most likely they're gonna fall back on what is really there, tried and proven and those are the 3G, 4G modems. I don't really need to introduce our speakers today. They're well known for years and years here at the Congress. So I'm just gonna pass it right over to them and have a great talk. So today we're going to talk about cellular modems just to differentiate it. It's not about baseband or baseband exploitation. It's really about a GSM module or 3G or 4G module. Our talk is going to be structured in a couple of phases. First of all, our motivation. Why are we looking into it? Where are we coming from? The second part will lead to the history. What have we done before in terms of modems? Looking at how we picked the modems we actually looked at, then something that we actually didn't expect when looking at it. Also, then looking at the firmware upgrade mechanism if there's one how it works, what has been done, and we will finish with our recommendations and wishes. First of all, we're implementing GSM specifications for more than a decade now. It started with humble beginnings of sending AT commands to modems on mobile Linux devices to actually working on a free software smartphone at OpenMoco and then working on OpenBSC and OsmoCom to implement radio area network software and core network software. And has been eight years since LaForge presented about how our Zen modern smartphone hardware looks like. It's seven years since we worked on OsmoCom BB to run our own baseband software on our commercial grade hardware. And professionally, we have worked with M2M devices and have built M2M devices ourselves using 2G modems. And from this point, we started to explore how which kind of device would we use in modern embedded devices or M2M or IoT devices these days for our implementation of 3G and 4G network software. So if you send messages over the air and you don't get a response, it's always difficult. Like, did you encode it correctly? Was it sent? So we looked into having a device that allows us to get logging to see if the message arrived or throws an hour, even able to extract traces from it. And what's also important for us and got us into OsmoCom and OpenBSC is to build tools to allow others to understand how cellular technology works. So while TCP IP might be well known to many of us, how the IP is actually transmitted back to the CoreNet and routed to the Internet is not set clear and we want to make it more visible and having technology and tools helps for it. For a brief moment, picture yourself trying to build our classic M2M device. You might pick a modem because it's already certified and easy to use, but you need to run some application code on it. And the traditional approach would be to get a microcontroller or a bigger processor and connect these two devices using USB or serial. But it means that you need to have a bigger PCB more power consumption, so it would be nice if you can run application software on the modem itself already. And one of the driving factors for it is to reduce the PCB space to have a lower power consumption to save on the bill of material to have fewer components. And back then we found something that's called OpenAT. It's done by Sierra Wireless, and mostly it allows you to write C software, which is then compiled with GCC and uploaded to the modem and you can start running it. It will be loaded into the real-time operating system. It runs as a normal process. There's no MMU, no privilege separation, so if your application crashes, the entire modem will crash. To ease debugging, Sierra Wireless has like a nice tools to get output and send AT commands and logging debugging. But the problem with this approach is that if you build an application and make it stable, you know so much about this OpenAT stuff that you're mostly locked into this API. So your architecture and software is following what an OpenAT application will look like. And then you spend years developing an application and suddenly there's no pass for 4G. So you're locked in and even your 2G modems will be discontinued. So it's a nice platform to get started, but it's kind of a dead end. And this brings us to our modern requirements. So what does a good modem look like? And one is we still want to be able to run our own code in it and not like some Python script or some limited Java, but like our real C application with access to the device and no artificial control. We don't want to be locked in by a single modem render. So it might be okay to use a specific ship set, but we don't want to be forced to follow whatever the modem supplier wants us to do. For debugging purposes, we want to be able to get log messages to see what C modem is doing, see if it's throwing away stuff, debug output, be able to control it. And for 3G and 4G development, we want to be able to see the radio messages. And you might know a tool called X-Goldmon has been written by 2B as Engel. It allows you to get tracing information from Infineon basement, but it has some limitations. So we want something like X-Goldmon, but for GPRS, Edge, UMTS and LTE. The modem market or general, the cellular market is kind of dominated by Qualcomm, and it's kind of set by itself, but it also means that if you pick a modem most likely, it runs or it's based on a Qualcomm ship set. And Qualcomm is very close to what we want from a modem because they expose something called the DIAC protocol. And it's also used in many different Qualcomm products from DVBH to GSM to FAM2 cells. The first time I personally heard about it was at the 28C3, but I talked from Guillaume that looked into the baseband Qualcomm stack. And this DIAC protocol, the framing is very simple. It's like classic HDLC with a start and an end marker with a comment bit, some payload and a checksum. And it's used for events, like if your modem is switching a network, you get an event, you can enable logging and then you get a lot of textual output, but also for comments and response. So you can send a comment to read a memory address and to get like the value from this memory address back. And literally there are thousands of different messages that can be sent or received. And in terms of free software implementations like the modem manager or GSM parser only use a fraction of these available messages. But it means like this DIAC protocol is something you want to have direct access to because it allows you to see what the modem is doing. And it brings us to the point of selecting a device that is exposing DIAC. And in the past, the option icon stick might have been a very good device to use because it's exposing DIAC on USB out of the box. But it's kind of old. It's using old Qualcomm software. It's limited to 2G and 3G. So we look into something more modern. And one of the devices we found is from a Chinese modem manufacturer called CrackTel. It's a UC20. It exposes DIAC out of the box. It's even documented in their hardware interface that it's a diagnostic interface. But sadly it doesn't support LTE. So if you look at a modern device, it makes sense to not go for 2G and 3G only, but also have an option to go for 4G, which brought us to the EC20. It looks like the UC20, but it has LTE. So that sounded quite nice for building a product that can be soldered to your BCP. But for development purposes, they also offer it in a mini PCI Express form factor. So you can just plug it into one of your devices that might already have mini PCI Express. So we picked the EC20 as a module we want to look at it. And once we started to look, it has the Qualcomm MDM9615 chipsets, which surprisingly is also used in the iPhone 5. But beyond that, there's not a lot of documentation of what it has, which brings us to the unexpected surprise. So after I got the modem, I used the AT-comment interface just to play with it to see if my application could do what it wants and was hanging after a day. And I got involved with the supply of the modem and they gave me a firmware update, which was a TIP file. And I unpacked it and all the file names looked awfully like a Linux system, which is why would my modem have a Linux system in it? But maybe I'm just mistaking it and then they have a flash tool and it looks like the flash tool of Android was fast, but maybe it's coincidences or it was... It was just convenient to use it. But actually other people have already seen that the MDM9615 runs Linux on it, like at the DevCon 26 by Mickey Sharkotov. So apparently it runs Linux on your modem. And the question is why? Why would it even run Linux? Because Qualcomm is known to have put their IP stack into the modem, IP stack, SIP. Why would they stop doing it? It didn't really make sense. So we started to look at it and also see there was no information that Linux actually runs on this device. Which means no written offer that I use the R-Mines GPL tools to untax easy flash file system. It really looked like Linux. And I started to look at some of the binaries that are not standard, but either QuakeTel or Qualcomm specific. And you see funny strings that look like AT commands, but like AT plus Linux or Q Linux command. What would it do? And at this point, we started to explore both technically. So what is this platform really looking like? But also from a legal point of view, like can we please get these source codes? Can you please put a written offer in it? And at this point I hand over to LeForge. Yeah, so yeah. So as a lucky coincidence, I have been doing some GPL enforcement in the past. So, well. Okay, but first we started to look at better the hardware. And well, if you're doing hardware anyway professionally and you have all the tools and the process and your partners for assembly and so on and so on, why not just do a couple of boards to help you with the task at hand? So many of the mini PCI Express modules that you can find for cellular modems, they have additional signals on undocumented pins of the mini PCI Express connector, like PCM audio or even URs and so on. And well, of course, if you just put the modem in a regular PC mainboard or an embedded device, those signals, they don't terminate anywhere. They're just not used on the slot side. And soldering wires to the pitch of a mini PCI Express board is not very convenient. So I created what we call a breakout board. And you can see a picture of that. It's an open hardware project, schematics and everything. Design files have been published. So you have this connector on the right-hand side which exposes all these extra signals so you can actually easily access the various undocumented signals. So the EC20 solder module documents, there are a debug UART pins, which are not the normal UART pins on which you speak AT commands, but it's additional UART. But it seems like not all modules have it enabled. So we bought modules from three different suppliers. They all have different firmware versions and different configurations, and some of them have it enabled, some not. But those that had it enabled have it at 1.8 volts. But how can I say, in their wisdom, the designers decided not to expose the 1.8-volt voltage rail on any of the other pins of the modem. So you have external voltages of 3.6 volts, 3.3 volts and so on, but no 1.8 volts. And since in previous projects, whenever I needed to attach to a UART of an embedded device, I built another level shifter for a specific voltage. I already had built for 2.8, 2.5, 2.3 volts before. I decided, okay, let's do a board that is a multi-voltage UART, so you can actually select the voltage of your UART with a small rotary switch and connect to serial ports of various devices. And that's what's here. It's also another open hardware project at Osmo-com. Yeah, and then you attach to the serial port and you get a Linux login prompt. And interestingly, if you look at the firmware update file that Holger just mentioned, it contains, of course, an ETC password file and there is only a desk hash. And if you do a little bit of password cracking, you see it's OE Linux one, two, three. It's the root password of the device. So by now we were 250% sure that there is no, there is Linux in the device. And yeah, this is by the way, how the full setup looks like. You can see I sold the small additional three pin header to get access to the UART on this module and this way we could start to explore it further. So, okay, brings us to the topic of well, where can we find the source code? The module didn't ship with a written offer. It didn't ship with a license text. It didn't include source code. It didn't even mention that Linux or other GPR license software was used. So while digging around the official supplier of the manufacturer didn't release anything or didn't provide any such information, we were looking a bit around because I mean, it's likely the other devices do the same and we found that actually Qualcomm is publishing a complete open embedded build system for building Linux for those modem chip sets. So this includes the open embedded meta layers, the kernel, the bootloader and various other bits and pieces. And it's almost completely undocumented. They're basically some Git refos and you can peek around them, but there's not really a documentation how to use it. And well, if you look at the entry level website of this open source project from Qualcomm, which is at code Aurora, well, there's like literally hundreds of branches and tags and you don't really know what to use for what and they say, well, this is one example version that you can build. And then somebody I think years ago posted, well, I tried your instructions, but well, it doesn't compile. I'm facing some issues. And of course, nobody ever responds because well, you know, why would they ever respond? But anyway, it's public. And on that website, you can find it and you can start building. So we started building that. Of course, we also ran into the issues that didn't build, but anyway, in the end, we managed to build some of the code. And meanwhile, we were talking to the manufacturer of the modem and asking them for the complete and corresponding source code. And then what they sent is the complete and corresponding source code to the firmware update tool that you run on your host PC, which we didn't ask for. And it was not GPL license. We still received the source code. Okay, nice. It's good. At that point, we could understand how the firmware update protocol works towards the modem.  By the way, all the typos and grammar issues are not introduced by us. So we never been in legal dispute and we always make sure to understand intellectual property rights ahead of using technology belonging to a third party. Well, clearly they did not in the Linux case and then they sent us this nice little letter. This is an excerpt from it. It's like, oh, we always respect the importance of intellectual property rights and laws and we actively engage with known essential intellectual property right owners, apparently the copyright owners of Linux and other free software are not essential. And so on in order to be compliant with the rights. So then you ask again and you ask again. So you see basically we always ask the same question. It's like, oh, we appreciate the efforts. This was to the lawyer of the Netfilter IP table project. They missed the fact that it's multiple tables with singular, but anyway. Well, then your client, me, doesn't have the right to empower copyright. It's like, ooh, okay, that's new to me. And they claim that I had transferred my copyright to the Free Software Foundation, which I never did and which nobody I think or at least it's highly unusual if you work on Linux kernel code to do so. So I did not have copyright. Okay, anyway. And call, sorry, my mistake, Quacktail always respects intellectual property rights, of course. Okay, so still no source code. Then we ask again and ask again. Well, then thank you for your detailed explanations. Da, da, da, da. We will provide a tar ball. And then we're always willing to achieve GPR compliance and so on and so on. And then another month or so passes and then I finally, well, we do some legal enforcement, we do some warning notices and so on. And then, yeah, we are not perfect and we cannot construct a perfect website which I never requested. We just wanted a source code. And then, well, you get some source code and it doesn't build. And then say, well, there is a header file missing. And by coincidence, it's a header file that I wrote. I don't know if they did this on intention. I mean, how many header files did I write? And if you know IP tables, there is a match for the differentiated services code point for the DCP field in the IP header. And that has a header file with just like eight lines of boilerplate definitions. And this was missing. And I said, no, we don't have this file. And Qualcomm also doesn't have this file. And Qualcomm never provided this file to us. I mean, it's in the public repositories that Qualcomm hosts on code Aurora and the kernel doesn't build without those files. And then, by the way, we will not discuss compiling issues by email anymore. Okay, then some more time. I get more and more. Then you get individual header files and individual emails and you put those header files in your kernel source tree. And then you see that the scripts in the kernel have missing executable bits, but certain C files suddenly have executable bits. And then another header file is missing and so on and so on. But by now we have received various source code tar balls. They interestingly contain not only the GPL-LGPL code, but also other code with like VSDs type or Apache type licenses where they wouldn't have to release it, which is good. And they did this intentionally. And I think it's a very nice sign of them that they don't release only what they have to, but they release more. For the EC20, it's still not license compliant. There is no busybox source code included, for example. Not that busybooks would ever have done any GPL enforcement in the past. And well, but that's not my primary concern. And I think it's getting there and it's workable and you can use the source code that they release. Interestingly, there's other motor manufacturers like Sierra Wireless, which are also building modems on such Qualcomm systems. And they release not only the source code, but extensive documentation. So this is a small excerpt from a screenshot where you can actually, oh, they describe how to build it with open embedded. They describe how to use fastboot to install the firmware on the module and so on and so on. However, as good as they are in the open source side, they try to lure customers into a proprietary framework like they did with OpenAT in the past and that, well, again would result in vendor lock-in. So it's not really recommended or I think a smart move to go ahead that way. And with that, I'm going to hand back to Holger before returning later. We're going to very briefly look at the hardware. It's a Qualcomm MDM ship that I've already mentioned, also in iPhones and it turns out maybe in your future car. At least right now it's in modems from QuackTel and Sierra Wireless, but sadly from a free software point of view, like it runs Linux, it talks to the hardware, but there is absolutely no documentation about the hardware in the internet. Like even on other websites, not nothing because it brings us to the hardware overview. So we know there's a ARM processor inside, probably hexagon, they're connected somehow, nothing. So that's very frustrating to have spent many years on free software to see Linux winning, even getting into the modem devices, but no hardware documentation being available. Not even a block diagram. You have to repeat it. Not even a block diagram here. Yeah, so nothing. Let's look at the software part and explore the system from a software point of view. LaForge has shown how to get a serial console on it, but not every modem has it enabled and we didn't look at what it takes to enable it and also soldering is not that nice. So after exploring the root file or the unpacked root file system, so we saw it runs an Android debug bridge. So if you have used Android, so ADB shell should give you a shell. And nicely, we have already seen the AT plus Q Linux command to execute something on the device and we found a script that is reconfiguring the Android USB gadget to actually put ADB in it as well. So let's try it, you execute the AT command and then suddenly the serials on your host Linux don't work anymore because the way the QC serial kernel module is written, it's matching a device based on the number of interfaces and if you added ADB to it, you suddenly don't have four interfaces, but five interfaces and your driver cannot identify the device. So we had to first hack it a bit and LaForge has made a more clean patch to actually get it. But after the small experience, we have ADB shell on it. It works on any module, but that's... And the ADB shell is root, of course. I mean, so you don't even need to root the device. It's like you get the root shell immediately. So there's no lockdown as well. It's root, there's no SE Linux and just a very nice and open Linux system. To build it, it's a bit odd that it has a bootloader that seems to be proprietary, then it has the Android bootloader and Android Linux kernel, the Android debug bridge we've mentioned, but surprisingly, it's not using the rest of the Android system, but it has a GNU Lipsy with Busybox, UserLand, System5 in it. So it's a very classic, open-embedded build and it's actively developed and maintained by Qualcomm, but they make so many releases, you actually don't know which one to pick. It's a bit of a zoom. Yeah, and then you start to look a bit at the Linux kernel that is released and luckily and interestingly and to my pleasant surprise, there's no binary-only kernel modules, so everything in the kernel is released in source code. Nevertheless, of course, it's a lot of source code, so if you look a little bit at the number of lines, a diff shows up between the closest mainline version and the kernel that's used in those modules, you end up with 1.5 to 1.9 million lines of diff. I mean, this is not actual code lines, this is counting all the lines of a diff output, including the context, but still it gives you an idea about the size of the differences compared to mainline. And of course, you expect on those kernels that there's all the CPU-specific stuff and lots of driver code and so on and so on, but then if you look at it in more detail and as a disclaimer, I haven't looked at Qualcomm, Android, Linux kernels during the past 10 years or so, well, let's say eight years, no, six years, whatever, a long time, and I know there's a lot of code in there, but I didn't expect all the different things that I found in there. I mean, they have their own shared memory-based logging infrastructure and shared memory is not shared memory with the modem processor, it's only shared in the Linux system. You have an inter-processor communication logging process. IPC is not inter-process communication, like you would know it's inter-processor communication. And you have something which completely flabbergasted me, it's called remote spin locks. I mean, you know, spin lock, you basically, you have a mutually exclusive, exclusion mechanisms are only one thread one CPU can enter a critical part of the code on your multi-processor Linux system, but then here you can actually also block the modem processor, the hexagon on the other side from entering a particular section. What could possibly go wrong if you hold, if you keep the real-time operating system in busy waiting, but okay. Yeah, then you look at the source code and I've actually, since I haven't looked at Qualcomm kernel source code for quite some time, I was expecting, well, this has been all these Linux Android phones that have Qualcomm chipsets and lots of, since it's open source, plenty of people must have analyzed it and there's certainly some documentation, some high-level overview about all these individual subsystems, how they glue together, how this works, and I could just look this documentation or look at that documentation. But interestingly, it doesn't exist, so I had to start to write that documentation. There's now a lot of information in our wiki and some of the interesting parts that you find in there is the shared memory device, which is the core of all the interaction between different CPU cores, you have inter-processor communications, you have remote network, you have a BAM, that's also a BAM to BAM, is the bus access manager, and we have IPA, this is not your favorite beverage, but the internet packet accelerator and there's some diagnostics forwarding and so on. And if we look at these SIP subsystems, I draw a graph, you know, if you normally know how rare that is, I draw a picture. And it, to symbolize you what's happening in this modem. So if you look at this picture, you will see basically the large square at the top is the application processor, the bottom small part is the modem processor, about which we don't know much, of course, but then on the left side, due to the availability of source code, we can see what's happening. So you have the shared memory device and then you have channels implemented by the shared memory device and individual different subsystem binding to those channels as two for AT commands, which attach to the serial function gadget of the USB gadget code in Linux. So basically the important part is to see that the USB you speak, you don't speak to the modem actually, to the modem processor, to the basement processor, but you speak USB to the Linux gadget inside the Linux ARM core on those devices. And then that Linux ARM core forwards or handles different interfaces on your USB configuration in different ways. And you have this small box symbolizing the user space and you can see how the different paths go. It's quite interesting if you look at the serial ports, you have a serial port for GPS and you have a serial port for AT commands and you think, well, okay, these are both serial port devices, they must be handled quite similarly, but no, the GPS part is actually handled here, over here it goes into user space, it's bridged, it goes into a virtual serial port here again and it goes into the serial gadgets, whereas the AT commands go straight here inside the kernel and never end up in user space. So I don't know why, but it's quite sophisticated to say. If we look at the diagnostic subsystem, which is particularly of interest to us, and now you can see I didn't draw graphs anymore, I just wrote a little bit of dotty. We have the modem DSP on the left-hand side, we have the, then we have the Linux kernel where we have the shared memory device. On this, a DIAC forwarding module in the kernel binds, on that, we have a connection to the diagnostic function gadget of the USB gadget driver and that just goes to your host. So if you talk the DIAC protocol to the modem, it actually goes this way through Linux, through a shared memory device in the modem DSP. But what's even more interesting is that there is a diagnostics character device on Linux called DevDIAC, which, well, for example, to QMocs to your other processes, they basically attach to this diagnostics device and all the logging that you find in those Linux user space processes, they don't use this log, they don't use an Android logging framework, but they log through the Qualcomm diagnostic subsystem and you get the log messages of those processes through this kernel device over to the function device, over to USB into the host. So if you manage to figure out which logging flags and so on to enable, you get the log output of those Linux user land processes over DIAC. Well, very Qualcomm-like, not so surprising, but still sort of unusual in the Linux world. If you look at the networking, the QMI, which controls your, basically, the modem, which network you attach to, whether you activate PDP context, your QOS parameters and so on, you might have used QMI, CLI, or other tools on your Linux laptop to talk to such modems. And in this specific case of those Linux-based Qualcomm modems, well, you again have the modem DSP, goes through the shared memory device, talks to the RMNet device, the USB gadget, USB to host, and you have your host PC somewhere on the right-hand side over there. So this is basically the path your QMI takes. But then you have also QMI in the user land on the modem itself, which is what's presented here. And they have what's called the QMuxD, the QMI multiplexer demon, which then offers Unix domain sockets to various different client programs. So basically, all these user space programs, by using this Unix domain socket, they can talk QMI to the modem as well. And all of them can basically configure, get status reports, and so on, all the different parts and all the different services on the modem, which is interesting and it's across something that we want to have coming from our initial motivation. We want to run our own applications in there and we want to talk to this QMuxD and talk QMI in there. So we created a couple of tools to help the analysis. On the one hand side, we used the open embedded that Qualcomm released to build a matching OPKG and the packages for tools that you need, like Socat, S-Trace, LSOF, and so on, for some exploration. We also have written a couple of C programs for testing, basically for accessing the QMI from code inside the modem that's successful. And then we have a couple of, those still link to the proprietary libraries that are provided in the modem. And then we have started with some entirely free open source programs, like the QMuxD wrapper, which is an LD preload library, so you can trace this QMuxD communication. There is ongoing work for LibQMIGLib transport for this QMuxD, which then would enable you to run a program that's linked against the free software LibQMIGLib inside the modem.  There's also a tool which we call OsmoQCDIAC, which is basically a host tool for obtaining these DIAC-based logs from the modem. So you can run this on your laptop, attach it to the modem, and then you get all kinds of traces, not only the interface traces, but also QMI protocol traces, which we then again decode using LibQMI, so you get a textual representation. There's ongoing work here to basically move all of that into Wireshark, so you get the full decode of that in Wireshark, but that's not yet there. So what kind of user-based programs do we find? Okay, ADVD, we know what that does. We have an ATFWD daemon, well, AT Forwarding daemon. Well, what does it do? It implements those things like an AT plus QLinuxCMD and other AT commands. So basically, a user-based program on Linux can register a callback within the modem to forward certain AT commands into the Linux user space where you can then implement them. So you can basically implement custom AT commands in user-based programs. There is all kinds of other software, which we haven't really figured out yet, a lot what they do. There's one monster called the QC Map Connection Manager, which basically allows you to run a Linux-based Wi-Fi access point with LTE backhaul, excuse me, for the typo. So basically, you have to attach a Wi-Fi chip to the SDIO interface of your modem module, and then you have a full personal access point device that has an LTE backhaul. And then the Wi-Fi, like the parameters, for example, the key and the SSID and the channel and so on, you configure all of that through what? AT commands, of course. If you ever wanted to look at software that receives AT commands and then generates textual config files for a WPA supplicant and for host AP demon, then you can look at this code. I prefer not to. So we have the Quacktail Bridge, which, well, is a very simple device. It reads from one device and it writes it to another device. And apparently, this is such a complex task that you need to schedule a different process, and I think it has three threads or something obscure like that. So, okay, well. Which brings us to the funny bits and pieces that you find in those modems. Well, the first thing is AT plus Q Linux command. We spoke about that. You can run arbitrary shell commands as root in a read write rule file system in there. So, basically, you can do anything. I mean, you can send an RM dash RF slash and then, well, it's gone. It's dead gym. So we also have commands to switch into fast boot mode so you can update the firmware. You have a special AT command to print a D-mask and you have also all kinds of other AT commands. And when you do a strings, just a strings call on those executables, it looks like shell scripts in many cases. And one of the most funny things I found in this modem is how many processes and threads does it take to reboot a system? It's apparently a very complex question. How do you reboot your system? Apparently, this was the easiest method they could find. So, there's one process, the reboot diag app, which registers a diag command with command code 0x29 with the diag infrastructure. And it spawns a thread which executes another executable called QMI simple real test with an input 5.0. And then it calls system echo modem reset to write modem reset into the 5.0 of the input of the process it just spawned, which then causes this to send a QMI message to the modem, which will reboot the baseband processor. And then, of course, you clean up, you remove that temporary file, because slash TMP is not a tempfist, but it's read write file system. And then it goes on to write the string reboot into slash def slash rebooter def using fwrite, not using echo this time. This is a C program, not a shell script. So apparently, they discovered that and used fwrite. And then we have a reboot daemon, a second process again with two or three threads, which reads this rebooter device. And then actually they published the source code, so this is the actual source code, right? So you read from this def rebooter device, then there's a nice comment documenting what it does. You do a string compare. You have the first printf going for reboot, you have the second printf initiating reboot, and then you call system on the reboot executable. So this is apparently the most simple method. So if you ever were wondering how we would reboot your Linux system, this is the new reference. Yeah, then we have C programs that look like shell scripts. So this is an actual, of course, condensed output of strings on the QuackTill daemon, right? You see like echo in SysFS files, you see copying files, even with semicolon in there. You see echo into the duty cycle of some pulse width modulation, no idea what that does.  And even they don't use reader, but they do like LS and then parse the output of that rather than use opendir reader and the usual calls you would do to get a list of files. It's quite amusing. Yeah, which brings us to the topic of firmware updates. But you can, I actually missed this example. Sorry, I have to make a quick interruption here. All these machine to machine modems, they typically have an LED and the blinking rhythm of the LED indicates to you whether it's registered to the network, whether the data connection is open, whether it's searching for networks, that's all different blinking patterns of the LED. And how do you implement this on this modem? Well, you run a user space daemon that calls system echo one to the dev GPIO which controls the LED all the time, you know, to blink the LED. It's not like the kernel wouldn't have infrastructure for LED blinking patterns and so on and so on, but okay, so you have a daemon that does nothing else but basically toggling your GPIO by spawning shell processes using the system syscall. Okay, with that I hand over to Olga. Now the question is, do you expect anything after the topic of firmware upgrade or is it going to be an empty slide? And the answer is, they know that they have to offer firmware upgrades through over-the-air updates making it as small as possible. And actually it's something that Qualcomm is preparing for modem vendors. So it's based on the Android from around 4.0 recovery kits not using Android myself. I haven't looked at how it worked before. Many of you might be more familiar with it, but it's mostly a SIP file and it contains Delta updates and surprisingly they are somehow hashed to a SHA-1 and then the SHA-1 is being signed with a private key and the result is being put into a comment of the SIP file. That's probably pretty standard but looked a bit odd and it's nice that they prepare probably secure firmware upgrades with like minimal Delta functionally. So what has QuackTel done to this code? They still use it, that's quite nice but they have removed or actually not really removed but they're not using the RSA code to verify a signature and instead of using the standard Android way to patch these systems they use a proprietary component from a company that used to be called Red Band but now it's Harman and probably soon Samsung. And this Red Band component is nothing that QuackTel has written but it's a commercial product and it's used in the QuackTel UC20 module as well and also in other automotive projects we have seen Red Band updates being used. So at this point I started to look into how does this update format look like and instead of presenting a very complex form of the format I have this slice. So other people like Matthew Solnick I think Black Hat presented something called attacks on all my device management. These can be remotely triggered but the update mechanism used here cannot be remotely triggered. The modem needs to be asked to start an update so that's already a bit more secure but I started to look at the hackstamps of a specific Delta update and with a lot of help from Detaspa we actually managed to understand how the update binary looks like and we have created a small tool to take an existing update and put it into smaller parts and also be able to create our own defiles. The format itself has many different pointers and offsets so in the example you might already see the offsets here and compression size so it starts with a common header and then after the header you have a LZMA compressed table of contents or however you want to call it and outside in the header you have an offset into the decompressed version of this table of contents where actually file update starts and when you start creating your own file you might get the offset wrong and the update binary just crashes with your malformed update file so it's like not very robust code, a very complicated file format and nothing is cryptographically signed so when you use strings on the binary you see the word signature but it only refers to a CSE32 checksum. The next part like now we understand how the update format works. We can create our own update files. The question is how do they end up on the device and it's something that is implemented in the AT Forward Demand that Harold or LaFoche has mentioned and if you grab for some specific strings like WGet, this QC map connection manager or photo or update.zip you already kind of guess how this application works. So you issue an AT command with a URL for updating it. In turn it will disable your normal IP connection that you have my established on your host and opens our PDP context on the device itself using the QC map connection manager then it will spawn WGet to download the file then it will use system to move it to the right directory. It will remember what it wants to do with this file and it will reboot into the recovery partition and system and at this point the update zip file will just be applied and the system will reboot once again. Again, without any cryptographically signature or checks. So if you manage to hijack the update process you can install any binary on the device or on the modem or anywhere else on the system as you want. But instead of just seeing how bad it is we want to say like what do we expect them to do and I'm handing over to Harold again. Yeah, so rather than saying oh this is all bad it's all unlocked and it's insecure and so on well it's fun for us of course because that's what we wanted, right? We wanted a modem device where we could do basically whatever we want to and where we don't have to break sophisticated security mechanisms that are designed to keep the user or the customer or the owner of the product out. So yes there are security issues and those security issues must be fixed but we need security mechanisms that work without locking out the user or the owner of the device of course. So this is our public call to the manufacturers if you fix those issues keep in mind that the openness of the platform is interesting for all kinds of legitimate use cases and while you want to protect against malicious attackers you of course still want to enable the actual owners of the device and the users of those devices to use the flexibility they provide because there's a lot of, yeah, thanks. Yeah, so what's the status today in Outlook? Well, we have just opened the wiki on the, it's on the last slide, there are all the links so on the Osmo-com project we now have a wiki for QuakeTail Qualcomm LE modems where all the information that I gathered from reading the thousands and thousands of lines of source code is in there. We have released the debug tools presented in this talk in a Git repository and source code. The hardware boards are released as open hardware and available and what's unfortunately still ongoing is the libQMI GLIP integration which is well to some extent to the fact that I've never written anything against GLIP before or anything inside a program that uses GLIP. It's like all this infrastructure. I'm usually more low level than that. And while we hope to grow this documentation and we kindly invite all of you with an interest in understanding those platforms better to help us out, you don't actually need to necessarily reverse engineer and disassemble things, it's just read the source code, understand what it does and play a bit with the device. We are planning an open embedded package feed so we can actually easily install additional and everyone can easily install additional packages on those modems. There's plenty of flash, I think it's like 20, 30 megabytes of free flash so you can install quite a number of additional packages in there. And our aim is to have free software only user land on this Cortex A5 CPU so to do away with all those proprietary processes that run in user space and the libraries and run the open source kernel and have basically the libQMI GLIP integration and all other bits needed to run our own standard Linux user land code in there and have custom images that we can run on modems for all kinds of use cases. Okay, now before we go for Q&A in a minute, there's an unrelated announcement that we would like to present here. The OsmoCom project has gained support for running your own 3G 3.5G network during the last year. Not sure who has noticed that, unfortunately it suffers a bit of a lack of contributions. So we want to motivate people to contribute more and we have just started an Accelerate 3.5G program which provides 53 3.5G femtosells to people who can convince us that they would contribute something reasonable to our project. So these femtosells are already supported by the OsmoCom code so using the femtosell and the OsmoCom code you can run your own 3.5G network and we're giving those away for free so if you're interested in any of that, please submit a proposal until the end of January and then you will hopefully receive your free femtosell until the end of February. Which brings us to questions. Yes, it's Q&A time. We have a total of eight microphones here. One, two, three, four, five, six, seven, eight, I can do math. Please step up to the microphones to ask your question. Meanwhile, we have from the Signals Angel we have a question. Yes, the internet wants to know if there will be, in quotes, next open moco. Not from us, no, we're not working on a mobile phone. We're looking at modems that not at mobile phones at the moment. So microphone two. So just to clarify, does that mean that Linux runs on the iPhone 5? We don't know. We don't know, we're happy to hear from you if you can find it. But I think you can run the trip with something else on this Cortex processor. But we don't know. Signals Angel? Yeah. The internet wants to know why there are no mini PCI Express slash M2 to USB 3 adapters because they think LTE is capable of at least 300 megabits and USB 2 could be a bottleneck. Well, I'm not really in the business of manufacturing or selling adapters. So, I mean, yes, we did this open hardware device out of a specific need, but you would have to ask the hardware manufacturers that I'm sorry. Could I ask the people who are leaving to leave quietly, please? Microphone two. Can you buy the entire EC20 with the breakout board and the UART as a single kit somewhere? Well, you can contact us, but it's not really something that we have prepared for. But yes, it's certainly an option. But I mean, we're not here to sell you anything. We're here to invite you to help us learn about modems. Thanks. And with the Android debug shell, you actually don't really need the serial. So you can refresh the device using USB. Even if you break it, it can be refreshed. And with ADB shell, you have your root shell. So that works. And with ATQ Linux command, you can actually start a lock-in on the NMEA console as well. So even if ADB doesn't work, you can get a lock-in on it. So it's very easy to get started without serial. Signals, Angel? Hello, okay. Do you have, have you tried to get a source code from other manufacturers? Well, we know at this point of, I think three different manufacturers that use this MDM9615 plus Linux combination. From QuackTail, we have just described how it went. Sierra has published all this already by themselves in a very good way. So there's no need to ask them. It's out there. You can just download it and it's documented. And the third one is an old end-of-life Huawei module where we have also asked, but this is still ongoing. They are now, it's interestingly that from a Chinese supplier, you get the excuse, oh, there is Christmas coming up. And it was like, okay, is there so many Christians in China? But okay. Well, I think I'm quite sure if I ask in January, you guys, oh, there is Chinese New Year coming up. But we'll see about that. Microphone 4. You mentioned the Qualcomm chip used in the iPhone 5. Does this mean, well, is it likely that this, the iPhone application processor talks AT commands to this Qualcomm chip? Is this still a state of the art? No, it's not state of the art. And I don't think it's happening. I mean, also on these modem modules, the AT command is there for legacy purposes. You have the QMI exported over USB and normally your modem manager or whatever you use, a phone or whatever infrastructure talks QMI to those devices. I'm gonna go back to the signals agent again. Yeah. The question is, what is the total size of the flash or the root FS on there and how much RAM has this thing got? I don't know. I don't remember the flash size. Was RAM a 32 megabytes? Yeah, this 32 megabytes of RAM on this, the successor, the EC25 has 128 megs of RAM, but a flash size I also don't remember right now. But check out the Wiki. We have boot logs and all kinds of like D-mesk outputs and so on all on the Wiki. So I'm quite sure it's somewhere in there. Microphone four. You said that you tried to check Legato Linux from Sierra. Wouldn't it be possible to completely build your own kernel there and your applications? Yes, it's certainly possible, but then of course, if you do this, you buy a lot of things with your money that you don't use in the end. So, and you support a vendor that tries to lock people into this proprietary framework. So it's, yes, it's possible. But do you have to use a framework? I don't think so. No, you don't have to, but I mean, they developing this and part of what you pay for is this framework and that's why their products are more expensive. So. Microphone two. Yes, do you have some ballpark figures about the power consumption in the lowest power quiz and current mode? No, I'm quite sure it's going to be high. I think Holger has some comment on that. So when you look at this device, you use S-trace against the QMux D and it's like mostly waking up every couple of milliseconds. So it's not power efficient, the C code. It's really, really, really annoying to see processes that run all the time. And from the previous slides, it's echo mem to CISFS. That's actually the advanced power management. So you can trigger an AT command to have the device sleep and it writes echo mem into it to go to sleep. So it can be tuned and with a free software user space, it can probably be better than what it is right now. Signals Angel again? Yeah. How accessible is the baseband? Like memory and like EMI and stuff. We haven't really investigated this in detail, but we also haven't seen any signature verification and so on there. So I think it's completely open. So yeah, the DSP firmware is in three separate partitions and there's no RSA signature and it's the end of these partitions. So it seems that you can modify it if they have locked down like the poke command. That's something we haven't tried or looked at it. Microphone one. Are the modules readily available in the LGA package rather than the mini PCI dev board? Like if people want to start trying to use these in open hardware? They should be available again, yes. I mean, they were temporary, not available due to the TPA enforcement, but I think now they should be available again. And what are the costs of those modules like? I think it's like 47 something euros around that region or maybe, no, it was more than 50, but anyway, somewhere in that region, yeah. Okay, thanks. So one more question from the internet. Yeah, and the internet wants to know if you can capture layer two network stuff with this. Yes, yes, you can. So I think that's the end of our Q&A session. Please join me in thanking LeForge and Holger on this fantastic talk about things that I really didn't want to know about 3G modems.


Or do you keep doing this to yourself? Making plans with people like you're gonna show up? You know, Rachel's just gonna ask questions that you don't want to answer about your cancer plumber. Three times. Can't do it a fourth. Okay, just get out. Go in. It'll be like... I've missed you too. Um, I'm sorry. I'm sorry that I can't see you so many times. I just worked me crazy. You know how it is. It's okay. I'm just glad you're here now. Lauren said you weren't feeling well the other day. She mentioned that you left early. Oh, yeah, but you know, I just, I think I ate something. It didn't agree with me. No, it's nothing. It was nothing. You know if there's ever anything wrong, you can reach out to me, right?  I promise. I love you. Yeah, no, of course I know that. Oh, thank you. So sorry. Work's been crazy. I've been really busy. I'm just cooking dinner, and you know, the onions, they're crazy, so I'm okay. I, you know, it works crazy, stressful, like always, but I'm surviving. I'm okay. And I'm gonna do a self-care night. I'm gonna take care of myself. I'm gonna take a bath. I'm making dinner. I've got a handle. Do you say so? Every 11 minutes, somebody commits suicide just in the United States alone. John Watson said, everyone that you meet is fighting a battle that you know nothing about. So always be kind. And sometimes the people who seem like they're the happiest need the most help. So please talk to your friends about how they are. Ask them how they're doing and show them love if they open up to you about how they're feeling. The best thing that you can do is be there for them and assist them in getting professional help. And if you're watching this and you're struggling, please know this. You matter. Please reach out to someone that you know. And if you feel like you have no one to talk to, on this screen is the number for the suicide prevention line. Please call this number now if you need someone to talk to. Share how you're feeling because I promise you this. You are not a burden. Remember that people care about you. You're here for a reason and the world would not be the same without you. And everyone else, please share this video so that this message can get to more people who need it.