Do this and the narcissist Will go insane That's what we're going to be talking about in this video, and I have done a few videos on this topic already And this what I want to talk more about it because I know usually I just say All you've got to do is go no contact and move on Then that will drive the narcissist insane Which is true. I mean that's normally enough to drive any narcissist insane because they have such a Obsessive need for power and control But there is More to it than that, which I would like to go into in this video Because What narcissists really can't stand is when you have something That they want and I don't mean You've Taken something from them, although I'm sure that would irritate a narcissist as well or anyone but this is more you Establishing something on your own something that they desire to have and Typically these will be your Possessions because they are more concerned with superficial things so you might move on and buy a new house one new car or You just become successful in something Maybe you start a new business or You start making more money start making new friends These are the types of things that they will be envious of Because these are the types of things that they decide to have another thing as well is if you move on and You meet someone new you start a new relationship I don't know it's funny because you might look back and think but when you were with them They never cared about you They neglected you They were never even there when you needed them. So it might come as quite a surprise for you to hear this Because you might be thinking Hold on a minute They neglected me the entire time. They were never there for me when I needed them They were always out doing their own thing and then they just contact you when they're bored To do so it might come as quite a surprise to hear Just how jealous narcissists can be Because they're actually very possessive and controlling They see you as an object that exists to serve them whenever they need you so That's typically how it goes as well because they don't really believe That you can move on on your own they don't think that you have the power to do that because You've already handed your power over to them You've let them define you and the relationship and who you're supposed to be for them So they look at it as though if you've moved on Then someone must have taken you away from them That's usually how they see it if they see that you're in a new relationship Again with the superficial things they see that you're with someone Who is physically attractive Something they see as attractive to them Maybe someone who is in good shape someone who's tall someone who is Powerful and successful And not only that but someone who cares about you Someone who takes care of you So it's pretty much someone who Does everything they didn't do for you Everything they should have done when they had the chance So it's quite funny when you think about it, but what really irritates them what really drives them insane It's when you move on and you find someone Who does everything? They didn't do for you and maybe everything that you were doing for them You find someone who's doing that for you. So look back or remember How much you cared about them? You did everything you could to make them happy it was never good enough, but you still tried If you move on and you find someone like that Someone who cares about you in the way that you cared about them Someone who Maybe even puts you for them Someone who loves you As much as you love them If you move on and you find someone like that That will really drive them insane because They want something like that too although They're not really concerned about If it's real or not so much But what they really want is this great a source of supply Who will be there for them whenever they need them The supply who will do whatever they want When they say jump the new supply says how high the new supply extends themselves as far as they need to go Please the narcissist the son-peaceful person They bend over backwards for them.   I don't know many of you you may have been in prison to these relationships 10 20 years But you can't remember the last time you smiled Can't remember the last time you were actually happy and I feel for you Those of you who had to go through that because that is no way to live As I've always said life is meant to be enjoyed not endured and I want you to enjoy every minute of your life after leaving the narcissist But I can also tell you That's what will drive them insane the most it's to see your happiness your satisfaction with life and If you're in a new relationship a new person that you are with but you've got to sit back and think Hold on a minute. Why does that drive them insane? Why does that bother them so much and it's actually quite simple Because let's say there's something that you Desire in life it may be a friend of yours It could be a co-worker It might even be a family member and Maybe they're any new relationship They're in love As you look at that and you think Wow, that's great. I'm happy for them and maybe that could happen for me The narcissist Does not feel that same way The reason why they go insane why it irritates them so much Because they already know it's never Going to happen for them The best they're ever going to get is This source of supply Just like you were to them, but in the end what happened They couldn't sustain it They ended up devaluing you turning against you making you miserable Driving you insane and then in the end I Know many of you you just Didn't want anything to do with them so They already know that's never going to happen for them. They're never going to have someone Look at them in that way with actual Desire and Love like they're the best thing that ever happened to them in their lives They're never Going to experience that feeling that sensation They're never going to have that and they know it They already know it And that's why it drives them so insane because a normal person if you see something that you desire something that you want and You know that you can get it. You know that you can make it happen if you really want to Narcissists they can't do any of that They can't They can't experience love That's not something That narcissists get to experience and I don't want to stand here and validate other people's feelings. I have to be honest. It is the truth They don't get to experience real love How can you experience real love? When you are self-absorbed and you lack empathy When you're constantly thinking about yourself your own feelings and needs you're constantly in survival mode survival mode They are never Trying to share someone else's Feelings or experience and you should know that already From your relationship with them When did they ever sit down and try to understand you I? Bet they never did that and you might have been with them for ten years. You couldn't remember a single time Where it seemed like they actually cared about you so Yeah, there's no way that they are going to move on and have something with anyone It's never going to happen and that is why it eats away at them so much Because they've been with you long enough to know that you do have empathy They know that and they've used it against you They played the victim they tried to make you feel bad for them in most cases. That's how they got in in the first place When they first met you They complained about the last person they were with They said they did all these things to them To make you feel bad for them then you give them a chance because they know that you are empathic and Pathic people they have the best relationships The most amazing Connections Something that narcissists Will never have they will never get to experience that and Yeah, it's like I said before Love always wins In the end it really does It's the truth But yeah, they will go insane For all of these things anything superficial Anything that you achieve or attain after they're gone And they'll feel like they're missing out. They'll wish that they could be a part of that Whether it's money power success Whatever it is a new business bought a new house a new car Because these things are very important to them They are ego driven they have this need to feel important especially after they after you're gone They're constantly Watching you and comparing themselves to you and Trying to be better than you trying to get one over on you Because they're using you as a tool to regulate their emotions They can't regulate their own emotions Which means that they can't Generate that feeling of love from within All they can do is pull people in And enslave them Domesticate them And just use them as a source of supply. I don't know some of you You may think about What if the narcissist moves on find someone else and they fall in love Well, you may have seen something on social media the posting of pictures They're looking happy with the new person That person's just a new source of supply And to know that you've only got to look back at how they treated you did they ever care about you? Did they can't ever care about what you were going through with them? Did they ever try to understand you? No, they didn't And that is how you know They're gonna experience the exact same thing with the next person and the next person after that And it's gonna be the same thing again and again until the day they die And many of them end up alone So it should be no surprise But this is the thing This is it This is what their envious of the most.  Yeah, it will really drive them insane to see like And you found someone Who is giving you the love Poor they never gave to you, but they're looking at it like if they had another chance It's not so much that they were trying to establish a connection with you Because they already know that they can't they know it doesn't do anything for them They would just use those things to manipulate and control you That's all they've ever tried to do and that's how you should know that Even when they move on All they're going to do is try to manipulate and control someone else That is all they're going to do They're not going to do anything else, but for you You can have that for real you can experience that for real and that Is what they're so afraid of That is why They are so possessive and controlling over you Because they already know that What they have with you is not real They know that already They know that they've tricked you. They've manipulated you They've groomed you. Yes, they are fully aware of that And they are terrified that One day you'll figure them out You'll realize that it's all a lie They're not about anything for real. They're just future-faking you They're making False promises about your possible future with them to get what they want in the present And then of course when you realize that that's when you know it's time to go and Of course, they already know what you're going to be looking for Once you've left them behind because If there's one thing that we all have in common on here everyone who watches my videos We were all looking for something Before we met these narcissists we were looking for intimacy and connection we will Joy happiness Maybe marriage Children starting a family That's what we were looking for Before we met the narcissist But when we first got involved with them and they tricked us They made us believe that they were about that While knowing fully well That they weren't They just wanted to trick us contain us domesticate us And keep us stuck for as long as they could And maybe they were hoping to keep us there for life So that we'd never move on and we never realize that They're fake they're not about love They're not about anything Other than manipulation lies and tricks, but they know that you're about something for real They know that you're an empath They know that you want to share your love With someone and you want it to be real and they're afraid of that. They're very jealous They don't want to see you moving on and doing that.  You did everything for them You invested all of your time energy and money You did everything you could to make them happy Sometimes you just got to look back and imagine What if you could meet someone who could do that for you someone who? Could care about you just like you cared about the narcissist Just imagine how amazing that would be and use that as your motivation To move on from them because that's What you need That needs to me um that needs to be your motivation your vision That should be what fuels you is to one day find this person Who cares about you for real And they're not just manipulating you. They're not just playing games They're not trying to keep you stuck so they can use you, but they're actually reciprocating back what you're giving to them and It's an equal exchange because I know many of you you have been Starved for such a long time.  They hid you from the world because deep down. They knew that you deserved So much more you do deserve so much more and I want that for you, but it all starts for by taking responsibility for Where you find yourself now because of course you can't just go from this narcissistic relationship To be in with a person Like you desire And who gives you real love? It doesn't work that way First you must heal yourself You must practice self-love and self-care and become the best version of yourself Because there should always be an equal exchange So whatever Love you want someone to give to you You need to be able to give back to them because that will sustain the relationship And I know that you can have that for real It doesn't just have to be a dream a fantasy You can experience that in real life and you will and I can say that from my own experiences For much of my life. I Felt like I was locked away as I never got to experience real life But then over the last few years my life completely changed And I got to experience things that I never thought I would get to experience and It's been amazing I'm so thankful for it for how my life has changed and of course I could look back and Feel bitter and resentful for how I was treated and How my life was pretty much robbed from me as It was for many of you, but if I did that That would have kept me stuck. I Wouldn't have been able to have moved on what kept me going is this vision of the future and And What I hope to achieve and I don't just mean in my business with money or Things like that, but just having a Normal reciprocal relationship with someone was someone who loves and cares about me Just as much as I love and care about them because deep down I think that's all what we all want That's what we all wanted before we met the narcissist And we have to remember that Because many people after they get involved were they narcissists to become So paranoid and distrustful They just want to be alone for the rest of their lives And that's exactly What the narcissist wants for you They want you to be stuck They want you to be unable to move on unable to forget about the past Everything that you went through with them They want that to play on your mind for the rest of your life But of course, I don't want that for you I want you to be able to move on and I know that you will in time and If you ever need someone to talk to Just remember that I am available for one-on-one coaching And whatever you're going through we can talk about it And We can talk about moving on the things that you need to do I've been there. I've been through it Many times So I know where it's like And I believe that I can help you So yeah, if you're interested in my services, you can book a session with me Through my website. It is Narcseviver.co.uk That is it for this video That's what drives a narcissist Insane I'd just like to thank you all for your support. Thank you for joining me today Please give this video a thumbs up down below if you enjoyed it Share your thoughts in the comment section and read your comments every day And share the video subscribe And also check out my instagram as well It is Narcseviver youtube on instagram. I have new pictures and videos of my travels every day on there So check that out Okay, I'd just like to thank you all for joining me And you all have a great day I will talk to you in another video very soon


tf news update. Good morning folks. Steve Rhodes coming to you live from the shores of sunny Delray Beach, Florida. We've got sort of a green board out here. You've got the Dow up 12 points. S&P's up seven. NASDAQ is up one point. The Russell's up 10. Semis are up 18. Trendy's up 63. You've got gold trading up two bucks. Silver's up 9 cents. Light's recruit up 52 pennies, trade at 82.82. Natural gas is, it's got the wrong contract in there. Give me a moment. Sorry about that. That's weird. I've changed it. I know I've changed it a few times. It's weird that it comes back. It's up 18 pennies. It's a nice move there. Trading out of 354 and the third of your treasury up about a half a point. Trading at 109. 25. Let's figure out what all that means by looking at that nine panel. Market update chart. We begin with the ES mini upper left hand side. We've got a TD nine count bottom pattern. We've got a roadsman to indicator bottom. We've got a new profile that did take hold. Support is at 41 46. Resistance is at either 42 44 or 43 17. I expect we'll get up to the 42 44 level. Spot politics trading below yesterday's low. That's bullish for the S and P 500. So that again should make that move up to the 42 44 level. In the case of the NQ, it's got a TD nine count bottom out there. It does have a new profile. It's bearish in structure. The resistance zone is between 14 838 and 14 938. We take a look at the US dollar index. It found support at the bottom of that new profile yesterday. That's at 105 80. And now it's going to go target the top of that profile at 106 45. Gold also tempting now to form a new profile with resistance up at the 2019 70 level and supported 1970 10. A close today above 2009 20 would negate its TD nine count top, but still would have to deal with that resistance up in 2019 70. That's assuming that the profile takes hold at day's end. We take a look at silver did close above the top of its profile yesterday does not have a top, but it does have resistance up at 23 92 lights. We crew continues its consolidation with inside his profile price right now stuck in that bullish buy zone. That's between 81 43 and 83 88 natural gas did test to reject the top of that swing point yesterday. That was the October 6th, October 3rd swing point, and it is most certainly taken off. We take a look at the 30 or Treasury. A trade above the top of its profile, but it's dealing with here is trend line resistance that trend line resistance as well. Today's high will call that the trend line resistance point one 10 12. It might be just slightly above that, but that's the level that it has to deal with. Folks, stay tuned for the Trader's Ed show. But if you're off to start your Tuesday, first have a happy Halloween and we'll look forward to speaking with you again soon. Take care now. The reality.


All right, success. Look at us, 10.30. We're ready to rock and roll. Both projectors blazing. Good to go. I'll take like a minute for any questions. So I've created assignment two. It will be released on Friday. So I'll have to create the test cases, make them edvious, and get my TAs to review them so they're not too edvious. We'll see that. So yeah, it'll be released on Friday. It'll be two week assignment, just like before. We can talk about it Friday. Any other questions, class related things? I'll decide on them in turn time soon. And I will post it on the mailing list and on the class website. Any questions on networking? Anything we've covered so far? Let's get started. So now that we've moved on from, we're talking about networks, right? We've seen all the different ways that networks can be insecure, and how as an attacker, we can influence, using our low level knowledge of networking protocols, right? We can influence the delivery of packets. We can spoof and send data or information as if it came from somebody else, right? We can sniff the packets, try to sniff data. We can hijack things. So now we're going to move on to the things that are actually generating the traffic, right? So it's not, you know, networks don't exist in an isolation, right? They exist because applications want to use them to communicate with each other. Applications at a high level? So applications, so they can provide services, right? Thinking about applications very abstractly. So what kind of, like, how could can applications provide services? Think about all that different applications you're running right now on your computer. All notate apps, I assume. Where's the next apps that you run? Applications. Interface with, hey, where's my examples? I'm not a trick question, yeah. Is it user interface on the back end? Yeah, it could be like a user interface, right? I could show you something. It could be something running locally on your machine, right? Which means that it's, you know, word processing or you're the finder on the Mac or explorer on Windows, right? Something to manage files, all kinds of stuff, right? These are all applications that are running locally, right, on your device or system itself, right? So it would be the opposite of local applications. Remote applications, right? Something that's on somebody else's server. So what are some examples here of things that you interact with constantly? SSH constantly, it's not like that. Facebook, maybe for the rest of us, right? That Facebook application, right, does not, the database of all, whatever, how many billions of friends, right, is not resting on your computer, right? That's on some Facebook server and you access that remotely over the network using port 80 or 443, right, to do HTTPS. But either way, the application is really running on their server, right? What are some other types of applications? Remote applications. What was it? Web services, yeah, a whole host of web services, right? Your phone even, the applications on your phone, right? A lot of them actually use a backend website that they communicate to, right? What else? Games, yeah, games, right? You have the client running on your local machine and you have a server running somewhere else if it's a multiplayer game. It could be it's not a server and you're actually peer-to-peer connected with everybody else in the game and you're trying to decide what's going on. We're at like DNS, right? You don't actually have a DNS square, you make a request to a DNS server. Right now, it's connected to ASU network, that'll be one run by ASU. And then that job of that server is to serve your request and to go out and find the DNS entry and then give your response back. Okay, so, right, so we think about applications, right? So I, right here, we're taking the mind frame. Eventually we're trying to break applications, right? We want to break applications just like we broke the network, right? We tried to do things in the networks that we weren't supposed to be able to do. Listen to packets that weren't meant for us. Inject data into a string that wasn't between us, right? So what the influence is, the behavior of an application. So I like to think about like an application as kind of this, yeah, it's a very high little thing. So what are all of the possible inputs that influence the behavior and the execution of that application? What's the big one? The user input is one, but few before that. I think that application know what to do. Operating system is another one. The code. Code, yeah, that application is code, right? It's nothing without the code, right? So it has some code. You, the user can give user input. It's running on a certain operating system that provides services. What are some other things? Is it just the code itself, the code of the app? What was that? Data. Data, right? Yeah, so the application, it could be data in the form of stored photos for a photo browser, whatever application, or it could be configuration files, right? So the app can behave completely differently depending on what configuration files are there. You've actually seen how SSH can change, right? Depending on the configuration of the authorized key file and the known host file, right? You can actually, I hope, part of the reason why you looked at the authorized key file that you saw, but it's actually really complicated and you can do a lot of crazy things. There's a lot of options you can do there besides just give this person access. Right, so yeah, kind of generally, we can broadly think about this, like, okay, the behavior of the application depends on the code, right? The data that's being processed in the input and the environment that the application is being run in, right? So these type of things can all influence the application. So if we want to try to attack an application, what types of things there, I think there are, I really hope we did talk about this, I'm pretty sure we did. What are the three things that we want to try and compromise when we talk about secure security? Yeah. Confidentiality? Confidentiality, just one, okay. Confidentiality, integrity, availability, yeah. So how can we do that though? Generally, right, what are our options? Right, in a sense, we're trying to influence the behavior of this application, right? To violate one of these three principles. So we're trying to either trick the application or force the application to somehow execute some behaviors that make it violate either confidentiality, integrity, or availability. Right, these are the core things that we wanted to. So if we think about a model of the application, right? So this is what I like to think about, like, okay, so we have an application, right? And it's just kind of this nebulous blob of things, right, behaviors, right? But that's kind of contained within an environment, right? So there's some environment here. So what does that application typically run on top of? Are applications just executing on a processor just willy-nilly? Yeah, the OS, right? So the OS provides a lot of abstraction to the application so that it doesn't need to know, hey, this is actually an SSD you're writing to instead of a standard hard drive. So this means you need to do ware leveling and all this stuff, right? So the operating system provides this abstraction layer. And then if our application wants to talk to, you know, other machines, what else is it going to mean? Which we saw, we looked at the network, right? So it's got a talk somewhere. What are some key abstractions or features that operating systems provide? I can't talk about one file system, right, or some others. Hardware drivers. What was it? Hardware drivers. Hardware drivers, yeah. So it extracts the hardware. What's the other stuff? IO drivers. IO drivers, yeah. All kinds of drivers. Video card drivers. It's all I'm doing, driving. RAM? Yeah, so it can be a little more specific. It's a little more abstract, but yeah. Okay, generally, right, so yeah, so not just operating system doesn't just provide us with the memory of the RAM, right, but it segments it so that each process sees a different part of memory, right? So that way, we're not all in the same address space and just can overwrite each other. So it provides some way that I can think of, like, separating processes, right? So that, you know, the whole idea here is, hey, it doesn't matter what crappy application you're running, if my application's well written, you shouldn't be able to crash my app. Is this always the case? Unfortunately not. You can actually break an Android phone very easily with a simple fork bump, like a C program that just forks and you can run that and it will just take up all the process on your phone and break your phone and you have to, like, hard to get it back to normal. Okay, and then so, but then, so where do we fit into this picture? So we're remote, where are we kind of in this picture? Is that on the network? Yeah, through the network, we're off the left somewhere, right? Our packets are coming in over IP, GCP, UDP, one of those, right, coming in. We've seen how all of that works. What if we're local? How does our input get to the application? Having the access of the system, except on... What kind of access? The login access and off being the same subnet. So we're gonna ignore, so we'll think about local just as the first one, right? So on the same subnet, we'd still consider that to be network access, right? So yeah, there's some way we're gonna abstract it here is the terminal, right? So you're at the terminal, if you're SSH, SSH gives you a way to remote in, essentially, and get the terminal, right? Or you're physically at the machine, right? And you can interact with the process. Terminal here, we're using kind of very vague, it could be a GUI, it could be whatever, I mean, that really doesn't matter. As long as you're able to get input to the program, that's an important thing. So your input is mediated through the operating system. So the operating system, whenever you, you're at the keyboard, every time you type something, a hardware interrupt happens, and the operating system gets signaled and then it sends that command. It tries to figure out which process to just go to, and then it sends that command up there so we know how input's being read. So what are all the things that the operating system, the application can touch, and what does it go through? I should say, wait, first, before we talk about that, is this all the layers? What are some that are missing? I don't see hardware there. Hardware? The kernel is in the OS layer. Yeah. Right, so yeah, the OS has, so there's the kernel and then there's a bunch of different drivers to do all these different things, and the OS itself is split up into a bunch of layers. Right, so yeah, the very low layer of the hardware, right, the hardware's not in here. Permissions? Is that in the case? Yeah. User interface, we'll throw user interface under terminal, just say that it's all input. We'll say permissions are kind of in the OS. Is there anything below between the OS and the hardware? Really good. What was it? Really good. Again, you get to say it louder. Really good. Middleware. Yeah, there could be some kind of middleware, usually not between the OS and the hardware, but maybe between us and the OS, there could be libraries we're using or other services. Absolutely. And we could share that with other processes. Or hypervisors, right? Our OS, there's nothing to guarantee is that the operating system is actually executing on the bare metal, right? We could be running on Zen, and Zen is managing multiple operating systems that are all executing on one hardware, right? But anyways, we're just gonna keep this at this abstract level, because to the application, all the application sees is the operating system, right? What the operating system sees is the hardware. Whether there's other stuff in between there, who knows? This could actually be an application that's written. I mean, you get kind of crazy where the application is a Windows application that thinks it's talking to a Windows operating system, but really there's a compatibility in the middleware or layer in here like line, which is translating between Windows system calls to Linux system calls. Actually, the application's running on a Linux machine, but all it sees is Windows. Anyways, okay. So the picture's not complete, but we're kind of okay with that, right? So then where are all the places that data can be in this, like what can our app communicate with in this diagram? Where can data, so we talk generally, right? An application is influenced by its code, which is gonna be inside this blue circle, right? And it's gonna be influenced by the environment, which we're just saying is kind of outside of that. Where's the data live? Let's go over here. Stack. Say that again? Stack. Stack. Little, so yeah, inside the application, there will be data. Yeah, what about in the diagram? So yes? Yeah, the file system, right? It could be reading files from our file system. What else? The network, yeah, it could go make requests, right? If it tries to resolve any DNS entries, it's gonna make a network request. If it makes any web requests, HTTP requests. What else? Anything else? Could be from us, the user, right? We're kind of seeing that we can get data into the system. Yeah. Memory and the registers. Memory and the registers, yeah, those I'd say are all in the blue circle, the applications environment in some way. But where did that come from for you to get there, right? That's kind of the trick. What about that other completely disconnected circle from the diagram? So most OSs have a way to do inter-process communication, so it actually could be memory mapping, so maybe that, right? You could map the same memory region so that way one process writes to it, the other process can read from it. But in essence, that happens through the operating system, right? So the operating system is mediating all communication between processes. So, why is this important from a security perspective to know this, right? It seems pretty simple and easy, right? I mean, I hope I'm not blowing your minds here with the architecture of an application, right? So why are we talking about it? Let's go back to our goal, right? We want to make the application do something it's not supposed to do. So what influence is what the application does? The code, the data, and what else? The environment, right? So those are the three ways we could potentially attack the application. So if we'll actually look at exactly how the code is written and done, right? If we can arbitrarily change the code of the application, then we can kind of do whatever we want. If we can modify this environment circle, right? Then we could maybe get the application to do something it's not supposed to do. But this data, right? Getting data into the program, it's really important to really understand what are all possible ways that data can get into this program. And what do I, as an attacker, have the capabilities to modify, transmit, or influence, right? Because if I can change that data to get the application to do something that it's not supposed to, then that's a security vulnerability, right? So this is why we look at all these things to see, maybe the application's great, maybe it's 100% bulletproof, but maybe it relies on data from this process. And what if I can control that process? Now I can control that data that goes into the system, right? Or what if we talked about networking attacks, right? Can I inject some data into this networking stream? Is it trusting an IP from another host, right? That I can impersonate? These are all kinds of things. And the file system, right? It's reading from files from the file system. Now we talked about permissions. What are the permissions of those files? Can I mess with those files to get it to do something like that? So it all comes, so the high level we're talking about here is basically application and vulnerability analysis. So we're trying to understand how do we identify vulnerabilities in an application? And so this is kind of an important clause there at the end, right? As deployed in a specific operational environment, right? So what? So kind of, let's try to talk about it and think about it. Like abstractly, what kinds of ways can there be problems in an application? At a very high level, before any code is written, can there be a vulnerability? Compatibility. What was that? Compatibility with the environment. Compatibility with the environment? Yes, we're gonna get to that. It's a little bit more low level, but yeah. Design of the environment. What was that? And the design could be vulnerable, right? It could, the design just like, oh we saw for instance in the Morris worm, right? So I remember what it used, the SMTP vulnerability that it used. It was a debug option that automatically executed the given command on the machine. This is the back door that you wrote. You wrote a back door that does this. This was intended functionality in the SMTP client. This is design level problem, right? That's not an implementation problem. This is straight up, that design was broken from the start. It doesn't matter where you deploy that or how you do it, that's just a straight wrong, right? And you can tell that before any code is even written.  Probably not a great idea. Right, so then what about, okay, let's say the design is good. Does that mean the system is secure and no vulnerabilities? No, so what could be a problem then? Oh, yeah, cool, yeah. Yeah, right, so implementation, right? So how did they make a mistake, right? Maybe the design says, hey, only administrators should be able to execute these commands from a remote location. But it turns out because of the way they coded it, right? That anybody can do that, right? So that's not really design level, that's more implementation level. Well, let's get into this, we're talking about compatibility, right? So what is, so if we go lower let's say the design's perfect, implementation's beautiful, is it still secure? The OS itself could have vulnerabilities that can let someone in and take control of your process. Ooh, okay, that's tricky. Say we're not gonna include that in this model, but it is definitely something to think of in general, right? So that's actually kind of why that layer diagram is great, because not only could they compromise your operating system, what if they compromise your hypervisor, what if they compromise your hardware all the way to the very bottom, what if they compromise the firmware that's running your hardware, right? There's all these different layers below you, because yeah, as an application, you just trust the operating system. The operating system has full control, absolutely. So let's say the OS is secure, all the bottom layers are secure, design's fine, the implementation's fine. Bad data? Bad data, boundary conditions, no, the implementation's fine though. Boundary conditions, I've solved, I've fixed all boundary conditions. I handle all that data. What was that? Yeah, maybe, right? What about the environment that this perfect application is executing in, right? What if I, so for instance, PHP has this really famous configuration option called magic quotes, which whenever any data is in your PHP application, if there's any double quotes or single quotes, it automatically puts a slash in. Anyways, we'll get to it eventually, but it prevents the SQL injection vulnerabilities. Only if your application is running on a PHP host that supports this application, that supports this setting, they change that in one of the PHP versions. So you could take an application that's 100% secure, right, take it from one operating system or one server, put it on another one, and because of the configurations of PHP, your application is now vulnerable, right? Or what about if you deploy a super secure application and you have an administrator account whose password is what would be the first thing you would guess? One, two, three, one, wait. Admin, admin would be the first one, password would be up there, right? And the admin, admin account is active, right? Is that secure? No, and it's an employment problem, right? Because nobody changed that default password. So design vulnerabilities are actually very tricky to find. They're kind of the next frontier of automated vulnerability analysis, because the idea is these are flaws in the logic of the application, right? It's like the logic is wrong, but the code is correctly implementing the wrong logic, right, so how do you tell what is the wrong logic when the code is doing stuff that is? The code says it's supposed to do, but by design, it shouldn't be doing that from a security perspective, right? So these are very difficult because it depends on the exact functionality of the application, right? This could be things like lack of authentication or authorization checks. It could be erroneous trust assumptions, right? Like maybe when we saw being able to log in to a computer from an arbitrary IP address is probably not the best idea in the world. Because anybody on that subnet could impersonate that machine and log in. What would be some other ones? What are some other design flaws that maybe you've heard about or can think about in any application? Very big, very broad.  Yeah, that is a huge- They just work for Microsoft. Okay, but that is a huge, you know, once I saw it in that video that there is an option for disabled people to, you know, use these sticky keys, right? So if you replace a sticky keys file with a command prompt in the system32 folder by pressing the sticky keys outside your login page, you can access command prompt and log into it. That's tricky. Yeah, so that'd be like using an, like a feature in a way that it's unintended, right? So yeah, it's probably the design there is a problem. They should be checking maybe the format of the sexy games, like, frankly. Yeah, so it's actually a lot of instances of this. Yeah, just flaws in the overall design. So they're incredibly difficult to identify automatically because you need to not only identify what the app does, but you also have to try to infer what should the app do, which is very difficult. And it's completely specific to every application. So for instance, one of the things that I like to, one of the ideas I like to convey is to try to get people to understand that behavior is not necessarily vulnerability by itself, right? So if I said in a web app, dare use this, maybe you can stop me. In a web application, you can, anybody can change the content of a page. Is that a vulnerability? So the answer is it depends, right? It depends. Is it cnn.com? That anybody can change the content of that page? Right, that's a clear security vulnerability, right? The security requirements for cnn.com say that only editors and journalists can change the content of that page. It can't be any arbitrary people, right? But then what about Wikipedia? This is the functionality of Wikipedia. Literally anybody can change at any page on Wikipedia. You can go now, you can change any page. It's not a security vulnerability, it's intended functionality. So how are you gonna automatically check for this type of security flaw? It's hard to tell. In both cases, there's not checks, right? The code could be identical, but in one case it's intended, in the other case it's not. Okay, there's also a whole class of problems called the confused deputy problem, which is in essence when a malicious application can be tricked into doing something on your behalf. So for instance, have this super beautifully separated firewall application, like I'm running this application, let's say it's gonna be malicious, and but I say, hey application, you can't make any HTTP requests. I'm locking you off, you can't make any HTTP requests. But I have a process on my system that accepts inter-processed communication requests and will go make an HTTP request and return the response. So now, this application that I wanted to never make an HTTP request, it never makes one. It just makes an inter-processed communication to me and then I make that request. It's actually a really big problem in Android, because the Android system works on intents, so you can send an intent to any other app, right? And so maybe you don't have the permission to do something, but if that's your phone, okay. I remember that being louder, maybe I'm getting it now. Yeah, so the idea with these Android apps, right? It's like, okay, maybe I as my app, I don't have the permission to read all your photos, right? But does there exist an app on your system that when it accepts an intent, will get a photo and return it back to that service, right? It's actually very tricky to do this 100% correctly. So in this case, I have this confused deputy problem. Well, it's a test, don't worry, a test. Okay, so design vulnerabilities are kind of at the high level, right? They're problems with the design. And then below that, right, we have these implementation level vulnerabilities. So this is when we say, okay, so is the application coded correctly, right? What does it do on these boundary cases or these bad inputs that we said, right? So is it, I was gonna ask which one's more likely. I'm not sure that's an easy question to answer. Do we have, still have implementation vulnerabilities? Yes, why? Yeah, we're humans, right? We make mistakes. We still haven't figured out exactly how to write bug-free code. Can't write bug-free code. We'll never be able to write vulnerability-free code, right? And so we're humans and we code things and they're not able to correctly handle unexpected events, test, you all perform badly, right? So what kind of, what could these unexpected events be in the context of what we're talking about with the three, with the three ways we can influence an application's behavior? We talked about something, you could reuse those answers. What are these unexpected events? Super big term. Somebody's phone ringing and doing a test emergency and it causes vulnerability. Yeah, but what makes it, what can make it crash? An unexpected condition or something. Yeah, so maybe the input is weird. Some unexpected input, that wasn't very good. Exactly. Any kind of unexpected input? Different environment, it's being deployed to maybe? Yeah, it could be the environment that does it. It could be that it got an exception that it wasn't planning on getting, right? If you have an exception at the wrong part of your code, maybe that changes the state of your application and now your application is in an insecure state, right? Maybe you're trying to check if this username password is valid and right before you go to set the flag that yes, or that it's invalid, right? Right before that there's an exception that occurs and so you never set the flag that this user is not a valid user. Are all applications, single threaded applications that always execute one instruction after the other? No, right? Even though that example we had for the fact that applications is incredibly simple, there's still a ton of complexity there, right? We can make network requests, right? We can read from the file system. We can talk to other processes. We can have multiple threads in our application. So really, what if for most executions the order of events are safe? But there's some unexpected way that these events can be ordered such that it causes security vulnerability. Very difficult to detect. Yes. Could be that the output of our program is unfiltered and causes problems, right? It could be that the output of our program is the input to another program, right? Which could then be used in the output of another program which eventually causes a crash or some kind of problem. Right? It's actually kind of a hard one, but it comes up in the context of cross-site scripting. All kinds of these, these are all kinds of things, these unexpected events where the programmer didn't think about this case or they didn't anticipate something. Yeah. That locks in the database throughout the actions. What about it, is that again? That locks. Ah, yeah, so exactly. So that could be like an availability attack, right? So, yeah, and that kind of could be this unexpected interleaving of events, right? So it's like the database, the database deadbox or maybe your application deadbox because it's not handling its locks properly. Yeah, all these kinds of things can trigger a vulnerability if you're able to get it to somehow compromise the availability integrity or confidentiality. The tool or technology that you're using for implementation might have an inherent vulnerability by itself. Yes. Exactly, so let's think about that. Yes and no, it all kind of depends. It depends on kind of where you define application, right? That bubble. If it's, for instance, like there's this recent vulnerability in the DNS resolver in libc that causes a buffer overflow, it affects SSH and all these other protocols. So it's this core library but it's used by so many applications. So if you think about like the attack service of your application, the attack service of your application, which is I think about as like, what are all the places that people can attack you, right? You have just the code that you wrote, but then there's any code that your code depends on, then any libraries that you use, right? And it grows and grows. And then you gotta think about operating system if you want to be really secure, all that kind of stuff. So yeah, I forgot what the question was but I hope that answered it, kind of. It's like I was gonna circle back around, reference it, my camera over talking about it. It's good though. Okay. So then design implementation, then we talked about, so there's also deployment vulnerabilities, right? So a completely secure app, put in an insecure environment or misconfigured way can compromise the security, right? So for instance, let's say your app is meant and tested to be installed as a normal user on Windows, right? So that's the environment supposed to be run in, but it gets installed as an administrator privileges, which it wasn't expecting. It shouldn't be installed that way, but for whatever reason it is, right? So now because of that it's insecure. It could be, yeah, it could be that the application is installed and it's supposed to be that a certain file is read-only, right? But it turns out for operating system misconfigurations and that file is actually writable. I'll tell a kind of personal story. Like one of the first servers, like actual servers, I was renting, I think it was one of those five dollar a month servers. I couldn't SSH to the machines, my website was down.  I was like, I don't understand. I can ping it. It seems up, but I can't SSH to the machine. Can you help me figure out what's going on? And they reply back with, oh, okay, yeah, your machine is up, but it seems that the permissions on your authorized key file and in certain SSH directories were 777, which means readable, writable, and executable by everyone on the system. And so if SSH detects this insecure configuration, it won't allow you to enter the system. And I was like, oh yeah, there was that time that I couldn't get things to work. So I just did a CH mod 777 on everything. And it worked. I've learned sense, but I was very new. And I was like, ah, it doesn't work. Just make everything readable and writable. That'll solve all the problems. Which is how you can have security problems, right? Is, especially if you have maybe development and operations separated, right? So the app developers just pass the app to deployment and they're supposed to deploy it on the server. Maybe they don't realize that this file has to be re-old and otherwise the entire security of the application can be compromised. Yeah, we talked about easy to guess default credentials, right, admin and admin. All these kinds of stuff. And the host more. So the idea is, the way you can kind of tell, right, is if the application was deployed successfully, it would not have this vulnerability, right? Whereas an implementation, doesn't matter how you deploy it, it's still gonna have that vulnerability. Modulo and deployment kind of mitigation, exploit mitigation techniques, but that's a whole other issue. And the design, right? Design is just, it's always gonna be bad. It doesn't matter how perfectly you code. So let's talk about the difference between a remote and a local attacker, right? So what are the differences from our diagram? Think about that diagram, right? The app terminal with the local user and the network. I mean, the size one is local and one is remote, right? Those are the inherent differences. What does it mean for vulnerabilities, for security? Direct injection of the attack and indirect injection of the attack. What's the difference? Yeah, so the big difference, right, is exactly that. So if we wanna do a remote attack, any, the only way from that diagram to get data into and influence the application, right, is through the network, right? You can't influence the application in any other way, right, except for that network error. But if we're local, then we have a lot more options, right? Can we mess with the file system that it's reading data from? Can we mess with the process itself, fault in memory? Can we mess with any other processes that it relies on? Can we mess with any temporary files it creates, right? We have a much greater view as a local attacker. But what's the downside? Can you do this at every machine? You need to have either physical or, you know, either physical access or SSH access to the machine, right? You need to be somehow executing on that machine arbitrary code in some sense, right? So you need to either have an account or compromise another application to get control there, right? And the idea is once you're on there, right, well, you can already execute code on the server, right? You're there typing commands in, you have an account, you can type stuff in, right? You can run things. So really what you're looking for is to get more privileges, right? Like you wanna take over my account or you wanna take over the administrator's accounts, you have full control over the system. So usually what you're looking for as a local attack is a privilege escalation to try to get to a higher privilege level. In general, they're easier to perform. Why would that be? Other knowledge of the environment? Yes, okay, what else? How you can, you're on the machine, you can see things, you can maybe look at the processes. You actually know the entire environment, right? So you know exactly, is it 64 or 32-bit system, right? What library I live to see is installed? What version of boots are they running, right? What's the kernel version number? All those things you have access to and can understand, whereas if you're remote, all you're doing is talking to that machine on that port, right? So often local attacks can be easier. So remote attacks, right? So you can have unauthenticated remote attacks, right? So unauthenticated just means that the application doesn't know who I am. And remote means I'm coming from somewhere else. So, I don't know, is that better or more severe? What was that? More severe. In what sense, why? Because you can write these things up, but you don't need to go up. Is this terrifying? So they can just send information to your process, right? You have no idea who they are, they don't have an account in your system, and then they're able to remotely exploit that to, let's say, get an account where they establish themselves, like completely control that process, right? And unauthenticated, which means they don't have to use any password in your system. Literally anybody who can talk to that application on that port can take over that process, right? Where as a local attack, you need to have local access to the system, right? So in some sense, these things can be staged. And the idea is, I'm not trying to, I mean, I am trying to escalate my privileges, usually from somebody who's remote on the machine to now something local. So I want to try to get the privileges of that vulnerable application, right? If I can do that, then I can do a lot of cool stuff. So in general, these are compared to local attacks, they're more difficult to perform because you don't know what's the operating system, what's the security mechanisms, what's the version of C, all this kind of stuff. You may not even know the architecture, armor x86 or MIPS, right? Could be, it's just a network application, you don't know. So this is why we looked at things like OS fingerprinting from the network level, right? You can tell, now you have information that can help you in successfully launching a remote attack. Cool, so let's talk about the high level, the life of an application, right? So you want to write an application, what do you do first? Very high level. Design, design, design it, get some requirements, write it, write it in ones and zeros, sure. Sure, it would be fun. Okay, no, you first write it in like a higher level language, right, so you write it in like, I don't know, even C, C++, Java, Python, whatever, you write it in the language. The application is translated or compiled right to some kind of executable form saved into a file. It may be that it could be, what's the difference between interpretation and compilation? Interpretation is line by line in what sense? Whenever there's an edge in stores. Yes, but what it's also doing is it's going, what is it doing is it's going through line by line. That's the question. What is it doing? Checking, checking. Trying to check errors, it is doing all those things, it's also doing something else, and that's the key difference between interpretation and compilation, right? When you compile something, you're also going through the whole program, right, line by line, looking for syntax errors. Yes, and what is interpretation doing? Yes, executes, yeah, that's the key difference, right? Interpretation goes through the program as executing the behavior of that program, right? Whereas compilation takes the program and translates it into some other form, right? Machine code, whatever, that it can later be executed. Yeah, so those are the key differences. And these differences can be muddled, right? So like a Java program is a Java application. So do you interpret a Java file? No, right? Yeah, you compile it to a class file, which is specific Java byte code. That Java byte code can't run on the machine directly. So you use an interpreter that interprets that Java byte code and then performs the actual executions, right? Whereas when you run a C program, you compile it to, we'll see in a second, an ELF file that the operating system knows how to load it to memory and actually start executing. So once you've written it, it's compiled, translated, saved to a file somewhere, right? You load it into memory, you execute it, and then the application terminates. So at a high level, we're going to, we're kind of going to ignore a little bit the interpretation compilation question in some sense. I mean, we'll look at interpretation, right, for a little bit, but we're going to focus on compilation and the idea is, well, every interpreter, like somewhere, some binary code's got to be executing, right? So like Java, the Java virtual machine is written in C or C++, right? And it's running actual machine code, and it's even dynamically translating the Java byte code to machine code on the fly, right? So we just talked about this, right? The program's passed to an interpreter, it may be translated into some intermediate representation. For instance, like Python will do an interpretation, but it'll also create a PYC file, right, that has Python byte code, so that next time it doesn't have to do the whole interpretation process, it can just do that byte code. And the important thing is each instruction is parsed and executed as it's going through this file, right? So it's executing it as a interpreter. And what this allows, this allows actually a lot of flexibility, a lot of really cool features from interpreted language. So what does this mean generate and execute code dynamically?  Can you do that with the regular program, too? Okay, once it is compiled, then it's like, all you need to do is like, as in running the string. Yeah, so you can actually take a string, right, and interpret data, some string, and interpret that as code, right, and just start executing it, right? Because you have an interpreter, right? So a lot of these interpreted languages allow the programmer to say, hey, evaluate this string, take this string, interpret it as if it was a line of code in this program right here, and execute it, right away. So Python, batches, JavaScript. This is fully and terribly evil. We'll look at why later, right? At a high level, you're thinking about, okay, I wanna have this program execute arbitrary code. If I control this string, I can literally make the program execute whatever code I want. All right, which is exactly what we want. All right, we'll stop here, and then we'll look at compilation, and we'll get into the nitty gritty of what objects and binaries look like on x86.


We are continuing with our small signal model before we start amplifier. Typically as we have so far solved equations, the equivalent circuit of a MOS transistor is shown here. This is your gate, this is your drain, this is for common source, this is your source which may or may not be grounded in some cases it may be and then there is a bulk and we believe that all capacitances are right now not relevant in the low frequency range. Essentially it means 1 upon omega c is such that it opens circuits everywhere. So assuming that you can see there is a input voltage of Vgs which is equal to input voltage of Vn and since gate has no connection resistively to the source, this is open and therefore Vn is equal to Vgs. At the output side and the drain side you have the current source which is gm times Vgs or gm times Vn plus and there is another current source which is due to the VSB substrate bias which will give me a gmb VSB term shunted by R0 as the output resistance. Now if this is the low frequency model and in many cases since we are interested in the MOSFETs or MOS circuits bandwidth which is the frequency at which gain is at least reasonably constant for those frequencies will require capacitances and this is an equivalent circuit which is called high frequency small signal models. This is most important all this analysis always has been done for small signals and the issue we shall raise little later if there is not enough small signal words satisfied what do we do that is one of the major issues right now in most due devices and circuits. You can see from here source has small resistance RS dash which is the source region resistance N plus region resistance RS dash similarly there is a drain region resistance which is R e dash the rest part is similar this then there is a capacitance across the Cgs gate to source capacitance which we declared as Vgs and there is a capacitance between drain and gate which we call Cgd then at the output side there is a gm Vgs as the one current source gmb Vgsb as the another current same as this plus and they are 0 so they are same now what is difference is there is a capacitance between gate and bulk sometime it gets screened sometime may not get screened but we should show it in case it screened we just remove that and there is a resistance which is associated for substrate okay there is called RSV and there is a resistance between source and bulk CSB then there is a capacitance between drain and bulk CDB and there is a resistance of the drain side which is Rdb now these these are essentially equivalent of a diode you know R into parallel C is what the RC combination so these are those resistances are normally they are very high so open circuited but as a logic we must put them and then say okay they are large small and many remove them out okay but this is total small signal high frequency equivalent model of a MOS transistor and in case you want to solve this the easiest way is to figure out the values of each of them and there are number of loops or number of nodes whichever way you want to solve Kirchhoff law you will be able to solve V0 versus Vn relation that is what we are looking for at the end gain V0 by Vn since I have enough nodes or enough loops I can solve as many unknowns as many nodes or as many and as many meshes therefore you can always solve this circuit will give a small example to show how do we solve that in all analysis please take from me that this may be a very good this at the end of the day we will not solve actually all the circuit by hand but to start something on CAD we need some hand calculations so in that hand calculations or more modern can be simplified because you are only trying to get the first guess okay in that case all these detailed values may not be required in many hand calculations though there can be some error in hand calculation I will list them out what happens if you do not take care enough in case of designs however this is the model which we will be using for a MOS transistor and this is shown common source but it does not matter you can tilt any angle to make it common drain or common gate whichever way the circuit remains or the equivalent circuit remains same let us say it is N channel all this device unless said otherwise devices are N channels if there is a CMOS part there we will explain that CMOS again okay there is a resistance associated with this region and there is a resistance associated with this region after all there is a semiconductor regions and they may have heavily doped so the resistance may be very small less than 5 ohms or 3 ohms sometimes depends on the area now that is where the problem started why we started looking into it if you see a roll by a as the R you may actually reduce row because of doping higher doping but this area also is going down because you are scaling so if you scale down this area may not be as what it was earlier may be 100 times 1000 times lower so essentially R may not be as small compared to what we thought in the long channel devices so please take it that why this new models are added these terms because they may be dominant term not never dominant but they may actually change the pole positions or zero positions and therefore one must take care in solving any case of law on the any circuit is that clear in normal case we neglect them we say it is few ohms the others are kilo ohms forget it if they are in series but if they are in shunting then they will be the one who will matter most of it so one has to take care of all this in writing as circuit requires comes will remove the terms which are not relevant in evaluation is that okay and plus this is like a three dimensional device a three dimensional register okay so this is a bar of semiconductor which will have some resistance rule by okay so this is what we keep saying you that this is needed because in case you are using accuracy then you may need them also okay so another method of solving the same amplifiers which I earlier did this is my method which I always say that you know you can look at the solving any equations or solving any circuit by very different small signal analysis not really very different but interesting way so I just always want to show you how do I can solve other ways let us say this is a common source amplifier which is biased by a constant current biasing which is constant current biasing is IDS is constant fixed current source right now I also assume it is a good ideal current source what does that mean the output resistance of that current source is infinite okay in real life if I replace this by P channel device as a current source it is already R0 will actually come into picture is that correct right now it is assumed constant current source ideal in reality they may have to be modified for the real R0 comes there so the analysis is I just this is a technique and there is nothing great about these solutions which otherwise we will get we know this current IDS flowing in this transistor is a function of Vg and function of Vd which is a standard MOS transistor theory I can use my partial differential kind of a partial differential of this to equate some terms I say okay change in IDS must be equal to red I mean delta IDS by Vg into delta step similarly for the Vd delta IDS by delta Vd into capital delta which is a step function we know by definition change in drain current with gate voltage is essentially change in drain current with Vd drain voltage is essentially G0 okay so we rewrite delta IDS is Gm delta Vg plus G0 delta Vg if I convert into differential forms it is delta divi IDS is Gm dVg plus G0 dVg in our case change in Vg is essentially the input signal AC signal so GA Vn is dVg V0 is dVd which is the output AC signal which is nothing but change in the drain voltage is because of the small AC signal which is applied at the input is that okay this is as I say many people believe that I know this is better way of explaining that 2 port parameters which you have must have learned or you must be learning now somewhere S parameter AV parameter H parameter how do we get parameters for any transformations this is how we get it okay so that is the technique I am showing you how do I get 2 port network solutions this is how one can try any 2 ports or any inputs in fact longer difficulty in solving. So now I have equation delta IDS is del Gm del Vn plus G0 dVd okay so here is that expression which will appear I put it now so I get delta IDS is Gm Vn plus G0 V0 as amplifier is biased in constant current source there is no change in current okay so G delta IDS is 0 which is equal to Gm Vn plus G0 V0 if I take a ratio of V0 by Vn it is minus Gm by G0 G0 is the output conductance which is 1 upon R0 so it is minus Gm that is the expression we derived this is called intrinsic gain of a MOS amplifier why it is intrinsic no load resistance was used instead of load we have constant current source with infinite output resistance for that is that clear so this is Gm times R0 okay now if we take the first order model using an RD now instead of constant current source the and let us say there is a series resistance with the source and then and let us say some capacitance Cgs is taken care and right now assume that Cgd is open circuiting at a frequency of my interest then I say Vn is Rg equivalence or there is a Cgs which is holding the Vgs voltage then it is Gm times Vgs R0 shunted by Rg so this is and in all these cases VSB is taken 0 that is source and bulk are grounded unless specified do not use those terms if I specify something or indirectly specifying it look for that value and substitute in GMB VSB terms and solve for it okay what is that you have to do is just add many times 0.6 1.1 plus 0.6 Gm is going up as a Gmb equivalence of that so you can need not solve many times just add instead of 1 put 1.6 and you can get rid of much of the solving this is for high end calculation so this much assumptions may not be very absurd but in real life you may have to calculate actual values given doping given everything and then figure out what is the Gmb values you get okay so if this is my equivalent circuit why I am doing it I want to give some numbers which is very interesting in designs and that is why I am trying to look for them is it okay this is equivalent circuit there is nothing great all that I put 2 terms here and additional term Rd here so this is still low frequency that Cgd is open circuiting 1 upon omega Cgd is still infinite infinite enough to neglect open it for the transfer function from output to input which is the gain function AVS which then can be written as Gm R0 parallel Rd I should have put a minus sign here because if face opposite now we can use some derived values for Gm Cgs R0 which we already derived in our device theory earlier we said Gm is 2 Ids by Vov which is Vgs minus Vt the excess voltage so those who have taken a course of my analog like should be is there and many others there is a difference in approach when I come to design a course the basic I cannot change I mean analog amplifier will give me gains but how do I derive and how do I am actually get designed for it is what I am now showing so it is nothing extraordinarily different from what we learnt in second year but even then it is worth looking at it the Cgs value we calculated other rate is two-third W by L C ox in saturation if you wish you can use once a while C ox term as well two-third can be made one but if you want to keep and I do keep sometimes so I am keeping it but as I say if someone puts it this is nothing very absurd will happen R0 is 1 upon lambda Ids which is the current then AVS and AV0 is defined as sorry it is minus everywhere is Gm parallel R0 RD you can see from here sorry I will just put it and come back the current in this parallel resistance of R0 RD is what Gm Vgs current is flowing through so minus Gm Vgs into R0 parallel RD is my V0 so that is what exactly is Gm R0 RD is my DC gain and if you say RD is much smaller than R0 it is minus Gm RD if R0 is much smaller than RD it is Gm R0 which case this will occur the second first one is normal resistive loads the second is the case when the biasing is constant current source in that case R0 will be RD will be much larger compared to this and in that case probably this term can be that is why say intrinsic so once we do this so what is the trick I am trying to show you I am trying to derive some expressions for Gm Ids and Gm Vgs Gm by Vgs and these are the two expressions I am going to use in my design so I want to get those expressions from what I am writing I normally use a term which I will show you later R0 parallel RD small R0 D which is R0 parallel RD and then you can replace it by either R0 or RD depends on the values or you do not you solve it and automatically one of the term may go if it is much smaller or much higher is it okay so having done this if ROD is R0 as I said in that case AV0 is minus Gm R0 then I can write R0 by AV0 is 1 upon Gm from this expression 1 upon Gm magnitude wise then I say Gm by Ids I know is 2 by Vov I know Gm by Cgs is to 3 by 2 I had derived last time uo V by L square then these two terms I will call them as figure of merit figure of merit for analog designers I repeat which are the two terms I am going to design for Gm by Ids and Gm by Cgs please take it this Gm by Cgs is essentially FT and we will see what that term is okay that is why it is called figure of merit Gm Ids is a figure of merit because it decides what it decides some with the power it decides the bandwidth and therefore the gain is well so that is the figure of merit okay so what is Gm by Ids and what is Gm by Cgs will decide every aspect of an amplifier so these two terms I call it as figure of merit okay so what is the major decision for any analog designer is to choose proper Vov you can see expression everywhere you are only seeing Vov so if you can choose proper Vov so that the power dissipation the gain and the bandwidth specs are met is that correct so what is the designer spec Vov is that clear Vgs- Vt how much excess voltage you want to keep for the bias requirements is all that matters in decision of making power dissipations gain as well as the bandwidth is that correct somehow though I am keep telling you all this and then I say I do not like this Vov term very much and I will revert back to saying I will not use this but initially I will say okay Vov is a great term which allows me to design every spec which I am really looking for the choice of Vov typically what do you expect the value of Vov should be in a smaller technologies now anywhere any idea let us say I am working on 1 volt supply what should be typical Vgs- Vt will be 0.2 volts so typically it will be around 200 millivolts is kind of Vov values you will have to choose so one technique is fix Vov do something or fix something else and let very Vov okay so we are we are trying to design based on these features okay so is that clear so Vov in my opinion is one of the major factor which decides the circuit performance what are the three parameters I am looking for an amplifier again the power dissipation and the bandwidth one term which I have not said maybe I will have separate chapter to that a separate talk lot many on that which is the noise part we are assuming as if everything is nice for us in reality the killing part will come from the noise part and also temperature part which we assume as if everything is fine all models are fitting into all our requirements which may not be really true okay so the whole why spice or why everything is because all such variations analytically solving for all of them simultaneously becomes very clumsy not that impossible but very clumsy so it is much easier to go on a cat tool to solve that okay so if we see this expression which I wrote here okay AV01 plus SRGCG same expression which I had now HS is one of GMR0 RD1 plus this so if I now substitute gain function as AV01 plus SRGCGS RGCGS has a some kind of a time constant means it is a pole sitting right there okay now please remember if we have done our secondary course well which we I hope so all of you have done so if I plot frequency versus gain and I figure out for certain frequency till certain frequency gain is constant and then of course it goes down and goes down like this of course this is a 3 dB point where the gain falls by 0.7 but as a Bode's plot we can actually connect two slopes and this frequency from where the gain starts falling is our bandwidth up to which gain is constant. Now few things I must know I want to increase this A that means I am really looking for something like this in real life I want larger gain larger bandwidth and also in turn power should not go up that is what I am asking myself and then I will say A, then I will say what I can actually work with so that the third parameter may help me to get what I want so to I can get maybe third I will have to give up so within a given range if I can fit that then I say I have designed an amplifier is that okay so my worries are bandwidth gain what is this term essentially if I plot in dB then this is 0 dB unity gain so this is the point G gain into bandwidth that correct and this point actually we may like you can do like this you are many ways of moving this point okay so we will see how can you play games that means how many capacitors are around and where they sit where this poles positions can be changed to suit your requirements okay sometimes you additionally put capacitance sometimes you see to it the capacitance are not really strong there which your way we can adjust we will see to it what can be done is that okay so design means given aspects how do you play with so we have already said that the gain bandwidth this RGCGS is related to bandwidth now because that is the only pole available to you so we therefore say in the case of circuit shown by me no CGD and no output capacitance the dominant pole or only pole available to US on upon RGCS and that is the one which will decide the bandwidth if we write now CGS as 2 3rd WL into C ox we can write also we know GM is mu C ox W by L into V O V we are derived this expression there from here I get I find out C ox from here and substitute in CGS what do I do from this GM expression I get C ox value and then I substitute in CGS value is that point what clear I use the second equation GM is C ox mu V O V evaluate a C ox something like this GM L by W V O V to the power minus 11 upon mu and then I play little game I say okay if you see carefully GM R0 or ROD whichever you say is the gain GM RO is the gain so gain by RO is GM so I replace GM by AV0 by RO parallel to ROD or you can keep one of them also into length RL by W which is the aspect ratio one upon V O V into one upon mu if I see very carefully now this W0 if I substitute back here now CGS I have calculated this expression long expression I substituted in my bandwidth terms 3 by 2 ROD by RG 1 upon AV0 mu upon L square into V O V this is the expression I get for my bandwidth why I did all this calculations I am looking for gain into bandwidth and I am also looking which term will actually vary for what I am looking for there are three terms there I will show you I will write down I will show you this if you finish this I will show you what I mean I repeat my worries are power gain bandwidth so I am trying to see expressions in a different form so that I will see which term likes a power which of the terms in power expression which will actually enhance the power or which will reduce then reduce the power but if I reduce this I will come back to the other expression see if that term varies here what will happen to the second expression which I use W for example so I keep writing expression for each which are of relevant for me and I keep playing games to see which term is dominating for me and when I can control is that design issue clear should be is that now you understood why second year to 4th year there is a issue here sometimes so the issues are that is the design part so please remember what why we have a separate course on analog design a VLSR design because there we only solve something okay and we say it is fine it comes like this now we are very given something how do I match it so this inverse process needs much thinking then because there are many possibilities which may do that which one is better but if you choose one then the other may hurt okay so where do we get hurt which terms are important is design okay so is that omega 0 term is clear so I write now same expression if I put it here you can see now W0 is 3 by 2 ROD by RG into 1 upon a normally these are specifications for the amplifiers gains are functions RG is external resistance of the source which is generally 50 ohms to 600 ohms depends on the source used ROD is normally RD if you are putting a resistor there that is something which you have fixed if you are put as a channel length somewhere you are fixing RO okay so this we say is essentially specs related first few terms 3 by 2 ROD by RG into 1 upon AV0 is a specs related the second term there is mu by L square this is not in my hand the technology people will say okay this is the best mobility I can give and this is the length of the technology node I have used 0.18 micron 0.13 micron 90 nanometer whichever technology L and mu is decided them we have no control whatsoever on them so this is whatever technology gives that is the spec for I mean you cannot change okay let us look at the power dissipation is IDS is the current power supplies VDD so the DC power dissipation is VDD times IDS if I substitute that IDS expression from the this I can rewrite please check it AV0 is related to GM please remember what is gain GM times ROD is that correct GM can be written in terms of what is that IDS by 2 IDS by VOV manipulate expression that is what I am keep telling I just manipulate few things so I get half VDD by ROD AV0 and now we observe if I want to reduce power dissipation what should I do this is all fixed we