Hello and welcome to Take One Tech. My name's Alec and this is one of a series of videos I'm doing this week, all about some great little utilities and menu bar apps and Mac apps that you can get as part of the SetApp bundle. But I'll talk about the SetApp bundle at the end of the video. But for now, we'll get straight on into this app because it's a great little app called Yoink. And basically it is something that you can use for helping you with your file management. And it does one thing, but it does it very well. It's probably easiest if I just demonstrate it to you. So here I am on my desktop and I tend to use my desktop much like the top of my actual desk, which is when I'm working during the day, I tend to throw a load of things onto it. And then at the end of the day, I clear it all away and file everything where it should go nice and organized. So when I do have things on my desktop or when I'm working in the finder even and I maybe have different folders and things like that open and I want to sort of shuttle things between different folders or maybe I've got a project where I've got a load of different files from all different kinds of applications and they're all there on the desktop and then I want to clear them all away and get them packed into those folders. Well, Yoink is basically think of it a little bit like a shelf where you can store all of your folders to then get them all over into the finder. So here I am on the desktop and what you'll notice on the left hand side, as soon as I pick up this file and start to drag it, there's this little window appears and this is the Yoink interface and I can just drop that on there and there we've got a file. And by the way, Yoink is an application that sits in your menu bar, I can also do things like I can just simply copy something from the clipboard. So some text that I just copied from the website from Yoink has just been dropped in there. I can preview all of these things. I can preview any images and I can drop as many different files and folders and things like that on this little shelf as I want. But then when I navigate to my finder, say I've got a folder that I want all of these things to be packed away into. So let me just quickly create one for you. I just paused for a moment there because I actually got a folder created. So let's just say that you've got a particular folder and so you've dragged on all of these different things that you want to sort. And then now you can simply drag them from Yoink and put them in the folder and you'll notice that it's disappeared from the desktop but put it into here. So you are actually moving the original file, but it just makes, I mean obviously if I'd only got this folder and that desktop item then probably could have just dragged it straight in, couldn't I? But when you are working and you've got multiple different windows over, consider this a sort of holding area that allows you to flick between different things. Or maybe you've got a finder window open and you're not sure quite where you're going to put it. So you can just put it here for the time being and then you haven't actually copied it.  So say I want to move it to my take one tech folder, then I could just drag it into here like this and then it will have just popped down there. So that is just an example of how you can use it to move files and folders around. But you can also use it, say you're doing research or something like that and you want to get images off the internet. Then you can simply just drag them from websites and drag them over onto there as well. Or maybe you want to take a tech snippet and just copy that and then you can just add it to the clipboard in that way there as well. And as I say, just grabbing images and things like that. It's just simply a case of drag and drop and that one is actually a link.  In terms of the setup, there really isn't much setup to it. As I say, it is just a menu bar app that sits in the top. The controls that you have over it are, for example, you can, if I just move these all out of the way, you can change a few of the settings. So the window position, the moment I've got it left at the top, but you can also have it left at the center and so on. Left at the bottom, you get the idea or right at the bottom left or center wherever you want it positioned.  So when I pick up a file or pick up an image or something like that and start to drag it, then it will appear automatically. Or you can press the hot key, which is F5 or obviously map that to a stream deck if you so wish. You can change the size as well. So it defaults to three items, but you can make it much bigger if you want, just depending on how many things you are changing, moving rather. And then a few other things that you can change in there. So if I go into the preferences, then you can see at the moment so it automatically shows when I start dragging, it's got a little graphic there to show you what's happening or you can press this toggle. So there's not much more to change, to be honest, apart from that. Remove items when dragging them out. So you could toggle that off if you want to leave them in here and you can just actually duplicate them to different places. Combine multiple files to a stack. So if you've got multiple images and things like that then you can have them to stack up. And yet just a few other different settings that you've got there. But basically that's how it works. Launch Yoink Login if you want it to be always running. I personally don't have a lot of things that open at login. I have a set routine that I run that opens all the things that I need under any given circumstances just because I've got quite an old Mac. And so I like to only have the things running that I need to have running. But that is basically it. And that's all I really wanted to tell you about today. So that is a very short one. I don't know if this might turn out to be my shortest video yet. If you have liked it, go and give it a like. And if you want to know about any more of these apps that you can get as part of Setup. By the way, I did totally forget to actually tell you about Setup, didn't I? I know you've probably heard about it if you've watched some of my other videos. But in case you've just stumbled across this and this is your first time watching any of my videos. Hello and welcome. But Setup is a monthly subscription service. It's $9.99 a month. But if you use my link by going to takeonetech.io. Setup, then you can get a free trial, which is two weeks. And then if you sign up after the free trial using my link, then you will get a free month. And I will also get a free month too. So that is how their referral link system works. And once you remember, by the way, you can obviously sign up to the referral links too. The referral program too. And then share it with all of your friends and family. Because it really is a great way to get access to over 200 apps for a really affordable single monthly payment. And you obviously get access to all of the upgrades and things like that that come with those apps as well. So I do highly recommend it. Well, that's just bumped the time along a little bit. And now this is no longer my official shortest video. So anyway, thank you for sticking with it, if indeed you have. I will put a link to the playlist with all of the other set apps. Just set up apps at the bottom right. And so I'll see you in one of those until the next time. Have a great day.


Let me pose another question to the audience. If you hand a hacker a device that has a screen and two to four buttons, what is the first question that every hacker will ask? Does it random? Exactly. That's the question everyone asks if such a thing appears somewhere. So please welcome on stage for the talk, Payment Terminals as a General Purpose Game Computer, Thomas Rensmann. Check, check. Yes, cool. Yeah, so thanks everybody for coming in here quite late, this late also in the event. But I hope you enjoy, you will enjoy this. There will be hopefully, if all goes well, a demo in the end, so. So a quick table of contents, I will first start with a couple of small disclaimers and give an introduction of myself. Then I will give kind of a short overview of the device itself that we will be talking about from a hardware perspective and then also from a software perspective. Then I will mostly kind of chronologically go through the process that I went through when I got this device from the moment I got it up to, yeah, basically the process I followed to get in code execution. In order to explain that, we will have to go a little bit into how the bootloader works and the main operating system. Once we get to the point of having code execution on the device, there's the problem of turning that into something practical, so we need to build sort of a tool chain in quotes as you'll see. Once we have a tool chain, so we are able to build C or C++ to run on this device, we can of course port doom. So quick disclaimers, there will be no new vulnerabilities in these slides in this presentation. This is purely using an already patched vulnerability actually, so it's also good news for anyone who owns a shop who has one of these things. If you connect to the internet, hopefully it should be updated and patched. The other thing is that I will mostly be ignoring all the kind of sketchy payment related stuff, so of course this thing is secure because it needs to protect payment assets, payment keys, whatever is going on in there. This is kind of a whole kind of worms I don't want to open, so I'm just interested in, as the title said, using this as a general purpose computer, seeing what it takes to run my own code on there, or, well, someone else's code, John Carmich's code. So, a little bit about me, I work as a security analyst at a company called Codian. We build tooling for security analysts, basically trying to make security analysts live as good as possible, and there I mostly focus on software security analysis, so code review, pentesting, and this is also my main background, so I'm really a software guy, not really a hardware guy, and I do have, in my previous job, a little bit of experience with the payment world, but this was mostly a soft pause, so basically a terminal like this, but implemented in an Android application, so I know a little bit, I have some context of the payment world, but not that much, and definitely not from a hardware perspective. However, kind of as a hobby, I've been getting more into embedded security, and I guess this is a form of embedded security, and really, I like tackling these things from a logical perspective, so from a software angle, so we will be looking at the PCB and stuff, but yeah, I'm not really using that for anything. So, a bit of context, I guess for most of you, the reason is clear, you just want to run Doom, why would you do this? Well, because you can, I just was bored and I was looking for a new target, basically, and I wanted something that was kind of cool, so yeah, you may actually have seen this at the bar, for example, here, so these are quite commonly used in the Netherlands and worldwide, I think, so I was looking for a device like this that also nobody had ported Doom to before, and it seemed to be from some Googling nobody had done this one, and also, this is a bit of an older device, so I figured if there are any exploitation mitigations, they are probably not that strong, so I should be able to build an exploit if needed, yeah, so I ended up with this device, there's also a bunch here that you can maybe see afterwards, this is the VX820 payment terminal, as I said, it's also here at the bar, it is, yeah, it's made by Verifone, very popular, POS or Payment Terminal manufacturer, yeah, most of you will probably recognize it, so I got my second hand of Markplatz, yeah, so here's a picture I took yesterday at the bar, yeah, so why a payment terminal, so I thought it would be interesting to run Doom or anything similar, specifically on this device, as it seems so overpowered, right, why does this device have so much power, it only needs to display a couple numbers, read a card, maybe do some crypto, so yeah, I thought it would be interesting to use it to its full potential, and it has all the needed peripherals, right, it has a screen at least four or five keys, yeah, and as I said, it ticked all the boxes basically, so a little bit about this device, it is, yeah, it has a pretty strong or powerful, at least for its time, 400 megahertz arm processor, it has quite some flash, which is useful to store Doom levels, it has enough RAM for us, it has a color LCD, which is also a touchscreen, not so useful for Doom, maybe for other games, as we'll see, and it has actually quite some peripherals, so there's not a lot of ports on there, but you can connect a dongle, hopefully show this in the demo, that then exposes an ethernet port, USB host, USB client actually also, and just plain old RS232, and then of course it's a payment terminal, it has a smart card reader, it has NFC, it has Magstripe still, and actually it has a couple more internal smart card readers, if you're into having access to many smart card readers, it has, from a software perspective, it's running an operating system called Verix, from what I can tell this is a proprietary operating system, only used on this generation of Verifone payment terminals, and it's actually quite cool from what I've seen of it, so it's very Unix-like, it has support for multi-applications, multi-threading, it has sort of a concept of environment variable, so you can set key value pairs, which are then used by the operating system and also by applications for various configurations, it has a regular file system, with some level of access control, it has also separation of permissions between multiple applications, and then it also exposes all kinds of peripherals as devices under slash dev, and it has all the normal syscalls to access those, it's like Linux basically, but with some weird dos names, so it's slash dev slash con one, so I wanted to very quickly show the hardware a bit more, for people who are maybe more interested in this, and it's just fun to look at it, if you don't really know what you're looking at, so this is the bottom side, and there's this little flap that you can take a screw out, you can take it off, and you'll see that, this actually does not trigger the tamper detection system, so if you're not familiar with these devices, they are supposed to be tamper evident, tamper proof, I don't know to what degrees exactly, but they should detect the fact that you're opening it up, but this flap, actually you're supposed to open this up to, as I said, these are the smart card readers, so you might want to change those secure modules, I think these are maybe four cards with private keys from acquirers, but I'm not sure, and then there's also this proprietary connector at the top where you can connect this dongle basically that exposes all of the rest of the peripherals, but then when you actually take the back cover off, you will see this, and now I did trigger the tamper warning, you can see here, this is the first tamper detection system that is triggered, this is just some contacts on the PCB that are normally touched by a little conductive pin on the back cover, and actually I think this is also the thing that sometimes accidentally triggers the tamper warning, so if you google the name of this device, space tamper warning, or tamper detection, you will see many people who just drop the device, or I don't know, maybe it's an earthquake or something, and it triggers this because it disconnects quickly, we'll get into that more later, so there's this, you can see there's this funny green PCB here, as I said I'm not a hardware guy, but this seems to be doing some fancy tamper detection prevention stuff, I think it has a bunch of internal layers, and you can't really see it here, but there's a big male socket here, I don't know, a whole bunch of pins that plugs into a female socket, and it's connected to this whole battery thing, actually to switch out the battery you need to take this whole thing off as well, and this is basically I think protecting all of the sensitive parts that you might want to tamper with, so the main system on the chip, the external memories I suppose, and this is the smart card reader, so I guess this is also quite sensitive, they can see the header, and some other funny stuff that I think is not common in normal embedded devices, like very squiggly lines everywhere, either to prevent RF emanations, maybe someone knows about this, can tell me afterwards, but thought it looked interesting, and you can take it apart further, and you can see here the NFC coil around the screen, and then if you lift that there on the kind of top middle or top left area, there's another tamper detection thingy, so it's kind of detecting all the steps you're taking to take it fully apart, and I'm not sure actually what implications that has, from a software side I only found the 01 Boolean basically, so going a little bit back in time, I want to kind of as I said tell the story of what I did with this device, so when I bought this thing second hand, I actually got it in a pair like this, so this is how you will often see it here in lots of small shops where the device on the right is the device on the merchant side, so it also has the receipt printer, this is where you actually start the payment, and that's basically the host for this device, so our target device is really acting like a slave where it just receives commands from the main merchant device, so this is how it was configured in this case, and this was a bit annoying for me, so it was running actually software from CCV, which I think is quite common with the blue background you see often, so both devices were running CCV software, and it was our target device was running in the slave mode where you really couldn't interact with it, so I couldn't find any key combination for example to do something with it, so normally there's a way to jump back to the kind of a management menu, but this was also locked down, so I couldn't do anything with it, except really start payments with it through this merchant side device, so I figured it's really the merchant device that sends commands that do interesting stuff, so yeah this is really, this picture really doesn't make anything clear, but this was my janky setup of basically man in the middle in this, or capturing the data that was being sent from the merchant side device to this target device, and then the response is being sent back, and you can see in RJ45, but that's just the cable they use for Serial, for RS232. So based on all of the communication I actually quite well, not that quickly, a couple of evenings I figured out this protocol, and remember this is a CCV specific protocol, this is not related to this device, it's related to the software running on these devices, but I was able to figure it out, or at least some basic commands in the checksums to be able to send my own commands, and then you can do some fun stuff like this, very funny, but doesn't get us any closer to Doom, right? So I thought, okay, so now I can kind of control this, this user land application, but what if I want to have control over the device itself, get my own application on there? How do we kind of escape this application? So I realized well, if you open them up, and I didn't really explain this yet, but when they detect one of these tamper attempts, they will wipe all sensitive data, so that's the point you're really not supposed to access, I don't know, transaction logs, payment keys, whatever is sensitive, and they will also wipe everything, including applications. So is this just an easy way to kind of clean the device? What if we just open it up a little bit, screw it back together? Well, then you get this, actually. So this is the login prompt for the system management menu, which you need a password for, and now it's specifically the tampered version of that, so this tamper message will be flashing. Luckily, this password is publicly known, you can just Google Fairphone system menu password, this is the password, if you can see, 166831. So if you ever have one of these, press seven and enter, at the same time, should go into this screen and enter this password, you're in management mode. However, application vendors can actually tell the system to use a different password, but in most of the devices I got, they kept the default password. So then, okay, cool, we can enter the system menu, but it's still in this tampered state. Luckily, just Google, or actually on YouTube there are tutorials how to clear the tamper flag, as I said, people just drop these things, they want to keep using it. Turns out it's just kind of a cheat code. This is the main menu. You kind of have to navigate to the next screen, and there's this option five, key management, and there's an option called IPP key load. Okay, cool. Then you get to this screen, which apparently is doing something over serial, receiving keys, and it tells you press one to end, but what it doesn't say is that you can press two to clear the tamper flag. So press two, device reboots, tamper message clear. This feels a bit sketchy to me. I guess it's fine because all of the sensitive data is cleared, but what's the point of the tamper flag? I don't know, but for me, this was perfect because now we have kind of a clean device, no more applications that we don't really care about. It's no longer tampered. Okay, what to do now? So it gives kind of two important hints, download needed, and no go variable, or star go. So this go variable is one of these environment variables I talked about, and this is basically the one that defines, you set it to an application name, and that is the application that will start when the device boots. So if it's not set, it doesn't know what application to run, but this is easy. We can set that using one of the options in the system menu, and download needed. Okay, so we need to download something to it. So turns out it uses this protocol called XDL. I'm thinking this is also proprietary to Verifone, and this is a protocol where if you connect the device over serial to some kind of host machine, you can download files in one direction to the terminal device from your computer. There's no way to extract files. So you can download files, you can set complex variables like this go, for example, and there are some other commands to wipe flash or clear SRAM. And a couple of others I haven't really reversed yet. So yeah, I basically made a Python wrapper or library for this to easily do this as I kind of needed this for the main attack we'll see later, but this is just some code that sets this go variable and then also uploads the file. And this on GitHub, I will also link it later in the end. So, okay, we can just upload Doom, right? Sure, yes, we can, but we will get a different screen. So go not authenticated. So now I properly set go to the file name that I actually uploaded, and of course, I guess it makes sense, applications need to be signed. So normally you're supposed to upload a .p7s file together with your .out executable file. And this p7s file is kind of like, yeah, it's an asymmetric signature. So there's a whole, I don't know the details, but there's a PKI system, some certificate chains in there. I think the idea is that you're supposed to get some sort of developer contract with Fairphone, such that you're able to sign applications, you get the right keys from them, then this device will allow you to run those applications. However, there's some funny logic happening. So once you do this upload of a file, immediately after you upload a file, it'll reboot, or if you're done uploading multiple files. And if it sees one of these p7s files, the signature files, the kernel will start verifying the signature, see if it is a valid signature over that executable. And if it is, it will actually remove the p7s file and generate a .sig file. And this .sig file, it turns out, it's completely unrelated to any private keys or PKI system, anything like that. This is just an HMAC using a key that's on the device itself. And then later, every time you actually want to run the application, it'll just verify the .sig file. So I'm thinking that this is done for efficiency reasons, I guess it's quicker to verify a symmetric HMAC than a symmetric signature file. But this is pseudocode, but this is kind of the logic in the kernel that these are really separate functions. So the verify p7s generates .sig. So these smart guys, I'm not sure if you can read it, I will link it in the end as well, from the payment village, the DEFCON payment village, they figured out that this is how it works. And of course, maybe you already can think of this, but if we can somehow call this generate .sig function on our binary without ever supplying p7s file, there will be a valid signature file. So there's code on the device itself that can generate valid .sig signature. So this will be kind of the goal from here on out. So what these guys also found were a couple of other interesting features, bugs, not in this device, but in a similar device from the same family, a little bit older, I think. So first thing they found, which was also on my device, is kind of a hidden shell. So there's no need to upload a program if there's already a hidden program on the device that has a valid signature, which basically sponsors shell on serial port. This is pretty fun. You can traverse the file system. You can even dump files, which was very useful for me. This was a way to get files out. But apart from that, it's still some application running in user land. It doesn't give us any extra privileges. It doesn't allow us to execute new code. So this was fun. And apparently this is also patched already. But yeah, not really useful for me. Another thing they found was a buffer overflow, and they might have found a couple more, but at least one in one of the sys calls, I think it was the open handler actually in the kernel. So that's much more interesting. But they actually tested a slightly different OS version, and I couldn't quickly get this to work or something easy for this as you have to actually exploit this. It's a lot of work. So I kind of went for the third thing they found, which was also present on this device, a hidden mode in the bootloader. And this is quite a sketchy thing. So this device has a bootloader that apparently has a hidden mode if you press three keys at the same time while powering it on. It'll go into a mode where it basically accepts data over serial. And if you set the right things, it'll load this data at an arbitrary user-specified location in memory before doing anything else. Well, we'll get into this a bit more later. So actually here. Okay. So this device has secure boots. I think this is also claimed by a manufacturer. So it has a couple of boot stages. Each one verifies or loads the next one, verifies it. If it's properly authenticated, it jumps to it. And this bootloader that I'm talking about here is called SBI. And this is the bootloader that basically the final bootloader, it loads the actual operating system and verifies it. And this is the bootloader that has this secret mode if you press the one, five, and nine keys. And so in this secret mode, it also uses this XTL protocol as I showed earlier to kind of load scripts. And I think this is supposed to be like a proper secure implementation where you send it a script. And these are scripts with very low-level commands, like write some bytes to NAND flash or this very low-level bootloader stuff. But these scripts are authenticated. And it's also using, again, some kind of PKI system. But if you don't specify a script, if you don't give it like it's an actual ASCII script, if you don't give it a script, but some magic value in the beginning, and then just an arbitrary long file with at this offset an address, then it will load your file at this address. Okay, cool. So, yeah, obviously this breaks secure boots. Yeah, so to summarize, we kind of have an arbitrary write or a write what were primitive that allows for code execution. So this is kind of the implication we can write to some place that execution will happen anyway, and then it's executing our code. So in my case, I'm just overriding the bootloader code while it is running. Then we have arbitrary code execution. And it breaks secure boot. And it's still present on many devices. So I got a couple from Markplatz, different sellers. Yeah, if you don't know what you're looking at, it's this SBI version, which is all the vulnerable version. So that was very useful for me. Yeah, and this is a way in for us towards Doom, because I had a plan. So remember this generate signature function in the kernel. So this is all the way when the device fully booted in the kernel. There's somewhere there's a function that if you call it, it will generate and make a valid signature file for any binary you want. We want to call that. But we have control over the bootloader. So my goal was kind of to follow the normal boot process while kind of keeping control such that I was able to call this function once the normal operating system was fully loaded. And this was a bit convoluted. So I hope this is all readable, but if you don't follow all the details, it's fine. So I kind of have a schematic here of the memory. All of the yellow is the bootloader. You can see a little red arrow. That's our current place where we're executing code. And so at this point, we're right inside this magic download mode. And what I do here, I just basically send it a copy of this SBI file with a couple of patches. One of these patches is right after, so that's stage zero. It's right after the Verix operating system is loaded and authenticated, but just before the bootloader jumps to it. And that's actually when we call stage one, which in a bit we'll see what it does. So loading and authenticating Verix always kind of looks like this. So at this address, 40 million or something, it'll put Verix. And this is actually not proper Verix. It is a compressed version with a little decompression routine in the beginning. But that's fine. So as you can see here, we're just before stage zero. So what happens when we execute stage zero? Well, it jumps to stage one. So we execute stage one, which then actually makes another patch. So it patches something inside this code that was just loaded. So it inserts a small patch called stage two inside the compressed version of Verix OS. So just before the compressed LCMA blob, but just after the decompression routine. Okay. So at some point, our modified version of SBI actually jumps into this hex 40 million or something address. And as you can see, we actually execute this clone functionality. So what it does, it clones itself basically to a much higher address and actually also transfers control flow there. And it does this such that it can then actually decompress back to this original address, which we see here. Stage two actually. Oh, this is just before stage two is executed. This is when decompress is executed. We can see that the normal decompressed version of Verix is on the right there. And then, so here we're just before stage two, we execute stage two. And this is what inserts the final actual thing we want to do, which is a patch inside the normal kernel image, the fully decompressed kernel image that calls that kernel function that generates the signature file for us. Okay. Cool. So now we can run our own code. But let's take a little step back. So how did I do this hello world? We need to actually supply an executable file. But how do we make one of these? Well, it has a specific format. So you might be familiar with elf. This is much, much simpler, luckily. And I didn't reverse engineer the full thing, but it's, yeah, we don't need to understand the full thing. There are some magic flags. So I took this shell.out that was already on the device as a nice example for my program. And it has all the things you might expect in an executable file header, like address of your main function, the start of the text segment or the equivalent, start of the data segment, and the stack size. And there's also a way to specify which system libraries should be loaded when it loads this application. And there's a system library called sys.lib, which is kind of the libc equivalent in Verix. Actually, not using that, but we'll see you later. So, yeah, this format seems pretty simple. We can deal with this. So to kind of build a quote unquote tool chain, this is why I put it in quotes before. It's just a hacky make file. I used a linker script, which was new technology for me, but it's pretty cool. You can kind of give the linker the script and it'll tell it how to arrange some stuff in the actual file and in memory at runtime. So you can give it a starting address and kind of the order of the sections. And this order then will also be followed in the elf file. So when you then turn the elf file into a raw binary with up your copy, you kind of get what you actually are saying in this linker script. So this is how I was able to get things in the right order that Verix expects. And then after making this just raw binary, I just concat this header file I took from this other binary and patch in the right sizes. Okay, cool. So we can now generate, we can take c code and make proper executables for this device. But what do we call? Well, we need to call some functionality that's in the kernel or we can call functionality that's in maybe this libc equivalent. But for some reason, I couldn't get that to work. Maybe there's some initialization functionality. I don't know. But to me, I was reversing the kernel code anyway, so it was easier to just call syscalls right away. And they're quite familiar. So you have, as I said, open, I think a syscall1, read syscall2. And it's just kind of what you would expect. Literally reading from the keypad is reading from slash dev slash console. Yeah, and there's also some public documentation of the functions in this sys.lib, but this gives a really good hint about the underlying syscalls. So that was quite useful as well. So now it was really a matter of engineering. So as you can see here, this is some hacky c code. Well, this is the proper, the only way to do it, but to actually do this syscall here, you can see the syscall instruction, but I wrote these wrapper functions for all of the syscalls. I might need such that I could just call it from c or c++ code. So now we can actually start porting doom. And this is where I want to give a demo. So let's see if everything works well. Let me quickly show my terminal, and then afterwards we can switch to the video. So the first thing I will do is start my script, which uses this Python xdl implementation I talked about earlier. And this script, I can zoom in more. This script will do two things. So it will send over the actual application. So this executable with the doom code inside. This is normal. There's nothing, there's no exploit there. We're just using the download functionality. And then after that's done, it will kind of pass us. And when I tell it to, basically, it will assume that we're in this secret bootloader mode and it will send this payload. And in the meantime, we will have to enter this bootloader mode. So I will trigger it. Now it's just waiting for the download mode to start. So if we can switch to this camera, perfect. So I kind of have a setup here to explain the situation.  There's actually ethernet port as you can't see. This is just a serial port. It's RJ45, but it's just serial. And then I have a serial to USB adapter here. And a button here. That's the main reason why this is a whole setup, because I need to cut the power, because this thing doesn't have an off button. So I will turn it on now. See my script is still running? Yeah. You should probably be able to see the screen in a bit. So this is it just normally turning on and my script triggered. So you can see here the cool thing is about this XDL protocol, there's also a command for sending a message on the screen. And with some form feeds and backslash R and stuff, you can actually delete all of the normal text that's on the screen and do some nice ASCII animation. So I made a progress bar. So this is just after every little chunk of the program it sends, it sets a new message on the screen. Okay, now we're just restarting. And then once it's restarted, we should see not doom yet, but this message that I had in the slides before. So now we have, I actually uploaded the binary and sent over the or set this environment variable, this go variable. So it actually found this go variable and tried to load the program, but it figured out that it was not authenticated. Okay, but this is what we have the exploit for. So I will cut the power, I will trigger the second stage or just the actual payload now. This is a bit tricky as I have to hold the right buttons. So it's one, two, or one, five, and nine, sorry, never done this upside down yet. So turning it on now, actually looking at my own screen. Okay, you can't see anything here because the boot loader doesn't do any I.O., but now we're actually uploading the payload. And now it's done. So now we're running the payload. So this is now going through all the stages I mentioned before. And the indicator that it's done is when the LCD turns on. So this is when, here we go. So now we know that it's done. And actually my code kind of freezes the operating system because I didn't properly, yeah, my patch is a bit messy, but it doesn't really matter as this signature file is now just stored on the file system. So we only need to do this once. So now I'm just cutting the power again. And now if we turn it back on, we just boot it normally, no weird key combination. And it's a bit slow to boot. And here we go. Doom. So let me get it to the right orientation. Okay, so it's actually already going through the demo. But we can actually start it. So yeah, the screen orientation is a bit annoying. So I actually mapped the buttons that way. So it makes sense. But not really if you're on the other side of the screen, but I will try my best. So we can start a new game. Let's do easy or medium. And then wait. Okay, so we can turn left. We can turn right. We can, wait, what is shooting? We can shoot. You get the idea. Okay. That's Doom. And then there's another demo I wanted to give. And I think we have some time left. So let's do that. And this, let me put this aside. So as I said, we can also do whatever we want, right? Why Doom? Why not just some other games? So I actually ported some other stuff. There's a couple more of these. All goes well. They should have power. Yeah, let's kind of... So one of these is running a Gameboy emulator. One of these is running a Game of Life implementation. Let's wait for them both to boot. Here you can see the Gameboy emulator. I didn't really do proper display scaling yet as the resolution is not a proper multiple of the 144 pixel width of a Gameboy emulator. But yeah, so there's no sound, sadly. It does have a beeper. It's kind of a PC speaker. I guess you could map some of the Gameboy sounds to that. But yeah, exercise for the watcher. What is my key mapping? Well, I guess you can believe that it works. And then here, this is actually my own code. I kind of promised running your own code. So I wrote some of my own code. This is using the touchscreen to play quote unquote Game of Life. So I can run it. It's just Game of Life. I can pause it again. Do some more stuff here. And well, the rest is just up to your imagination. Yeah, this is where I was out of time. Thank you. Are there any questions from the audience? If there are, please line up at the microphones in the middle and we'll take your questions. Unfortunately, we do not have any questions from the interwebs. So anyone in the room interested in any details of these wonderful hacks? I have a bonus if there are no questions. If you can switch back to the camera. Could we get the camera back, please? The suspense. If the colleague is second. Ah, cool. Thank you. Okay, so I said this is a whole family of Pharaophone devices. Well, this family is actually quite, oh wow, there's a lot of fingerprints. Sorry about that. This family kind of reaches to quite modern devices. So I have this device as well. It's a mobile one. So this has a battery pack inside. Turns out I will actually boot it now. It's running the same boot loader. It's just as slow. And the good thing is they fixed the screen orientation. Yeah, they made the viewing angle worse though. But you get the idea. Yeah, so I would say for sure if you're interested actually playing with this, I will leave some of this stuff here and we can see afterwards. I also have one device here that is kind of taken apart if you want to see the insights. Right. Any more questions? Any questions? While you think about those, please do not go down to the bar and hack the payment displays there to play around with you. So I checked with the Aachen people, even though I think it's not actually them responsible for this part, but the boot loader should be up to date. We have a question, please. Have you looked at the NFC interface? Well, not really, but this is for sure if you're interested in messing with smartcards. This is the perfect device for it. I'm not sure if there's anything specific about it, but yeah. So there's some functionality in the kernel, I guess what you're getting at that does some of the low-level logic in the smartcard interface, the contact and the NFC one. I guess this will also be interesting to audit for sure. But no, I haven't looked into it. Another question. Thank you very much. Have you taken a look at ROM boot loader? So many devices have several stages of boot loader the first boot loader being in ROM and unpatchable and some later layers can be patched with an update, but the first player can't be patched because it is physically in ROM and you can't change it without replacing the device. Yeah, so I only looked at this boot loader and only because these guys from the Dev Compayment Village found this vulnerability in this second stage boot loader. Actually, I think this is the third stage, but I'm assuming the S and SPI stands for second stage. No, so I did not audit anything besides that, so for sure, if you find a vulnerability in the actual ROM code, yeah, that's a much bigger issue with these devices. Do we have any questions from the interwebs? No, okay. Any further questions from the audience? Last chance. Anybody? No. Well, if not, please enjoy the evening and before you go, give a very warm applause to Thomas Rinsma and Payment Thomas as General Personal Game and Computer.


Alright? Any questions? Where are we? Oh, we're starting to do no questions. We're okay? Yeah? Alright. We, for those of you that have been in physics one, we hit this sum. We're going to do it a little bit differently. This time so it works. Hopefully it works better. Because we're going to do much more involved problems than we did before. Ultimately we're going to have three ways that we solve kinetics problems. We've done one and we're ready now for the second. Each of the three, and this is no different than it was in physics one, each of the three are a little bit better at solving certain types of problems than the others are. The first one we had for solving kinetics problems is simply f equals m a. That works very well for general problems. You have the acceleration. You need to find the forces to ensure that acceleration. You have the forces. You need to figure out what the resultant acceleration is. Those types of things are other general problems. The second one that we're going to get on today is the work energy equation. We're going to hit this one right from the start in its full form and use it right from there. I think that would be a good way for us to be able to get into some fairly complicated looking problems that if we're controlled and disciplined about doing this become very easy problems. We'll see exactly one of those today. This is very good for position dependent type problems wherein something very much depends upon the position and the problem. This is quite true with things like friction that can very easily change at a certain place in a problem. Also has to do with spring since the forces they exert depend very much on the position of the object when in relationship to the spring. It can also handle the general problem where forces themselves change with position as they often do. The third method we'll use is the impulse momentum equation. That works real well for time dependent problems as we'll see when we get there. Same three general solutions for kinetics problems that we looked at in physics one. We're going to then revisit these near the end of the term when we redo all of this stuff we've been doing for rigid body motion. We're going to take that a step farther than we did in physics one as well. Let's lay out the work energy equation. It's a little bit different in the notation it used with this book than the book we used in physics one and for you other guys one you sought. I'm not sure what it looked like. So we'll stick with the notation that's in this book and just be okay with that. I've got a little bit of a change with it in the way I do it just to I think makes it a little bit more rigorous. But the work energy equation itself looks like this. That first term is the work. When we do work on something we can change its potential energy. We'll come back to each of these pieces one by one. Change its potential energy. We can change its, our book uses a V here. Sorry. We can change its height or we can stretch or squish a spring. We'll call that E for elastic media. For our purposes those are the only things we're going to look at. These are all mechanical energy terms of some time and there are certainly other types of changes that can happen but we're going to stick with these. So the first one we'll look at is the term, this is sort of the input to the problem. These are things that can come from the outside. These are, this is work done by applied forces. The best term for this is what we call non-conservative forces. We use a U here because if we used a W for work then it would look like a W for weight and it would be confusing. Defined as, not every book uses this subscript 1, 2. This implies to us it only occurs when there's movement between two points. They could be the same point. It could be that we come back to where we started but there's got to be some kind of change in position. There's no such thing as a definition of work at a single point. It's only moving from one point to another. So that's why I like to use this subscript there that it reminds us that we've got to be actually doing something, doing somewhere with this. No such thing as work at a single point. So the definition if you remember in its full and general form is something like this. As we go from one place to another, so I'll use S for a general position and this can be 1D or 2D, it doesn't matter. The net force being applied to the object as a vector dotted with our position vector, in this case we'll use the differential elemental form because that allows us the possibility that as position changes the force changes as well. That can be a change in the direction or the magnitude or both as we do that. So that's the full and general form of our definition of work. For a special case just to see what it looks like for constant force, then that comes out of the integral. We're just integrating a dot in there. That's just simply an operation. Remember. And the integral of dS becomes delta S. So if the force is constant, it turns out to be simply the force being applied over a certain distance. This kind of makes sense. It has good common everyday sense. You apply a little force for a very long way. You could be doing as much work as a big force for a very short distance. So those make some pretty good sense. It is very important to us that we recognize the utility of this dot product in the setup of the problem and the definition of the work. Easiest way to show that is imagine pushing some object across the floor some certain distance and doing so with a force like that. The dot product gives us the fact that it's only the component of the force in the direction of the motion that's doing any work. The dot product will do that for us automatically. The component of the force perpendicular to the work does no work because there's no motion in that direction delta Y in the direction of the Y force does no work. It does not mean that this has nothing to do with the problem. If you remember the applied downward force can increase the normal force on an object, you increase the normal force on an object, you increase the friction on an object and friction is most definitely one of these non conservative applied forces. So don't think that FY doesn't have any play in it. It does. It just doesn't have any direct contribution to the work. Sound familiar so far? A little bit? Have you seen this before? Maybe not in this precise form but something like it. Can I have you too? This term non conservative work this tells us what forces we can actually put in here. There are other forces in the problem but they don't all go into this part of the calculation. Non conservative forces are those forces that if we turn the problem around we don't get back what we've lost to those forces or what we can't recover the work done by those forces if we turn the problem around. This example is friction. You push something across the floor, you work against friction the entire way. You turn around and push it back, you double the amount of work you had to do against friction. You don't get that back and return to a zero point. There's still all the abrasion that went on, all the heat that was generated and you don't get any of that back. You cannot return to your original situation with non conservative forces. So we'll do some problems applying this work as we go but let's remind ourselves what each of the four terms are and how to deal with them. Of course the units on this, the force times distance, so the units are Newton meters. When talking about work and energy type problems we define one Newton meter of work or energy as a jewel. I don't find any great utility in finishing a problem like this. If you finish it with Newton meters just leave it there. But it is certainly a viable and well used unit for these type of problems. So that's the work term. It works very nicely if there's a position dependence upon force as we'll see in some of the problems. The second term is the kinetic energy term. It simply means if we do work on an object, we could change its speed. If we do positive work, we can increase its speed. If we do negative work, which is what friction does, because friction is always against the direction of motion. If we do negative work we can slow something down. We can have both going on at once so we'll see this term in all kinds of different ways. The units, the masses, kilograms, velocity squared, velocity, there's velocity squared. What are those units in more, perhaps more familiar terms? If we take kilogram meters, just one of the meters, but both seconds and rearrange them to look like that, same units just rearranged. That first term is a Newton and we have exactly the same units as we had for the work term, which we must or they wouldn't be equal. So we're going to find that all four of these have exactly the same units. If we're in English units we have pound-foot, more commonly said foot-pounds, but we have those very same units. Now every year I go over this. I find it necessary to do this even though I will have a few of you who will neglect to pay attention to this fact failure. I'll put it down here. v2 squared minus v1 squared, which we need for the kinetic energy term is not equal to v2 minus v1 quantity squared.  Jay, somebody in here, might as well volunteer now is going to try to do this. Nobody's volunteering? Frank, you're volunteering? No? Pay attention to that. That isn't even a legitimate physics one mistake. You might as well tell us a second year dynamics mistake. Alright, so so far we've got the possibility if we do some work on something we can change its speed. All these pieces are developed in the book and I don't see any great need to to repeat that. So I think it's a lot more instructed if we get to some problems we wouldn't get to otherwise if we'd be able to do all the development of each of these pieces. So the next piece is the delta vg, the gravitational, that's the g, potential energy. Our book uses a v. Why but it does, it's easy enough. Perhaps you're more familiar with this than even magnetic energy term. This just relates to us the possibility that we might have a change in elevation in the presence of a gravitational field. If there's no gravitational field then delta h is meaningless. If there is then it applies as written. Remember here that this is not a distance traveled by the object. It's simply a change in elevation in the direction of the gravitational field. So if we have some mass we raise up to some height delta h has the same change in gravitational potential energy as an object that goes a greater distance but still only goes up the same height in the in the direction of the gravitational field. And this all depends upon the implication that gravity is straight down. So we don't have to worry about any of the distance it travels just simply its increase in height. If we have a decrease in height then that of course that delta vg would be negative. And once again the units the kilograms meters per second squared times meters for the height well this first piece here. So once again we get new meters or joules for the units. As they should be we can't add one thing with one unit to something with different units. All of these must have the same units. So those usually look pretty familiar to most students. The other one I've always had trouble with the way the books do it because I think they set it up for more errors than need be. So we'll revisit it in a much better way which of course is my fault. This is the elastic potential and the fact that we may have in the problem a spring. Springs can store energy. They can accumulate it. They can disperse it and we have to take into account that fact. The slight bit of complication is the fact that springs can be stretched and store energy or they can be compressed and store energy. It's not a one way thing like it is with the gravitational potential energy. It's a two way thing. Sorry. That's why it's a conservative force. If you pull a spring out then let it return back to where it was before your release in terms of the spring in exactly the same place you were. Other terms the fact that you had to put your chin there and do that or there might be friction those kind of terms are always over here. It depends upon the strength of the spring. So this term is known as the spring strength or spring modulus or spring constant. Any of those terms are all fine. Remember that tells you how much strength this spring can exert once it's been either stretched or squished which we take into account with that second term there. The trouble I find with most of the other books and I believe ours is one that does it, they very often put an X in here which I think is confusing because there could be an X in the problem, a position in the problem labeled X that is different than the X that goes here on the spring equation. That term del is the difference in the spring from its rest length. But any time in the problem it could have length L which is greater than say its rest length so del would be positive. The length of the problem could be, the spring could be also squished some so L is less than its rest length. But once we square that it doesn't matter whether it's positive or negative which just shows us the spring can store energy whether stretched or compressed. This rest length that's the length of the spring as it comes out of the box after you went to K's hardware and got it from Earl. Be right there sitting there right in the box. And the K is also something determined by the manufacturer of the spring. It has to do with how tightly wound it is, how thick the wire is and what material it's made of. Remember the units on K are? No units on one half. It's what? Newtons per meter. It tells us to stretch a spring one meter. How many newtons must we exert on it to do that? If we need to squish the spring one meter, how many newtons must we push to do that? And then del squared of course is a length term so this has units of, that has units of one meter squared so again we have units of newtons meters. That's it. That's the work energy equation. I think all of the other stuff that goes into it is interesting. More so the physics students generally than engineering students, engineering students usually like to get to work on things rather than look at all the background theory and development to get to some place. That's why we're engineers. We have work to do. So let's do, let's set up a problem. It might be the type of thing you'd have to do if you're designing warehouses for UPS. Imagine a crate of somebody's shipment being delivered from the back of a truck into the warehouse or something. It needs to slide down a ramp. You don't want it to damage itself when it gets there so you develop some kind of bumper system to cushion the impact of the box when it gets to the bottom. Put some numbers on this. Let's say that's 23 degrees, 8 kilograms, flesh, coefficient of friction of 0.24 frame constant of 121 Newton per meter. And you want to determine by how much the spring will squish. If it's too much then the box might go ahead and hit the wall anyway. If it's too little then maybe the spring's not really doing as much cushioning as it should. Oh yeah that's in there too. 3.2 meters to the initial contact point with the spring. Fairly simple set, fairly simple problem. But if you just start throwing everything into the work energy equation it's going to be prohibitively difficult to. So if you want to do that just start throwing the things in and ignore me. Go ahead. If you rather fall along I'll show you just how easy it can be to use this equation especially on a problem like this. I've seen this type of problem. I remember trying to do it. You get lost in the units, the mathematics, and the amount of minus signs. So here's our first step. Go through any of the four terms and determine if any of them are zero. If so we're already at a smaller problem and things are getting easier. Is there any work being done by non-conservative forces? Is anybody reaching in and pushing or pulling or shoving in any way? We have friction in this problem. That's the classic non-conservative force. There's no way we can let this slide down the hill, push it back up the hill and get back what we lost to friction. So there's definitely some work being done that we have to keep in there. Is there any change in speed? Well of course there is. It's just sitting here at a rest. Then it slides down the ramp and then it comes into the bumper and is brought to a stop. That's not the concern here though. The concern is is there any change in speed from the initial point compared to the last point? We don't care what happened in between. So this is our first point and this down here is our second point. Is there any difference in the speed between those two points? If there's not, that's all we care about. We don't care about anything else. So in this case we can already make the problems 25% smaller by getting rid of that term. Since V1 it started from rest, it finishes at rest. It doesn't matter what else it did in between. We term something like that a point function. Anything that only depends upon the end points, we call a point function. The work term is a path function because it depends on where we go. The farther we go, the different surfaces we go over, all of those increase the work being done. The third term, very simply, is there any change in altitude? Of course there is. Start it up the ramp, finish at the bottom of the ramp. Is there any change in the length of a spring in the problem? Of course there is. It was at rest to start with compressed at the finish. We want to find what happens when the spring, the box brings that spring all the way to its point of compression. Alright. Now that we've made the problem 25% smaller, go back and do each one of these one at a time. Paying attention to the units and the minus signs at this time. Because now it's a very easy thing to do. The problem is really small. It's not too big a deal. Alright. Any work being done by non-conservative forces? Yeah, we have the friction. Non-conservative work. There's no work being done by the normal force. Why not? No movement in the direction of the normal force. Is there any work being done by the weight? Only movement in the direction of weight. However, what, Jake? That term is taken care of over here. That's conservative work. If we let it fall down and then we bring it back up to where it was, the weight is still the same. Gravity is still the same. There's been no change in the problem in that way. We have to do the work to do that. So the only friction, force we have is friction. It's in the opposite direction of the motion. That's why we have a minus sign. If we did the dot product on the vectors of this, it would give us just exactly that. If you remember, friction is the coefficient times the normal force. And the normal force equal to that component of the weight. That component of the weight in the y direction. What was he saying? Signing a cosine of 23. That angle between the normal and the weight is always the same as the incline. So this is cosine 23. Do we have all of those values? Now hang on. A lot of people working real hard here and I don't think you've got the whole thing in mind here. What is delta x? We've got all these other pieces. Coefficient and friction is 0.24. The weight is 8 kilograms times 9.81 meters per second squared.  What is delta x? 3.2 meters? Not quite. No? No? Plus delta. The amount of the spring squishes. That's why I don't like using that for squishing. That's in meters. So if we carry this calculation all the way through, which we will, we've already ascertained that the delta we're looking for will be in meters. We've got to watch this as we go along. So what's that equal to? That's just a quick calculator of business for us. Use it down to its farthest point. We've got kilograms of meters. We've got units of Newton meters as we should. Let's make all of these terms in Newton meters. Get the units right when we've got just a small problem. This is very easy to do so far. Term plus 1 something times del. Jake you've got it 5.5 or minus del. And we know that all of them have units of Newton meters if del is in meters. Everybody not get that? Are we getting different? We'll do the second term. Delta VG, MG, delta H. What's this term? We have 1 meters per second squared. And delta H is, what's delta H? It's, what'd you say? 3.2 plus del. Plus del times the sign of 23 going down. We need to take care of all the units and the minus signs at one time. So this term also has a delta H in it. When we put all those pieces together you should get, and your sign 23. You've got it? Okay. 9.81 minus what? 30.7. Yep. And we know that's in Newton meters and again it's determined that del itself must be in meters. So keep track of each of these pieces. Little problems one at a time. Let's see. Number two was plus 17.3 del. Alex just gave us, take care of all these things as we go. So the last part, del one is zero. Spring was at rest while the box was at the top of the slope. We'll have units of meters that will give us Newton meters. And so what's that plan? 21 is 60.5. You might have? Yep, we did. Those two are on the same side so we can add those directly together and we can bring this over and we get a simple quadratic in del. Good looks something. Let me look at the calculator. 60.5 del squared. That's the only term we have with the del squared in it. Then remember this is a negative but it's on the other side. So it's 98.1 minus 98.1 plus 55.5 which is like 42.6 but it'll be minus. Minus 30.7 del plus because we'll bring it over 17.3, 13.4. That's a pretty easy problem to solve. If you put everything into here you wouldn't have an easy problem to solve. This is a very easy problem to solve. Some of you even have a quadratic equation solver on your calculator and make it really easy. You'll see if this quadratic actually works out. Look around for it online there's a connector that allows you to download stuff to your calculator online which they have in the math lab I think if we don't have them here I think we have a couple of the plugs here. If not, you can use the quadratic equation solver B plus or minus find out where it equals zero same thing. The value equals here. Does anybody else get that? If it turned out that there were no real roots under the square it was negative what would that mean if there were no real roots to this equation? It would mean with this friction the box actually gets to this frame and there's no real solution to it which is certainly a possibility but that would show itself as non real roots. Were there two roots? I would assume so. Actually it's the negative root because we're talking about spring squish where they probably weren't the same. The positive root I think would be if we squish the spring this much and then let it go the spring would extend to that much as the problem was trying to reverse itself. I think I'm not positive that's what that would happen. But the point being if you do each of the sections one at a time watch your units, watch your non-assigns you end up with a very, very easy problem to solve. If you put everything into there all of this stuff into there first thing you're going to stop worrying about is your units you're not going to put those up there anymore so you could screw those up you're also going to lose minus signs we didn't have to worry about this minus sign but the other way around if this was zero and this wasn't it's very easy to lose that minus sign so I very highly recommend you do this problem each little piece at a time as you go through it it makes it an awful lot simpler. That's extremely easy to solve for you guys. Now if you want to, as an exercise put all of them in there and just make sure you can do it accidently can happen I think for many of us doing it. Alright, ready for one of your own? Energy equation so when you start to solve these that's the first thing you should write down is the work energy equation see if any of the parts disappear and we have an easier problem. Here's a smooth shaft spring there down here at the bottom is a smooth collar that can slide on that shaft attached to the middle of that collar and its height is 25 millimeters that's to that is a cable that runs up this right level with the spring 25 millimeters which is 200 newtons spring stiffness how big a spring do you need to go down to Earl and buy so that the amount of spring is squished as you pull on this force it's going to hit the spring we need to limit del to 75 millimeters now I would suspect sounds like a nasty and complicated problem break it into pieces that aren't so nasty and complicated checking your units checking your minus signs as you go looks like a big problem huh first thing you do is go over that if any of those parts disappear if they do the problem is already smaller the problem is smaller all the better yes a little bit of trouble then go on to one of the other ones for a bit just to get in there got the force is 200 starts from rest at the bottom engine kinetic energy zero certainly it picks up speed but then it loses it again once it hits the spring all we care about is the start compared to the finish between point A and point D is all we care about any other parts that are zero outside force is being applied the collar doesn't move in the x direction if by x direction I assume you mean the direction of the force does not move in sideways no what work is being done by that force look at that force force doing some work to figure out how much force that work is doing the change in those energy terms that we're interested in change in height we've got M, we've got G what's delta H that's the only thing changing height technically the spring the center of mass goes up a little bit as the spring compresses but we're not going to mess with that we're not going to worry about that the collar will go up a certain height just how far the center of it will go up to 450 so it's going to finish right level with V on it because 75 millimeters of the collar is above that center point and that's how much spring squish work is going to allow so the collar is going to finish with its center right level so how much I did it actually game 450 plus 75 which is how much if you have something that speaks up all I can do is these little mumbles and then I have to keep asking for you to repeat thank you so now you're mumbling again oh boy isn't that big news hairline is going back hair is turning white I heard it all the time and I've got to hear from you when I'm getting home do the units work out is there a minus sign and so what's that come to be 6,000 millimeters a little bit of geometry work on that one but basically we got that the K we don't know that I know it's going to come into the equation for us to find it let's see del 1 is 0 and del 2 is the limit of 75 millimeters if K is in newtons per meter this will have units of newtons meters what's 0.057 squared 0028 1 and that happens in there as well centimeters if K is in newtons per meter itself we already worked out the units of K we're reducing this down to a very simple equation with a single unknown so that's the right hand side all set 0.1 so that integral will work out that way then all it depends upon is what's that delta s is it this distance that the collar moves trouble with that is if we do it by that the force on the collar changes it's first here then it's there its angle is changing all the time the dot product is going to change all the time the integral of that I think would be kind of nasty to do is there an easy way to figure out what work was done by the force the way to do it is to figure out how far that force actually moved itself in its own direction a force being applied in that direction if it moves in that direction that's got to be how much work it does isn't that this distance minus that distance is how much of the cable was actually pulled over the force would move that far in that direction just 200 newtons what is this distance 225 squared 450 squared actually 450 plus the little bit extra what is this distance 583 so in meters do you use the 5 to the when you're doing that do you use the 5 to the 450 well it depends on your right triangle is right there on whatever the right triangle is 225 across the top across the bottom it's 450 plus the 75 572 572 that's millimeters so we'll turn it to meters we want the units to work out here but it ends up with still the 225 over there that will give us units of newton meters what's that come out to be then how much path 69.35 meters close enough 69.3 the whole equation all the units checked all the minus signs checked now you've got a really simple little equation to solve for one single unknown and you already know the units are going to work out because they had to back here to give you newton meters in this 61 is 332 divided by 0.0281 right just because they had to here to give us newton meters in that equation that again is a pretty simple little equation to solve you put everything in there all at once you're going to miss unit signs units squares that's the other thing that goes very easily under pressure I think Wednesday will be ready for even harder problems


Several months ago now, we had Gary Chardier on the show to talk about the corporation problem in libertarian thought. As an actual historical phenomenon, the modern corporation was a direct outgrowth of medieval kingship. Over the early modern centuries, monarchs broke up their bodies of special powers and privileges to distribute them for a price to their most favored totes. After the revolution, congress and state legislatures usurped the monarch's role. By democratizing the corporation, our early libertarian loco-focos began a long process by which we came to positively identify ourselves as part of the modern capitalist class. Capitalism seems to include space for you and me, just as much as Bill Gates or Warren Buffett, but maybe we need to go back to that actual historical phenomenon before we go around making it part of our identity or endorsing the modern economy. To do this and more, I've invited Kevin Carson to join us, a self-described anarchist without adjectives. Welcome to Liberty Chronicles, a project of Libertarianism.org. I'm Anthony Comegna. So my first question to you was going to be to give us a definition for capitalism, and especially because I know that you're concerned with rooting our definitions of capitalism in the actual historical development of capitalism. So could you go ahead and start us off there? When I refer to capitalism, I'm referring to the actual historical system that's succeeded feudalism five or six hundred years ago, and not to any kind of idealized or normative free market system. And I see the defining features of capitalism as including a very high degree of state involvement on behalf of the property classes with the state acting in many cases as an agent of the property classes. Capitalism was founded on large scale robbery, enclosure and expropriation of land, imperial conquest of foreign resources, enslavement, state repression of the laboring classes and legal prohibitions against freedom of association and movement by them. That's basically it. I mean, in some sense, that makes capitalism sound like everything that's wrong with modernity. What is the essential feature of capitalism that makes it different from those earlier pre-modern economic systems? Well, the dominance of the cash nexus is probably the main thing that distinguishes it from feudalism and the dispossession of the laboring classes from actual occupancy of the means of production. I think Marx put it as the freedom of the working classes, both from obligation to their employer and from ownership of the means of production, turning them into propertyless market agents who were forced to sell their labor on the boss's terms in order to survive. Would you really mark enclosure in a place like early modern England as the origins of capitalism? That and the predominance of the cash nexus and place of direct production for use. We recently talked to Nima Sanandaji, who is an Iranian-curd historian, and he treats capitalism or entrepreneurship free markets in a very broad sense as something that's a fundamental component of civilization throughout world history. But then there are of course these historians who treat it as a sort of singularly modern phenomenon with a definite origin point. And I think in part at least that's because that's how Marx wanted to talk about it when he really invented the term. Could you take us back to just the history of the use of the word capitalism to describe the culture of exploitation or expropriation that Marx was trying to describe? Well, I'm not really a scholar of the history of the term, but from what I've been able to gather it was the term capitalism was first coined by anti-capitalist radicals in the early to mid 19th century in reference to the actually existing system they lived under. And by the late 19th century it was being used in some cases as synonymous with Marx's, with Marx's, I'm sorry, with markets. There were some individualist radicals in the Boston Anarchist group in the United States who seemed to oscillate quite a bit between considering themselves socialists or anti-capitalists and referring to their position as capitalist anarchism, just depending on the context or who they were debating with. I think Volterine DeClaire wrote a piece on a debate between a capitalist anarchist and a communist anarchist where she was using capitalist anarchist in reference to the same Tuckerite position that Benjamin Tucker himself had considered socialistic. And then by the early 20th century, when von Mises was writing, he used capitalism unambiguously as the idealized system he was advocating, I think is a sort of in-your-face attempt at recuperating the term from its enemies. And Ein Rand followed suit. Now this does get me to my next point, which is that I find it very interesting that my favorite documents or some of my favorite historical documents from the 19th century are from both the most libertarian people you could ever encounter from the time period and they are visceral anti-capitalists and they are condemning the exact kinds of historical phenomenon that you've been talking about and the conflation of concepts that you've been pointing out here. And it prompts me to ask you the question, can you describe your concept or term vulgar libertarianism for us? It's a lot like what Marx referred to as vulgar political economy when the industrial capitalists supplanted the wig-landed oligarchy as the primary political power in Great Britain, a political economy which had been a fairly radical and anti-establishment doctrine when Smith and Ricardo were writing. It was critical of the landed interests and mercantilism and so forth shifted gears into a defensive or apologetic mode on behalf of industrial capital. Acting, you know, as Marx said, as hired prize fighters on behalf of the ruling class and that's what I see vulgar libertarianism as today there were major currents of classical liberalism in the 19th century that were radical or anti-anti-capitalist, you know, including Thomas Hodgskine and Great Britain, the individual anarchists in the United States, Henry George and so forth. But by the late 19th century the bulk of the movement or the mainstream of the movement had shifted into defending the interests of industrial capital and today mainstream libertarianism uses the rhetoric of the free market in order to defend big business against criticism. We see articles written in defense of sweatshop labor saying that sweatshops are good because they're the best available option for the people who work there and they completely ignore the fact that the options are deliberately restricted by the state acting in collusion with employers. So they're defending actually existing capitalism as if it were a free market. It strikes me that all sorts of people are vulgar versions of whatever their ideological group is, at least to the extent that people have membership in some ideological group. And I think that has something to do with what purpose history serves for us. For most people it seems to be the purpose of history of learning it and studying it, caring about it is to confirm your biases, whatever they might be. Even libertarians do that all the time. You end up defending what you like about the status quo, the world that you inherited however it is. And rather than embracing a sort of totally hands-off libertarian futurism where you just say I'm not going to try to shape and control the future, people get wound up in protecting what they feel like they already have. I mean I wonder if you could comment on what you think our study or understanding of history has contributed to vulgar libertarianism? I'm not sure to be honest. It's something I've not thought of a lot, although I remember reading a passage in Human Action where Mises admitted that the enclosures were bad things and that they were unjust but framed the capitalists as the good guys by offering employment to all of these dispossessed peasants and saving them from starvation. And he argued that the capitalist employers were just basically master tradesmen who had been unusually frugal and productive and saved up their income to invest in industry and expand it. So there's some, I guess you'd say, unrealistic or falsified view of history in that case because that was obviously not actually correct. But as far as the question goes of whether there's any consistent or comprehensive vulgar libertarian view of history, it's not something I really thought of a lot. I think most of the people I've encountered just ignore the question of history altogether. They treat capitalism as a system that's axiomatic or self-evident or a universal set of rules of human behavior rather than a system with a historical beginning and end or ongoing laws of motion. Now you know, that brings up another interesting thought to me. It strikes me that one of the biggest drawbacks of thinking in this vulgar libertarian fashion is that you forget that there were ever alternatives available to people. The way that we live now or the way that we're used to living is the only way that was ever reasonable or good or just or whatever and that there probably weren't any better alternatives available to people otherwise they would have taken them. But of course that's not true and to me a great example of this is pirate ships in the golden age of Atlantic piracy where people ship by ship were literally revolutionizing society on the ship and creating their new micro societies and micro civilizations that floated around the world and the great empires of the day had to all get together and prosecute an international war against pirates to clear them out because they were such a threat to international trade under corporations and insurance companies were being hit and the navies were having to pay a lot to defend from pirates and they were a serious threat to the global status quo of massive empires. And if we see ourselves identifying more with the merchant and the imperialist side of that divide that spells big problems because we forget that there are all sorts of ways for people to live more freely. I wonder if you could give us some examples of maybe alternative social structures out there that really are available as historical examples but we just don't give enough time to them. Well I think they've only existed you know for the most part since the rise of the most of the first states and the most marginal areas outside of state control and the dominant trend in history has been for those kinds of alternatives to be deliberately suppressed in order to prevent any kind of competition from existing that would weaken the ability of ruling classes to exploit and to the extent that these systems have existed you know again they've mostly been marginal and ephemeral but they generally fit the pattern that David Graber or not David Graber James C Scott referred to as a Zomian non-state spaces in areas that are not amenable to control marshlands, mountainous areas and so forth. You know the classic example would be Israel under the judges which I think was originally a Zomian type population of runaway peasants and debtors and slaves from the Canaanite lowlands who settled in the central highlands of Palestine and formed a tribal confederation with laws deliberately designed to keep a landed or moneyed ruling class from ever arising again. And other examples are the kinds of things you described the various pirate utopias, Zomian societies on the edge of American society like amalgamations of Native American tribes and runaway slaves and runaway white debtors and indentured servants forming communities in the backwaters of the American southeast or the Cossacks on the frontiers of imperial Russia so forth the traveling people like the British travelers the Romani and so forth. A lot of these sorts of examples that libertarians might point to or that they really like pointing to strike back to the pre-modern world and I mean on the one hand that tells us well you know one of the key features of modernity is the rise of the modern state this massive totally new sort of institution that's able to control more about people's lives than you know pharaohs of old were ever able to right it's ability to intrude on the average person's life is so much greater than before. So then why are we so antagonistic sometimes to other ideas that stretch back to the same sort of time period and I what might be a controversial controversial question for you which is if you could address the labor theory of value and your sort of economic philosophy of mutualism and where do you think that fits into the broader libertarian tradition. Okay before I do that could I go back to the previous question because I think I like that whole important facet of that things that are going on in the present day within the interstices of capitalism like the new municipalist movements and in Spanish cities created by post-M15 activists and Barcelona and Madrid and so forth and other European cities as well and Jackson, Mississippi and the United States, the Cleveland evergreen initiatives and all these different interstitial attempts at building counter institutions they're things I think that are coalescing together and forming the kernel of a post capitalist system as the existing system decays they're also contemporary systems on the on the Zomian pattern like the Kurdish Rojava experiment but anyway to answer your your last question to be honest I don't really consider myself a mutualist or at least I don't identify primarily as a mutualist or market anarchist these days I usually call myself an anarchist without adjectives but I can see that mutualism as a philosophy it's the name itself is is identified with Proudhon with his emphasis on mutuality or reciprocity as basic organizing principles of society but when I called myself a mutualist when I wrote the book on mutualist political economy the primary concrete economics I had in mind were those of radical or socialistic classical liberals like Thomas Hodgkin the American individualists and Franz Oppenheimer the uniting idea was that the defining feature of modern capitalism is state intervention to enforce artificial scarcities and artificial property rights of various sorts that enable monopoly rent returns on the ownership of land capital and so on as well as more recent forms of state intervention to socialize the operating costs of big business to suppress competition and so forth and that if you abolished all of these state enforcement monopolies and all of these artificial scarcities market competition would destroy rent and profit and interest for the most part and result in and labor receiving the full value of its product as a wage now do you see moving to the subject of a post capitalism that we might be opening on do you see that happening right now I do I think you know as I said before capitalism is a historic system with a beginning and an end and there are a lot of a lot of crisis tendencies going on right now that indicate the system has reached its limits and it's in the process of decay and I mean it seems to me that especially with some of the radical new production technologies where you can produce things in your home in ways that you could not before and especially with you know 10 20 years of more research and development who knows what sort of a world we'll be living in but it seems like there will be a much smaller role for concentrated capital if people can create so many things cheaply on their own or share things cheaply on their own yeah big influence on me has been the in the last few years has been the autonomous Marxist especially the the most recent writers like Nick Dyer with the Ferd and Negri and Hart and their idea is that the production process is becoming less something where the means of production are owned by capitalists and Morse the sort of thing where the production process is becoming co extensive with society as a whole with the social factory and the main source of productivity is human relationships and social capital and the model they promote is exodus where workers basically pick up their social capital and vote with their feet and cut the capitalists out as superfluous parasites from the social economy that's already in process of affirmation they don't really these writers don't really address very much from what I've seen the cheapening or a femoralization of physical production technology or the ability to produce ability to produce directly for use within the social economy or within the commons though that is something Massimo de Angelis excuse me has written about in his work on the commons also I think another thing that's really influenced me a lot is the framework of Michelle Bowens at the foundation for peer-to-peer alternatives he argues that there are two major crisis tendencies in late capitalism until until the present capitalist business models and rent extraction have depended on the artificial abundance of material resources that have been looted and enclosed with the help of the state so that they're able to pursue a growth model based on extensive addition of material inputs rather than more intensively or efficiently using existing inputs and that depends on free access to these looted resources and the other thing capitalism has depended on is artificial scarcity of information through intellectual property laws and so forth and it's become even more dependent on these things in recent years as the means of production become cheaper and smaller in scale because the means of production themselves are becoming more amenable to small scale ownership by individuals or small groups and so forth I think a garage shop using tabletop CNC machine tools could probably open source tools could probably produce a lot of the goods the previously required a million dollar factory with a set of machinery equivalent to a scaled blue collar workers wages for six months so capitalism depends increasingly on not capitalist ownership of the means of production but in legal monopolies over the right to produce like like patents and Bowen's argued that both of these pillars of capitalism are becoming eroded in the case of artificial abundance of material resources it's through peak resource crises of various sorts like peak oil the fiscal crisis of the state and it's its inability to continue providing subsidies on the scale that are required and so on and in the case of information the growing unenforceable unenforceability of intellectual property law so that the state is no longer able to prevent people from producing directly for themselves in the common just going to an industrial equivalent of the pirate bay and downloading CAD files to produce stuff in the garage factories you know that the capitalism has reached the limits of its ability to grow and is in process of decay and again as it's decaying we've got all these things growing up in the interstices to handle the pressures that are put on people by precarity and the collapse of the welfare state and so forth like we see with the commons based municipal movements in Barcelona and Madrid and they're they're the seeds of a post capitalist system that are coalescing together Kevin Carson holds the Carl Hess chair in social theory at the center for a stateless society where he's also a senior fellow some of his latest books include the home brew industrial revolution organization theory and the desktop regulatory state his current project is exodus general idea of the revolution in the 21st century liberty chronicles is a project of libertarianism.org is produced by test terrible if you've enjoyed this episode of liberty chronicles please rate review and subscribe to us on itunes for more information on liberty chronicles visit libertarianism.org