Up on stage, we have a returning goon who wants to demystify some vulnerabilities and why they're mystifying. I don't know. I don't understand the words in front of me, but reverse engineering the eternal exploits. Who's excited about this? I see the room is getting pretty packed. Life! There's people alive in here. That's wonderful. Alright, with no further delay, I'm going to hand it over to zero sum, zero x zero. Thanks everyone for coming. So from a show of hands, how many people pop the shell with MS1710 over the past year and a half? Yeah. How many people are finding it everywhere, right? How many people helped with WannaCry and Netpatch and the cleanups of those, right? Yeah, yeah. It's like I said, it's been a year and a half since they got introduced. We're still finding them everywhere on our red team. It's a path to glory on our pen test. Before I do get started, this is top secret information classified on, we don't know exactly what it is, but it's allegedly from the NSA, stolen from the NSA. So if you have a clearance, Francis CKRS, it was at DerbyCon last year. He gave a talk on dander spritz and he gave a disclaimer, so I thought I would give one too. So everyone leaving the room right now is a fed, and you should keep track of their names.  So I did have to cut a lot from this presentation that I wanted to go over just because of time. The goon probably will hook me off stage in a little bit here, but hopefully we can get through it. So if anyone's not aware, the Equation Group is the tailored access operations former department at the NSA that wrote a bunch of exploits. And they've never really gotten a lot of public credit, but just like hacker to hacker and all the politics and everything aside. And just looking at the technicals, it's a very talented team. And so they deserve a lot of credit. And then the shadow brokers, we don't really know who they are. There's some evidence that they might be Russia. They claim they're an inside job if you read their messages, but they came around and started dumping these exploits about a year and a half ago over the course of a couple of years. It's been going on. They've been pretty quiet for the past year. So I'm going to try and get through SMB internals real quick, and then we can get into the eternal exploits, which are all SMB v1 vulnerabilities. So SMB was invented in 1983 by a guy named Barry Feigenbaum at IBM. He also worked on the NetBios, RFCs, and stuff like that. We originally saw it. There was a product from Microsoft called Land Manager. It was played or built into Windows, and pretty much all modern versions of Windows have SMB built in. And it's a very extensible protocol, so you can build things on top of it. And so that's where we get things like PS exec running on top of the distributed computing environments remote procedure call, using SMB as a transport. So SMB v1 looks, this is kind of the packet layout that you would expect to see from a normal SMB, a well-formed SMB. So normally you'll send a message block request, and then if the server processes that request, it'll send you a SMB reply. So both replies and responses look very similar. They have a command, which is like the opcode. Hundreds of commands in SMB v1. There's a flags field, which tells you this is a request or a reply. Are we talking unicode, that kind of thing. If you're getting a response from the server and it wasn't able to process that SMB, there was an error. It will set an error number for you. This is also where SMB signing is located. And then there's the user ID, tree ID, process ID, and multiplex ID, which we will talk a little bit more about later. And SMB also has a parameter block, so depending on what that opcode is, there's going to be a structure associated with that opcode, and that's generally where the structure is going to end up in the parameter block, so it's a fixed size depending on the opcode usually. Then data block is just arbitrary data associated with the command. So if you think about it, this way if you're creating a file, your command is like create file or whatever, the parameter block will be the file name, attributes, and then the data block would be like the file data. If you want to think about it, it's an oversimplification, but it works. So SMB v1 has DLC, so the later version you have, the more features you unlock. Pretty much all of these features have been available in the latest version, or since the earliest versions of NT, so you don't have to worry about it. All these exploits they date back to the early 90s before NT was officially even released in the late 80s. So the main driver that all of these vulnerabilities are going to be in is the service.sys driver, which is the SMB v1 driver. Those who have done low-level, high-concurrent networking will be familiar with a pattern called load balancer. So what you're doing is you have producers taking the network traffic and then consumer threads that are eating that traffic. So we're working with queues from computer science, you know, first in, first out container. And this is because SMB is designed for speed. And what you're actually producing and consuming are these things called work context, which is, so there's hundreds of SMBs and all of them can be kind of pigeon-holed into this mega-C structure called a work context. And that's what's being processed. But the really important thing to note on this slide is that when the server receives a SMB request and it's going to process the response to you, an SMB can be sent to the back of a queue multiple times while it's being processed. And so there's two different types of queues. There's the normal queue coming off the network. And then if something's going to take a really long time, it'll get sent to a blocking work queue. In Vista, they introduced SMB2 and they stripped the networking portion out of the services driver and put it in a driver called servenet.sys. So this is what's actually binding the SMB ports. And then serve.sys and serve2.sys come along and they register callbacks with that driver. And so whenever traffic comes in, they inspect the SMB and they're like, that looks like SMB1. My driver can process that and then that happens. There's only a few SMBs that are ventrists. In the negotiate stage, we pick our SMB dialect, either that NTLM or Cairo. And the server will make this connection struct. Later when we go to log in, it's called a session setup. The server will create this structure called a session. It'll have a pointer to that connection. It'll also have our user name, our user domain. At this point, the server will assign us a user ID. And when we log in, when we do the session setup, we tell the server a max buffer size that our SMB client is able to process. So we say if an SMB response is going to be bigger than this max buffer size, send it to us in a multipart SMB. And so mainly what you're doing with SMB is connecting to trees, which are basically shares. There's one that we're going to be connecting to in all these exploits. I mean, you can connect any tree, but the one that's usually open for anonymous logins is the inter-process communication share. And when you connect to a tree, like that IPC share, the server will assign you a tree ID. So now I'm going to talk about transactions, which are a special subset of SMBs that are what all these exploits take advantage of. So a transaction, you can think of it as like an octal. They perform a variety of functions. Most of them are file system-based. But what's interesting about transactions is they can be split apart across multiple SMBs. So you'll send the primary transaction. It'll be, I have, you know, this much data to send you. The server will send an interim response saying, okay, I accept that, send me the rest of it.  And then when it finally gets all of them, that's when it's going to process and send a response to you, which can be broken up as well. But it's kind of like a database transaction. You know, like it's an atomic thing as soon as that last secondary transaction comes in. That's when it's going to be processed. So a transaction is kind of like a message block inside of the server message blocks. So in addition to the SMB parameter block and the SMB data block, you'll also have the transaction parameter block and the transaction data block. There's different types of transactions over the years. So trans and trans one, as I might refer to it, is old stuff like mail slots and the remote access protocol. Trans two introduced support for greater than the old DOS style 8.3 short names. You'll see a lot of OS two to NT conversion stuff in there. And then NT trans, the parameter and data block sizes were changed from shorts to longs. So that's the major difference there. And they all have different dispatch tables that perform different functions. So when you send a primary transaction, you'll have the parameter offset and the data offset as part of that SMB. That just tells the server how far into that SMB the trans data and parameter blocks actually begin. There'll be a count. So that's how much data and parameter you're sending per this SMB. Total count is how much we're expecting between all primary and secondary SMBs, transaction SMBs. And then the max count is we're telling the server, if you're going to send us a reply for this transaction, this is the buffer size that we're going to reserve for that response. So don't send us more than that. When we send our secondary transactions, a lot of the fields are the same, except for now there's a displacement field. And that's, so as we're sending, you know, piecemeal transaction data, we need to tell the server where in the buffer it needs to write this packet at, because it's not keeping track of that. That's our job to do as a client. Part of the problem really. And so when you do create a transaction, when you send a primary transaction, the server will create a transaction structure. You can see we have pointers to our connection, our session and our tree connect. Then you'll see we have buffers for the incoming parameters, the outgoing parameters, the incoming data and the outgoing data. A lot of times, the server will reuse the same buffers. So the request buffer, it's, you know, smart about it. It doesn't make two allocations, not always, but sometimes. And then you'll see a transaction also has a tree ID, a process ID and a user ID. So I talked about user ID and tree ID, but process ID is just our client saying any random number, really. But that's like our process. So when we allocate or when we send a primary transaction, the server will call a function called serve allocate transaction. And yeah, the nice thing about this driver is a lot of the symbol names are available through PDB files on the tech net servers. So it allocates a transaction. Generally, the minimum size is going to be 0x5000. And the reason for that is it's going to grab it from a memory look side list. Not always. And then the maximum allocation size is going to be 0x10400, generally. Otherwise, you'll get a error saying you tried to make a transaction that's too big. When we send secondary transactions, that transaction is already allocated. So it's going to call a function called find transaction. And it's going to look it up by our user ID, our tree ID, our process ID. And then we have this other info field, which is generally going to be a multiplex ID, which is just another random number that we can send as the client. And that lets us have multiple transactions going. And the server knows which ones we're actually talking about when we send transaction packets. Another thing to notice is that all of these structures I talked about are reference counted. So if you want to think about it like C++ smart pointers, only like done in C, when you reference it, number goes up, when you dereference, it goes down. And then eventually, when you hit zero, it gets freed automatically. And so that should be enough background. So there's a concept with files called extended attributes. And so this is just name, value, key pairs, metadata attached to files. The concept was introduced in OS 2, 1.2, which is an old Microsoft IBM operating system. They had the high performance file system. Windows NT, we don't really see extended attributes that much anymore. There's a thing called alternate data streams, which most malware analysts are probably aware of. But one thing I was reading, modern use of extended attributes is for the Windows subsystem for Linux. They use it to store file permissions and case sensitivity data. And then in SMB parlance, there's fee and key. So fee means the structure has both name and value and key or full extended attribute. And then key is a get extended attribute, which is just the name. So you might send a key to get a fee. So here's what the OS 2 fee structure looks like. It starts with the flags field, which is either zero or 80. Zero means this fee or this extended attribute is not really that important. OX80 means if you're going to copy this to a file system that doesn't know extended attributes, think twice. Because it's an important extended attribute. And then it has a count of bytes for the name field. And then a count of bytes of the value field. Then immediately following that, it'll have a buffer or it'll store the name field, which is a C string. So it's null terminated. And then the value is not null terminated because it can be just arbitrary binary data. But one extended attribute by itself isn't very useful. So you usually find them in a fee list. So this structure has the count of bytes of the entire list.  And then you can get the size of the fee, its name plus its value plus the size of the structure. And you can loop over this fee list structure and read each individual fee. With Windows NT, they added extended attributes, but they changed the structure a little bit. So you see we still have flags. We still have a name length and we still have a value length. And then we have the name buffer and the value buffer afterwards. And then there's an alignment. They align it to d-word. I guess certain, maybe certain CPU architectures, they wanted to support a need of that alignment or something. But there is no separate fee list structure. There's just this next entry offset. So you parse a list of fees until that next entry offset is 0. So parsing is a little different. Here's the side of the bug of internal blue. The main bug, anyways. What this function is doing is it's calculating when we send a OS 2 fee list over the network, the server needs to convert that into an NT fee list. So this is just calculating how much size it needs to reserve in memory. And then on that vulnerable line of code what it's doing is if the size of our OS 2 fee list that we sent is bad, it's going to try and fix it for us. I don't know why it doesn't just reject the packet there. It might be supporting older clients or something. But I mentioned that the count of bytes of the fee list is a U long. What you saw there was it's putting it into a U short. So it's casting it wrong. So if I as an attacker say, here's OX 10,000 bytes of fee list, then my high D word is set. When that function comes along and it says, oh, I only see FF5D valid fee list there. When it casts incorrectly, you'll see that high D word is still set. And it thinks the size of the buffer is bigger than it really is. And then when it calculates the size that it needs to reserve from the NT buffer, it's only going from the correct casted variable. But here's what it looks like in code. Most people are probably familiar with x86, x64. You can see that we're working with D word registers. And then at the side of the vulnerability, it's moving a word pointer. So I'm going to explain the same thing just a little bit more clear here. So as an attacker, I'm supplying this fee list in an SMB. And I say, here's my OX 10,000 sized fee list.  And that's just where the name and the value are both zero. It's an exercise for you to figure out why that would be the most efficient way. But basically five bytes of OS 2 fee here become 12 bytes of NT fee because there's more data in NT fee. And so this really is the most efficient way to pack it. But then as it's parsing through all the fees, it gets to the end of this buffalo overflow fee. And it sees that the start of that fee plus the length of that fee exceeds the list, the CB list size, the ROX 10,000. So it says, I'm going to do a great job and correct that for you. And then I'm going to reserve an NT buffer. So then in another function after these buffer sizes have been calculated, it's going to go through and it's going to copy each fee one by one doing the conversion to NT fee. And then when it gets to that buffalo overflow fee, it's going to exceed that buffer. And then you can see if we keep copying, we're going to hit unallocated space and crash the target. So we can send an invalid fee. That's just where the flags are not zero or 80. And when we send that fee, we'll get a SMB error from the server that's invalid parameter. And so that's a really good sign for us. That means that the overflow fee happened. We didn't crash immediately. We may not be Gucci, but it might still crash later. So we're looking for the path of least resistance to trigger this bug. Some of the functions that call these vulnerable functions require a little bit more access or access to name pipes. So this trans to open to is the best way to do it. You're opening a file, but you're also creating one. And you can see that it takes a extended attributes list for that. And so you can set most of this packet or this SMB to just saying default values and then put your exploit fee list there. Another thing, another bug. Like I said, we're sending greater than 0x 10,000 data. But with a trans to request, data and parameter blocks are only word sized. So what's going on here? If you look at the wire short capture, it's first opening with an NT primary transaction. And then it's sending trans to secondary transactions. So the bug is it doesn't matter what your primary transaction is. It doesn't matter what your secondary transactions are, except for that last one, when the transaction gets executed. That's when it's going to choose the dispatch table. So we can reserve, since NT allows us to do a D word sized parameter and data blocks, we can use this to help us trigger the bug. There's another problem with session setup allocations. So there's many different ways to log in to SMB. At least two ways are anti security and extended security. And depending on the flags of the SMB, you can actually confuse the server and it'll read from the wrong offset where it should be allocating the size of that SMB's data block. So this bug doesn't really let you do much in terms of exploitation. It does help you groom the pool, which we're going to get into. But it basically lets us reserve a large amount of memory and then if we close that connection, it'll free that memory immediately. And this is still in the master branch of Windows. Pretty sure they still haven't fixed it. But like I said, it's not really a vulnerability. It's just weird quirk. So now we have all the ingredients we need for eternal blue. We have the exploit connection. So we're going to be opening many connections to the server during the exploitation process. On one connection, we're going to be setting the exploit. On different connections, we're going to be setting that session setup bug that lets us reserve large amounts of memory. We're going to make an allocation and a whole connection. And then what we're actually going to try and overflow into is a servenet.sys network buffer. So when servenet.sys sees network traffic, it's not just a buffer, it's a structure and then a buffer that follows it. We're trying to overflow into that structure, at least for Windows 7. Windows 10 gets a little weird. But we're going to send primary grooms, secondary grooms. They look like SMB2 packets. There was a little confusion in the early reporting that some of these bugs were SMB2 and 3. They're all SMB1. But it's before like servenet does callbacks and either serve2 or serve1 handle it. The only thing that I've seen credible claim is that it might be an IDS bypass because eventually after we overflow these servenet structures, we're going to send it to the shell code and all that over it. So maybe if it looks like SMB2, that was an attempt at an IDS bypass. So before we start the exploitation process, there's a servenet, the network buffers, they have look aside memory. And then there's just me random stuff in the pool. The first step is we're going to send our primary exploit transaction and all of the exploit transactions with the fee list in it, except for the last one. So nothing really going on in memory yet. Just as soon as we send that last transaction, it'll trigger the bug and do the overflow. We don't want to do it yet because we haven't groomed the pool. Then we're going to send the initial grooms. So these are just basically naked SMB. It's before either SMB1 or 2 takes over. And what we're trying to do here is force new pool allocations. Then we send, open a new connection with the, that allocation bug. We were going to reserve a large memory block, but it's not going to be the same size as our incorrectly calculated NT buffer. We're going to send a whole buffer. So this is the exact same size that the NT fee buffer, eventually the incorrect sizes. We want it to fit in this hole. Next, we're going to close the allocation connection. This lets just random stuff in the pool come along and allocate memory without messing up our exploitation process. Then we're going to send the secondary grooms, look exactly like the primary grooms. We're just hoping that one ends up after the whole connection there. And then we're going to free the whole connection and we're going to send the last exploit transaction. And that's going to think it can fit in that hole. And then during the memory copy when it's parsing all the fee, it's going to overflow into the headers of the next. So what are we actually overflowing here? Like I said, it's not just a buffer. There's a structure, a couple structures. You'll see there's a MDL, which is a memory descriptor list. It's a common NT structure that lets you map virtual memory to physical memory. So we can overwrite that one of those MDLs and depending on what address we get it, that's a right, what way or primitive. Once we overwrite that MDL, any network traffic we send over that connection. Instead of going to the buffer, it's going to go to wherever we overwrote. So the Hal Heap, until the very latest versions of Windows 10, they were not ASLR. On Windows 7, it's not DEP either. Then you'll see we're also overflowing a pointer to this WSK Winsock structure. We point that pointer at the Hal Heap as well.  Then we also send our shellcode at this time. So that fake structure that we overwrote has a function table, as the most important member that we're worried about, everything else, same defaults. So we send the shellcode to all of those primary grooms and secondary grooms, they're all separate connections. We don't know which one actually got overflowed to the right, what way or primitive. So we close all of the groom connections and then they're going to go through and they're going to call these handlers for when the connection closes and eventually it's going to hit the function table, which we have conveniently pointed the clean up function to point at the address of the shellcode, which is on the Hal Heap. But it's still not that simple because in Eternal Blue at that point, we're operating at dispatch level in the kernel, which means that a lot of common functionality, libraries and stuff, functions exported are off limits because we don't have access to things like paged memory. So one of the quickest and dirtiest ways that you can get from dispatch level to passive level is to hook the syscall table. Then the next time a syscall happens, instead of going to the normal syscall handler, it'll come to our function. We'll transition gracefully from user mode, you know, we'll set up the kernel stack and all that. And then we'll run the main stage, right, the double pulsar backdoor, which is going to backdoor the serve transaction to dispatch table. And then after we're done running double pulsar, we will restore the syscall handler. And I'm going to go into double pulsar a little bit later. But basically, here's the patch. They just fix that cast from a short to a long. It's pretty straightforward. And yeah, all these patches are one-liners. So Eternal Champion, transactions, if I try to send secondary transactions after a transaction is already executing, it'll have this executing, boolean locking mechanism set. So before it executes a transaction, it's going to set that locked variable to true. And then if I send a secondary, it's just going to reject it. Except if I have a primary transaction where I send all of my data and parameter in one primary transaction, I don't really need a secondary transaction. The bug is they forgot to set that lock. So then while that transaction is executing, we can come on by and send secondary transactions and actually modify the data of that primary transaction. So this gives us an info leak on a single core processor. And then there's a stack overwrite. It seems to only be triggered on multicore. And I believe it's Eternal Champion because champions win races. And this is basically a race condition. So in order to perform the exploitation, we need to leak a transaction. We need kernel addresses, that kind of thing. So there's another, so the first thing we can do with this race condition is we can look for an SNB which echoes data back. On older versions of Windows, the remote access protocol has Wnet account sync and that's server enum 2. Those will echo data back to us. On every version of NT, you have NT rename. The only difference is that that requires a valid file ID. So you have to open a name pipe. And so there's a little bit more permissions associated with that. But basically, all we're going to do is we're going to send a primary transaction where the data is greater than... Jesus. Sorry, I spilt some water. Just in case you needed a quick review. So we send a primary transaction where the amount of data in that is greater than when we logged in with the session set up. We told it it's max buffer size that we can expect for a reply. So the amount of data it needs to echo back to us can't fit in one reply. So it's going to send it to the back of a work queue. And then while it gets sent to the back of the work queue, we can have another secondary transaction come in and modify the amount of data, the data count on it. And then just because there's bad validation, this does let us, when it goes to read data back to us, it'll read past the buffer into another transaction. So here's the code execution path. So there's a transaction, I believe, too, called query path information. And part of its parameter block has a sub command. So the first step we're going to do with that sub command is we're going to say I want a query and extended attribute size. And that's going to send us to the back of a blocking work queue. So when we send secondary transactions, we're on the normal work queue. And then the transaction is also being processed on a blocking work queue. The second step is so after we've triggered that, we have another transaction secondary come by that modifies the parameter block, the transaction parameter block. And then we change the sub command to a is named valid. And this is pointing at a stack variable now. It changes our end data pointer to a stack variable. And so with that end data pointer, pointing at a stack variable using data displacement, we can get past things like stack canaries and stuff, and we can overwrite our return address to our worker thread with the secondary transaction. Sorry, running low on time already. So basically when we send the sexploitation sequence, it's going to be eight SMBs in one TCP packet. The first one's going to be that query EA size primary with all of the data and all the parameter. And so that's going to cause the blocking work queue to be triggered. And then we're going to send a transaction secondary that changes it to the is named valid sub command, which is making a point at a stack variable. And then we're going to send six transaction to secondaries with a data displacement that's going to overwrite the return address. But it's a race condition, so we send eight packets per exploitation attempt. So we attempt, we see if double pulsar has been installed. And if it hasn't, we run it 42 times by default. When we get code execution on a depth thing, if the thing has depth, we'll search the connection transaction list. We're looking for a special identifier at the start of one transaction. And so this is basically an egg hunter. So we're going to store the shell code. At this point, we have access to allocation functions of the pool, so we will copy the payload from that egg and then run it. Then we will increment the amount of available threads on one of the structures that we get passed into our shell code. And then we can resume execution with little NT magic. So there's the processor control region, which is a global variable in the kernel. Just going from there, we can get to the current thread start address and then just jump to it and resume execution in the worker thread loop. So here's the patch for eternal champion. This is primary transaction. If all data was received, it began executing the transaction. After the patch, it set that executing variable to true. That's it. So I talked about when secondary transactions come by instead of allocating a transaction, it's looking up a transaction. Generally, it's going to be a randomly generated multiplex ID, but there's a special SMB called a write index. And if you open a file in raw mode with write index, it makes a transaction instead of whatever they do for everything else. And with this weird pseudo transaction, that's not really a transaction, as they're copying data that you're sending to write to that file, they'll increment the end data pointer of the transaction. So we can cause a type confusion sequence here. So we do an nt create index for opening a named pipe. The server assigns us a file ID. Then we're going to create just a normal everyday transaction, nothing special. But we're going to set our multiplex ID to the same as that file ID that just got assigned by the server. And so the server's going to allocate a transaction. Then we're going to do that write index request with the FID. It's going to see, oh yeah, there's a transaction, a transaction there. And it's going to increment that data, that end data buffer pointer. So this is going to allow us to shift the pointer. So what we're going to do first is we're going to groom the pool. So there's an exploit transaction and then a victim transaction right after it. Normally our transaction end data pointer will only be able to using displacement and all that. We can only access our data buffer. But after we do the shift, that pointer got incremented. So if we send a secondary transaction now, we can write past our buffer. So there's another bug that lets us get an info leak, because again we need kernel addresses, that kind of thing. So normally transpeak named pipe, you're just peeking a named pipe. It expects the max parameter count to be 16, but it takes the client value. So if we are allocating from a look aside list, we can set that max parameter count to most of that OX 5,000. And then we'll set the max data count to one. You notice a really tiny value. Then because there's bad checking and the way that it writes where it writes the data when you're peeking that name pipe. Basically if we can put greater than one data to be caused into that name pipe, then it'll be, it'll just read past the buffer when it replies to us. So there's different ways that we can groom the pool. Fish and a barrel affects older versions of Windows, I think it's up through Vista. But basically what it was doing is when the serve.sys driver started up, it would create a preallocated heap. And so with a preallocated chunk of memory, we're not fighting other drivers and stuff. We're not going to the pool. So it's really convenient. It's also great because this private heap is only for very specific MSWrap transactions, which are very rarely used these days. So it's a very straightforward heap feng shui. That's what it looks like. We're sending victim transactions, they're called fish. And then we have a dynamite, which is just a transaction that with the MID set to the FID. So it's eligible for that pointer shift. And then we'll just send more victims. We'll send another dynamite in case the first one failed for whatever reason. So it'll just groom the pool that way and then attempt exploitation. Match pairs is all versions of Windows, including 7 plus. So when they remove fish and a barrel, that private heap, you still have this groom available. The only difference is that instead of having that private heap that no one's using, now we have to go to the normal page pool, which is what everybody, every process, everybody, everybody wants page pool. So it's very contentious. So this is a little oversimplification just for time and space of the slide. But we're going to send these groom transactions and they're going to take up pretty much as much as they can of several pages. And then on that last page, it's going to leave a little bit of extra space at the end. And so that creates a special kind of pool called a frag pool. And so this is, we're just filling up memory at this point. Then we send exploit, something eligible for that pointer shift. And there's a little extra going on there. But basically, yeah, we just send an exploit pointer shift thing. And then we come along with the brides, which are specifically designed to fill that gap. And so we're only sending like 10 or so grooms. We send 48 brides. And we're hoping that one of those brides ends up after one of our exploit pointers inside that frag. So now that we have the pointer shift and we can write into one of these victim transactions, we can create a write what we're primitive out of it. Basically, we modify using our exploit transaction that's been shifted. We modify our victim transaction. It's in data pointer. We point it to where we want to write. We set that executing variable to false. Some other clerical things. Also increase the reference count of the smart pointer type thing. And then when we send a victim transaction secondary that whatever's in our data block is what we actually want to write. Read where we modify the victim transaction to point at the leak transaction. And we can get the address of the leak transaction. We can infer it's address by its contents. This time we set the out data pointer from where we want to read. We change it set up to a peak name pipe. And then we set max data count to how much data we want to read. Then we send a leak trans secondary and it will echo back out data which is pointing from where we want to read. So we have read write primitives. We're on a quest to find somewhere to store the shellcode. If we set the victim transactions out parameters to null, and then we send a secondary transaction, it will change that out parameters to point at the work context response buffer which is read write x memory. And then we can use the read primitive to read the address that just got set and the write primitive to write the shellcode to that location. And now we're on a quest to execute the shellcode. So this is similar methodology to what double pulse R is doing. Only we're doing it remotely. So we read in our leak transaction. It has that connection pointer on it. We read in from that connection pointer. It has a variable called end point spin lock and that's pointing to a global variable in the serve.sys driver inside of that PE's data section. So then we just read backwards in memory. We're looking for a special table called the serve SMB word count. So the word count is associated with the size of transaction or SMB parameters. So this is a table that's about 256 entries but only has 100 commands. So anything that's not a legal command is going to be a negative two in this table which is OXFE. So when you see a bunch of fifi when you're reading the thing you know you're getting close. And then so immediately following that will be the transaction to dispatch table and then offsets 14 and 15 into that table are not implemented and we can overwrite OX14 which is with the address of the shell code.  So here's how they patched the info leak before the max parameter count was either the user supplied max parameter count or 16 after the patch they made it always 16. And this is how MS1710 scanners one way you can write one. So I mentioned before that when you allocate a transaction if it's greater than OX10 400 you'll get a status and sufficient server resources. So what we'll do is we'll send a transaction where the max parameter count and the max data count is going to be greater. The sum of those is greater than that OX10 400 before the patch it will reject that packet and send us that status and sufficient server resources. After the patch it's going to fix that max parameter count to 16. And so now it will do a proper allocation. We'll get a little bit further and get a different error message. And so that's how you can tell if the target's been patched. So here's another thing they fixed was if the data count in the named pipe is greater than the max data count the size of the client buffer they'll just fix that. Here's the remote code execution before the patch and after the patch. So before the patch remember it was shifting that pointer during a write index. After the patch instead of shifting the pointer they're just using an offset during the copy. Another thing they did to fix remote code execution and this does help with eternal blue as well is now when you allocate a transaction you set what you the expected secondary command should be. And then later when you go to find a transaction it sees if that new incoming secondary transaction if that command matches up with the same expected secondary command. And if not it won't return it. So now we can get into eternal synergy. So this has the same Buffalo overflow and rewrite primitives as eternal romance. You also get the match pairs and the classic grooming. And I didn't get to go through the classic grooming. But they inadvertently with Windows 8 they patched the info leak that was in eternal romance. So we can't do the normal eternal romance methodology. Instead we do our info leak using the eternal champion methodology. But another thing is the address that we stored our shellcode at last time has became a depth pool which means that it's not executable. So we needed a new way to find an executable portion of memory. So using our read primitives same ones as eternal romance we can read the connections preferred work queue which is going to be it's going to have on it a member called IRP thread which gives us a K thread structure. K threads have a K process and then K processes have a process list entry double linked list only normally a double linked list one goes to one and then going backwards that you can traverse back and forth with the process list entries it appears to me that as you go forward you go to the next process but at each step if you try and go back you just go back to the list head instead of being able to go yeah and so that list head is actually a global variable inside NTOS kernel so you just start reading backwards in memory from that global variable till you get to the mz header and then you can parse the using the remote read you can parse the NTOS kernel P headers and on Windows 8 and 8.1 they have this section inside of NTOS kernel.exe that's just a read write it's names and name of sections read write exec and so the only thing that's really ever legitimately calling this portion of memory is a function called kx unexpected interrupt but this is where internal synergy decides to store the shell code is right there so here's some a good list of resources for this stuff I think sleep use get hub repo is probably the best if you want to look at this at the code level and then Nicholas Jolie of MSRC did a sort of a similar talk at HitCon and then there's there's some more resources Jenna Magius and I's white paper from last year and then if you're interested on the shadow brokers there's more stuff on the bottom there just some archives and I'll also be at DerbyCon doing kind of like a part two for this so that's it thank you


थी आप बढुवर्ठे कि बढ़ायी टीएस तोग़ने प्योट रन्टम लाग प्रोचुस के खिज़ वाग के अप आप की वो than we have discussed about a pure random wag process. अपकी सीरिज जोहे वेप रेन्दिभ वाग होगी, उस में द्विफ्त नहीं होगी उस में देटर्मिनिस्तिक त्रैन्द नहीं होगा उस में यह स्झरफ फर सरफ रेन्दिब वाग के अपकी प्रण्वेश्ब वेलिएः प्रवियस पे दिपशः का रही होती है आपझा पह से थ Gebh все mein ka puri al pa kahaortshker तुछ मेह size favors तुछ मे शें� か Naar mat? असकोईakt pesh तुछ वो आप यही दीएखे की al base तुछ मेहंझा तुछ और बहुर्ड maneira आप यहांग्वागे न दीख गे But Amd उज़़ उठे सब परज अूगड़ dom च Kris उग्oll फोपबीम स्रहा था कईका, Warum? आ показा ईका मेग NSE और स्तोख वोअ, Rosen, तो आख आप के आपुध आप से आप मुर्प करता जारें थो अगर आपके आप, this is comprehensive model and if beta 1 is not equal to 0 आप आप आप आप आप आप आप आप आप आप आप आप आप आप, it means there is some value of beta 1 and there is drift.哈. And beta mu is equal to 0 it means there is no deterministic 10 to value hai yo haap ka with passage of time change nahi hoindi. It's make specific impressive trend nahi hai and beta three is equal to 1 it means haap ka jo random walk hi vent wo exists karta hai two, mat random work hi. Howun window walk hi again whee condition if the value of beta 3 is less than 1 then the series is stationary if its value is 1 it means there is a unit root and unit root means the series is non-stationary and when the series is non-stationary then how to make it stationary there is a very much simple procedure but before moving toward the procedure of making the non-stationary series into stationary or how to remove the unit root from the series so that we have a random number and an efficient series for which we have beta 1 is not equal to 0 beta 2 is equal to 0 and beta 3 is equal to 1 so we have the resultant equation this is yt is equal to beta 1 plus beta 2 is 0 everything is 0 then y3 is equal to 1 so when 1 is equal to 1 then it means your series is non-stationary if you have its value less than 1 then the series is stationary if value is equal to 1 then there is a unit root and consider that the series is non-stationary you have to convert it into stationary what is the procedure how can we efficiently do it in presence of constant or without like your constant there are two sorts of random work sometime there is constant and sometime there is no constant


Did you consider going with Desmond or Ernie going tonight? No, trying to win the game, Josh. Got the ball back, the chance to go win it, tie it at the end, our guys keep swinging. So there's a lot of things we got to do better. And it starts everywhere, it starts at the top with me. And there's a lot more that goes in the quarterback play than just stats. And we got to protect better, we got to do everything better. So you got to give Carolina credit, they came out, they got the lead. They won both lines of scrimmage and it wasn't pretty.  As ugly as it was at the end of the day, Josh, we had the ball, we got the ball back with a chance to go win or tie. And so it says a lot about our guys, but clearly it wasn't good enough. Mike, I know those are the popular narratives right out there. Those are the easy questions to ask. As a whole football team, we got to do a better job, start with myself. So we look every week to make sure that we got the right guys in the right spots. And like I said, we got to protect better. We got to play the run better. Chicago's going to come in here and try to run it 500 times. And so we got a lot of work ahead of us. So did you speak to the state markets? Mike, look, guys, you could make it about the quarterback. How about about the team? So we had an opportunity at the end of the fourth quarter of the last two weeks. And for a lot of different ways and a lot of different phases, Mike, we got to get better. And we're thankful that we got an opportunity to come back and do that with seven games left. What were some of the issues? Well, they kept back. And when you're running some of those own schemes, D-Led, and they cut back and we're out of a gap, they had some decent runs there. And they kind of grinded it out. And like I said, it wasn't great by either team on third or down, but they had more than we did. It's NFL.  They have a say too. And they came out and they put everything they had in it. And like I said, it was kind of ugly at first. But somehow, some way, our guys find a way to at least have a chance to go in it. And as always, there's a lot of things we got to correct. And we will. Backed up for the half? Hell no. In a game like that, it was a little possession. Early in that game, fourth and short, backed up. No. We didn't have a lot of carries. And so a lot of it was, he was all over the place in different spots too. So again, those are easy stats to look at. We'll look at everything. But we didn't come out, we didn't run the ball very well. But we chipped away. We had some decent runs in third quarter. And obviously we're down two possessions. And you're in a hurry up and we're able to move the ball pretty quickly down the field. Made some big throws, some big catches. Got the touchdown pass to Hodge. Had a chance. Had a chance to get a pick. Didn't, had a chance with the ball back. And we didn't. We went forward and out. It's hard when you're scramble in the set your feet. So guys are competitor. Like all our guys, they fight. It wasn't pretty. But they fight. And you know, probably something here, there every play. But we'll look at it all, Josh. Like we do every week. Probably had something to do with it. But again, we didn't fumble any snaps. Things didn't much. They ran the same calls. They just won some of the battles up front early. But they brought five man pressure a bunch.  So we're kind of used to it. But again, they got a good front. And they won some of the matchups early. We stuck with it.  But we kept chipping away. And we hit some runs. Maljeer hit some runs. Huntley hit one down there in the third quarter. And probably the reason we had a chance late. Yeah, I wanted to, you know, Rashad wanted to see what he could do.  And we're happy we have Rashad. There's a lot of guys who are cycling up front. You're on a short week. Guys played a lot of snaps on Sunday. So we're trying to keep guys fresh on a short week so we didn't have injuries piled up either. And that's a big part of it as well. Make sure guys are fresh. And again, we'll look at everything. That was a good strategy or not. But that was the reason behind it. So it wasn't a good strategy? Everybody, did you see how many guys we subbed up front? Outside my backers and inside my backers. Pretty common. Yeah, he did. He was too often. Yeah, we left last night. I asked him on a plane how Maggie was doing. And they thought that she was going to get induced on Sunday.  And then he woke up this morning and obviously, she went into labor. And so he thankfully went down there and saw his first baby born. And then thankfully, Mr. Blank, they were able to pick him up and get him up here. And he played and says a lot about Jake and got to be there for the birth of his first child. And he came back and wanted to play.


CHAPTER XVI Pop me down!" said Billy. You'd get hurt if I did, travelling at this pace. What are you going to do? Drive about till you promise to marry me. You'll have to drive a long time." Righto! said Sam. The car took a corner and purred down a lane. Billy reached out a hand and grabbed at the steering wheel. Of course, if you want to smash up in a ditch, said Sam, writing the car with a wrench.  Okay, found stuff, explained Sam. I ought to have tried this before. I don't know what you expect to gain by this. That's all right, said Sam. I know what I'm about. I'm glad to hear it. I thought you would be. I'm not going to talk to you. All right, lean back and doze off. We have the whole night before us.  Have you ever been to Scotland? What do you mean? I thought we might push up there. I thought we might push up there. We've got to go somewhere. And, oddly enough, I've never been to Scotland. Billy regarded him blankly.  I'm crazy about you. If you knew what I've gone through tonight for your sake, you'd be more sympathetic. I love you, said Sam, swerving to avoid a rabbit. And what's more, you know it. I don't care. You will, said Sam confidently. Have a North Wales. I've heard people speak well of North Wales. Shall we head for North Wales? I'm engaged to Breem Mortimer. Oh, no, that's all off. Sam assured her. It's not. Right off, said Sam firmly. You could never bring yourself to marry a man who dashed away like that and deserted you in your hour of need. Why, for all he knew, I might have tried to murder you. And he ran away. No, no. We'll eliminate Breem Mortimer once and for all. He won't do. This was so exactly what Billy was feeling herself, that she could not bring herself to dispute it.  Why, in the name of goodness, why?  It was a sudden inspiration. I had to do something to make you think well of me, and I thought that it might meet the case if I saved you from a lunatic with a pistol. Wasn't my fault you found out? I shall never forgive you. Why not Cornwall, said Sam? The Riviera of England. Let's go to Cornwall. I beg your pardon, what were you saying? I said I should never forgive you, and I won't. Well, I hope you're fond of motoring, said Sam, because we're going on till you do. Very well. Go on, then. I intend to. Of course, it's all right now while it's dark. But have you considered what it's going to happen when the sun gets up? We shall have a sort of triumphal procession.  I shouldn't notice them myself, because it's a little difficult to notice anything from inside this thing. But I'm afraid it will be rather unpleasant for you. I know what we'll do. We'll go to London and drive up and down Piccadilly. That will be fun. There was a long silence. Is my helmet on straight? said Sam. Billy made no reply. She was looking before her down the hedge-bordered road. Always a girl of sudden impulse. She had just made a curious discovery. To wit that she was enjoying herself. There was something so novel and exhilarating about this midnight ride, that imperceptibly her dismay and resentment had ebbed away. She found herself struggling with a desire to laugh. Lock-in-va, said Sam, suddenly. That's the name of the chap I've been trying to think of. Did you ever read about Lock-in-va? Young Lock-in-va, the poet calls him rather familiarly. He did just what I'm doing now, and everybody thought very highly of him. I suppose in those days a helmet was just an ordinary part of what the well-dressed man should wear. Odd how fashions change. Till now, Dignity and Roth had combined to keep Billy from making any inquiries into a matter which had excited in her a quite painful curiosity. In her new mood she resisted the impulse no longer. Why are you wearing that thing?  You don't suppose I'm trying to set a new style in Gent's headwear, do you? But why did you ever put it on? Well, it was this way. After I came out of the cupboard in the drawing-room. What? Didn't I tell you about that? Oh, yes. I was sitting in the cupboard in the drawing-room from dinner time onwards. After that I came out, and started tending about Aunt Adeline's china. So I thought I'd better switch the light on. Unfortunately, I switched on some sort of musical instrument instead. And then somebody started shooting. So, all with one thing and another, I thought it would be best to hide somewhere. I hid in one of the suits of armour in the hall. Were you inside there all the time we were- Yes, I mean to say, that was funny about Breen, wasn't it? Getting under the bed, I mean. Don't let's talk about Breen. That's the right spirit. I'd like to see it. All right, we won't. Let's get back to the main issue. Will you marry me? Why did you come to the house at all? To see you. To see me at that time of the night? Well, perhaps not actually to see you. Sam was a little perplexed for a moment. Something told him that it would be injudicious to reveal his true motive, and thereby risk disturbing the harmony, which he felt had begun to exist between them. To be near you. To be in the same house with you, he went on vehemently, feeling that he'd struck the right note. You don't know the anguish I went through after I read that letter of yours? I was mad, I was. Well, to return to the point, will you marry me? Billy sat looking straight before her. The car, now on the main road, moved smoothly on. Will you marry me? Billy rested her hand on her chin, and searched the darkness with thoughtful eyes. Will you marry me? The car raced on. Will you marry me? said Sam. Will you marry me? Will you marry me? Oh, don't talk like a parrot, cried Billy. It reminds me of Bream. But will you? Yes, said Billy.  Probably very bad for the tyres. Did you say yes? Yes. Darling! said Sam, leaning towards her. Oh, curse this helmet! Why? Well, I rather wanted to kiss you, and it hampers me. Let me try and get it off, then down. Ouch! It's coming. There! How helpless men are! We need a woman's tender care, said Sam, depositing the helmet on the floor of the car, and rubbing his smarting ears. Billy! Sam! You angel! Your brother, darling, after all, said Billy. But you want keeping in order? she added severely. You will do that when we're married. When we're married, he repeated luxuriously, how splendid it sounds. The only trouble is, said Billy, father won't hear of it. No, he won't. Not till it's all over, said Sam. He started the car again. What are you going to do, said Billy? Where are you going? To London, said Sam. It may be news to you, but the old lawyer like myself knows that by going to Doctor's Commons, or the Court of Arches, or somewhere, or by routing the Archbishop of Canterbury out of bed, or something, you can get a special licence and be married almost before you know where you are. My scheme, roughly, is to dig this special licence out of whoever keeps such things, have a bit of breakfast, and then get married at our leisure before lunch at the registrars. Oh, not a registrars, said Billy. No? I should hate a registrars. Very well, angel, just as you say, we'll go to a church. There are millions of churches in London. I've seen them all over the place. Immused for a moment. Yes, you're quite right. He said, a church is the thing. It'll please Webster. Webster? Yes, he's rather keen on the church bells, never having wrung out, so blithe appealed before. And we must consider Webster's feelings. After all, he brought us together. Webster? How? Oh, I'll tell you all about that. Some other time, said Sam. Just for the moment, I want to sit quite still and think. Are you comfortable? Fine, then off we go. The birds and the trees fringing the road, stirred and twitted grumpily as the noise of the engine disturbed their slumbers. But if they had known it, they were in luck. At any rate, the worst had not befallen them. For Sam was too happy to sing. The End End of Three Men that Are Made by Pidgey Woodhouse Read by Tim Bulkley of BigBible.org


Plenty of that next weekend because he's running in the New York marathon and he's Joe Gibbons and he's from Glenswally and He decided he actually decided when he was getting chemotherapy that you know that if I get through this and I come out the other side I'm gonna run in the New York marathon as you do shows with me in the studio and Joe, how's things? Good job. Thanks for having me. No bother You're looking fit. Well as you would be and you're about to run that. Oh, did you mean it? That's still showing. Yeah, not the first marathon you've run, but no, I've ran two before so looking forward and now the hard Work's done And was it ahead of one of them that you first figured that there's something not right? Yes But ten days before I was about to run the Belfast marathon Well, there's actually three weeks roughly before I was about to run and I come back from a training one morning and I Passed a bit of blood meering So I said the wife has told her and she says I don't think it's anything so but she says might be safer to get a check so Text doctor Keir and Rorty and he told me to come up and he checked everything and everything looked good took the bloods and everything and Then as he texts me afterwards, you don't know He says how lucky we were because I had my hand on the door ready to walk out and he says sure here now He says I'll I'll give you a check over And as I start up a silly it is more or less argued with me and told me to get up in the bed And he then found a lump in me groin Because you felt you know you passed about a year round, but you just put it down to training or whatever So you actually felt all of that you felt like you felt okay felt 110% amazing Yeah, so it's a sort of thankful you got a physical check and found the lump Found the lump and still suppose I was very naive because as I say he he he probably knew the signs But I didn't and suppose from playing football all my life. I was all lumps and bumps So he was he has the man who say he went deeper and found the fault Thankfully it is exactly exactly so Initially what initially was a was the treatment was well initially initially put me on a Weeks antibiotic program and then I went back into him and when I went back in the lumps hadn't removed Obviously, and he sent me up to Keisley and later that evening.  I'm fit and healthy and and all the rest So I'm needless to say John at five o'clock the next evening when I was told that was the Friday evening Exactly nine days from the marathon That I had lymphoma Fairness to say my mouth had the ground Stupid question in a way, but did you do the marathon? I wasn't allowed to do the marathon Did you feel like you could have done the marathon? I really wanted to do the marathon because suppose I thought on my own head That I was fit. I was healthy They told me the biopsy wasn't going to be for a week to 10 days or maybe a fortnight And I thought listen, this is probably my last ever chance. I was in the shape of my life And I thought I'd never ever get to run a marathon again. So I really wanted to do it, but they never let me do it And and since that you've had Two rounds of treatment Take me is that right? No. Well Suppose I had six rounds of chemotherapy every three weeks. So I think it was 18 weeks chemotherapy Yeah, no so but before that they started out watching weight So from the October to the June the May time they done nothing Because they didn't know how long I had it and I didn't know myself how long I had it So they said if it didn't move they weren't going to move All right So then in June time I found another lump in my shoulder And That's what they meant by move move somewhere else. Exactly. Exactly. Um, so then they Took me in again. It was a fairly straight forward biopsy. I remember setting up on it just to go We need a lot of my shoulder and I remember getting the text message. I was sitting in my dinner saying can you talk and I said to the wife I said, oh well if he's texting this is good news And I think that was the Wednesday or thursday evening and they call come to say to be on and monday They were starting chemo on tuesday. Okay. So that was the dreaded phone call. Yeah, that was a bit of a disappointment I can well imagine and a big disappointment in the overall scheme of things because you know You were ticking along at that stage where you were kind of figuring well, you know, nothing's happening and I feel fine Yeah, nothing had changed and from the day I was saying I never knew I had cancer and I wasn't sick with it and I was I was tapping along nicely thinking it would never move Yeah, yeah um And then I came with therapy then after that and how I was was the chemo people Often say it starts off okay, and then gets tougher as it goes on and for me personally Like the first the first one you obviously have to get into hospital because they want to make sure you're not allergic to anything So that was three or four days in hospital I got out and other than the energy been down a little bit for the first one. I was I was grand But as you say the longer the chemo went on and then I asked the doctor I said listen is the chemo getting stronger or am I getting weaker? What's the story and he more or less said that because The chemo was killing the cancer that the chemo was actually attacking more of my good cells then So I did find the last few or I was just glad to hear when the last one was done. That was it. Let me tell you Yeah, because I mean um The side of doing a bit of running.  I will as As I say, I really didn't think I would get back to the shape of my now At the start it was just about probably trying to keep the head right and Get out and out and about again like because I've been training since I was probably seven years of age So Yeah, because you're a footballer as well And then in a previous life played for dunny gall and uh Then after football is over you did a bit more running. Hi. Um, I got under the run in 2019 and Probably got sort of hooked on it You know when you see your times going down and The up the trend and the times are still coming down you definitely do get hooked And the great thing I used to say I loved a bit running is you're not really running against somebody you're running against the watch So that's that's lesson. You've got well, yeah, exactly And you've got the elites who's in a different level But everybody no matter if they're running a marathon in two hours or running in a marathon in five hours They're trying to beat the watch. Yeah, yeah, you know beat their own time So it was towards the end of your treatment that you you said that listen if I get through this I'm gonna run a marathon and why did you pick new york? It was always on the bucket list. It was always on the bucket list I just thought the scenery and the seeing the people actually the photos and everybody's probably seen them running over Brooke, I think it's brooklyn bridge Like to see 50,000 people running over that and I just thought Someday I would love to do that Yeah, fantastic. Well, listen to the best look with it. Um It'll be you know, it's this huge crowd from new york marathon and iconic Landmarks and buildings and so on so it'll it'll be it'll be great And uh, all the training is done now at the stage more or less. Yeah the the favorite word supposed is taper So yeah, so the runs will be light between now and the runs get lighter and the days get lighter So yeah, the six o'clock starts. We'll be getting fewer. Thankfully Uh, because you know to run a marathon And give it a bit of attention and do it sort of semi seriously. You do have to put in the miles Definitely definitely. I'm a member good friend of mine, Marty Lynch telling me when I started running There's no great secret to running except run run run And it's very very it's very very truly you don't have to do the sessions Obviously the help But if you do the miles you get the rewards and have you is most around on your own or do you have a running partner or I have a running partner. Well, most of the time when he doesn't sleep on Peter Donald from kill mcranan. Uh-huh. Very good running and skiing partner. Uh, exactly. When are you going to get back to skiing? Well, that's in the pipeline for january. Hopefully Let's take it one challenge at a time. Exactly. Exactly. All right. Well, um, listen, it's great and everything's You know Everything's great now and I as I say listen still a wee bit some problems with the stomach and the bowels times But nothing nothing like what I have nothing compared to what if some people has like Um, so when you get told you're in remission when you have cancer, that's as good as it gets. Yeah So they put it back to sleep and hopefully it stays sleeping now. That's the big one Yeah, and it makes you I'm guessing that when you have a cancer diagnosis and then you come out the other side and makes you grab life with both hands and Exactly. Exactly. And suppose another thing that when you get told it, I would say I never prayed as much in my life You know what I mean like so Listen, you look for any solution you can get because as I say all you want to do is get out the other side You know So anyone listening and a particular man and particularly young men and young men who who might feel healthy if there's anything sinister going on Um, you know be determined and ask the hard questions. Don't be afraid to ask for an examination as well I say I know a lot of my friends Was pumped as I was and a lot of them went and got checked after I got checked, you know and suppose With this marathon, I obviously was going to go and do it, but I wasn't going to to publicize I was going to do it Um, but I thought if I do this and I says if I can raise awareness that there is life after chemotherapy And that was like if it helps one person To get over it You know what I mean, or if you're told you need chemo, it's not the end of the day Like it's not the end of the world Yeah, no and it's an important message and it's important to raise awareness about that message as well And not only are you raising awareness, but you're raising a few a few pounds as well Absolutely blow blowing away John. Um, like if you go follow me page. There's a go follow me page If somebody had told me I would have raised a thousand I would have been happy I think it's at 11 000 and heading on the other side of that So it's I'm absolutely the generosity And as everybody knows when you ask the people of Donegal for help to raise money They they certainly do roll one behind you like to like I'm just I'm speechless about that. Yeah Yeah, no, I know I suppose it's for two good causes John, which helps, you know Yeah, I can't take care of west the support center here in Donegal and pay at a house. Yep. Yeah two two great causes All right. Well, listen, um, I'm not going to ask you about times and And so on but you'll you'll you'll complete it anyhow. Well, that's the plan John. That's the plan Hopefully it all goes to the plan. Wendy head over. Uh, this day week Two years My wife Susanna and there's two other couples going on this as well. So Great time into the bargain. Yeah, that's the plan. Listen. Uh, enjoy it Joe and uh, and thanks for coming in No, well, John. Thanks for having me


Provided that it exists, we can always find the inverse of a matrix by solving a system of equations. And a good habit for linear algebra students is always identifying what system of equations needs to be solved. So if I want to find the inverse of a 2x2 matrix, I can solve the system with 4 unknowns. Another good habit for mathematicians or human beings in general is asking, how can we do this more efficiently? Now, one of the things we notice about this system is that our variables actually split into two sets. The first and third equations have the variables x1 and x3, but they don't have the variables x2 and x4. That is, the coefficients of x2 and x4 are zero. Likewise, the second and fourth equations do not include the variables x1 and x3, but do include the variables x2 and x4. Because the variables split this way, I can solve four pairs of variables. For example, since x1 and x3 only occur in the first and third equations, we can solve for them by solving the system ax1 plus bx3 equals 1, cx1 plus dx3 equals zero. And we can solve by performing a sequence of row operations on the augmented coefficient matrix. Likewise, x2 and x4 only occur in the second and fourth equations, so we can find them by solving the system of equations ax2 plus bx4 equals zero, and cx2 plus dx4 equals 1. And we can solve by performing a sequence of row operations on the augmented coefficient matrix. But it's important to remember that the row operations only depend on the coefficients. So whatever row operations we need to solve for x1 and x3, we need to apply the same row operations to solve for x2 and x4. In fact, the only difference between the two of them is going to be what happens to the constant terms. So what we can do is we can perform whatever row operations we need on a doubly augmented coefficient matrix. We can form this double-wide matrix where on the left-hand side we have our original matrix that we're trying to find the inverse of and the augmented portion corresponds to the identity matrix of the appropriate size. And if we row-reduce this double-wide matrix, the entries on the right-hand side will be the entries of our inverse. And so this leads to the following theorem. Let A be any matrix and I, the identity matrix of the appropriate size. If there is a sequence of elementary row operations that transform this block matrix, matrix A on the left, the identity on the right, into a block matrix with the identity on the left and some new matrix on the right, then this matrix B is going to be the inverse of our matrix A. So let's apply that. Suppose I want to find the inverse of the matrix 4, 5, 5, 6. So our theorem says that we can take this matrix and augment it with the appropriately sized identity matrix and then row-reduce to find the inverse. So we'll augment our 2 by 2 matrix with the appropriately sized identity matrix and we'll perform our row reductions. And after all the thus settles, we have the identity matrix here on the left-hand side and this thing on the right-hand side is the inverse. Or so I claim. So here's a good rule of life that's also applicable in mathematics. Anytime somebody comes around and says, hey, here's a better way of doing something you've already done. You should ask yourself, does it actually work? And so we claim that this matrix, negative 6, 5, 5, negative 4, is the inverse matrix. Well, let's see what happens when we multiply it. So if we multiply on the right by this matrix, we get the identity matrix. And so this really is the inverse. At least if we multiply on the right, we get the identity, so this is a right inverse. We should verify that this also works as a left inverse. What about a 3 by 3 matrix? Here's where this blocked matrix form is particularly useful because if we wanted to find the inverse of a 3 by 3 matrix, we'd need to set up a system of 9 linear equations, which is not impossible. It's just a little tedious. So here I've compacted that system of 9 linear equations down to a 3 row system. So let's augment our original coefficient matrix with the 3 by 3 identity matrix and we'll perform a sequence of row operations. And again, after all the dust settles, on the right-hand side, if we've done everything correctly, we should have the multiplicative inverse of our matrix.


President of the Senate, Gotswil Agpabio, has set up a 15-man ad hoc committee to communicate the welfare of the senators with national assembly management headed by Senator Issa Jibrin. He noted that members of the committee were drawn from the six geopolitical zones and had two weeks to submit his report. He said they were expected to work with the Senate clerk, Chinadu Akabweze, to ensure seats and offices are located to all senators within the set time frame. The development was sequeled to a motion by Deputy Senate President Senator Barao Jibrin and supported by lawmakers after a closed off session. I'll finish. Now, the welfare committee will compose of Senator Issa Jibrin, okay, as chairman, and the vice chairman will be Senator Darlinton Mugosha, and then we have the fully members We tried to draw from all the geopolitical zones. Senator David Muese, Omae, now senator for my government. Senator Omae, Ibrahim Muomet, we have Senator Barinanda Beghi, then we have Senator Epeyong Asukwa, they have almost a week or two weeks to complete their work. So the clerk, you lead them and direct them as appropriate, Deputy Senate President. However, the leadership of the 10th assembly has communicated to President Bola Chinabu that it has fully resumed the full parliamentary business. It was also gathered that the leadership of the Senate has written to the international parliamentary body on its resumption. On the other day, there's a motion standing in my name that this August Senate will send a message to the following international parliamentary bodies, informing them that the quorum of the Senate of 10th National Assembly has assembled and is ready to receive any communication. One, African Union, EU. Two, Commonwealth Parliamentary Association. Three, Inter-Parliamentary Union. Four, Echoa's Parliament. Five, Pan-African Parliament. And six, the Association of Senates, Shura, an Equivalent Council in Africa, and the Arab world. Mr. President, I so move. I second that we do send correspondence to the executive arm of government on the composition of the 10th Senate. Those who are in support of the motion say aye. And those who are against the motion say nay. The ayes have it.


Patriot Prime Reviews is a channel for adult collectors and may not be suitable for children under 13 years of age. Viewer discretion is advised. Hey, what's going on guys? Patriot Prime here once again with another Transformers review. But before I get started, I need you guys to do me a favor. If you're watching this video right here and are not a subscriber of Patriot Prime Reviews, please consider hitting that subscribe button right now. It won't cost you a thing while help me and my channel out tremendously. Also, make sure and check out the sponsor of this video, ToyHacks.com. Hi, I'm Bert the Stormtrooper and this is the Legacy Generation 2 Laser Optimus Prime and I love this toy. But he's missing that Generation 2 look, that colorfulness that the original toy had. Hey, Bert! Hey Patriot Prime, where did you come from? It's the Internet, man. Anything's possible. Here, put these ToyHacks.com decals on your Laser Optimus Prime. I think you'll get that G2 look that you're looking for. Whoa dude, you gotta show me how you do that. Alright awesome, let me put these on and let me get right back with you. A few moments later. Holy crap, Laser Prime now looks amazing. He looks just like the original toy thanks to ToyHacks and thanks to you, Patriot Prime. You are welcome. Not only does ToyHacks make decals for the modern Transformer figures, but they also make reproduction decals for the vintage G1s. Check out their toy stages to find a cool backdrop for your collection display and visit the ToyHacks Armory. They have a wide variety of weapons in multiple colors. And don't forget, each purchase with ToyHacks.com adds RoboSense to your account that you can use for future purchases. So check out ToyHacks.com and make your collection stand out from the rest. And don't forget, tell them Patriot Prime sent you. The featured bot in this video is the brand new Transformers Legacy G-Axis. And this was one figure I was so excited to see when he was announced. While some other Transformer fans were like, who the hell is this guy? Well G-Axis here was written specifically by writer Simon Furman for the G2 Marvel comic series. There was no toy of the figure he was written specifically for the comic book. And a funny story is Marvel told Simon Furman says, yeah, we want you to do this new comic, but we'll probably cancel it after 12 issues. And so Simon Furman named G-Axis G-Axis because it's kind of a play on words G-Axis. You know, we're getting canceled, G-Axis. So that's where his name came from. He was the primary antagonist in the G2 comic series against both Optimus Prime and Megatron. He was a dictator that took a group of Decepticons who they renamed themselves the Cybertronians.  So once he came back to Earth, discovered Optimus Prime and Megatron big battle rage and the two had to team up to fighting. So enough of me rambling on about the figure. You're not familiar with this guy. Highly, highly recommend that you track down the G2 Marvel series. I know Titan Books did a couple of graphic novel reprints of the entire series. I have those and you can get them for like 10 bucks on eBay. Highly recommended. So enough of me just rambling on about the comic history of G-Axis. Let's go ahead and take a look at the figure and welcome to Patriot Prime Reviews.  I had to show off G-Axis's packaging in the intro. I was too busy talking about his comic book history. Anyway, here's the box. No window right there. Plastic free. You've got G-Axis in his Cybertronian jet mode. Here we have G2 universe G-Axis. Side of the box we've got art of G-Axis right there. It looks really good. Very faithful to how he looked in the comics. On the back of the packaging we've got G-Axis in robot mode, jet mode and then there's that QR scanner that you can scan to get his tech specs. And then the side of the box right here is the art we've seen many times with Megatron, Dragstrip, Iguanas, Skywarp and Kickback. So now let's take a look at what you get when you get G-Axis all opened up out of the packaging. You get a set of instructions that as usual are very well illustrated and easy to follow. He also gets this thin little silver blaster and it's actually clear plastic painted silver. So it doesn't look too bad. But my gosh, that is thin. And then he has this red blaster that looks a lot better. I like the size of this more but I wish it had some paint applications. Now you can take the mega thin blaster and attach to the red one. They're on the side to form kind of like a double blaster and then this one also has a port on the back. So if you take a weapon say like the axe from Skids here and there you go. So now you get some kind of mega rifle. So there's one option. I guess there's all kinds of stuff you can do with that. And of course we have G-Axis himself. My first impressions with G-Axis when I got him out of the packaging was wow. This guy looks so good and looks exactly like his G2 comic counterpart. Now this isn't the first G-Axis figure that we've gotten. We got one way back in 2003 in the Robots in the Sky series as a KB exclusive repaint of Beast Machine's JetStore. And then in the Thrillin 30 line I believe in 2013 we got a version of him using the Armada Starscream mold. But that was based upon his IDW appearance where he is more of a scientist instead of a brutal conqueror. So I prefer the Marvel version. So taking a closer look at the figure he's got a fantastic head sculpt. He just looks so mean and just very evil figure. I love the green eyes, the yellow face. Never could figure out if that was a chin strap or what on his helmet there. But it looks good. Paint applications are off the chain. He's got his sensor array right there on his shoulder with some green in the middle. Yellow for the chest, a little bit of white right here. He's got a G2 Decepticon insignia on his chest. In the comics he wasn't a Decepticon as I said he led a force called the Cybertronians. No real paint applications for the figure until we get down here on the legs where he's got some yellow. And look at the sculpted detail right there on the shins with the wires. That looks awesome. That's great looking right there. I dig it. Got these little wings on the side of the legs. Also very faithful to the comics. Little bit of yellow up there on the knees. Yellow for the feet. Yellow fists. And that's about it. The figure cleans up really, really good. There's no waffles anywhere to be seen. So this guy looks awesome. Now as far as articulation the head is on a ball joint. Can look up, can look down. Do a complete 360 though. Once I turn it a little bit to the side it gets loose right there. I mean it's not bad. It's not going to just flop around but it gets a little looser as soon as you turn it to the side. So you got that going on. The arms can go out. They can go in. They could do a complete 360 except you're going to hit the wings back there. There is a bicep rotation. Bicep bend. Let's see. Wrist rotation and the fingers I believe. It's very tight. There's a pin. Yes the fingers can open and close. There is a waist rotation. Legs can go forward. They can go back. There is a very deep knee bend. A rotation and ankle tilt. So he's got lots of posibility. Let's go ahead and grab his weapons. You got his red blaster right here. He didn't peg that into his hand. I'm not real sure why his fingers open up because you really don't have to open up the fingers to put the weapons in. But it's still a cool feature. So there we go. Dual wielding. Now that's exactly how he looked in the comics. He had these big blasters he carried into battle. So there you have G2G Axis all armed and ready for battle. So now let's get G-Axis transformed into his Cybertronian jet mode. And the first thing we want to do, go ahead and remove the blasters. And then we'll take these little panels right here. Flip these out. If I can get them. There we go. Flip those down. Fold the fists inside. Go ahead and rotate the waist. I'm going to flip the wings back. And then take this whole section. Pull down. That'll release the head. And you want to rotate the head around. And go ahead and collapse that down like so. Then you're going to reach in. And pull up his chest section. Just like that. Go ahead and take the sensor array. Kind of fold in. Bring this chest section up. Fold out the nose cone of the jet. And click that into place. And you bring this out.  So it's angled just like that. Then you're going to bring this section down. And it's going to tab into place just like so. Go ahead and straighten the arms out. And you're going to fold these sections in. Right where this yellow piece is. Make sure the head is looking forward. Fold those in like so. Now we're going to go down here to the legs. Open up the legs just like this. This kind of reminds me of the old combiner wars figures. Take the feet. Fold the feet down. And there's just kind of collapsed the leg onto itself. Just like that. Now flip this section here around. Just like so. And you've got these little tabs right here. They're going to line up to the tabs behind his knees. Go ahead and let's get... Oops. Forget this every time. There is the tail fin right here on the inside of the leg. Go ahead and rotate that around. I've transformed this guy a few times. I've missed that every time. Now go ahead and snap those legs into place. And snap the legs together. You're going to bring the arms down. There's those little green hinges. Pop these out and you're going to bring these down. And the arms are going to tab in right here to the leg. So get that tabbed in. Get that tabbed in. You're going to take these little ankle wings. Fold those up in under the vehicle mode. Take the wings here. Rotate these around. You'll have to lift out slightly. They peg in right there. So lift out slightly. Bring those around.  The wing here. Unfold the wing. And now you've got this little slot right here. The slot's right there. It's going to go onto that peg. Onto the side of the leg. Go ahead and do that for both sides. And there we have G-axis in his Cybertronian jet mode. And this thing, if the tail fin will stay peg together, is near identical to how he looked in the comics. It's a very weird looking Cybertronian jet. And that's just how he was in the comics, too. I dig it. I kind of like the organic bat wing look to the wings there. The details from the legs carry over. There's no real new details to look at in the jet mode aside from the cockpit. You've got translucent cockpit all the way to the nose cone. And if you can see right there, that is G-axis's head. So you do want to make sure and rotate the head around. Or he's going to be looking at you through the cockpit. Streamline's up pretty good. I mean, I wish something could have been done with the little foot wing or the ankle wings there. But I guess you could fold those up like so. Doesn't look too bad that way. There's no landing gear whatsoever, but he sits perfectly fine. Now the weapons, you can attach the weapons right there under the nose cone and take the thin blaster. Nick can peg in either side here. So you've got that look going on or take the blaster off and you can actually peg it in to the side just like I shown earlier. Now one fault with the Cybertronian jet mode, he's got a very ugly gap right there. So not a big fan of that. But what you could do is rotate the gun around. Let's say you peg it this way to kind of hide that. And then you could take the other blaster and peg it in right there. Like so. So you've got that look going on, but it doesn't look near as good. So it may be something you just have to deal with. I'm sure some 3D printing wizard will come up with something that can hide that spot right there. So there you go, guys. There you have G-Axis in his Cybertronian jet mode. And now for some quick size comparisons. Here is Transformers Legacy G-Axis with Generation Select's G2 Megatron with Larkin's layer upgrades, Generation Select's G2 Ramjet and Legacy Laser Optimus Prime with Toyhacks decals. Transformers Legacy G-Axis was a very pleasant surprise. Never in a million years would I have thought that we would get a figure based on the 1994 comic book villain. This guy not only took me by surprise, but a lot of other Transformer fans as well. And he actually ended up being a great Transformers figure. I love the robot mode and I love the jet mode. The only complaint is the big gap underneath the cockpit. Other than that, this is an awesome figure that I have waited almost 30 years for. So there you go, guys. Transformers Legacy G-Axis. So does a Transformers Legacy G-Axis belong in your collection? Absolutely. I love this figure. And I think you guys will too. Even if you're not familiar with the character at all, this is amazing Transformers toy. And I am still just shocked that we have him. Finally, after all these years, we have an outstanding representation of G-Axis from the Generation 2 comics. Now hopefully we can get a Lord Stratus to go along with him. So yeah, we've got a great robot mode here, great vehicle mode, fun transformation.  So if you see G-Axis on the shelf, pick him up, you are not going to be disappointed. Now guys, if you enjoyed the video, don't forget to like, don't forget to subscribe, and don't forget to click that bell icon to get notified when I upload new videos. Also, if you're in any position to help out the channel, I have a new Super Thanks button thanks to YouTube, and I also offer channel memberships. And I want to give a huge shout out to all my current channel members because it's support like yours that helps keep this channel growing. Once again guys, this is Patriot Prime, signing out.


All right, we've got time just in time. I've learned a new term this weekend called technical problem a Group of us we're heading to the sky bar just around here this area on the Saturday night or Sunday night. Yeah, and We met these bouncer's and they said you're going to the sky bar technical problems They didn't let us go there We speculated the rest of the evening as to what the technical problem was was a fist fight You know what what was going on or did they just not like us? I think it is either we just they just didn't like us So my name is Todd little I'm vice president of product development for IHS IHS is not the Indian Health Service It's a company that's a global company that's invested in data and analytics I'll talk to a little bit about them what I'm going to talk about tonight there to this this afternoon here is Stand back and deliver this is the book that four of us wrote together the four of us met through conference just like this I was organizing the Agile Development Conference in the United States and met up with a number of like-minded You know we'd get together in the hallways and start talking about things that were of interest to us Polly Anna Pickston Neil Nikolaius and and kept McDonald and I said hey You know we've got these ideas and if we pull them together We've got something that's better than each of us individually and the synergy came together in the form of a book The sort of the outline is this model up here where we have purpose collaboration and delivery and Around that the influence that has on decisions we make in the development process So yeah, my welcome to India. I am mr. Toad or And about IHS I said it's not the Indian Health Service It's actually a company that you have definitely heard from and you probably have no idea who we are We're the ones that are the information and data behind a lot of things that are going on in the economy We're the ones that are out there predicting what oil price is going to be we're the ones out there telling you what's happening in the military Advice through a company an acquisition James. We're acquiring a lot of companies We are providing and feeding a lot of the data and analytics and decisions that are influencing a lot of Major economic risk major decisions that that company's making we're a global company I've been involved in global teams one of the reasons I'm here in Bangalore is that we have a very strong facility here in Bangalore many of my team are in Bangalore I Represent in my organization. I have nine different sites that we're developing software and It's you know, we are global company and we're globally distributed to how we develop that software So let's start with it. Let's start with purpose. I think I always like to lead in with purpose That's how we lead in in the book Really, we find is if you really know what your purpose is


Welcome to the Co-Report. I'm Sergeant Tyler Mayne, and I'm Sergeant Lefette Leyva. Saturday, August 15th, Marine Forces Reserves, the Navy Reserve, and the City of Chattanooga will hold a memorial service honoring the four Marines and one Sailor's Guild during the shooting on July 16th. The Commandant, SecDefs, SecNAS, and the Vice President will attend the ceremony to honor the lives of Gunnery Sergeant Thomas Sullivan, Staff Sergeant David Wyatt, Sergeant Carson Holmquist, Lance Corporal Squire Wells, and Petty Officer 2nd Class Randall Smith. Be sure to check our social media sites for live coverage of the memorial service. Last week, the Senate confirmed Lieutenant General Robert Kneller as our 37th Commandant of the Marine Corps. Lieutenant General Kneller will take over as CMC following a passage of command ceremony September 24th at Marine Barracks, Washington, 8th and 9th. To learn more about our 37th Commandant, click the link in the video description. After 53 years of service, the CH-46 C-Night took its final flight August 1st. Throughout its lifetime, the C-Night flew missions during the campaigns in Vietnam, Lebanon, Iraq, and Afghanistan. Although the CH-46 is being replaced by the Osprey, the history of the C-Night will remain with the pilots who flew it and the Marines who got to fly in it. For more information on the final flight, click the link in the video description. Remember, you can catch up on everything else going on around the Corps by logging on to our official social media sites. Thanks for watching guys, we'll see you next payday. Right here on the Corps Report.


Hello, and welcome back to the craft box. My name is Brennan today. This is a very very short video I knew I kind of said that I wouldn't do any more pirate 101 videos But this could happen to be the last one so on Twitter. This is um Use tweet deck to look at Twitter Yeah, I follow this guy called The automaplex and he's he's spoils things for both games But um you shouldn't follow him if you don't want to see spoilers But this is kind of important. So he kind of just said that um in the pirate 101 2017 August producers letter which came out last year because last year was 2017 in August obviously They've changed a bit. So he then also provided two links. So this is the current one. This is the um What they've done now and in the second bit, there's just the normal stuff at the top saying like what they've released so far Ha ha ha ha and then they've got this which is Weird because it's the basically the same stuff that they released in December and it's the December newsletter or the producer's letter. So if we just open up another tab here We can see that real quick producers letters and we can see that the December one We've got all of this stuff here. So this is exactly the same as the 2017 August one, but this is December Even show you December 2017 and then if we go back to this one, it is the same and this is August like Excuse me. So then we go back into the way back machine and we find that the middle paragraph was a whole lot of stuff that they've deleted and You can't simply just delete one two three four five six paragraphs that easily and Accidentally do it on accident. That's not possible. But basically in this paragraph It says well, we can't immediately offer players a major story update We still don't want to move the straight head. So we're going to work on smaller bite-sized chunks Which is like really important for those people who still have hope for pirate 101, which is me as well. So basically They're talking about here. This is like the first part that they released last year, which was the The diplomacy thing I don't even know, but yeah, I played it once I think but kind of boring But basically just having them ambassadors and all that and they've very succeed with something He's been trying to realize for five years long. They didn't want to Yeah, just if you want to read that I'll leave these two links in the description below But it also says they're gonna grow it a little wider with more systems Like more you have PVP but pet systems and all that sort of stuff So kind of like what was it one-on-one has with crafting monstrology and all that sort of stuff is like what I assume they were gonna be planning and more badges and Just a whole bunch of extra stuff that is like really cool to have like Just things that would be good, but no that's been changed into What they did in December? Um So yeah, I don't know where exactly this leaves, but I would definitely love an Explanation from Kings are for this because this is not just a simple mistake. You can't simply mistake this for The other one like that's impossible because they write them all up Like months apart. This was August and this one's December. So like what like nearly half a year apart You can't mistake them for that Especially if it was already like perfect like it was already what you wanted and even that Yeah, it was just the producers led it, but just changing the Bloob address shouldn't be doing that So there's definitely something going on here and I would love if someone could get to the bottom of it I probably can and I don't think we probably can because we don't know what's going on at Kings are but From this I personally wouldn't have too much hope for Pirate 101 anymore Yeah Unfortunately, so if you have any more Questions about this I will probably do more videos I mean if something else happens like this and we find it out then we will definitely be I'll definitely make a video about it, but I'll leave the link to The person who sport of showed it on Twitter and these two links in the description below the August 27 Producers letter and also the way back machine one. But yeah, anyway, just a really short video I thought I should kind of like to let you know because that's pretty important like Three like more than three paragraphs. That's a lot like a whole block That is a lot of stuff to accidentally Replace with stuff that is in the December newsletter Producers letter, so Yeah, just short video. Thank you for watching and to like and subscribe and if you're very subscribed press the little bell So you know exactly when I post another video and a member craft outside the box