of Teacher Academy. We are glad to have you here. The main goal of this webinar as you already know is to facilitate entry and engagement in the course for those who are not familiar or less experienced with Teacher Academy online courses. We hope that after this webinar you will have a clear understanding about how things work in Teacher Academy, how you can make the most out of this course and how you can complete it successfully. To this end we have asked you to post any practical questions you may have and we will try to address them during this webinar. During this webinar we will also have some relevant to the topic discussions and we will present additional opportunities you can see in this period. Please note that this webinar is being recorded and I would like also to inform you that if you have any additional questions during this live event you can post them in the chat box that you see in the right corner. I see your roles already very active there and we will do our best to respond to them. So before starting let us introduce ourselves first. So my name is Efe Sardidu. I'm the instructional designer and course coordinator of this course and other courses of Teacher Academy of School Education Gateway so some of you may know me already and I work as pedagogical officer in European school nets supporting the pedagogical and professional development activities in future classroom lab and other European school net projects. But in this course I'm not alone. I'm very glad to have with me in this course Jose. Jose would you like to introduce yourself? Of course. Hi good afternoon. My name is Jose Villas. I'm a teacher from a high school in Coruña Spain. I teach biology and I'm part of the group of experts in the Ministry of Science in Spain of experts about citizen science. I train teachers and from primary and secondary school on hands on activities and I'm a communicator in a science TV program for kids. So as you can see I am a teacher. Excellent thank you Jose. I'm really happy to have you with me in this initiative. Here you can see also our Twitter handle so if you want to follow us and connect with us please feel free and I also make a note that if you face any technical questions throughout this course you can contact the teacher academy in the email you see there. But in this course it's only it's not only me and you Jose right? No. So in this course we have many participants joining from all around Europe. You see here I've seen already here in the chat we see people from Poland from Greece from Italy from Spain from Portugal from Germany and I'm really happy that we are so many different so many people from different countries here Albania North Macedonia I'm just reading your your chat now. So we are glad to have you all here. So before we start I would like to share some ideas and to to be all on the same page and start reflecting about the topic because our topic is how to address the global climate crisis in our classroom. So to this end I would like you all all of you to go to this to this website to go to menti.com and use the code that you see here. I can add also the website to the chat so it might be easier for you here. So go here use the code 31 38 56 and try to reply with one or two words in this question. So what is the first word or phrase that pops in your mind when you hear climate crisis? I will give you one minute to reply to this question. In this course we are choosing the world crisis instead of chains. So while we do that especially in this period the first climate change sounds rather passive and gentle when what scientists are talking about is a threat for humanity. It's a bit weird to discuss about climate crisis in this period while we are experiencing a global health crisis but the world crisis really shows the urgency of the situation so that's why it has been chosen. So we see already your responses here global warming urgent chains a big problem natural apocalypses yes well we we don't want to to make you feel scared though but we will discuss at the later stage while we are going through this presentation how how this term can be defined actually and how the period we are all experiencing is a bit more relevant to the climate crisis. So disaster urgent and I cannot see all the words high temperature natural health yeah you can continue posting your your answers there I see already 77 people have answered you can continue do that yeah okay pollution excellent take action I also see this response take action I keep that for later because this is what we are going to do also with this course we are teachers and we will try also to take action based on what we can do in our own classrooms or in our teaching in general because now we are not in the classrooms okay excellent so why to address the global climate crisis in your classroom. Cristiano Figueres executive secretary of the united nations framework convention on climate change back in 2011 said it is alarming to admit that if the community of nations is unable to fully stabilize climate change it will threaten where we can live where and how we grow food and where we can find water in other words it will threaten the basic foundation the very stability on which humanity has built its existence so teacher face a demanding task they need to understand what and how to teach about the complex forces driving climate change as well as its impacts on well-being and development prospects they need to show young people how how they and their communities can respond to the threat and play a part in reducing the scope and severity of climate change teachers also need to play their part in taking forward the whole school response to climate change that includes addressing climate and sustainability across the curriculum the audio is very bad okay I'm sorry do you hear me well was that do you hear me well yeah I can hear you perfect if there is my problem or your problem maybe if you can mute while I'm speaking and I will mute when you speak because maybe we have so that's actually what we will try to do in this course and this course will help you to understand and make sense of the scientific evidence behind the crisis and the associated ongoing debates more importantly it will explore how you can approach the topic through projects and other activities in your classroom so I have another question for you and in the meantime while you're applying to this question I will also try to solve the problem with the mic that I may have so how relevant is this learning how relevant is learning about the climate crisis in this period in a period where we are experiencing a health crisis let's see okay I hope you see the results to your answers also right so 97 percent of the participants think that it's quite relevant in this period as it is it is a serious issue to discuss and learn about especially in this period some people are a bit neutral so it is something to think about alongside other societal issues but I'm happy that you see that this topic is relevant in this period so I'm continuing back to the presentation what is happening in this period and why we are explicitly referring to that we can obviously we cannot ignore the current situation we are all experiencing right now unfortunately a threat is unfolding which gives us a direct comparison with the climate crisis what so what made the two crises so different in terms of the threat itself and in terms of our response let's see the coronavirus outbreak has triggered global alarm and the world jumped into action because it feels immediate it's here today and if we don't act on it today it's going to cost countless lives so we moved on restrictions on travel factories setting down guarantees and we have seen a huge surge on scientific research around the topic so we have seen big structural changes climate change also requires big structural structural changes which will take us here to put into place so probably the best we can do about this topic is to put our efforts in stopping us getting to that point of crisis in the first place instead of jumping into action when there is an extreme weather event for example which of course is necessary what about putting our efforts to stop one of the biggest driving forces climate change for the topic of climate change often public or political opinion view the necessary steps as not realistic but how realistic was it for you to stay at home for more than one month some weeks ago so why our responses to those two threats are so different we can open a big discussion here but i'm going to stick to our topic so the kind of fear that future generations will inherit depends on what we are doing today actually there is an additional connection between the two crises the environmental changes caused by the coronavirus lockdown were first visible from space in the first picture for instance nasa's earth observatory pollution satellites so significant decreases decreases in air pollution over china since the coronavirus outbreak began and the second picture highlights that the water in the canals of venez now looks clearer because there is less traffic on the canals while we are staying at home nature seems to be increasingly able to breathe more easily that's a very concrete evidence that shows that climate change is caused by human activities that's why we all have a duty to act to stop the climate getting worse the actions we take now will determine what the world will live in will look like in 10 20 or 50 years time so education is critical in this regard actually the current situation enables the change of perspective young people now have because of the covid 19 crisis on what the crisis really means it is not a far away thing that happens to other people it can be terrifying and require drastic measures it also pre prioritizes the scientific perspective through which we should approach things like that both covid 19 crisis and climate crisis are based on scientific facts however we have seen many conspiracy theories and fake experts regarding both topics that's an area that we should focus more in our teaching we should support our students to be critical thinkers and build an immunity to fake news so we first need to understand and counter misinformation about climate change and we can do that with many creative and inspiring ways i'm sure that during this course we will meet many of the of them coming out of you and your amazing practices cranky uncle for example is the creation of the scientist and cartoonist John Cook who uses cartoons humor and critical thinking to expose the misleading techniques of science denial and build public resilience against misinformation to explain why and how some people reject scientific evidence co-creating the character cranky uncle the family member we all have who thinks he knows better than the world scientists you can have a look in the link here and find out more about this character and how it can inspire you for more another interesting tool is this app named spot the fake which has been developed as an outcome of the project digital resistance found by the european union spot the fake is an app for mobile phones designed to teach students how to recognize fake news and how to critically assess and access information found online you can download it in your device or try it online on the last link you will find relevant free educational resources and worksheets developed by web wise for teachers that you might find useful please note that you will receive presentation the presentation so it will be uploaded in our platform so you will be able to visit the links as well so let's go back to practicalities Jose would you like to explain us the course structure and tell us how we can succeed in this course yeah can you hear me now yes okay perfect uh first of all the course structure we start as you know on 27th of april and we finish on in the 3rd of june so we have different life events big life events that like like this one and we have the first one on the 3rd 13th of may at the at 6 o'clock in the afternoon and it's a twitter chat a twitter chat as you know twitter is a very popular social media platform to discuss these kind of topics and the topic of climate crisis is very known in this in this platform so we have a twitter chat and we can address the global crisis and the sustainability in our classrooms and after that we have even to hear your views about the most important part of this chat is to know other people that is involved in this in this kind of topic and to connect with them and to share our resources in this case the next life event is in 28th of may at five in the afternoon and so teacher meeting is a organized teacher meeting but is in an informal meeting is to know another people who is working in this in this our adventure in our course and is to know the good practice of these of these people and to to to learn from our peers I think that one of the most important parts of these courses to learn about what is the what is the activities that other peers are are doing in in in this topic like this the climate crisis and the last one is a school education gateway webinar that we are going to to announce soon an expert and a teacher that is going to be involved in this one so as you can see the course of structure has four modules each model open every Monday as you can see then the last Monday is 28th of May and you have for each Monday for each module you have seven days after that seven days you have ten days of race period to finish the the taxes you if you want so the first one is the module to understand the global climate crisis the second module is to how we can teach about the global the climate crisis and how we are involved in the sustainability of the climate crisis in in our classes but the last one for me is one of the most important one is the the module for is the how to implement this this climate crisis in our teaching so because it's the most important one and the most tricky one you can see which is the way that we can be we can do this for model first of all we are going we're going to submit our job our work and this job is going this project is going to be assessed for three years three of our colleagues in our in this course but we are going to review the the the activity of the projects of other three peers so this is a a big way to know how the other people is working on on this topic and how they implement in the classes or in the teaching in the teaching experience in this in this case so the most important question sometimes for the courses is how to certificate and these are the four big tips for for this one the first one is visit all sections of the models of course the second one is be an active participant and engage in discussions in my case I I would like to say be very active of course in and participating and engaging discussions and of course develop and submit your classroom projects and remember the deadline 3rd of June but if you do as soon as possible in the first seven days is perfect because we are going to do the next activities that is to review the the activity of the other three peers so the deadline is 3rd of June but it's the last one the last one day remember that when you finish the course you don't need you can continue sharing your your experiences but you can see the activities of the of the course during the Sundays one of the things that you are going to do one of the activities that we recommend strongly recommend is to to do to make a learning diary if you want to know how is your evolution if you want to know which is you are you doing during this this course the best thing that you can do is to do a learning diary that learning diary and it's very useful at the end of the in the in the fourth module because you can see all the things that you do during the during the these weeks so it's very easy it's a resume or you can summarize all your activities during four weeks in this learning diary if you want to know how to do this learning diary the best way is to follow this youtube video how participating the discussions one of them is to follow the pamphlet of course and the forum of the of the of the course the pamphlet is very open is is a very good tool to to know and to practice with them and the other the other one is the social media the facebook group and and twitter you can you can see and you can follow the course even in different in different tools or in different devices and and you can be in contact with the other with other peers and colleagues so the best thing that you can do now is to invite peers and and friends to join because it's very very grateful to to do this kind of activities in this kind of courses with other people than you know so they it is open to to continue and i recommend you that just take with other people indeed so please invite your colleagues invite your friends to join it's still very early on this course we started on monday so certain news and invite your friends because learning together is better just to reply quickly to some questions that i read in the chat so yeah the mandatory activity of this course since in the module four all the other activities of course we highly recommend you to take part in the other activities as well because you can exchange and inspire your colleagues but the only mandatory activity is in the fourth modules social media are not necessary but of course we have the facebook group and we have a twitter so it's also good to to be there so you keep an eye on what's going on there and regarding the live events you can find more information on the live event section in the platform so before we leave and before i give you some time to to ask any other questions you may have i'm keeping a surprise for you so i didn't present math at the beginning now it's the right the right time to do so because as part of this course we also suggest you another MOOC another MOOC that could work as a complementary resource to your learning and to actually support your efforts to to improve your knowledge and practices in this topic so i would like to introduce you Matt Larsen Doh Mattis Education Manager at WWF in United Kingdom he developed the educational program that accompanied the our planet Netflix series which includes the popular natural ID app SIG and it's a combining resource pack the our planet lab local action and biodiversity to it Mattis chair of social social educational charity HVP Nepal United Kingdom Matt could you please turn on your camera and your microphone so we can welcome you in this hello the sound works i can see the little thing coming up excellent so i think it is working it's working perfect so thank you so much for giving me this this small platform i'm absolutely delighted that this MOOC that you've developed is coming out so close to the launch of ours they really are very complimentary and we'll be doing the same thing to people who come through our course will be signposting this fantastic course on educating the climate crisis um as you'll see it really does fit um perfectly together um so uh i am the education manager at WWF UK however um as as you heard previously i worked on the global education program associated with the our planet series um that was a Netflix series that some of you may have seen um if you haven't because you don't have Netflix it is now available uh for free on YouTube and it's a fantastic resource for the classroom um or to direct your students to watch and also for your own interest um if you have seen the series you'll know that its focus uh was not on one particular issue but on how the planet works as a living system um so it's it shows how the different biomes of the planet all have a role to play uh to create the conditions for life and then how human activity in each of those biomes and the way that we live generally um is actually preventing the planet from uh supporting life from supporting us in the future so climate change is therefore one of the issues that the series deals with and it's an incredibly important issue and it's obviously the one uh which most people are aware of these days when it comes to environmental crisis um and so it's a fantastic place to start and it's also a fantastic opportunity to engage students in thinking about issues that go beyond climate change and so the course that we've developed is called education for a sustainable planet and it's built around some of the content that was developed for the our planet series so some beautiful video footage um that was shot for the series and also for the website ourplanet.com and it also tries to make a similar point that there is a living system our planet that we need to support um and enable to continue to function if we want to survive for the years ahead so that means that it takes one step back from focusing on a specific issue like climate change and looks at the very broadest issue and the very broadest issue is that we are not living within our means we are not living sustainably and and uh at WWF we believe that this is the principle that we really need to underpin um everything that students do around uh geography and science um and any environmental issue that they discuss or study at school um because it's not just about understanding the causes of one particular issue it should be about the principles that can prevent us from causing issues in the first place and breaking the living system that supports us on our planet and so what sustainability and an understanding of sustainability means in practice is that we mustn't just think about the way we need to change um the way we live we need to actually change the way we think because we need to be able to look at everything that we do now but also anything that we might do in the future that we currently don't do um and we need to think about whether or not it is sustainable whether or not it's going to cause problems whether it's contributing to climate change or whether it's causing another problem um and think about whether or not it's actually a sensible course of action and if students can be led to understand how to think according to the principles of sustainability um then that means they will be equipped whatever they want to do later in life to do it in a way that contributes to a sustainable planet to a sustainable future for our planet. So I've already mentioned our planet because I thought this slide would have gone but the series itself as I mentioned takes you on a journey through the different biomes of our planet and talks about how damaging one biome leads to problems across other parts of the planet and so with climate change there's a really important side of it which is that it is contributing to problems in the natural world as well as changes to human life and but also are damaged to the natural world that has nothing to do with climate change um so our habitat destruction and the impact of land use for farming and so on that in itself is stopping the planet from being able to stabilize the climate um so it's not just about the things we're doing that are directly causing climate change it's about biodiversity loss contributing to climate change and making the planet less able to deal with it um so we want to encourage students to recognize the links between issues and so one of the key ones being the link between climate change and biodiversity loss um so we know that students are aware of climate change we know that they are striking on Fridays um because this is something which is scaring them something which is worrying them something which threatens their future and we don't just want them to be angry we don't just want them to see activism as the only way to bring positive change because it shouldn't just be about stopping what we're doing that's damaging the planet it should be about working positively towards a better form of life on our planet and that's what this MOOC that we've developed is all about it's about thinking about the whole system and underpinning all decisions with the principles of sustainable thinking and system thinking so seeing the connections and just like with your with the the climate change education course um we promote a whole school approach so it really does complement well anything that you learn um from one course uh will relate to uh what you want to apply from the other course and so we talk about uh how schools are not just ways for students to gain skills and knowledge um they are uh places within a community that have an impact themselves they have grounds so they are themselves sites which can have biodiversity impact good or bad um they are opportunities to connect with the wider community the families of students the families of staff the suppliers that bring food and other supplies into the school all of these um are ways to influence uh wider society so a school um has a huge potential impact huge potential positive impact so in our course um we try to encourage all educators and principals to think about not only whether or not they are teaching positive values and teaching uh the the facts and the science behind the issues that are planet spaces but also whether they are demonstrating the principles of sustainability and good practice environmentally by the way the school is actually uh working itself and um by the way that the school is run and managed and schools um are not just places um which can do positive uh could do things well or can do things badly and can set a good example or not and they're also convening places um so schools and colleges are uh incredibly important hubs of the community and they can drive individual action by students but also they can bring together individual actions not just um by students but also by the wider community because of the place that they they hold in a community and they can drive community action and of course that's where it starts to scale up and have more social impact and it can lead to influence on business and even governments and it's those uh big changes we believe um can drive the huge changes that are needed at the planetary level and as a wider point this is something which the MOOC also deals with is how um everything uh that we teach our students about sustainability and about the environment should be connected to how change happens there should be political literacy alongside environmental literacy so this understanding of um how we can bring change is a really good way of countering the helplessness and the fear um that the scale of crisis can cause in young people so um the MOOC um in its essential form is a course in taking a whole school approach to education for sustainable development it has five modules um bookended by an introduction and some uh resource and signposts which will include this climate change education course um and uh it will share some of the videos that are going you're going to experience if you if you take this climate change education course because there is such profitability you might find that some modules you can really power through but each module should take about an hour to complete and you can do them in a different order if there's a particular area of interest um and when you complete all the modules uh you'll have um you'll be able to claim your course uh completion certificate but there'll also be a badge for each module because they are important concepts in their own right um so as you can see it covers the importance of education for sustainable development how uh this idea of sustainable thinking should permeate everything that we do and the way that we think module two is all about systems thinking connecting issues to issues and connecting uh impact to causes um module three is about uh learning in an active and participatory way so that these things come alive in the classroom and also go beyond the classroom uh four is all about uh schools themselves um being exemplars of sustainability and demonstrating uh sustainable practice so that people involved in the school community live it as well as learning it and module five is about um what you can do to empower young people uh who are introduced to these concepts and to these skills um to actually bring about positive social change themselves and i just wanted to mention a couple of really complementary resources um that are signposted from our course anyway um but this uh our planet's future summit toolkit is available from wwfuk's website but also rplanet.com and it's a really good way of doing what i just described bringing together uh different issues and different biomes um so that you can explore the connections between them and but also um bringing political literacy uh into the picture with environmental literacy and it's a role played uh international summit so uh students take on different roles either world leaders or representatives of different biomes so they're there as environmental experts giving evidence and and there's a big discussion lots of presentations so each student uh research is something and presents on that but also here's all of the other issues and then there's a big round table debate the world leaders get the final say um but they have to think about what they've learned and how they can make that into a plan for the future of our planet so it's trying to make sure that no issue is seen in isolation that everything is seen as connected and then the other thing i wanted to mention which i think epi already mentioned was um our citizen science stream is all about um looking at uh real world um landscapes real world biodiversity um so that students can gain uh some hands-on experience of uh these subjects so we have this fantastic actual speak which is all about being able to identify the wildlife around you um and that's our way of making sure that in learning about uh these issues in learning about the the big planet wide uh crisis um students have something practical that they can go out and do they can use this app to explore their local wildlife see changes in the landscape uh changes in the ecosystem over time and but also they can be citizen scientists they can take wildlife observations and upload them to help scientists monitor biodiversity so it's a real practical them experience um that also means that they have a practical way of um relating what they learn about in the classroom to uh the the landscape around them so i just wanted to leave you with the five principles that underpin our course um there'll all be things that you dive into in more detail if you can take the time to do it so the first is that as educators we can teach the connections we can make sure that students do not um just learn the science of a particular cause and effect and that they actually understand um that everything that we do that has an impact on the world um is connected to everything else and one uh one change um for the planet uh leads to many other changes secondly we can foster sustainable values we don't just have to teach the science behind why they're important we can help uh students and staff of course put them into practice thirdly we can nurture a connection to nature so that uh students become more able to see changes in their own environment and more sensitive to the impact of their own actions outdoor classroom um and forest school and all of these other um methodologies that are available to us um that um help us to get students to spend some time um exploring and understanding better the natural world fourth we can support and empower students we don't just have to be uh leading them we can uh stand behind them and boost them if there's something that they want to do um so giving them a role um in defining what changes might be made within the school and also helping them um to make the connections that they need take action themselves so the ways we can really um lead to these principles and this knowledge becoming something real to students something they can use and therefore something that they believe in and that drives them forward and lastly we can lead the way we can lead by example both in our individual lives but also um in the practice of the school so I will just pop into the chat a link to the page we've got on our website the MOOC is going to be going live within the next two weeks it was meant to be live already but with COVID-19 things have slipped a little bit and I'm sure we're not the only um people to feel the impact on that um but if you go to this website um you'll be able to sign up to receive an update when it goes live and I really hope that you'll find it a very useful compliment to the climate change education course um it's also free um and as I said it is um it does come with participation so thank you very much excellent Matt thank you very much for presenting this course I we highly recommend you participants to join so please make your agenda your weekly agenda to save some time both for the climate change MOOC and the MOOC that Matt just presented to you because there are two great opportunities now in this period which are both free and they're very well prepared for you to equip you with the right knowledge and skills and attitude that you need in order to include these elements in in your teaching so um uh I think we have answered answered most of your questions you had so far during the presentation if you have any other question please post it here now it's the last opportunity um the recording as we said will be available in our platform we we have seen also some more content related questions but we are not going to reveal everything from now at this very moment so stay tuned and we hope that until the end of the courses you will have all your questions answered so since you don't have any other questions I'm gonna close this webinar I'm gonna thank my two great gentlemen for being here and presenting their practices thank you Jose thank you Matt um and thank you all of you 250 people that you saved this time slot for to spend it with us in this webinar I hope you are enjoying the course so far I hope you find the first module of the course useful stay tuned interact with your colleagues take as much as you can inspire each other and enjoy this learning journey have a nice evening everybody and take care


Hello, and welcome back to the craft box. My name is Brent and today we are doing some more completionist crafter I don't even know what episode this is. I think it's like 540 something I don't know but today we are crafting the poetic toga Easy peasy again an aquila from callos coppersmith on screen is everything you will need So yeah, that's cool. Not too bad basically the same as everything else that we've crafted there recently Equipment crafting station as always and we will go to robes and we will cast the poetic toga One of the senators which again, I would just farm the first boss And we you eventually get it Minotaur can be bought from Fitzhume crystal vials Really simple to get just buy them from a reagent into black pearls Go and watch the reagent hunters or gone which reagent hunters water lily cat tail transmute or just farming cat tails best way blood moss Gardening for pink dandy lines is how I get them read mandrake. I don't even know I almost have an idea how I get read mandrake. But yeah, there we go. That is the adepts poetic Laurel it gives 200 and 10 health 4% power pip chance 10% death resist 5% incoming life heal obviously or healing spell 3% outgoing healing spell 10% life Resist 4% ec myth accuracy and 11% myth damage as always the Zeus hat would be on screen as well Robes sorry, so you know exactly what you're comparing it to But yeah, otherwise, thank you for watching. This is all for today Remember to leave a like and subscribe if you subscribe press the little bell so you know exactly when I post another video and remember to craft outside the box


The IAEA Director-General has addressed the Pacific Island Forum about the controlled discharge of water from the Fukushima Daiichi nuclear power plant. Pacific leaders told Rafael Mariano-Grossy that their current concerns are also influenced by past nuclear testing in the region. The nuclear legacy in the Pacific is a very alarming and a concerning issue for us. I think it's really important to continue the engagement and sharing information so that member countries can understand more on the nuclear implications. The Director-General explained the independent, neutral and scientific role of the IAEA to monitor the discharge before, during and after the process starts. Mr. Grossy also used his visit to learn more about the challenges facing the island nation and to discuss the ways nuclear science can help address these issues from climate change to food security to plastic pollution. Raising public awareness through education and training benefits more the use of nuclear science and technology for development and above all transform fear to confidence for many things nuclear.


The search for a missing Duluth teenager is underway and area law enforcement agencies are hoping the public can help find her. Seventeen-year-old Lea Buring was last seen on the 4,000 block of West 9th Street in Duluth on Saturday. She has not been seen or heard from since and may be in need of medical attention. Buring is described as a white female with brown hair and hazel or brown eyes. She is five foot seven inches tall and 180 pounds. Buring may be using the name Angel Faith James and have a knee brace on her right knee. Authorities believe she is still in the Duluth or Superior Wisconsin area, but may have left that area. If you have seen Lea or know her current whereabouts, you are asked to call the Duluth Police Department at the number on your screen. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


One of the things we commonly do in programming is find where an item is within an array. Consider this array of integers. We'd like to find out where the number 15 is in the array. The way we do it by hand is to scan the array from left to right until we find the number, as in this case. Or if we get to the end and we haven't found the number. Let's write the code to do a linear search through a data array looking for a given value and returning to position where it was found. We'll run a for loop starting at the beginning of the array as long as the position is less than the length of the array, one position at a time. And if the data at the position that we're looking at equals the value we're looking for, we'll return that position. If we get out of the loop without returning anything, that means the value wasn't in the array and we'll return negative one to indicate an invalid index. Here's our main program. It sets up an array of integers and then has a do while loop that asks for a number to find, a value. Does a linear search through the data array and tells where it was found and prints the result? Let's compile that and let's run it. We'll look for 15. It's at index 3. Let's look for 78, which isn't in the array, and it gives us back a negative 1. When testing a program, you want to test at the boundaries. You want to test to see that it will find the first element in the array and the last element in the array. And this program works. That's our linear search. Although the program works, my personal preference is to have only one return from a method than having two different places where we return a value. Let's rewrite this method to use only one return. The way we're going to do this is we're going to start our position at zero. As long as there are items left to look at in the data array and the one that we're currently looking at is not equal to the value, we move on to the next position. Once we exit the loop, we're going to see if the position is less than the length of the array. If so, that's where it was found. Otherwise, it's not found. And we'll use the ternary operator instead of an if statement. We're going to return, if the position is less than data dot length, the position, otherwise negative one. Let's compile that and let's run it. 15 is found at index 3, 78 isn't in the array, 37 is at the beginning, and 56 is at the end. And this algorithm also works. One thing to note, the time required for this algorithm is proportional to the number of items. If your array has 60 items, then on the average it will take 10 times as long as when the array has only 6 items. In our next video, we'll examine a more efficient search, the binary search.


All right, so if you can tell if you follow me on Twitter, I have a terrible cold. I've had awful Defcon Been sick the whole time. I didn't get to play soccer. I haven't you know I've been sober for 72 hours and I can barely talk so I'm gonna do my best and you know bear with me But I do have a backup plan. So here's my backup plan. Let me see here If I start to phase out here, you'll be here this My battery hacking talk Is that good? Should I do that instead? All right, I'll try it if I get too nasally. I'm gonna go back to the computer. So so hopefully that won't happen Okay, so who am I? And sorry about the screen. I guess they had to move it up. So so people in the front could see So I used to work at the NSA for five years doing secret stuff And then when the iPhone came out I hacked it and when the Android phone came out the gene one fun I hacked that one ponon last four years. I've been sporting the stylist jacket So if you see a guy, you know wearing a white jacket for some reason, that's probably me So everyone who won this year got the jacket for some reason I'm the only one who wears it written a couple books and that sort of stuff and then the most important thing is there's an info So comic that has my name in it. So I feel pretty cool about that. Although. I don't I don't understand this particular comic But maybe that's because it's about me Okay, so why am I why am I here? Why did I decided to do battery firmware hacking? So last year I came to to black hat and Def Con and and I saw Barmy Jack's talk and I would thought it was really awesome. So I was like, this is cool that you know It's easy to explain to someone you walk up to an ATM and it gives you money, right? This is this is what it's all about. It's not like hey I can make calculator pop up on your computer like it's just not impressive and you know That's what I usually do. I usually do less impressive stuff than that It's like I can make this bit change or something, right? So so then I was like I need to do something cool like Barney me So I came across this YouTube video of this you know computer like catching on fire and like the flames just going feet Hi, I was like I want to do that. So So I set out like in September last year like right after black hat I was like, I'm gonna see if someone remotely could blow up my computer and you're gonna find out I actually didn't do that, but I made a lot of progress and so it's sort of interesting anyway and Maybe someone who's a little smarter than me can actually finish it up for me and also I'm kind of a chicken So you'll see that you can see about that too Okay, so this is the spoilers. You know despite what you might have read in the paper. I actually didn't blow up anything Mostly well, you'll see there's a lot of layers of security. I totally bust one of them and and then I got kind of scared so there's there's like all these parameters You can switch and you got charge it and discharge it and maybe overnight and I work out of my home and you know So anybody's kind of a chicken shit, but you'll see that it's kind of cool So what what's the talk about so mostly I'll start out with a little sort of intro on how Batteries work and that sort of thing and then I'm gonna basically tell you the story of like seven months my life looking into this and You know it's it's mostly a story about a guy who's good at software hacking who tried to do hardware hacking So the good thing about that is you know probably not you guys who were in hardware hacking village Which I should actually go to and hang out But the guys you do software you'll probably learn some stuff Hopefully about how to do hardware because that's what I had to learn and then I'll talk about like you know This so what question since I didn't blow up something something. What did I do and what could I do? All right, so so when I started this whole thing I didn't know anything about batteries or you know chargers or really anything about hardware So I'm giving you a little bit of a spoiler here because just to sort of make sense of what I'm going But I didn't know this when I started so there's this document called the smart battery specification and What it does is it outlines exactly how? Batteries and chargers and computers are supposed to communicate with each other and so this is this sort of justifies You know what I went after so it says you know safety is a primary concern It's great The primary con concept is that the primary intelligence is supposed to be in the battery itself, so You know the computer smart it doesn't have to be the charger doesn't have to be smart What's supposed to be smart in this whole thing is the battery so the brains are supposed to be in the battery and the reason is because When the the battery knows the most about the battery so it knows how much charge it's gotten it knows how much You know how much it's got stored in it. It knows what its temperature is and knows what kind of chemistry it has so the The battery is supposed to have to be the brains of the operation and everything else is supposed to rely on that And so that's why I attack the brains So I'm going to go after the little the little chip on the battery okay, so What so what are smart batteries right I just thought these were like Dura cells well they they're Dura cells with a chip So are actually more than one chip you'll see so There's just a you know There's chemistry cells and then there's some some chips and this main job is to make sure that it's it gets charged And it doesn't blow up and if you if you have a MacBook like me and you hit You know the the more information about your system you end up with a screen that looks like that if you can read it And on this one on when I started it didn't say this on this one Actually, if you look it says device named BQ 20z 451 That's the the model the chip from from Texas Instruments on this battery But anyway this if this information is obtained from the battery by the the operating system asking the battery and the battery telling it All right, so like you know what what could go wrong with a battery, right? So you could you could make their battery not work anymore, and this is super easy. I do it all the time Never on purpose though and then You could you could reprogram it to you know why and this is what I do Maybe this would allow What what the engineers call thermal runaway and I call like explosions But I didn't do it so I can't say and then the other thing is you can imagine like just talking to you know Have the battery talking non-stop to the to the you know Oh, that's like, you know a Dan Kaminsky Defcon talk and then eventually the OS is gonna get bogged down Dang everyone loves Dan Kaminsky at black hat that would have nailed it. Okay, so And then you can imagine it also if there was a bug in the kernel It could actually attack the kernel from the battery and you figure like, you know Apple can barely write secure software when they know someone's gonna attack them But when they're like, you know reading values from a battery They really probably didn't pay attention and then you you're also on the same bus as like a TPM chip or the bio So you could sniff all sorts of other interesting things That you wouldn't normally have access to because you're you're at this other spot and hardware I see there's things that you might be able to do with this Okay, so so, you know the story was again, you know after black hat I sat around you know mopey trying to think of something interesting to do and eventually I was like Yeah, let's see if I can blow up a computer.  What else? Well, let's just use Google That's what a lot of this talk is I don't know what I'm doing. It's like Google stuff So so in this case I Google Macbook battery firmware, right? That seems like a reasonable thing to start and sure enough the very first hit is about a firmware upgrade that they that Apple put out in 2009 and I was like sweet. It's software I can look at this. I understand this. So I downloaded it checked it out reverse engineered it and I found out a few things. So one thing is that you know The computer is trying to talk to the battery and it just wraps this function I connect method structure is structure zero function over and over and over just keeps calling this and it turns out This is a function that you use an OS X to talk to kernel drivers like kexts So so this is the way you do it and the particular driver. They're talking to it's called Apple smart battery manager So the you know that your user land program it has to have root privileges is but it doesn't have to like have You know wires plug into hardware anything it can it can talk to the battery by use calling this this method So then you know, so I was like, okay cool So I noticed that there's this sort of associated source code bundle on the Apple website called Apple smart battery Actually, it's called power management package. You can download it. It has like some cool source in it But it doesn't build like they don't they give you enough just to like say that's open source But not enough to actually use it So but the cool thing is they have a bunch of header files and you can start to read some interesting stuff about like some of the commands It that this this firmware upgrade is doing. So what's the firmware upgrade do well based on that header file? I can see it does things like It looks at the device name and compares it to a list of things to see whether it this is something It should be upgrading looks at the firmware version looks at the pack I code again making sure it's something You know the right one to upgrade And then some things that it's not in the header files. I don't know what those things are And then I came across this and I was like that's weird It doesn't look like the rest of the program instead of just calling that function over and over It's got these like weird numbers like four one four and three six seven two like these stick out to me Yeah, like I wonder what that is so they're like, well, you know, I don't know I'll Google so so you Google that number and the very first thing is it's like the default is three six seven two oh four one four and It's like this is entered by sending the data for one four to add or zero and it's like look back at here Look, that's what it's doing. And then it's like and then immediately after saying three six seventeen That's exactly what it's doing. So what does it mean and then you can look down a little bit And it's like the default code is set to unsealed to full and it's like talking about like, you know All sorts of stuff and so you Google a little bit more and I come across this document from Texas Instruments That talks about, you know, the unsealed key is this magical number.  Hey, it worked. So So this is basically the whole talk is a slide is you know You know, they use this chip and you can download the spec and they didn't change the passwords on it So it allows it allows you to and this is on every Apple laptop I've ever seen I have a bunch of them and Apparently there's a bunch of other computers that use the same chip, but I don't know if they've actually changed the password So I mean like the chips. Okay, it's just Apple was stupid and didn't change the passwords So anyway, so now I was like sort of in business because a I know I kind of I know it comes from Texas Instruments because that's where I got the dock from I Know Apple is dumb, but I already kind of knew that and then that's that's where I'm at right now So I'm feeling pretty good But I still don't know exactly what chip I just know it came from Texas Instruments So I had to figure out what that was and you should know by now that like, you know I could have just like opened the battery looked at the chip, but I'm totally scared to touch stuff So I've still wanted to find a new software way to do it And so I did was there's a way you could query the battery for particular types of data with these different what they call subclass IDs And so I just did that I said, okay, give me your data for subclass ID zero One two three four and it would give me a certain amount of data for each one and all the Texas Instruments chips They have documentation on what that's supposed to return and each one returns something a little bit different And so I just you know saw what mine was and I looked at every single dock To see which one had sort of the same kind of it returned the right amount of data And I found out what chip it was by doing that. It's a Texas right here. I won't give away the store yet. So anyway, this is what my return subclass zero was 22 bytes So you can see like what kind of stuff this is this is the kind of stuff Like you're messing with now that you probably shouldn't be so it says like first level safety is subclass ID zero So it returns 22 bytes subclass ID one is first level safety current the other one was was voltage and then you keep going then you've got like second level safety and then You know single safety current single safety voltage and so on and it turns out it matches exactly this Texas Instruments chip called Ti BQ 20 z80 and so all the MacBook and MacBook Air's and MacBook Pros and all these Have some sort of chip really close to this not they're not all necessarily the 20s 80 But all this stuff. I'm talking about all works on all of them Okay, so that was my like totally weenie way to figure out what it was and then eventually Like I was like well, I should at least get my hands a little bit dirty So I took a battery and I ripped it apart and so if you take a battery out of your computer It looks like this and there's these little screws So you unscrew it and then you just like rip off the plastic part And this is what you see on the inside so you got six with the impalmer cells And then on the end I go over here It's like where all the electronics stuff is So then you rip that off and it's like whoa, there's lights on and I'm touching it It's like for a software got really creepy So there's like chips and stuff and you can open it up even more and then you can start to read the labels on the chips So there's one that's called BQ 29312 you can download information about that. This job is basically it does safety stuff and then so You know let's this talk, you know There was a newspaper and all that stuff and Travis Goodspeed who's like a total hardware nut Just because he's he's he's curious He takes one of his batteries and he you know rips apart the the chips He puts an acid bath and x-rays it and this is this is some pictures He did just because he's he's super curious guys. This is what the chip looks like under x-ray and Then on the other side of that that board you've got the BQ 20s 80 Which is the brains of the operation and then this other chip 29412 which is another one of these chips that does Safety checks so and then here is the BQ 20s 80. Thanks to Travis for these pictures Pretty cool So anyway So the the BQ 20s 80 is the main brains That's the chip you can talk to through that driver the other two chips You can't talk to directly they're in charge of some safety stuff But what you can do is you can set the parameters in the 20s 80 and it will push out those parameters to the other chips You can configure those other chips You just can't talk to them directly, but that's all you really need so like you can say oh, yeah You're in charge of the second level safety suite Yeah, yeah, don't go off until you're at like, you know I have million degrees and then then everything's bad, but until that it's cool So so you can still mess with those those other chips Ups, I skipped this slide So so this is so again like it took me that long to figure out what kind of chip was actually if I would have paid attention The actual header file they tell me exactly what it was Oh well, that's why you know, that's why we do it and that's why it took me seven months instead of my normal project Which is like two weeks All right, so so where am I now so I know you know I actually took it apart so I know what kind of hardware it is I can download information about it I know sort I can see how that this farmer updater talks to it so I can you know probably figure out how to talk to it But I don't really know like what what kind of things to say to it So back to this document the smart battery specification It describes exactly how this sort of communication works. So there's three components. There's the the battery which is in the middle And that's what we've talked about so far There's the charger, which is this thing that that you know decides Somehow how much charge to deliver to the battery or not to charge it and and then there's the host Which is like the computer or the thing that needs to get power So basically this is the way they can communicate they can communicate it's on this bus the SM bus and That's some buses based on I to see which Stephen Ridley gave this like really cool talk about There's lots of things in the Electrax world based on I to see anyway So they talked to each other and it's sort of complicated, but but I I Wrote this API that makes it easy to talk to the battery So and I released it you can now load it and play with your battery But just be careful that you don't break it or at least don't blame me you can break it if you want so anyway, so you can do things now like read a word like read the serial number from the thing you can Unseal it if you know the password which we do you can write a word so you can change what the manufacturer date was you can Change the device name which is what I'm doing here And then you can read data flash which is like all that that stuff. I was talking about about getting the idea stuff So here I'm reading some data flash 50 whatever 57 was I don't know which one those time ahead then you can get full access which I'll talk about in a Minute which is like the it's the equivalent of like, you know root or whatever on the battery And then you can seal things back up when you're done Okay, so so what kind of things can you can you know? Computer or can we say to the battery so that there's this document that says exactly what to do So there's these things called standard commands, which is the first column You can do things like ask it what's temperatures was voltages How much charge it wants stuff like that and then there's in the next column extended commands So these are things like a little more complicated These are things you need more privileges to do so like you can set passwords You can control the FETs, which is the little thing that that decide, you know that that physically closes to make electricity run instead of battery And then you know keys and all that kind of stuff then there's this data flash This is all just like data like that. You can configure the device with So there's lots of like interesting things you could imagine playing with right so you can you know change the Chemistry you can change the you know all these thresholds where like bad things are supposed to be happening And so I did that right You know the first thing I do is like How about no overvoltage protection? Let's change that But what happens is the battery still just you know it gets its charge and it knows when it's done and it stops So just changing those thresholds those are like safety features when things go wrong But if you don't make things go wrong somehow then then you don't need those thresholds. They're not ever they're not ever hit So you have to do something more so So you know we talked about how we can unseal it and then we can get full access But there's there's other modes are even more powerful So they're like boot run mode which I'll talk about in a second and that gives you like very low level access like you're sitting You're the ti guy sitting in the factory So these are all the different modes that you can put the battery in so seal That's how it's supposed to ship from them from the factory. Let me see if I have slides Yeah, I'll just go in so I couldn't remember because so the problem with this talk is it was at black I was 75 minutes and now it's 50 minutes and I can't remember for sure what I cut so Bear with me. Okay, so sealed. I guess I thought this was really important because I didn't cut it So it comes from the factory. You're not supposed to mess with it This is how your batteries are supposed to behave. You can't change anything. You can't configure it. You can't do anything So you can only do the standard commands, which was that first column and even there you can Only read them you can't write to those so you can't set anything if you unseal it, which is what the Former upgrade did so in a sense It wasn't bad that they use the default unsealed command because I could have just reverse engineered anything they chose The bad thing is that they they sort of gave me the idea to try the default for the full access and then they didn't change that Anyway, so in the unsealed mode You can then access the some of the extended commands You can read the data flash and write the data flash at that point You can start to do some some real configuration of the thing and this is again what the battery firmware upgrades go to So full access mode then you have all SPS commands. So again, this is like root All SPS commands you can write to any of them that allow you to write you can enter these other like super privileged access modes boot ROM and configuration mode and The the the Apple firmware upgrades don't even need to access that so one of the modes is called configuration mode And this is basically the way that you can configure all the little internal sensors and stuff So, you know the little internal sensor might think yours sent it has, you know 2000 I don't know so it measures, you know the amount of current passing into it and it thinks it's 20 mil amps But really it's 22 and so you tell it that and then it reconfigures itself to know that oh, yeah That was 22 and so you can imagine definitely screwing with it in this mode. I didn't mess with that mode So the things you can configure our number of cells So that means like six in this case current how much current and you're giving it how much voltage it has and what its Temperature is so these are the things that this document I found tells you to do I was like yeah, I wonder if there's any other Calibrations you can do besides those because this sounds like really fun and you know, I don't know and you know It turns out if you Google like what other calibrations for bq-20 z80 besides temperature voltage, you know like Google actually doesn't help in that case So I just went to the store. So I asked the Texas Instruments people so I said So I get on the board and I'm like, hi. Yes You know can I do anything besides this and this like really nice employee named Jackie writes back She's like no only current voltage and temperature Like okay, thanks and the other reason I put this up is I think it's really cool because they have these these message boards there And you earn points and it's like a video game and like I have a hundred five points at this point in this game And it says I'm a prodigy and I like that the game realized that you know While I don't know much about batters. I have a lot of potential. So I felt really good about that okay, so So then the other mode that I deal with a lot is called boot round mode and this allows low level access and In the regular document that talks about SPS It doesn't talk about this at all because really you're not supposed to be doing this unless you know what you're doing and Obviously, I don't So I had to buy some hardware to help me out So and again, this is something I bought just to help figure out things You don't actually need this to do all the sort of attacks I talked about So I bought this evaluation module and it's it's basically the same exact thing That's on the battery except it's like a big board You can look at it and you can play with it And the most important thing is it comes with Windows software that that talks over USB to the chip and let's and you know We'll like program it and stuff and so I can just sort of emulate what it does So this is what it looked like at my house sitting on my like dusty floor And then you'll also notice there's this Radio Shack You know device that I bought there and I was like well I'm a child of the 80s or whatever. So I was like those dudes at Radio Shack They know a lot so I went in there and I was like so I was sort of hint around at my project You know, I'm like, you know, I've worked for a consulting company and we're evaluating the safety of batteries and Tell me about batteries and what do I need to test batteries and the guy was like You can I interest you in a mobile phone, you know So it's not helpful at all So, yeah, and then yeah, it was amazing, but there's a lot of people who are still shop there surprisingly So anyway, this is what the software looks like and this is where I got the little guy for the title screen I think it's really cool. They have them. They have like a you know mascot for battery technology It's like a it's like clippy with a backpack on So this is what the screen looks like and this allows you like the ragui to change all the SPS commands And it shows you all the you know bit fields and what they mean and stuff and You know, so here's the data flash and you know again It tells you what each one means what they what the value is what to change it to But of course the first button that I push when I when I see it is the pro button, right? So it says like this this screen is only for advanced users and you know, I'm certainly an advanced user So it lets you do things like send raw commands And then the best thing is unless you flash the firmware, which is something I really want to do so So then what I what I would wanted to do is see how it's doing all these things and then write some You know write a driver or something for OS X to let me do it Unfortunately, it's a Windows program and I'm trying to do things on Macs But anyway, the the evaluation kit comes with this SREC file Which is has the firmware on it And so I want to I want to reprogram the thing and sniff what it does to know how to how to talk to it on this little level Because there's no documentation.  It says it's an encrypted or the sync file That's the ENC is for encrypted So it's an encrypted SREC file. And so like I reverse engineered the encryption. It's like XOR But you know to give it You know some some some credit. It's not just XOR with a bite It's like XOR with a bite and the previous bite. So it's like, you know, sort of fancy Anyway, the the firmware file has header header stuff It has all the data flash. So those are all the configuration parameters has all the instructions and then a bunch of check sums and stuff So I wrote a pie debug script to intercept the USB traffic and then I could see exactly the sorts and then by comparing it to the things I saw when I would just do a single byte write and all that kind of things in the GUI I could I could figure out sort of what was going on It's like for example, I figured out like oh to read a word apparently you send the command 8 to write a word You send the command 4 and so on So So then I'm back to Google, right? So I saw I Google SM bus bootrom read 8 write 4 So I was like, I don't know how anyone did any research before Google And no Google did not pay me for this talk I should have you know, just had Microsoft pay me I could say yeah, I used being being did it for me So anyway, I came across this document that talks exactly about like how to do Talk in the bootrom level and also it talked about how the firmware the instructions were laid out So that was like really useful to So now when I sniff the reprogram and I see this these are the steps It does what erases everything Instructions in the data and then I can see like how much data it expects and then it reprograms row by row the data And then it reprograms the instructions. So there's 300 hex 300 rows of instructions cool And then I can see the data too. So like I could piece together by the data at sending what the firmware looks like So I pretty much understand now how to write in bootrom to reprogram it just by sniffing I could probably figure out how to read, you know, how to dump the firmware, but I at this point in this story I have it I could get the data flash and But the problem is so I could I either have the firm I could either probably dump the firmware or I could just watch the firmware being uploaded from the src file But I don't know like what the hell is in there So that's the next thing I want to do so I wanted this assemble it and like reverse engineers see how it works But the problem is I don't know what kind of chip it is right?     I'll just steal your intellectual property So so I just take the binary I stick it into Hex editor and I just start staring at it, right? This is the worst job in the world And actually someone asked me about this part and when I gave this talk in black hat And they're like you're like wow you like some kind of genius for looking at this I'm like no This is the beauty of like, you know the cooking show where the guy like throws much stuff to cook six in the oven They're like, hey, it's done right so like this was like really hard Well in the slide deck it's like oh, yeah, it was this is so obvious, right? But this was actually like to me like a week is really hard But you know for your benefit it looks like really cool like I'm awesome So anyway, so so what do you notice in this anyone want to want to beat me to the punch So is there anything special? Can you read the the bites at all anything stick out? Oh I already said and the don't look at that bullet if you want to play my game All right, so you'll notice There's there's threes, right? That's the only thing that you really notice is there's some threes Okay, cool threes and anyone notice the really like you know something special about the threes They're sorry. Well, they're spread out a certain amount. So it turns out that the threes are separated by two bites each So it's like oh, well that's sort of interesting So so that's like well, maybe then it's aligned somehow on you know three bite widths So you know adjusted the hex editor a little bit and then you start to look hey look sure enough If you look down those columns There's there's this this feature that the the high nibble of the third bite is always zero one two or three Okay So maybe and then you can see this is true for all the columns So maybe this is a 22-bit word So there's so I got to find some sort of chip that has 22-bit Length instructions and maybe I'm in good shape and you know that's probably pretty rare Okay, and then the final clue is I looked at the end of the firmware And so what you see here is the very last so there's lots of these things at the end that say 3f ff ff And the very last thing before that is 23 ff ff ff so here's the 23 ff ff Can anyone like what would you think would be the very last instruction in something that you disassembled? See I am smart. I knew the answer. I don't think I've heard the right answer yet. Keep keep going What's at the end of like big functions little functions? Return right, so I'm like well, maybe this is a return because you know, that's how I end my functions And then any guesses what 3f fff is What's that? Oh, I heard it So so like what do you put at the end when you don't want to do anything? No ops So that's what I'm thinking right so not not not not not not not so let's see if I'm right So so the first thing to see if I have if I'm maybe I'm just like totally crazy So I was like well, let's search for this thing that might be a return and the whole file Okay, so there's 410 times it shows up cool, and they're all sort of like randomly spread about we're also cool and And and also I'm very happy to say that they didn't like encode or encrypt the firmware That would have really made this sort of analyzing in a hex editor harder So anyway, you know, I'm pretty sure this thing's a return by now and those other things are no ops And I know 23 bit instructions, so probably that might be enough to go back to my best friend Google But my Google foo was weak I could not find it But my co-worker Dian Los Acos he came up with a Google search that did work So he searched for 23 fff 3 fff 22 bit. I don't know why I didn't think of that so Anyway, I come across this document, you know to be fair to show how hard this research was it wasn't the top hit It was the second hit So you see things like it says blah blah 3 fff is a no op, you know return is 23 ffff So like this is this is pretty much business So you look in there and it says something about cool risk And then you Google for that and you come across the document and you find out that the BQ 20s 80 is a cool risk See 816 chip or at least something so close that it doesn't matter So at this point we're in we're in good good shape So I can read all about it and yeah, so who saw hackers last night? it's a great movie and You know, this is the best line. I think from it Angelina Jolie talking about risk architecture is like a total awesome thing So anyway, so this particular chip it's 8 bits It has has this Harvard risk architecture You can see the data flash 64k 64k flash instructions each 22 bits There's 8 bit registers and of course I don't pro doesn't support it So, you know, this is what the registers look like And luckily since it's risk and risk has got to change everything that There's not too many instructions and so there's this is what they are There's like, you know 40 or something and so basically all you have to do if you like I had a pro like me Is go in and you can you can write in Python I don't pro processor script and Tell it what each of these instructions means and and what it looks like and then it can disassemble it That's what I did. So this is, you know another two weeks of my life in one slide So you just go in this table in the document it explains exactly what the bits are you translate it into Python And then you've got a new setting on your I to pro that says Texas Instruments Cascades BQ 20s 80 And I'm really this is all released to so you can download it and disassemble and see how these things work now. Oh Sorry, you can't they're proprietary So so anyway now if you if you pop in I to pro you you you it's risk So you have to make a separate data section for it and then You're good to go to disassemble But the problem is that it didn't do that great job But I just can help it out. So I know that it's you know, the instructions are fixed length They're all going to be you know, three by a line So I just want to pie that script to go through and disassemble every single instruction because I know that that can mean a data because of the risk architecture So then now I'm in business and this assembled the whole thing pretty much And and I can start reading it and seeing what how this how this is, you know code on the battery What it does So if you can if you can see that so so basically this is some some function that takes in Those SPS commands that you can ask I for the temperature and stuff it does the operation and it sends it back to the computers This is exactly what we would kind of expect to see so this one if you if you can see so on the one on the left it says You know, so it's SPS command 21. So which is the device name So it does some calculations and then sends it back. This one is 20 which is like the manufacturer name sends it back and so forth Okay, cool. So so where are we now I can I can disassemble the firmware I know what's going on the battery but turns out things are going to go wrong for me very soon So I can disassemble it. I can I can dump the the flash cool What else can I do oh so then I start to dump the flash right and I notice that I'm not getting identical results when I flat When I dump the flash each time and you know, that's sort of weird, but man, whatever And then the bad things start to happen, right? So then I like well, let's let's make some changes to the firmware That's really what I want to do. I do it the battery doesn't work anymore So that's bad. The other thing wasn't so bad, but this is bad if I try it So I like well, maybe you have to do exactly what the Texas Instruments like gooey does so I do exactly what it does Bricked so, you know, I'm sort of stuck And so I start to you know, I get on the Apple store and I start ordering these batteries because I'm going through them So quick like faster than they can ship them to me. I'm bricking them So and they're like a hundred twenty nine dollars are pretty expensive so I have a ton of these things and this I have just piles of them in my house that don't work anymore So it's a very expensive hobby Lucky I have a corporate credit card So I had one idea. I was like, hey, I got an idea.  Maybe it's the same thing and then it'll be cheaper So I bought it and yeah, I looked at it. That's got the Texas Instruments ship And as far as I can tell it's pretty much the same, but he changed the password on it. So I Couldn't I couldn't hack it Yeah, so anyway, so the $40 battery was was like super safe. I was like, well, okay So so so to start to fix my problems and stop buying batteries I like I wondered if like the Apple store like Traxxas is like this guy's bought like 10 batteries What's he doing and then like you should have a special like and he's Charlie Miller, you know, he hates Apple He's up to something so So anyway, it turns out by experimentation I found out that when I do the reads from the firmware, they're not always reliable and they don't error out or anything They just return like random crap sometimes And so what I did is now I just have I changed the API that I wrote to like it reads it a few times And it makes sure that it always agrees and then it's okay And so once I do that then everything starts to go much better for me So I can I can you know consecutive dumps of the firmware like agree. So this is this is good All right, so then the next problem.  So when you see that that means you're screwed So so that means you've ripped your your your battery Well, if you're doing my stuff, it otherwise it just means you probably don't have a plug didn't quite time No, the other thing so speaking of the Apple store before I So the one thing you can do from this research I didn't blow up batteries, but I know how to like manipulate them So if ever anyone has a battery that isn't covered under warranty anymore, I can hook you up So I can you can go in and you can change when it was manufactured. You can change how many cycles it's ever seen so you You can make it look like it's like five days old.  I just bought this battery like five days ago And it's not working. I don't know what the problem is It's gonna it's good. So I help out the community when I can All right, so so then I start so now I'm confident I can read firmware and I can write firmware But still it's not working I'm getting this stupid X that says I've done something wrong And so I look at the traffic and I figure out what it is and it turns out that it's this particular flag Is set the data flash failure flag Total failure. So it's so you read it blah blah, and it's like number one after a full reset the instruction flash checks I'm does not verify it.  There's a checksum. I've messed it up So I need to figure that out, but luckily I have the firmware So I can reverse engineer how they do that so it turns out that there's these particular functions that I can't change That are in the realm and one of them is in charge of computing The checksum so I just need to figure out who's using that function And an Ida Pro there's only two references to it One is to some SPS command that Google will tell you has something to do with checksumming and the other one is some function I haven't seen yet, so that's that's my candidate So I check that out if you look at the Ida Pro double that it does something like it reads in and You know four bytes from data flash and then it compares it and if it's zero these four bytes are zero Then it just goes to the end of function Otherwise it switches the end in this calls The checksum and then compares byte for byte if it's true And if it's not true it goes to the bad code and if it is true if they do agree then it goes to the end of the function So anyone have an idea what we should set the that those four bytes in memory to? Zero right so if you set to zero then It doesn't compute the checksum anymore, and you can make any changes you want But then so that was the older version of firmware some of the newer versions of firmware like they got tricky and they Encode or they probably would say they encrypt the checksum And really I think they just did this because you might accidentally get zeros there someday But you wouldn't actually get this weird value So they do some encoding of the thing but the same basic principle applies that if you if you set these four bytes Instead of the zero to an encoded zero then It won't check the checksum anymore So you can just do a raw data flash right to the device to Of zeros for those four bytes, and it won't check the checksum anymore And but since I'm totally scared to go into boot run mode with all my dead batteries I figured out a way to do it without going to the boot run mode You can just figure out that there's there's this Undocumented subclass 57 you can read and the checksum is actually in there so you can change those four bytes Just with using extended SPS So now I can just freely patch The firmware and do whatever I want. So what do I want to do well? I Can make it lie so now when you ask for the temperature I can make a return anything I want But what I need to do is understand What things are asked of the battery and what things you know, so those are I need to know what to lie about So I bought some more stuff plugged it in and I was like, okay now. I'm gonna sniff the traffic The battery has these six little grooves and then maybe a couple other little spots where there's wires two of these are Gotta be S and bus. I don't know which to So I just was like well, I know I'll buy these little probes. I'll hook them up between the things and you know, I'll monitor what's going on This was a disaster So I did this and I must have touched the wrong thing at some time The computers didn't work anymore. So apparently I short shorted something on the main Logic board and so I had to take it into the Apple store Which I do this a lot. I go to the Apple store and I'm like, yeah, this isn't working anymore.  I was like, I don't know. I just turned it on and it doesn't work So they replaced the logic board and then everything was good again. So Yeah, I never tell them what I do Okay, so then I had I said well the problem was you know all these loose wires and stuff So I'm gonna build my own special cable that connects the battery to the computer And so, you know for someone who doesn't do any hardware. This is like a big deal It took me like five days Sodering and you know all this stuff. I plugged in it didn't work.  This is this is the right way to go So then I hook up this this logic analyzer and I can see exactly which cables have the SM bus traffic and then you can actually have ask it to decode it and You can see the actual SM bus right so it's like a right of eight Which is temperature and then it reads the values so B73 so I can see what the temperature responses and Then you know that's cool for just like show But then there's something called a beagle that will will record all this information for a long time You get like cool gooey like this and you can see still that some bus traffic You can record it for like an hour while you're charging your battery and see all the things that are ever asked of the battery and so these are the exact things that the With a computer off and a charging that asked for battery status temperature charging current current voltage Battery mode relative state of change remaining capacity full charge capacity and of those only five ever change So the rest of them are just like yeah everything's cool or whatever so temperature changes But probably that's not so important current, which is the amount of current it's delivering. Well, okay, then voltage Remaining charge or main capacity and relative state charge So these are the things that you could guess the charge is asking for in order to figure out how much charge to deliver it So I'm gonna lie about those things. So I gotta wrap this up quick, but Basically, these are the things I can imagine doing now. I mean so where am I at? I can make the battery do anything I want So so what could what you know, so what right? So breaking the battery is super easy. I'm an expert at it I'm not even just a project. I'm a full-blown expert So here is some code that with my API you can do that all this does is a race is all flash Definitely not gonna recover from that So you can make firmware changes like we've been talking about so you can change all the things that are queried to Why so like no matter how much charge it gets you always like hey, I'm 50% full keep it coming And maybe something bad would happen there so this is basically like a function that deals with SPS commands and I want to change the ones like so like remaining capacity, which is SPS command f instead of f I'm gonna say you you want to know f. I'll tell you 1b. That's manufacturer date And same thing if you ask me for full charge capacity, I'll tell you the serial number So you just make changes to the firmware and the reason is because manufacturer date and serial number are both words Which is the same thing as the remaining capacity full charge capacity But they're never queried and you can send any value you want so then you can control exactly what the battery is Reporting and you can do this live while the battery is charging, you know without any wires or anything just remotely with the root access So this is what the code look like that handles that case And then here's the the API call to pass the firmware and then it just all it changes that code to this code Which just changes the SPS command and then jumps to the other case So now when I query remaining capacity, you know surprisingly It's exactly the same as the manufacturer date and same thing full charge capacity, you know coincidentally is exactly the same as serial number Okay, so now I don't show it here But I go through and I have a white paper that that goes in way more detail than I can't hear But I go and I changed the firmware to lie about every single thing that's queried so now over time it Doesn't it doesn't change I don't want to I can change it on the fly and I did verify that You know these changes that I make do affect how much current is delivered to the battery But in like some sort of weird non like super obvious way So anyway, this is where I like started to get scared and I you know, I tell the story that I was driving, you know to a soccer game or something and I saw like fire trucks and stuff going the other direction I was like, oh shit Because I was just like messing with this stuff when I left It's like I call home and you know my wife answers. I'm like, well, that's good She answered the phone and then I was like, you know that computer upstairs in my office Can you go unplug that? So she did that anyway So I mentioned that there's there's various layers of defense besides this chip that I'm like owning is The main guy in charge of safety, but there's other things that may prevent the big explosion So there's these like thermal cutoffs and that you see so it's like these little cells that they get hot They melt and then you can't get electricity to the cells anymore But the you know the good thing about that batteries, I can't mess with it the off-market one The bad thing is I didn't see these little things on the off-market battery The other the other thing you could imagine again is attacking the kernel from the battery So this would be like a way to have persistent malware for example I didn't look for a particular bug again like knowing Apple. It's hard to imagine. There's not a bug there So you can imagine writing a fuzzer in cool risk assembly and changing the firmware and having the battery literally fuzzing the OS That is crazy, but it would be awesome the easier way is you can just do it in hardware just hook wires in there and emulate the fuzz and Travis Goodspeed is talking about he already has something it basically does that So then if you know, I don't really think there's much risk of anything bad happening to you from this Without someone else doing something, you know a lot more work But if you're the super paranoid type, which probably 90% of people in this room are pretty paranoid I did I released a tool called caulk gun which basically goes in and changes the passwords to values. Nobody knows The source code basically looks like this. It's just like yeah, it gets full access changes the password and that's it So here's all the people who helped me on this talk You know, I'm such a hardware noob that I couldn't get very far. So thanks to all those guys Here's where you can download the paper the slides the tools. I have I had a pro scripts I have the firmware IDB files everything you want to like learn and play with and that's it. Thanks a lot