0. Accounting software quote or estimate form.  Support Accounting Instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category further broken out by course. Each course then organized in a logical reasonable fashion making it much more easy to find what you need then can be done on a YouTube page. We also include added resources such as Excel practice problems PDF files and more like QuickBooks backup files when applicable. So once again click the link below for a free month membership to our website and all the content on it. Here we are in our custom zero homepage. We set up in a prior presentation scrolling in a bit by holding control scrolling up on the mouse wheel currently at one seven five percent zoom in opening the demo file but doing so with the reset item which will reset the data and open the demo file at the same time. Normally we would duplicate a couple tabs at this point and then we would I'm going to hide this open up our financial statements balance sheet and income statement not doing that this time due to the fact the form we're currently looking at which is a quote or estimate will not have an impact on the end financial statements. If I hit the plus button up top and we scroll down we're looking at that quote you might hear be called an estimate for example that's what we're going to focus in on here. First let's take a look at a flow chart to see where it fits in. So I'm going to look at a flow chart here and we're in our customer cycle or revenue cycle where at the end of the cycle we expect our checking account to go up generally. Normally that might happen if you have a simpleized simple kind of system like you're getting paid gig work from a platform you might wait till it clears the bank and then just record the deposit possibly using bank feeds at that point and revenue at that point if you have a cash based system but it's got a cash register you're typically going to have to record the transaction at the point of sale then deposit use the bank feeds to check and if you're on an accrual system which is going to be our major focus here driven by what industry you are in like a landscaper bookkeeper other kind of construction companies typically uh law firms typically they have to do the work first then invoice the customer track the accounts receivable receive the payment and make the deposit the estimate or quote then will typically be the step before we make an invoice if applicable given the the current industry now the kind of industries that might be more likely to have quotes are clearly like a construction industry anything that's more specific in nature meaning it's going to be a custom design type of thing then you might be more likely to use a a quoting type of system so a law firm or bookkeeping firm that's trying to say how how much will it cost to to do this particular job well you might in that case put a quote kind of system in a similar way with like a kind of a job cost system now note that a job cost system in of itself is kind of a specialty area especially for longer term type jobs which are often kind of construction jobs or possibly longer terms law jobs and stuff like that because the fact that they're going to last for a long period of time can kind of distort the revenue recognition processes in terms of completed contract or percentage of completion methods and tracking the jobs can be done in a few different ways so there's there's a projects kind of tool also with zero that can be used for so we're not going to go into a whole lot of detail on that but we'll touch on the concepts related to it remember that if you are a bookkeeper then what you want to do in your business is try to focus on where where's the specific industry that it's going to be where I want to put most of my time which might have some more specialized kind of needs in a long-term job cost or construction area could be one of those specialized industries and one of the specialized areas is the creation of the estimate because if you're making a long-term estimate bidding on jobs then you have to make a competitive yet accurate estimate in order to get the job and be able to execute the job so that your reputation for being able to do that is solid going forward so you can pick up more jobs but even in a more simplified kind of situation you might sell like larger items that are somewhat customized like we're going to go into guitars and you can imagine a situation where they want a particular guitar that's plaid or something like that it's like we don't have any plaid guitars but maybe we can order the guitar however you know we might want to to put in an estimate for how much it's going to cost before we go through the process and possibly get like a down payment in that situation or if if someone is going to like place an order or think about an order that they're placing then you might try to work out how much like they call in and say I want this that and the other thing how much will that cost well one way to kind of tie that out is to create an estimate on how much it'll cost as opposed to creating an invoice once we have the estimate made then we can track to see if it's accepted or not and then once the job actually is done or going forward depending on if it's a process cost system or something like that we can then create an invoice from the estimate so that's what we'll do here let's go back on over and say all right so we've got a quote we would expect the quote then to lead to an invoice if the quote or estimate is accepted so I'm going to go to the plus button we'll create a quote here that's going to be the starting point and I'm just going to make a contact I'm just going to say it's a a a for a new quote create a create a as a new contact so I'm going to say okay and then the date the expiry date if it's not accepted by so I'll keep that as the default number that's populated I'll keep that reference number if we have another reference number which you you might you know apply like a reference kind of system to the quotes that you're putting together currency we're going to keep at the United States branding theme we're going to keep at standard tax exclusive so you've got your tax options tax inclusive no tax so I'll keep that as is and then down here we can add the item so I'm going to imagine someone comes in and asks us for you know particular items maybe they call in or something and we're like okay how much would it cost for these particular items well instead of at making an invoice and then adding them we might make a quote and then say let's add a couple new items here that goes to our items page and I'm just going to say let's say we have a new item and let's say that this is going to be then the item let's say inventory one item that I'm just going to put in my quote and I'm going to say this has our inventory involved with it so we're going to track inventory item so inventory the purchase side of it let's say is uh 500 cost of goods sold account here it's going to be the cost of goods sold well didn't pick it up cost of goods sold and then I'm going to say is it subject to tax I'm going to say it has tax on sales we're going to say and then the price is going to be let's say let's say let's say this is 600 again 600 just so it's and then 1000 down here this is going to be the sales account so that looks good didn't pick it up sales and then tax on sales so that looks good okay so let's say save it I'm going to add some of those inventory items in place just so we have a couple on hand so I'm going to go back into it and say that we're going to have a new adjustment quantity let's say that there's three of them which I said they were 500 and the adjustment account is going to go to cost of goods sold just to put them on the books beginning balance here that's just going to create a journal entry putting the inventory on the books so I'm going to say all right post that adjustment there we have it let's go back to the items so I'm going to go to the business drop down products and services back to the item let's make one more for like an inventory item so let's say new item I'm going to say inventory let's not inventory let's say service item I'll just call it service item generic code or price let's make that 300 dollars account I'm just going to put it to sales sales which is the income account and service item so that looks good I'll save that so now let's go back to the estimate and let's say that we're going to have the inventory item so we know what exactly that's consisting of there it is let's say we had like three of these that they want for whatever reason and then we've got a service item service item and let's say they want didn't I put a price on it I thought it was 300 well let's say two of these at 300 and then it should be going to the sales account of 400 and tax and we're going to say no tax on this on the service item so I'll just generate that and obviously one of the things that that is that could be useful is to calculate that tax because we might see okay yeah you got three of those be 3000 but then the sales tax could be relevant so it's useful then to make the estimate for it and again in a job cost system if you're bidding on a job then you could have a very complex estimate for like a construction job or any kind of custom job that's trying to win the job over in this case we're imagining that someone's basically saying we want this out of the other thing I can make the estimate and at least I'll let it to calculate and then if they say they're going to come in and buy it then maybe I can say okay let's save the estimate we can send it out I'm going to save it and I'm going to mark it and then we can mark it as sent okay and so then if I go to my business drop down and we go to the quotes area notice no transaction was made by that it looks like you would kind of have a transaction it's on the sent area instead of draft now because because it looks like kind of like an invoice but it's just an estimate now if they accept it I can select this item and say okay now they're saying that the estimate is accepted so we're going to say they're going to follow through with it they're going to come in and actually buy the stuff or they're going to take on the job if it was a construction job then back to the business drop down if I go into the quotes that will pull it into the accepted area so now it's been accepted still hasn't created anything on the financial statements balance sheet and income statement because it's still just an estimate we haven't actually done the work when we record revenue we record revenue when we do the work so so now we're going to say okay let's say that we've done the job now and we're going to and we've done the work and we're going to basically invoice them at this point in time so now I can use the a quote to create an invoice so I'm going to say let's go into that create an invoice and mark as so I want to mark as uh as created or invoiced so that the estimate no longer is showing as approved but not invoice so I'm going to say create and then we create the invoice so now it's populated the invoice from the estimate now at this point in time if there's changes to the invoice that differ from the estimate which is quite possible if you're in a construction kind of system depending on the contract you set up you might say hey look this is just an estimate there's so much range that we have within the estimate and then you go through your billing process and so on or if someone comes in and says this is what I want and then they come in and they change their mind and they want something a little different well then you could you know you could change up the invoice at this point in time here obviously and add more lines or whatever you need to do for the invoice and now if I actually record the invoice that's when something actually gets recorded that's when there's going to be an increase to accounts receivable there's going to increase the sales increase in the sales tax decrease in the inventory increase in the cost of goods sold also the sub ledgers for a a a here will be impacted as well as the sub ledger for inventory tracking by item so I'm going to approve it and just check that out I won't go to the reports because we we saw them in in the past complete the tax field so I'm going to say this one says I'll just say it's exempt is that good zero for crying out loud give me a break man okay so now if I go to the business drop down and quotes then now it's moved that from approved to invoiced so that's good because now we're going to say okay that's been completed on the full process and then it'll be on the financial statements as an invoice and we can now track it on the invoices side of things if I go to the invoices there we have the a a a item here uh and it's under it's under the awaiting payment area of course so there it is and we can try to receive payment on it in the future and then we can also track that in the contacts and the customers and we're looking for a a a now a customer going into that we've got the detail down below so we've got the quote that was created and the invoice which is currently awaiting payment that we can discuss with a client there so it'll depend on what kind of industry you're in in terms of how exactly you're gonna you may or may not use the estimates and if you get into like a job cost system with long jobs and whatnot then you're going to get more into like a specific more detailed job cost system and you could try to integrate projects into a job cost system you can use a class tracking possibly method of going into that we've got so we won't we won't dive too much into detail because that's going to be a specialized area we may be able to go in I think we might have a courses on the specializations of job costs and projects in and of themselves because again it's a whole it's a whole specialty area in and of itself and if you are a bookkeeper you you do want to be thinking about okay what kind of clients do I want to pick up do I want clients that are service businesses what kind of industry do I want them in if they're if they're tracking inventory do I want to deal with that how am I going to set up my payroll if they're if they have payroll which we'll talk about more and do I want to be taken on people that have construction companies that have a job cost system especially if it's complex with percentage of completion or completed contract methods differing from normal revenue recognition so just some things to keep in mind so that's that one


Good afternoon, Pastor David. Hey, John. Welcome everybody to a random moment with Pastor David unfiltered and Pastor today my question centers on discernment and I was flipping through the channels the other night and I came across this This person who was on TV claiming that he had the answer to brokenness to depression Almost to salvation, but all you had to do was send a donation of $1,500 and well You'll get a prayer napkin and when you receive this napkin. It's going to give you the power to Unleash the power of God. It's the key to use but send the seed money in Well, I was thinking there's nobody that's going to fall for this and this person was saying all I need is $1,500 from 15 people here in the audience. I'm thinking there's no way people are going to do that and I was amazed by how many people Came and not only there, but online were paying they had a little clicker that showed all the amounts of money And it was spinning fast And I'm thinking about that and then I think about Then there's people out there who it sounds like sound doctrine It looks like sound doctrine Therefore it must be sound doctrine, but there may be a little bit of a twist and yet people are not discerning that So you see one extreme and then you see the other extreme How important is is it for us believers, especially in today's world that we have discernment? You know the Lord said blessed are the ones who are hungry those who are thirsty You know for righteousness and all that and I I think that the hunger and the thirst for the things of God are the things that That's what motivates you to search him out To to begin to discover You know not only what the word says but how it actually applies to our life and Because there are quite a number of people who Who sadly sadly are not going to a church that teaches line upon line And actually is teaching the word What they end up with is they end up with cotton candy You know when you used to go to the the fair and and you have this this large Amount of what appears to be Candy, you know, and it turns out it just evaporates the minute that you put it in your mouth That's what a lot of the the teaching that people actually are attempting to live on That's what a lot of the teaching really is it's just cotton candy It's it's a lot of appearance with no substance So a man who's up their line like that to the people is Disgusting the Lord Jesus Christ and Matthew 23 Made it very clear that there were Charlotte tins even in his day He says they devour widows houses and for a pretense they make long prayers and and so we we have that today we have blind guides and Blind guides who are leading people into ditches right now Because people don't read the word of God on their own Seeking the Lord for wisdom and what they're reading not to say that just by reading you'll have a depth of knowledge It requires study too, but I think a lot of people are not one as they're not reading the word And so when something is said and even though if it's misquoted or sounds close to what they Have read in the past. They they automatically just entrust themselves to it and also Because these false teachers Carry the air of authority, you know, they make these promises you send your money $1,500 because somehow God has given me that number that you're supposed to give to me So even though freely I received and freely I should give no not in this case What I'm going to do is I'm going to sell you his promises and all of that and then finally also I consider the those little monitors of money coming in who knows if that's really money coming in it's just to me It's just something spinning around because so that I think that that's like I come on to I think it's part of the Chicanery that you're seeing online Who's who how are you able to prove to me that that actually is happening that money really is coming in? right and so There are gullible people, but there are also people who are plants in audiences John So these people say now you're gonna give you this money and then after the show they get their money back It's it's just it's a sham. It's it's just wrong and so but we have it We have a lot of that. So what do we do? Well one spend time in the word of God yourself to be aware that when Lord Jesus Christ was asked what are the signs of your coming and Matthew chapter 24 and in in Mark chapter 13 and other places in the gospel of Luke and all They speak concerning. What is the sign of the times and and when you're about to return and Jesus the first thing he says is take heed Matthew 24 take heed that no one deceives you What is the primary sign that we are in the last days? Well Paul said the day will come when people no longer endure healthy doctrine But will heap unto themselves teachers having itching ears and will be turned aside from the truth and turned unto fables Peter gave the same warning. There were false prophets among the people there will be false teachers among you the number one sign of The last days the number one sign isn't the earthquakes. It's not Russia moving against Israel those are all part of it the number one sign Jesus said is deception and How do you know what is true and what is false? You know Spurgeon once said and paraphrasing He said discernment isn't being able to tell truth from error Discernment is being able to tell truth from what is almost true That's that's true discernment because what they're giving sounds true But discernment gives us the ability to say there's something wrong here though That is not the whole truth and nothing but the truth That's why they used to say I don't know if they do or not. You went to jail. You tell me When they used to say Do you solemnly swear to tell the truth the whole truth and nothing but the truth? Why did they say that because you can say some things that are true? So that doesn't mean you're saying the whole truth So you have to say things that are true that are whole truths and then nothing but the truth That's why they say it like that the truth the whole truth nothing but the truth They're trying to make it in such a way that you're caught. You have to tell only the truth Right. Well, a lot of people may hear the truth But it's not the whole truth and it's nothing but the truth and that's where this the charlatan That is robbing widows and robbing those who can least afford it. I have nothing but but discussed for that and anger Jesus got upset when these charlatans were in the temple Selling sacrifices to the poor Pilgrims who were coming to sacrifice or in Passover and he clean cleansed the temple. He did it twice It's my father's house should be a house of prayer. You have made it a den of thieves Well, that's what's happened to the church, but you know judgment comes first on the house of God and so These guys may be living well right now But I don't even know if they know Jesus I how can you how can you love Jesus and not love those whom he loves how can how can you steal from people? Like that. How can you see my mom was my mom was crippled for years? She died a cripple You know, she wanted to believe that that that that she could be healed and these people she wanted to And I never wanted to steal from her the hope of being healed because my God is the healer But I warned her against and and and kept her from giving money to these charlatans Because she asked me you know dad. She used to call me daddy. She says so daddy if I send some money It's no mama. Don't do that mama.  Yeah, well our God is the same God We could pray and ask our God to touch your body And if he does bless him if he doesn't then then that's up to him And she accepted that to the very end of her life. Let's just trust the Lord I wish that the Lord would have healed her many times. I I prayed for her since I was four years old Even as a non-believer, I believed in that's a God. Please God help my mother and when I was 20 I got saved I prayed for her until she died God helped my mama My dad prayed as a believer for mama and and she was not ever physically healed But we rejoiced to know that now she is she's completely healed So again getting back to your your original question John. I really think that That is a it's a shame. It's a shame on on the body of Christ It's it's a blasphemous to to be Making false promises and profiting off of the people and the Lord doesn't take kindly to that And this is why it's so important that we stay in God's way in the word that we're able to discern these Deceptions, amen. Well pastor and go to a church to teach us because there are a lot of churches that say, oh, I'm teaching you When in fact you're getting whatever was in the newspaper yesterday And they think they're able to discern Yes, yes pastor. Thank you so much for that and that was something because I I think about these People and on the other side of that These people have the opportunity to rightly divide God's word and there's no fear in that Well pastor, thank you again. Thank you guys for tuning in. Do want to invite you tomorrow evening to Christ of fire almost at Rastafari. Yeah, Christ of Fari, which is going to be our guest's worship for tomorrow Evening Wednesday at 7 p.m. Invite your friends and family to come out and join us And then again on Sunday at 10 for 8 30 and 10 45 and we look forward to having you Amen, so pastor. Thank you again. Thank you guys for tuning in. God bless you and we'll see you soon


All right, next lecture here is from Artem, next to the fact that he's, how would I spell it? Earning a nice amount of money probably at the lab that's quite renowned in the world as Kaspersky. And from that point on he's not just looking in this lecture to exploit development for Cisco stuff. We all suffered from this last year or we all heard about it and don't know the impact maybe, but he's going to explain us the work he did on that field. So please can I ask you all a warm welcoming applause for Artem Kodradenko. Okay, good. Please give him a warm applause and start. Hello everyone, so excited to finally be able to attend KS Communication Congress. Very happy to see you all. So without further ado let's jump into some practical iOS exploitation. So a few words about myself. My name is Artem. I do stuff, mostly security related stuff, but mostly my areas of expertise are penetration tests, both internal and external, and also do research on my free time. And a bit of bug bounty here and there. And this talk is actually kind of a continuation of my talk this summer at DEFCON about Cisco Catalyst Exploitation. So for those of you who are out of context, let's recap what happened earlier this year. So year 2017 was reaching vulnerabilities for Cisco iOS devices. So we had at least three major advisories for Cisco iOS that represented three remote code execution vulnerabilities. So the first one is a vulnerability in cluster management protocol which resulted in unauthenticated remote code execution via telnet. The second one is SNMP overflow and DHCP, remote code execution. In this lecture I'm going to be talking about two of those vulnerabilities because DHCP, RCE, is yet to be researched. So hopefully by the end of this talk I'm going to be able to show you a live demo of exploiting the SNMP service in Cisco iOS. But first, what happened earlier? So on March 26, 2017, we had a major advisory from Cisco that announcing that hundreds of models of different switches are vulnerable to remote code execution vulnerability. No public code, no public exploit was available and no exploitation in the wild. So it was critical and main points of the vulnerability were as follows. So Cisco switches can be clustered and there's a cluster management protocol built on top of telnet. And this vulnerability is a result of actually two errors, a logic error and a binary error. So the telnet options get parsed regardless whether the switch is in cluster mode or not. And the incorrect processing of this cluster management protocol options result in overflow. So what is interesting about this vulnerability that actually the source of research for Cisco guys was another internal research by the world seven leak that happened in March this year. So many hacking techniques and tools were released to public by WikiLeaks and among many vendors that were affected were Cisco systems. So basically, except for the advisory, you could go to WikiLeaks and read about this potential exploitation technique for Cisco catalyst. So basically, these were notes of an engineer who was testing the actual exploit. There were no actual exploits in the leak. So basically, this worked as follows. There were two modes of interaction. So for example, an attacker could connect to the telnet, overflow the service and be presented with a privilege 15 shell. The other mode of operation is to set for all the subsequent connections to the telnet, there will be credentials without credentials. So I did rediscover this exploit. Full research was presented at DEF CON 25. I was targeting Cisco catalyst to 2660 as a target switch. I also described PowerPC platform exploitation and the way you can debug it. You can look at my blog post about exploiting the service and also the performance of exploit on my GitHub page. But today, I want to talk about something else, about another vulnerability that was announced this year about SNMP remote code execution. So the actual motivation behind this research was that I was conducting an external pen test and it was revealed, and NMAP scan revealed that Cisco router with a default community string was available. So the goal was to get access to the internal network. So the actual advisory said that the attacker needs a read-only community string to get remote code execution on the device. The target router was a 2800 integrated services router, which is a very common device on the networks. So the technical specs for it is it has MIPS, big engine architecture. You don't have any client debugging tools for it available. And it's interesting in that sense that the firmware is relatively new for this router. And it might be interesting to look at the defensive and exploit prevention mechanisms employed by Cisco iOS. What I say relatively new is that interesting thing is that this device is actually end of support. It's not supported. So the last patch for it was came out at 2016. And to remind you, the advisory for SNMP overflow appeared in 2017, in June 2017. But nonetheless, this is still a widely used device. If you search for SNMP banner on showdown, you will find at least 3000 devices with SNMP service available with default public string. So these devices are all supposedly vulnerable to SNMP overflow. The question is whether we can build a remote code execution exploit for it. Since we're going to be exploiting SNMP protocol, let's make a quick recap of how it works. Just a light touch. So SNMP comes with several abbreviations like MIB, which stands for management information base. And it's kind of a collection of objects that can be monitored from the SNMP manager. And so management information base actually consists of object identifiers. And as an example, you all know that printers usually use SNMP, for example, if there's a certain level of ink in the cartridge you can query the SNMP service on this device for the percentage of ink left. So that's kind of example how it works. Management information base looks like a tree. So you have your base element at the top and your leaf elements. So all these elements represent an object that could be queried. We're going to be looking at get request. And that is why the advisory states that for the vulnerability to be triggered, you only have to know the read only community string. So it's a relatively simple protocol. You just supply the object identifier, your querying, and you'll get back the results. So here, for example, we get the router version, the description field. And you can also do this with readily available Linux tools like SNMP Get. So before we will build an exploit, we have a starting point. How do we look for the crash? So the advisory actually states that there are nine different vulnerable management information bases. And you only have to know the read only community string. So for the fuzzing to be done, I'll be using Scapi as a toolkit to work with network protocols. And here you can see that I'm building an object identifier, a valid object identifier that references the description field. And then I'm appending some letters A, which is 65, and an ASCII table. Then I build an IP packet, I build an UDP packet, and SNMP packet inside of it with community string public, and object identifier. So, of course, this will not trigger the overflow because this object identifier is completely fine. How do we get all the object identifiers that our router will respond to? So basically, there are two ways. You can take the firmware and just extract all the oids from it. It's easy to grab them, they're stored in plain text. Another way is to actually look at the vulnerable MIPS and visit the website, OID views, and get all object identifiers from this website. So, as a matter of fact, the first crash I had was in Cisco Alps MIPS, which is kind of related to airplane protocol, which does not concern us, because it's not a focus of our exploitation. So, the actual overflow was in one of its object identifiers. So, this request, this actually crashed the router. When you connect to the Cisco router via a serial cable, you will be, and there's a crash, you will be presented with a stack trace. So, we see here that we got a corrupted program counter, and we also see the state of registers that we have at the moment of crash. So, here you can see that we have control of a program counter. It's called EPC. We control the contents of registers as zero, as one, as two, as three, as four, as five, as six. Further inspection also provided me with knowledge that we have 60 spare bytes on the stack to work with. But before we build the exploit, we have some problems, issues to be solved, and that is, yes, we do control the program counter, but what do we jump to? Is ASLR on? And can we execute shell code directly on the stack? Is stack executable if we can place the shell code on it? Is data caching a problem for us? And if we launch our shell code, can we just patch the code? Is the code section writable? Is the code integrity check on? But the most important question is how can we return the code flow back to the SNMP service? Because iOS is a single binary running in the memory, and if you have an exception in any thread of this big binary, the Cisco device will crash. And if we look at the advisory, one of the indicators of compromise as Cisco states is device reload. So exploitation of the vulnerabilities will cause an affected device to reload. We will build an exploit. We'll try to build an exploit that will not crash the SNMP service on it. Before we dive deeper into the firmware, I want to reference previous researches on this matter. This is by no means a complete list. But this researches actually helped me a lot and seemed interesting and very insightful to me. You should definitely check them out. So, for example, router exploitation by Felix FX Lindner and Cisco iOS shell code by George Nassanko is a great resource for iOS internals and great reference to how iOS works in terms of exploitation. And the third resource, how to cook Cisco, is a great info on exploiting power PC-based Cisco switches and also great info on bypassing common mechanisms and exploit prevention stuff in iOS. So, basically, if I were to tell you how iOS works in one slide, it's basically a single binary running in memory. Everything is statically linked into a single L file which gets loaded on startup. Of course, you have no API whatsoever. Everything has no symbols whatsoever. Yes, there is a Julep C library at the end of the firmware, but it's also kind of hard to use it because you have so many different versions of firmware and the offsets jump and you don't know the exact location of those functions. So, to start with static analysis, you should probably copy the firmware from the flash memory of the router. Use the copy command. It supports TFTP and FTP protocols. So, you download the firmware. The next thing you do is unpack the firmware. The firmware itself, when the router starts loading it, has an initial stop that does the unpacking. But you don't have to reverse engineer that. You just use Beanwalk that will do the unpacking for you. You load the result of unpacking with Beanwalk into Ida Pro. You have to change the processor type to MIPS32 Big India. And we know that this is MIPS because we saw the registers. These registers tell us that it was indeed MIPS architecture. So, one thing I want to note, the actual firmware gets loaded into address 800F00, but the program counter is located at address 4. And this is because iOS, when it loaded the firmware, transfers, I mean maps the memory to 400F00. And this is important because to have correct cross-references in Ida Pro, you have to rebase your program to 4. And after that, you will have all correct string cross-references. You will have all the necessary strings and your static analysis setup will be complete. But in order to build an exploit, it will not suffice to only have the Ida Pro loaded with the firmware with all the cross-references. You probably want to set up a debug environment. It is well known that iOS can be debugged via a serial port. And actually, there is a GDB kernel command that is used to start the internal GDB server. Or it was because functionality was removed in the recent versions of iOS and you can't really run the GDB. But nonetheless, there is a way to enable the GDB. And this way is to reboot the device, send an escape sequence to the serial line. This will bring up the ROM monitor shell. So ROM monitor is a simple piece of firmware that gets loaded and run just before your firmware starts running. And in this ROM on, you can manually boot your firmware with a flag N which will launch the whole firmware under GDB. And after your firmware is loaded, the GDB will kick in. Now, you can just use your favorite GDB debugger and Linux and connect it to iOS via serial port because iOS uses a slightly different subset of commands of GDB protocol. It has a server-side GDB, but the client-side should be accustomed to this GDB server. Basically, there is no publicly and officially available client-side debugging tools for iOS. And that is because this is intended for Cisco engineers to be done. Although there have been some efforts from the community to build tools to debug several versions of routers and switches with iOS. And if you look for ways to debug Cisco iOS, you most definitely will find a tutorial that says that you can actually patch an old version of GDB that still supports iOS, but it actually never works because I tried it and all I could do is read memory, the stepping, the tracing. It just doesn't work. So, another way is to use a cool tool by NCC Group. It's called iAdit. It's a graphical debugger for iOS. It really works. It's a great tool, but the thing is it targets PowerPC architecture. And it has some problems. You probably have to patch the debugger to be able to work with it. And the third option, the last resort is to implement your own debugger for the router. And to do that, you have to know which commands actually Cisco supports. And not a lot. So, you can basically read memory and write memory and set and write registers. And the only program counter control command is a step instruction. So, basically, it's kind of easy to implement such a debugger because all the information is just sent as a plain text over a serial cable and appended with a checksum, which is just a CRC. So, this way, I was able to make a quick Python script using Capstone to be able to debug iOS. You can inspect registers. There's a basic breakpoint management. You just write a special control double word to be able to break. You can step over, step into, and also a good feature is to be able to dump memory, which we will use later. So, to find the overflow, the SNMP overflow in the code, how do you do it? Basically, you can follow, since we have all the string cross references, you can follow the strings that reference SNMP get request and just step until the crash. But a more efficient method is just to crash the device and start inspecting the stack after the device is already crashed. You just have to dump some memory on the stack, looking into the values that reference the code. Some of them will be return addresses, and this will give you a hint where the crash actually is. So, the actual program counter corruption happens in the function, I call this function, SNMP stack overflow. You can see here that at the end of a function, we load the values from the stack to registers as 0 to S6, and also we load value into register RA, and this is an important register. It's called a return address register, and almost every function in MIPS uses this register to jump back to its parent function. So, basically we have some space on the stack, but the question is can we place our shell code on the stack, and can we execute it? Because, you know, stack location is unpredictable. Every time you trigger this vulnerability as separate, space on the stack is allocated and you cannot really predict it. So, no valid jump to stack instructions in the firmware like we did on Intel X86, like jump ESP, no such instructions in the firmware, but even if we could find such instruction, the address space layer randomization is on, which means the code section and data section is based on different offset. Each time we reboot the device, which means that we can reliably jump to the instruction. And also, an unfortunate thing is that data caching is also in place. So, about ASLR, this is the first time I encountered the randomization in iOS. The previous researches that I've been dealing with, they said a lot about diversity of the firmware. So, basically, you had so many different versions of firmware. When you exploited the Cisco device, it couldn't really reliably jump to any code because there's so vast diversity of different firmware that was built by different people. We actually have the stack address space randomization and the text section and data section is loaded different offset after each reboot. So, another thing that really upsets us is data caching. So, when we write our shell code to stack, we think that it will be on the stack. But what actually happens, everything gets written into data cache. And when we place our program counter to the stack, we get executing garbage instructions, which results in a crash once again. So, this is basically data execution prevention. Well, it's not. It's cache. But the solution to this problem is the same as for data execution prevention and it is return-oriented programming. So, but unfortunately, we still have ASLR. So, we can really jump to anything because it's on random offset. But here, the raw monitor that I was talking about comes to our rescue. So, this little piece of software that gets loaded before the actual firmware might actually help us. So, the first thing we want to find is where this bare bones firmware is located. And the interesting feature of this ROM mon shell is actually allowing you to disassemble arbitrary memory parts. And if you target the disassembler at an invalid address, you will get a stack trace revealing the actual address of the ROM monitor. And what's the most interesting thing is the ROM monitor is located at BFC all zeros, and you can dump it using the debugger. Or you can just search the internet for the version and download it. The most interesting part about this piece of firmware is that ROM monitor is located at the same address and it's persistent across reboots. It's really great because we can use it for building ROP chains inside of it. So, now we have a theoretical possibility of circumventing ASLR defeating the cache problem. So, how do we build an exploit? So, the overview is as follows. We jump to ROM mon, we initiate a ROP chain which makes an arbitrary write using the code reuse technique. And after that we have to recover the stack frame to allow the SNMP service to restore the legitimate code flow. This is really important because we will be writing only four bytes. And that is not enough for a full-fledged shellcode. And we don't crash SNMP, we can exploit this vulnerability over and over again, thus building a shellcode in the memory. So, after we build a shellcode, we make a jump to it. So, here's how it works. We overflow the stack, we overflow the return address, so it points to ROM monitor. We jump to the ROM monitor. Then what we do, we actually find a gadget that reuses the data on our stack to make an arbitrary four-byte write just before the text section. Then we have to find a gadget that will recover stack for us so we can restore the legitimate SNMP execution code flow. So, this is basically an overview of one cycle of how we write a four-byte double-word. Now, a little bit on building ROP chains. So, what is it? What is return-oriented programming? So, basically the idea is to not execute the shellcode directly, but is to use existing code in the binary to execute your payload. So, you use stack not as a source of instructions, but you use stack as a data for the code that you're reusing. So, basically you chain the snippets of code, we call them gadgets, and you chain them together with jump or call instructions. And candidate gadgets has to meet two requirements. It has to actually execute our payload, and it also has to contain instructions that will transfer execution flow to the next gadget. Or, if it's the last gadget, it should transfer execution back to the SNMP service. The problems with the return-oriented approach is that there is a limited set of gadgets available. So, if we're talking about the firmware, it's around 200 megabytes of code, so there are plenty of different gadgets there. If we're talking about a raw monitor, it's only 500 kilobytes of code, so not a lot of code available. And the second major problem is that gadgets, because most of them are function epilogues, they modify the stack frame because they delete the local variables after they jump back to the parent function. And you have to account for that, because this might crash the process you're exploiting. Rockchains can be basically forced to do anything, but mostly, most of the times we do arbitrary memory writes, and this actually might lead to arbitrary code execution. So, the idea for looking for gadgets is that you find a gadget that loads data from the stack into the registers, and then you find a second gadget that works with the data in those registers. For example, you have one register, V0, which contains the value you want to write, and the other gadget, S0, which has the address you want to write to. So, we actually want to find gadgets that also load data from stack to return register, so we can jump to the next gadget. You don't have to look for these gadgets manually in IDA. There are a lot of different tools for building Rockchains. One of those tools is Rapper. You can find it on GitHub. It's a really handy tool. You just search for the necessary instructions to build the necessary Rockchain. So, now the last technical part of how the Rockchains in this particular exploit work, and then we'll get to the demo. So, this is how a perfectly healthy stack frame looks like. So, you basically have local variables on the stack. You have return address. You also have a stack frame of parent functions underneath the stack frame of our vulnerable function. So, when we overflow the local variables with our long object identifier, here's what happens. We overflow the local variables, and these variables actually partly get written to S0 and S6 general purpose registers. So, of course, overflow the return address, which will jump for us to run minor, and we also have some 60 bytes. After that, we overflow the stack frame of the next function, and we use that data also for our Rockchain. What we do here, we take the value of S0, we control the value of S0, as you remember, and we move it to register V0, and that's for only solid purpose, because there are no other gadgets in ROM minor that use S0 as a target register to write data. So, we have to use register V0. After that, the most important part is that we load the return address from the RobData2, and also we load the address we will write to from the RobData2. So, basically, right now, after this gadget stops executing, we have S0 points to a memory we want to write to, and V0 contains four bytes we'll be writing just before the code section. So, the final gadget that is performing the arbitrary write is the gadget that takes the value of register V0 and writes it to a pointer referenced by register S0, and the last thing it does is actually transfers the control back to the gadget which will recover the stack for us. The most important gadget it allows us to run the exploit several times. You might have noticed that the previous gadgets actually moved the stack pointer 30 bytes and hacks down the stack, and this actually means that the process that we will return to will crash if we don't point the stack pointer just between two stack frames. We find a gadget that will move the stack pointer down to 228 bytes and hacks, which will result in a perfectly healthy stack. Also, we load the return address to register RA, and it points to the parent function that called our vulnerable function. So, this way we perform an arbitrary four byte write. We can do this several times until our shell code is actually built just before the text section, and the final thing we do is overflow the stack again and jump to the shell code. A few words about the shell code. The device I was working with had a telnet service and it had a password, so I designed a simple shell code that will just patch the authentication code flow. So, as you can see here, we have a function, a login password check, and the result which is in v0 register is checked, whether the authentication was successful or not. We can build a shell code which will just patch this instruction, which checks login password check, and it will allow us to make credentialless authentication against telnet service. So, what it does, basically this shell code inspects the stack and the return address in it to calculate the ASLR offset because, of course, the ASLR is on for the code section, and we want to patch something in it, and after that it writes a zero, which is a nub instruction in MIPS to a call that checks for password for telnet and also for enable password. And then it just jumps back to SNMP service. So now, the long awaited demo. Let's see if I can make it a live demo. Alrighty, so here we have the serial connection to the device. You can see we have a shell. So what we do now, we inspect the password on the telnet service to make sure it's working as intended. So we see that bad passwords. We don't know the valid password for the device. What we do now is we launch the actual exploit. As parameters, it takes the host, community, and shell code in hex. So this is the shell code I was talking about that patches the code flow in authentication. So let's try it. So here you see that we initiate writing for byte sequences into the text section. Basically, this writes the shell code into the memory. So after the exploit finishes this, we just have to jump to the shell code. So let's see. Please do not crash. So, yes. So back to the slides. And, of course, you can build a shell code that will unset this behavior and patch the process back to enable the password. And on the side notes, how reliably can you exploit this vulnerability? So, of course, the SNMP public community will leak you the version of the particular router, but it does not leak you the version of Ramon. And we're basically constructing ROP chains in the ROM monitor. So, actually, you have not that many versions of ROM monitors available. You have only five if we're talking about 2,800 router. So the worst case scenario is just you crash it four times.  But there's a second option, which is interesting. Ramon is designed to be upgraded. So, basically, a system administrator can download a new version and update it. But the thing is that read-only region that contains the stock Ramon is always in place. And it is always at the same offset. So even if you update it, the ROM monitor, the read-only version of it, the old version that always been there, will always be at BFC all zeros. So, basically, the assumption is that all the devices manufactured at the same time and place that will have the same read-only ROM monitor, you can query your serial number of your router using SNMP GET. For example, my lab router is manufactured in the year of 2008 in Czech Republic. So it has the following version of ROM monitor. So, guys, to summarize about all this, do not leave default credentials on external networks. So, public communities are not designed to be placed on external networks for the showdown to find it. Take care of what you exposed on the external networks. Of course, patch your devices and watch for the end-of-life announcement by Cisco. Sorry? Sure. Why not? All right, guys, thank you so much for your attention. Thanks for having me. I suppose there are some questions in this audience. Please take a microphone. If you can, no one on the internet. They are flabbergasted here, it seems. Microphone number one. Hi. I'm a random network admin. And I know that people tend to use the same SNMP community on many of their routers. My view is that, basically, if you can get access to read-only on those routers, you will be able to eject that or use the same principle. So, basically, don't use the same SNMP community on all your devices. That would be also something. The main thing is to update your routers because it's a patch vulnerability. The patch was released in September of 2017. But if you tend to use the end-of-life products like router 2800, you probably should use a strong community strength for it. Thank you. Thank you. Someone else having a question there? Yes, someone on the internet is alive. It's alive. Let's try it. Yeah, now I've actually got a microphone. The internet is asking, how much time did you put into this whole project? Well, working on this exploit, I consumed around, I'd say, four weeks. From discovering the device on the external network to the final exploit. Yes. Thank you. I have a question maybe for you as well. You as well have lots of volunteers who are working with you as well in researching these exploits. Volunteers? Yeah, I don't know. No, actually, we don't have any volunteers. This is all part of my work. Okay. Thank you very much for this really revealing lecture. If someone wants to... Oh, I just forgot to say, is my mic on? Okay, so the actual proof of concept and debugger will be released in a few days. So the Python script with the capstone and the actual proof of concept, I'll publish it in a week or so. Okay, thank you.


Hello people of the internet, my name is Johnny and welcome back to yet another reaction video. This is the second one today. Before this video I posted a reaction to the FNAF big band song.  If you missed it it'll be linked down below and there should be an iCard right up there. Now this is yet another game theory reaction. This came out yesterday and originally normally I would make a reaction to it the day it came out. But I was doing a charity stream yesterday. Which the best part about it is that it spans the entire week. So link down below is the donation page. Please voice. Go donate. So all I know about this game theory is that it tackles the Fazbear Fanverse initiative. I really hope he doesn't try to connect the fan games to the main story lore because that is just gonna be very very complicated and honestly I don't think I would want him to do that. I guess the only way to find out what he's going to be talking about is to watch the video itself. So let's not waste any more time and let's hop right into it. Okay this is game theory FNAF the new breed. Again it's about the initiative that's all I really know about it. So if you're new here subscribe because I do so many reactions to game theory. I do reactions to all the FNAF episodes so if you don't wanna miss the next one subscribing is the best way. So let's not waste any more time and let's hop into it. Hey Matt how we doing? I feel like he's done this gag before but I'll go with it. I swear he's done this. Um. Here. True. Okay. Sure. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Ah. Interesting. So yeah it's about the initiative. It's been a while since he's used this intro. This intro.ζ interesting so yeah it's about the initiative it's been a while since he's used this intro it's always been like a custom FNAF one but I'm down hello internet welcome to game theory the show where my waistline is extending faster than the FNAF universe but it comes to five nights at Freddy's I didn't know that small deal about how huge this franchise has gotten I mean if you're looking to keep up with all the lore this year 2020 alone is home to not one but five new book releases if seven main games for spinoffs and the still-in-the-works movie weren't enough but there was an announcement made by Scott earlier this year that I've been wanting to talk about for a while an announcement that interesting is it just important to this franchise but is important for all of gaming between all my jokes about how much I hate the franchise and how complex the lore has gotten I've always said that the way Scott has crafted these games and how he's managed to run his community is perhaps the smartest most modern amen from the very first 519 he understood that the current age of gaming is all about sharing your experiences that no two playthroughs should ever be alike that obscure screens jumpscares glitches mini-games all of it should appear very small probabilities so that people can go online and ask their friends we did you see that was this a real thing from the first appearance of golden Freddy in the newspaper clippings in fnaf one all the way up to help wanted surprise coffee from his early game the desolate hope these sorts of things form the lifeblood of this franchise that is what gets people talking about your game and sharing your game and sharing videos of your game and yet it's a game design feature that shockingly modern developers just don't seem to do true actually a micro scale today we're zooming out to talk about the big picture another move that scott's made that completely bucks the trend of modern game development and truly embraces what it means to lead a successful franchise 2020 in space of creators and truly he's now in space I'm speaking of course about the fazbear fanverse initiative something Scott announced back in August of this year in Bangor title to the thing here's a quote from the reddit post there have been some great fan-made spin-off yay and I want to see them keep going that's why I put some of my own cash toward development of new games in those game series scott is just the best of the development side of things so that these creators can do their thing they're going to develop these games and interact with the fan base just as they would have normally and when the games are done they'll be released on game gel for free just like normal the difference now is that they'll also be bundled up and sold on most major I get excited every time people talk about the initiative and hopefully bring new entries to those franchises as well so the TLDR version of this scott's pulling a reverse Nintendo he's true yes he's investing in them helping them with distribution and heck maybe even merge the first wave of this initiative involves five titles five nights at candies for which you know is just FNAF but with cats pop to never green which is you know FNAF with rodents one night at flumpties which is FNAF with eggs yes love me some eggs fire and FNAF plus which is well it's just FNAF plus that is obviously a big simplification of all these games just for the joke but you get the point here they're all spin-off games with the basis of five nights at freddy's now all of this sounds well and good right I mentioned my scott coffin was taking the initiative to embrace and extend existing fan works and those are words with warm and fuzzy vibes but they're also words that have well they have themselves a history that's a lot less warm and boy thanks to a third e that's less mentioned extinguish that might sound harsh and seem like it's coming out of nowhere so let me explain what I mean with all this I think it's necessary to talk about another company that publicly took the embrace and extend approach and what it meant for the evolution of an industry and how scott is taking a similar approach but turning it on its head ladies and gentlemen it's time for a lesson on everyone's favorite game oh boy let's go antitrust law my favorite hot-top these days with Facebook robot Mark Zuckerberg and Peter CEO Jeff Dorsey getting grilled in front of Congress this year not just once but twice big a trending topic in 2020 big tech companies getting taken a task for monopolistic and anti-competitive business practices nothing new back in the 90s before companies like Google and Twitter and Facebook were but a twinkle in some source codes I the tech giant that everyone had their sights on was Microsoft this was almost a decade before anyone had even heard of an Xbox this is back in the days of Internet Explorer let me tell you was facing some fierce competition from the likes of Chrome fire heck no this is the 90s baby their competition looked a lot more like Netscape navigator and mosaic and I don't think I thought of those not so pleasant and as it turns out not so legal tactics in order to edge out the competition this doesn't sound good Microsoft was public about their strategy of embrace and extend the basic ideas that you start by finding something that someone else has made like a technology standard protocol or a tool of some kind and say cool we're gonna embrace it and start use the and then you extend upon it by saying well this thing that someone else made is cool and all but we're gonna make it even bigger and better we're gonna build our own proprietary technology on top of it and people can begin using our version of that old standard Steve Ballmer weather time was the executive vice president and went on to be president and later CEO described it in an interview with the New York Times quote new products and services should simply be extensions of the old whether it's me or the guy who replaces me because we don't do well and we will do well interesting quote according to one article I read a Microsoft employee even wrote a song titled the battle him of the reorg that ended with that exact phrase the song goes a little something like this oh our eyes have seen the glory of the coming of the net we are ramping up our market share objectives will be met sooner browser will be everywhere you ain't see nothing yet we embrace and we extend man catchy the policy of embracing and extending tools and protocols made by other people great names right you're adding to what's already there but what this hides is the fact that once you take an existing standard and extend it with your own proprietary technology you own the part that you're adding and not only that you're replacing the original public open standard with your own version that you alone have control over effectively taking ownership standard that someone else created and the Microsoft talk publicly about the first two ease there was a hidden third e that they didn't like to mention in public extinguish because once you've extended the kind of scary boys carry additions having effectively hijacked something that someone else had made you now have control that you can use to extinguish the way that third e is it just speculation on the part of Microsoft haters though Microsoft never talked about it publicly for obvious reasons investigation but yeah that probably would have been bad found that the motto extend embrace extinguish was used in Microsoft internal communication and the entire court case centered around the fact that Microsoft was allegedly using anti-competitive practices to bar other companies from competing with them the fact that they were literally trying to extinguish the competition didn't work all that well in their favor yeah if you have a business strategy that's evil and illegal try not to use words that make it sound evil and illegal and then don't use it in company emails you do the Microsoft example is a pro tips with map that easy to see examples of a similar strategy used in the entertainment world Danny Disney rather than creating their own original stories they began by embracing folktales and classic stories in the public domain like Sleeping Beauty Beauty and the Beast Cinderella and the Little Mermaid no problems there they were open and available for anyone to use then they extended these classic fairy tales by creating their own animated versions of these stories with their own spins on them but then they effectively extinguished competition by replacing the original work with their own and when it comes to protecting their own characters and copyright Disney is fiercely control oh yeah like Microsoft Disney's managed to do this without breaking any laws technically speaking they just lobby to change the copyright law the mouse is a 92 year old character at this time technically in the public domain by now except for the fact that the laws seem to mysteriously change every time his copyright is set to expire hmm but possibly have anything to do with the millions of dollars Disney is spending to lobby no way definitely not there is no Disney has worked so hard to prevent their characters from entering the public domain despite the fact that they began as a company by creating their own versions of classic public don't kind of are go talk of these versions of these stories have effectively replaced the originals in the public oh yeah which I gotta say is a shame considering I personally want to re-experience the original Little Mermaid's ending where you know she's given a dagger and has to choose to murder the prince or herself and the Red Sea at sunset is actually the result of her blood pouring out into the water yep that is the original story yeah you prefer the Disney version anyway it's not all that surprising that you go to the book section of Amazon and search for classic fairy tales like Cinderella the first thing that pops up is a Disney coloring book look at dinner really hard to make sure that their version of the story is the only version of the story that matters so it's not guilty and guilty oh yes back to FNAF funding fan projects might seem like a generous gesture but is this really part of his plan for world no not my boy in fact my strategy might at first appear to have some superficial similarities with the behavior of Microsoft in the 90s you can actually argue that he's doing the exact opposite of the business practice that's my boy and this applies to basically every step in the process for instance Microsoft worked by embracing public standards or products that other people had created and Disney worked by embracing fairy tales and folk stories from the public domain they were effectively targeting things that other people had created but here scott is honing in on what's effectively territory to begin with own work is the foundation on which these fan creations were made they exist with his blessing this is something that we talked about what a great freeze frame it is that well scott doesn't have the rights to publish work created by fans without their permission fans don't have the rights to publish work based on his characters without his permission all the fan creators are working with scott's blessing but ultimately it's his characters and intellectual property to do with as he pleases he's not capturing someone else's folklore and planting his flag in it to claim ownership over it his flag was already there to begin with god pretty planet this with the full consent of the fan creators which brings us to the second e extent rather than trying to extend these fan works for himself in a way that would allow him to claim creative ownership over of the way that microsoft did he's leaving the power in the hands of the fan creators and letting them be the ones to extend their own fan lore and lastly the third e god i hate that this terrible image of the original ee strategy rather than trying to quash all the creators so that the only thing left of the space is his original fnaf games the entire point of this initiative is to include and promote other creators who could offer their fan games as an alternative not satisfied with only seven official fnaf games here only seven that's it and now you can check them out on more platforms since they're coming to consoles and smartphones and scott kawthon has given them the development resources to make it happen so yeah i think that far from being an example of a monopolistic business trying to control everything this is an example of the opposite rather than being over protected with his ip and issuing scott with a mustache tries to create their own game or spin on his creation scott is doing the opposite he's giving yay listen i love watching videos about scott being awesome Pog can i get some pog champs in the comments boyo yes fan game in romhack communities and sega gave them the keys to the kingdom to produce what's probably the best canonical sonic game in recent history now contrast got a point there and sega's behavior with nintendo banning you with live streams oof and played on release day shutting down fan games because they were worried about it competing with their own products shutting down tournaments run by people that are still really passionate about a multiplayer game that was originally released in 2001 sorry to pick on you nintendo but i wouldn't be doing it if i didn't think it was deserved these are bad moves we get hold them on uranium or another metroid two we may come out you just kill them you stomp on them what could be and are in many cases fully fleshed out i remember playing you idiom years putting them together out of a love for your work you put them through a shredder congratulations you protected your ip but you killed the love of your community in the process and from a purely financial standpoint heck could have just embraced those projects could have hired those people on yeah a little bit you had two quick and easy money makers if you're thinking about it from just the pure cold hearted dollars and cents that is money you left on the table period i'm sorry times have changed the industry needs to change with them with so many scummy xx yes what a great way to end i love this this is amazing the companies that are doing it right and if we're able to recognize the more positive examples of how some companies are able to succeed by doing the right thing maybe we can get just a little bit more of that sort of thing fnaf is a huge example of a game that isn't just a game it's a community of fans that pour tremendous amounts of love and effort into making their own content whether it's the let's play videos that first hello everybody my name is more extra mile and been inspired to create their own fan games the fazbear fanverse initiative is a great example of what can happen when fans love a game franchise and the franchise is willing to love them back i just wish more people were paying attention yes that's just a theory thanks for watching well what a great ending that was fantastic i think that was a really good way to end that episode fuck you nintendo scott you are the best human become the earth you are goddamn incredible so unlike some of the other fnaf game theory episodes where mad talks about the lore in the books there's not really much for me to touch upon here because i think you actually did a very very good job at explaining everything normally i get a little upset when the content of the video switches from fnaf to mad pet going to different topics like microsoft when he started to get into microsoft i was like okay i get we need background but this is kind of a bit much but honestly the more i watched the video with more is like you know what he's making some banger points right here this was a good episode and then the thing at the end amazing honestly fricken what a great way to end that episode attack a nintendo which to be fair some people may find harsh but when you look at what they've been doing recently it's not looking good for them you know nintendo not looking like a very good company right now and then the final message of the community and scott all coming together being just a fricken amazing fandom that was sweet i really really enjoyed that yeah this was a very good episode not much to talk about because again he did a lot of great explaining he hit on a lot of good points and overall a very good episode i was a little confused not confused i just really was not expecting a initiative video i didn't know what he would talk about in here but honestly i think this was great again i i've been saying it but honestly a really good episode of game theory so that's really it thanks for watching again if you missed my reaction to the finnaf big band song it's linked down below same thing with my tiltify raising money for hashtag thank you miss and if you made it to the end of the video you liked it and if you haven't liked it already you probably should as well subscribing so you don't miss my next reaction to game theory so thanks for watching i'll see you all on the flip side goodbye Gregory be still i think she's found us


Yeah, I mean, obviously we have a ton of respect for the Chiefs, their organization, what Andy's been able to do there. I think it's just, again, we talk about what you do after a loss, what you do after a win, and hopefully we're able to compartmentalize and move forward here quickly with our preparation on the Chiefs. Does that make it like one of those GPS or see where we're at type of games? Did you just mention, you know, the importance of coming off the win? Yeah, I mean, I think you always have to try to, you know, every week validate what you do and what you've done and try to get going on some consistency. And I think that starts with preparation and understanding who you're playing. There are some similarities, you know, I mean, certainly with the quarterbacks and the way that they can extend plays and their talent and how they play the game. I mean, I think that was probably some of it. And we'll see where Greg's at and how much he is, where his recall is.  When the Holmes gets on the move, do you see, like do his receivers have rules or are they improvising with him at that point? I don't think there's rules. I think they kind of all just understand where he wants them and where they go. And he does a great job of finding them.  I think that they know that if they get open that there's a good chance that they'll get the ball. Can you frustrate a defense as much as anybody? Well, I mean, I think that that's something that's always a challenge when you play Pat, Patrick. And we've played him a few times and, you know, whether he drifts away from pressure, he seems to know where it's coming from. His ability to put it in spaces out in front of guys and man coverage is anticipation. You know, really, I played turn to game around last year. There was a long scramble right there before half. So, you know, it would be important that not only we try to defend him and when he throws it, is when he runs it as well. Kevin, I know we talked at the end of last season just about maybe wanting to improve and he's off to a good start this year. Three picks and club work out for a touchdown. Has he done anything different or has he just kind of put himself in a good, better spot? I mean, I think that sometimes those, you know, it's cyclical.   We got a lot of faith and confidence in Kevin and, you know, his leadership and everything that he does for us, you know, so that, you know, I don't get caught up in the statistics of it. I try to get caught up in the execution. And so it's always great. I think that, you know, for players that they can contribute and have statistical success. And so, you know, I think he's, I think he's playing fast.  I mean, Kevin was on his guide. Danico hit the quarterback. And so, you know, he understands that in man coverage, and when he's covering somebody that their job's not to let him catch the ball and he does a good job in zone to defend in the deep part of the field for us. How much stress does that put on the players? Well, they're just a lot of athletes, a lot of speed.  You know, there's a lot of plays that repeat. Something that Andy isn't afraid to do is to repeat plays. You know, and it's just that their efficiency with them is outstanding. The players know, you know, what to do and they're executing. And so, you know, it may look different based on the coverage that they see. And if it's man, then, you know, he may want to go to Kelsey somewhere because of the matchup. Or if it's zone, he knows that, you know, there's a receiver that's going to be throttling down differently in each zone. And so they create a lot of speed and it's a vertical threat, you know, passing attack. And then there's some underneath elements with guys working underneath as well. The release of Townsend's presumption is that Brett would be back. How good would it be to have him back? And are there things you can do with him as your regular guy, maybe in terms of directional punting that you wouldn't want to try to do with a replacement? Yeah, I mean, I think Brett's feeling better and hopefully we'll get him back, you know, towards the end of the week. And we'll see how he kicks when he gets back.  You know, right now he still has to go through protocol. And hopefully we can, you know, we can pump better and cover better. Did you get a chance to see what Brady Breeze might be able to do on special teams? Or, you know, do you just like his kind of athleticism and potential in that regard? I mean, we'll see where it is this week. He's, I think we've moved him to the active roster. You know, he was working his way back from the IR and, you know, again, we'll see, you know, where it goes as far as who we make active for the game. Do you think Shane has found a good rhythm as a defensive play caller?  Make sure that you get him in there in a timely fashion. Make sure that the players understand what they're supposed to be doing. And I think that, you know, there's things that we've changed a little bit. And, you know, we were, you know, doing well on third down didn't do so well the other night. But, you know, I think that they're, you know, they're making changes. We try to make some changes and adjustments as the game goes on and things that we like. And, you know, I think that the players ultimately are the ones that, you know, that execute no different than the last play of the game. It was the same thing we called earlier, you know, or called previously in the season. And then the players went out and executed it and made a play. What are some characteristics of Andy Reed coach teams that kind of been constant over the years and how do you like the way he's run his program? Well, I mean, I would say that Andy's been, you know, a great mentor for me as a coach, you know, going back to when I was in Houston, just to be able to have conversations with him. You know, he's coached a lot of great players. Coached a lot of great teams.  Andy tries to give input to coaches, younger coaches. So I'm thankful for that relationship. You know, they're always very explosive offensively. I think he's got a very creative, offensive mind. Seems like the players enjoy playing for him. Have a good time. They've been ultimately successful. You know, and I'm not saying like they have a good time because they win. You know, I mean, a lot of these had a lot of success in this league and very good offensively. And it's a championship coach and a championship person. Mike, in that second half, maybe find some rhythm in the passing game that can build on, especially now, you know, AJ seems to be getting his conditioning back better each week. You know, every week's different. We'll have to start the game better, Teresa. That's what we're focused on in Kansas City. You know, trying to just start faster and make sure that we have a good pocket for the quarterback. Try to handle the front as good as they are with Jones and Clark. You know, some of the guys that there, they'll rotate and play some guys inside. But that'll be a huge key for us to start there with protecting the quarterback and then trying to find some openings against, you know, match coverage. Your injury report in your IR list continues to grow. Can it be difficult to stay level-headed and keep the next man up, or is there a point where you become concerned about having enough juice? No, I think that that's all part of this job, Luke, is to try to be, you know, as focused and even keel, you know, as you possibly can. I know that that's probably not always the case. But you just have to try to get everybody to understand that when they come into work, that they could be active for the game. They could play a large role, you know, and just look to Nick Westbrook. He knows multiple positions. Impact player force on special teams. Those are the types of players that you look for, that guys that can play more than one position and go out there. You know, whether it's the block on a touchdown run, to pick up a huge third-down conversion, or cover a kickoff and make a tackle inside the 20. Let's try to find as many guys like that as we can. Keep your eyes open for me. Mike, just a follow-up on that. How helpful has it been? I mean, the rules last year on IR and being able to bring guys back, we're implemented for the pandemic with that 17th game this year. How crucial is it, particularly for you all, to now you're starting to get some guys back to be able to use that to survive these injuries? Yeah. I mean, I think that that's a good tool, and it's something that we have been forced to use just because of guys been hurt and been hurt for at least three weeks. With that becomes more decisions that you have to make when guys come back off of that list. So you can only have 53 on the active, and so that's a fluid process of trying to decide what you want to do with the practice squad and what you want to do with the 53-man roster as guys start to come off of the IR. Often that offensive scripting at the beginning of the game is some of the most favorable stuff you've seen during the week. You guys have scored, I think, 20 in the first quarter. Any thoughts on why that hasn't worked for you so far this year? I think we continue to look at that, and that's something that we'll try to improve on. I think it's just maybe some of the looks that we've seen. We have to do a better job of anticipating some things that may have been different that we weren't maybe expecting. Execution would probably always be a big reason, but I agree with you. We do have to get off to better starts and try to help ourselves early in the game. Obviously the injury list is long, but you're going with the walk-through today. How much does that change what you can do during the course of a typical preparation? Just the ability to have a walk-through. Do a walk-through as opposed to a typical Wednesday practice? Yeah, I just felt like I'd try to do what's best for the football team, and we get a lot of reps done. We get to see a lot of plays. We have a group of show team on each side that helps us out. I mean, we'll get to see plenty of plays, and we won't be able to recreate the speed, obviously, that we're going to see. Even if we did practice at full speed, we're not going to recreate the speed that the Chiefs have. I just felt like it was an emotional physical game. A lot of guys are banged up, and this is the decision that I felt like was best for the team. Bring them in there a little later. Let them get some sleep. I'll get treatment at a little later time, and then get back to normal schedule tomorrow. Roger was able to make it through the whole game the other night. How important was that, both in success in the run game and in patch protection?  I mean, he does a fantastic job of getting on those guys and covering up and finishing. It takes a lot of pride in it. We gained a lot of yards over there running behind him, and then helping us stay firm in the pocket. I've really enjoyed coaching Roger since he's been here, getting to know him personally. It was great to see his mom and his sister out in Seattle. I enjoyed coaching him and having him here. I'm glad that he was able to make it through the entire game. The code well for him you talked last week about maybe reassessing him. It probably does, yeah. As it stands now, I think he's feeling better, obviously, than he had a couple of weeks ago. With Josh Rattles, obviously he came here thinking that there was going to be an opportunity for one reason or another. It hasn't been for you as a coach, a guy who they referred to as a player's coach. How do you go about managing that? What does that mean, Teran? I don't know what that means. Well, anytime I ask them, they say that. They don't, what do they say that mean? I don't know. They always say that you have their best interests. They say that you're invested in them emotionally. Those are the two things. That's just being a coach. I mean, that's just being a human being. No, I know. And again, Josh has had a good camp and got injured. You know what I mean? And then so now he got an opportunity. Guys came back and there's a million reasons. And so hopefully, he keeps being ready to go, explained to those guys this morning. Like, where's going to be a lot of moving parts? Use Nick as an example. You know, know as many positions as you possibly can. Help on special teams. And that's a great recipe to be able to be active on Sunday. So I'm confident that Josh is going to continue to do that. Does Josh know all the positions? I mean, Josh knows more than one position.


Alright, how's going everybody this sells out icons random hit number seven. That's coming up next This is just for the select mini box break number 26. We're first gonna do a mini box of select Randomize all 15 or all 30 names 15 names bought in everyone gets two teams each Then we'll randomize the teams then at the completely end of the break after we're done We'll do a separate dice roll and all 15 customer names will randomize However, that second dice roll goes the top two in the last two spots and diamond icons So this is just for the break just for the mini box after Seven times Actually open the box first seven times one Two yeah, you got it. You got to put it either with someone safe That you know won't open it like oh, why would I open it? I have no interest in it You got to keep it with them or like in a safety deposit box and tell the bank teller that Do not let me withdraw it before the state Revealing all of our secrets over your take one two Three He flies under the radar being reckless Social security number John twins Shawn Astros Robert Mets Shawn Indians John Rocky Steven D. Backs Robert Pirates Steven Tigers I got to show you a teddy break log. You've never seen anything like it Robert Rangers John Brace I have to show you it Robert Mariners Reds White Sox Shawn Orioles Robert Cubs Marlins Brandon Brew Crew Robert Cardinals Dodgers Padres Brandon A's Robert Phillies Brandon Giants It's hieroglyphics holding up all the numbers Robert Brandon Braves John Yankee Sean Red Sox Robert Nats Blue Jays Angels So this is just for the break. We're gonna randomize it left and right Can't close the books because of daddy We'll go left side one two three right side four five six Left side one two three right side four five six four mini box break Something I think it's 29 no 26 One two three left four five six right one two three four five left side So the left side is the winner of the dance The box will be promoted To starter this second string box Maybe a little Tom Brady sitting behind Drew Bledsoe here. So like 27, which will sell out Diamond icons the next one that I'll post in the store We are talking break logs Also a funny story with Sean's break log that I probably won't show Because I just saw him in the chat Well, if the local man doesn't get hit for a few months I mean this NT is gonna go through the roof Honestly, I wouldn't be surprised if it's 25,000 a case in a couple months Zion logo man. I was telling everybody Enjoy the prices for this batch of cases. Yeah, this first run because it always goes up It's always hard to get it. It's not like prison where they can kind of print, you know How they choose how they please this is NT, you know So much numbered cards you could put out there Joi Vado skills Jay Chapman number to 500 Rookie autograph for the Chicago Cubs that's going on to Robert 251 to 500 Bartella cologne There's Alex Wood auto For the Braves that's going out to Brandon Walker And we got a prism Robbie Grossman and JJ Hardy There you go. That was the one box mini break. Nothing crazy. We did pull a yellow Refractor auto not too long ago from that stuff. So there's definitely possibilities in that. All right, so let's take all 15 names now 15 names on this randomizer the top two will win icon spots after Eight times. I think a lot of people are using ram.org right now seems that's a little slower and a small one today All right after eight times top two names win four five six seven Eighth and final time Robert and Brandon last pop mojo eight times There you go Congrats to you too. Thanks everyone else for trying though giving it a shot. Appreciate it very much Icons baseball coming up next