Good afternoon and thank you, thank you for joining the session. Yeah, this is Ying, and from ABM, I work for the BlueMix Oath Scaling Service for several years, and now I am a contributor for the Foundry App Oath Scaler project as well. Yeah, today I will cover two aspects. The first aspect is from the end user point of view, how to understand Oath Scaling, how to use Oath Scaling Service to serve for your application. And the second aspect is from the service provider point of view, how to deploy Oath Scaler, how to add Oath Scaler to your self-department, and how to enable the service. Yeah. First of all, yeah, Oath Scaling is used to help to manage your application capacity. With or without Oath Scaling, your application operation will be a little different. But anyway, as a prerequisite, without Oath Scaling or with Oath Scaling, in both situations, you'll need to understand your performance benchmark of your application. You need to know your workload type. You need to understand your peak hour. You need to know when the workload is beyond your expectation and will introduce some performance problems. And without Oath Scaling, you need to do the monitoring yourself. Maybe have some marching tools and you need to set some alerts. And once the alert is triggered, you need to do the CF scale command manually, and then you need to keep monitoring. And with Oath Scaling, you just need to create a service instance and then create scaling policy, bind the service to your application and attach the policy. Then Oath Scaler will do everything for you. Here, I want to mention, when we talk about the scale, we are talking about scale in or scale out. That means add or remove your application instance numbers. We didn't touch about scale up or that means add more memory quotas to your application. Yes, in CF, if you want to change your memory quota of your application, you need to shut down the current container and create a new. And then this will introduce some downtime so that Oath Scaler won't touch that area. Yeah. So here, maybe create service, bind service, you are all familiar with that, but you don't know how to define the scaling policy. That is what I want to talk about. Here, we have two types of Oath Scaling. The traditional one is the Dynamics Scaling. And here, I show a simulated workload for the throughput over 12 hours. And in this workload chart, you can see the workload is fact, sorry, it's fact-treated. It's up and down. And, but in general, you can see in general, the average value will increase at the beginning. And then, down at the edge, near the 4 p.m. And according to your understanding for the application, you define two performance benchmark. One is upper threshold and the other is lower threshold. And the green area is pretty fun. And the yellow area, yeah, is acceptable. It's normal, it is acceptable. We consider it's pretty fun. And the red area is pretty dangerous. And we hope to add more instance to serve the red area better. And we hope to reduce the instance numbers while it became green again. But as you notice, the workload is fact-treated. Do you expect the Oath Scaler to be quite sensitive with the spike? I think no, yeah. If we are quite sensitive to with the each spike, your instance number will be fact-treated as well. So how Oath Scaler do that? Yeah, in fact, we are smoothing your, we're smoothing the metric values with the start window. We will collect all these metrics numbers during this window and do an average. And if the average value is average, the average threshold, we will count it your average now. And then we move the start window a little bit and do another average again and to see whether it is continue to bridge. If the bridge is lasting for long enough, we will think, okay, it's time to trigger to get out. You need to add more instance to your application. And this is the result. After Oath Scaling, this is a similar workload for instance. Each instance, for example, in the middle area in the half, you can see the workload is almost a half compared to previous chart. And in this area, in the near to 4 p.m., you can see the number is quite similar to our previous chart. Why? Yeah, since in this area, we scale out to more instance, and then we scale in again. Yeah. Currently, we have four, we support four metrics, different metric types, memory use, memory utilization, throughput and response time. Here, I just want to mention the utilization is the percentage of your memory used. And besides dynamic scaling, we also support the schedule scaling. You can define different schedules. Schedules means a time duration. You can define recurring schedule by day of week or day of month. And also you can define the specific days schedule. And you can define multiple schedules here. And if the schedule has some conflict, for example, if you define every weekend, you need more workload, but also you define on the Christmas Eve, you need higher capacities than the specific days schedule will overlap the recurring schedule, since it is more particular specification. And also the schedule scaling is not conflict with dynamic scaling. When the schedule is taken in fact to, the dynamic scaling is also happy to change your application in capacities dynamically or maximally. Here we have some, I have a chart. In why you define a schedule, you need to define a minimal instance number, max instance number. This true value is quite useful. It's pretty one to the unlimited scaling. Otherwise, you need to, maybe your scale, your instant number will keep growing up. And there is a special one, initial minimal instance account. That means, let me take an example. For example, before the schedule taking fact to, you only have 30 instance. Then you define the initial minimal instance to 40. Then when the schedule taking fact to, all the schedule will help you to change your instance number from 30 to 40 directly. Yeah, but if you, but if before the schedule taking fact to, you already have 50, 50, sorry, 50, 50 is greater than 40, then our schedule won't change it anymore. It just ensure when the schedule, at the beginning, you'll have enough capacity to handle the more workload. So, yeah, here it is our policy definition. It should be a decent file. I just try some table here just to make sure it is pretty to understand clearly. And here in the decent definition, you need to, first of all, you need to define the minimal instance account, max instance account, and scaling rules. This works as default. And then you can optional define the schedules. And in the schedule, you define the time zone, and define the recurring schedule and specific day schedule at the table here. And for the scaling rules, you can see there are some numbers here and operators here. I can translate it into native language so that it could be easy to understand. For example, the second row. That means you will check the throughput at the metric type. You will focus on the throughput. And you will take the average number of your throughput every five minutes and to see whether it is greater than the 15,000. If it is greater than 15,000, it is a bridge. Then if the bridge continue for 10 minutes, then it's time to add more instance, add one instance. And after the scaling out is done, you have a period of cooldown. That is waiting time. That provides a chance for you to keep your system stabilized. No more scaling out action will happen during these 10 minutes, during the cooldown. Okay, and then after we already have a policy, we can attach the policy. We have several ways to do it. First of all, you create a service and then you bind the service with the parameter. You can define the policy file name as the parameter. Another way to do that is through our public API. You can do a CUR, you can do a CUR command to attach your policy with the put. Here, I just want to mention that the authorization code here, you must use your CF user token. After you're logging in your CF OAuth token command, you can get your user token. Put it as your authorization code when you exercise our public API. And we have the other operation available on public API. Retrieval policy, update policy, delete policy, and retrieval metrics, and retrieval of histories. Anyway, it is not quite flexible to use the APIs. It will come in soon. We will develop our command lines. The all-scale command line will work as the command plugin. So we will, all the operations for policy for metrics and history will be supported in the command line. And here, I list some steps to implement all scaling. I don't need to go through all this stuff here, but I just want to mention, as a prerequisite, you need to enter your application before enabling all scaling. You need to know the workload tab. You need to know the benchmark. You need to know how to define upper threshold, lower threshold. You need to know how to define the schedule if it is applicationable. Okay. Yeah, that is, and then, this is a deep dive to all-scaler. First of all, we discuss how to deploy all-scaler. Currently, we have a Bosch release. You can download from the gate and we can do the Bosch deploy. Both of the Bosch v1 manifest and Bosch v2 manifest is ported. And also, we can deploy using the self-deployment approach. Yeah, if you are working on Bosch Lite, you can use the self-deployment it is very quick. And then, after you deploy it, you can enable all scaling service. I have a short demo to include all these steps. So, wait a minute. Here, I just recorded it on my laptop, so it is using self-deploy to... You need to create release, upload release, and then use Bosch... Here, the Bosch command means the Bosch v2 command line. And in this batch of my deployments, the API server and service broker will be updated. It did take time. So, when I do the recording at ISBTUX, so that it won't take a long time for all of you. But anyway, it is quite easy. You only need three commands to steps to enable it. Now, the Bosch deployment is finished. And then, we can create a service broker. Here, we register our open-all-scaler endpoint on router. So, you can access it by open-all-scaler-boschlight.com. And then, you can enable service access. Now, here it is. Then, the service binding. First of all, you create a service, and I already have an application here. And I already have my policy defined here. So, I just bind the service with my application. And then, I can retrieval my application with the API server. It is... The endpoint is allscaler.boschlight.com. And then here, it is policy, as we just talked about. Yeah, okay. Go back to the next. I want to go through the roughly architecture diagram of open-all-scaler. We have two entries for any other. The first entry is to create and bind service from the CLI through the open-all-scaler... through the Swiss Broker API. And another is using the API server to do the policy, metric, and history operations. Once the application is bound, and once the policy is defined, the metric collector... On this way, the metric collector will start to fetch the container metrics from LogRGator. It will fetch the memory, and it will fetch all the HTTP-required numbers and response times. And we will do aggregation for these metrics, the raw data as a scaling metric. And the aggregation part will do the average. Yeah, if you still remember that window, we will do the average. And the event generator will check the average value with the threshold and try to bridge a scaling event. The scaling event... And then the event will be signed to scaling engine. The engine will check whether the event could be handled right now. There are some situations that the event will be ignored. For example, if you want to scale out, but the max instance account is reached, then the scaling engine will stop to serve the event, since you already have the maximum number. And if you are doing the cooldown time, the scaling engine will stop... Well, you can know the event as well. Yeah, since as you define, you need to wait a while before another scaling. And also, we have a scheduler. The scheduler will trigger the scaling event to the scaling engine. All these data are saved in Postgres database. And we have planned to add more database support in the future, but currently, it is Postgres. And all scheduler has to be deployed on the SAP Cloud in July this year. My name is Pradeut. I am responsible for apart from everything else to make sure the autoscaler runs fine on the SAP Cloud platform. So, I mean, a lot of people have questions about whether it's production ready. For example, we've been doing development on this for the last more than a year and a half, or almost a year and a half. And yes, the answer to that is yes, it is production ready. We already have this deployed on the SAP Cloud platform since June this year. It's currently available as a beta service, so which means no SLAs yet. But yeah, we have ramp up customers, internal customers who have been using it for a variety of use cases. We have very positive feedback on that. For the multi-cloud strategy that we have in SAP, so in that context, we have this service deployed on AWS Azure on an open stack. GCP is coming up in the future, so which means we'll have it available for basically customers everywhere. Performance tests, another question that we have all the time is to what can we support? So we are currently running tests as a beta service it is to be able to support at least 2K, 3K apps. The tests are currently in progress, it is positive. And once these tests are done, we will probably have a final release up on GitHub so that people or platform operators can actually download and use it. So that's going pretty fine as well. And with that final release, we will also go to GA on the platform, on the SAP Cloud platform. Yeah, that's a short update from my side. Yeah. VM, where platform? No, I don't have any updates on that yet. Anything else? Maybe we discussed that on the next slide. Do you have a slide for that? Okay. Sorry, I didn't put a slide too for the future, for the coming soon features, but I can do some summary here. First of all, just as I mentioned, in the future we will deliver the COI support. And also if we will output our performance benchmark and do some scalability upgrade. And also we will consider to add CPU metric back into our support metric type. And as you mentioned, we will consider to support the customer metric. That means your application can define your own metric and report it. And then all scaler will do the all scaling actions according to your customer metrics. And also we will consider to change the deployment approach. We may deliver our approach to deploy all scaler itself as co-foundry apps, not totally limited to both release. Yeah, that is our future plan. Yeah. Just to add to that, regarding the question about customer metrics. So the session that we had before this about side cars. So that is the concept that we're gonna leverage to pull metrics out of those containers so that services like auto-scaler and others who need those metrics for building use cases can be developed. So kind of a dependency on that. Any other questions? Yeah, sure. At the moment, you have quite a lot. It's a very important person recording your magical voice. Try that. Yeah. At the moment, you have quite a lot of moving parts to the auto-scaler. And I was wondering if there's plans to kind of reduce that or keep it with lots of moving parts of the long term. Kill the microservices. To give more detail, yeah. There's currently lots of moving parts. And it gives us quite a lot of flexibility in terms of being able to have multiple different metrics collectors and so on. I think over time we would like to reduce some of the number of those parts. Part of the custom metrics thing we were talking about is it'd be nice if all the things just came from Logregator, for example. And then you wouldn't need that flexibility. Everything would just be reading from Logregator to get everything. So over time we would hope to do that. But at the moment, I guess if you like microservices, we've got a few of them. You heard it first. Less micro, less plural. Big, big service, one. Hi, tomorrow during the keynote, one of our team members actually complained that the odd scale does not respect open connections. So, Satru? Yeah, you are. It's Diego's fault. It's Diego's fault. We have a no blame culture. So the problem is a valid problem, right? Like, when you auto scale stuff in the platform today, that means when you scale down, you get less instances and the instances get stopped. And at the moment, that doesn't coordinate within flight requests. That's actually not really auto scaling. That's a generic problem that we don't have coordination with the router as we're shutting down instances. So if you went to the Diego update earlier, you would have seen that one of the big items that Diego's now working on is zero downtime deploys and blue-green deploys. So it's really those features in the platform that would stop auto scaling having this edge case. It is a valid problem with auto scaling right now, but the solution is gonna be in Diego. I mean, if your app has long-running requests as a feature, you run the risk of being upset because it's a cloud. The current behavior is you get a term request and you get a few seconds to shut down. So normally, if your process is well-behaved, that should be okay. But yeah, if you've got long-running in-flight requests, then currently, that's just a general thing that we don't handle great. If you pick another ecosystem, the Heroku platform restarts every container every 24 hours regardless of what you think you might be doing with it. In part, to stop this idea that containers have a long life that you should be able to trust. Just to add that again. So if your application is doing a lot of background jobs or probably it is not restful, yeah. I mean, it's like if you don't use auto-scaler, but just do a CF scale down, you're gonna face the same problem. Really not another skill or issue. Thank you.


Melatonin is a hormone produced by the pineal gland which regulates many biological processes, such as circadian rhythms, cell growth and death, skin coloration, immunity, and energy production. Recent research suggests that melatonin may also be involved in regulating DNA methylation, which is important for controlling gene expression and plays a key role in cancer development. This review explores how melatonin may affect DNA methylation through changes in mRNA and protein levels of DNNTs and TET proteins, and suggests that it could potentially be used in combination with other epigenetic drugs as a new anti-cancer strategy. This article was authored by Kinga Linoviaca, Andre T. Slaminsky, Russell J. Ryder and others.


Oh You know how sharks are that's me. I'm a shark what is up my cranky crewひ Women Children because I don't discriminate, I just eat! We're back in Man Eater.  Actually, hold on a second. I was not paying attention when I was down in the thing. Where's the thing? Right down here. I played a smidge more by my lonesome, got to this new place. What do I do? Hearty organ. This evolution increases your health and resistance to being knocked off by a boat. The melee attacks of crew members. I like that. Very nice. Also, we have jaw. Dude, look at those little tiny baby teeth. Ready? Ha, ha, ha, wow.  So it really doesn't matter which I do first. So I guess we'll just do a little bit of tracking and we'll go and eat some group boys. Huh, how about that? How's that sound, eh? Let's see how I fare against a good old alley guy who didn't go, baby, here I'm at. I did that wrong. Where'd you go? Right there. Right there. I can't wait until I go out into the big old ocean man. Take me by the hand. It'll be so cool. Once I'm a great white shack, down on the ocean, and I'm a big ocean fool, might? Will I ever be out in the big, big ocean? I mean, I would assume I would, because this is, is this salt water? Or is this fresh water? Because bull sharks can survive in fresh water too. And it seems kind of like fresh water. Maybe a little mix of the two. Oh, musilange.  I eat you for breakfast now. We are almost a level seven. Oh, it's a person. Hi.  Oh, do I need to eat people? Oh, I think I need to eat people real quick too. Whoops, I'll do that, because why not, dude? Birds and passes. Yeah, I just stumbled upon, upon this. Let's be a sneaky, sneaky boy. Do, do, do, do, do, do, do, do, do, do, do, do.  That's a little mean. Let's get the people that are on the land. Why not? Why not, you know? We've got our breath, our big, big breath. And you know, we can, we can take a little bit of heat. Uh-oh, uh-oh. We got big, hunty boys coming there. Why are there so many hunters on me, dude?  Am I right? Am I right, guys?  All right, I don't need to find me. Oh boy.  I need to find something to eat. Okay, the hunters aren't after me anymore. That's good, please. Catfish, give me some health. That was close. Really, really close. Okay, we can go back. We only need to eat two more people. Okay, are these normal people? These are normal people. And there we go. And that's 10. Level seven, baby, and we completed a thing. Nice, Sue. Now let's go and do what we came here to do. Which is the Grapes. Oh, how do we get over there? How do I get there?  So this is where I am now. How do I get there? Is there some sort of secret underwater tunnel thing? Oh, wait, hold on. I was playing this a bit earlier, like I said. I might have to go through the sewer things together. Yeah, down here. This is how you get in. Okay, cool. Here we go down through the sewers. The shark can come up to your toilet and go through your toe.  Ow! Ow! Oh my God. My elbow's so hard. How I do it? They caught it a funny bone. It's not funny. Oh, there's two of them. I did not sign up for this. I'm trying to just get these as fast as I possibly can. So then I can get out of here. Ow, just get out. Get out as fast as you can. Okay, I might have done it. I might have done it. They're following me? No, I think we're good. Might as well, you know? Why not just kill a human on the way? You know? Whoa. Local police departments settle a dispute over jurisdiction. These two remain a popular attraction for selfies seeking snorkelers. Interesting.  What?  That's pretty messed up, dude. That's not cool at all. All right, group or time. Grouper, more like pooper. Very funny. Four, six, and let's see, let's see. Let's make that seven. Only a couple more. Oh, baby.  Okay, I can do that. Are there hunters over here? Why? Why? Why are you guys over here?  I was eating fish, dude. That's a loud, that's a loud. I understand when you get upset because I'm eating people, but I was eating fish. That is completely in my, in my, in my, I'm in my thing that I'm allowed to do. Whatever it's called, jurisdiction? Yeah. When you mess with the bull, you get the horns and I might, he might. Whoa, whoa, whoa, whoa, whoa.  This doesn't look super fun, dude. Oh, he grows. What's up with you, dude? I need to remember that I can heal up too by going and eating other things. I missed. He's a quick guy. Hello, Bakutia Kabir. Kabir, let me chomp you. He's almost done those. He's almost done so. Hey, buddy. Get him, get him. Come on, get him. Come on now, get him. And here he go, the last of his kind, the apex CUDA. How many CUDA courses he have? Ha, ha, ha. Sorry, just a little, just a little graphics card joke for you. The bone evolution sets, adds damage, resistance, and is the most effective for boat combat. Fee other apex predators to collect the whole set. Cool, cool, cool. Wait, check in on Pete. Whoa, yeah, let's check in on Pete. Where do I gotta go for that? We should probably go back to the thing and try and level up a little bit too. That might be smart. Hold on. Hey, why are you coming in here? Can they attack me? I don't think they can attack me in here. Why are you guys coming in here?   Cause it's just free food and free XP. Maybe I can lure an alligator in here. Is there an alligator around here? Ooh, there is. Hey, Bubba, come here. Idiot, come here. Yeah, yeah, yeah. Ha, ha, ha, ha. Come here. Wait, come here. Yeah, come in here. Ha, ha, ha, ha. You fell into my trap. See, watch, cause he won't get me. I am completely immune and now I will try them. Falling into my trap, baby doll.  Okay, let's see if we can level up some stuff. Whoa, those are pretty gross. Wait, this evolution allows you to just, allows you to rend steel and hold onto the slippery spray and electrical charge each time you bite. I forgot that I can upgrade things. How much stuff? Oh, I've got 19,000. Yeah, let's upgrade that, baby. All right, now that I've done a little bit of upgrading, let's go to there.  Don't worry about it. Don't worry, bud.  It's fine. Psst, being so dramatic. So dramatic, you know? Uh-oh. Uh-oh, big stinky pee. My elbow still hurts. I think I shattered it completely. Back on board the Cajun Queen. There he is. Esca. Esca. He's just here for the summer. Studies, marine biology. Marine biology. Hey, there I am in the back. I got one egg and still got a hook. You got two competitive shoes. Hey, whoa, whoa, whoa, whoa, whoa. Yeah. Is he gonna get eaten? Spent a lot of time together. We wasn't close. He was a shark on a, that's all it was. If anybody were gonna catch the mega, thought it was a government experiment, got itself loose. But he wanted that shark. He wanted that shark. He's getting deep, dude. What happened to your father? Got worked on you. Damn, got to eat. Got to eat, got deep. Wow, dude. I want to be the megalodon.  Crave New World, visit the Golden Shores Grotto. Whoa. Do I get to go to the ocean, dude? I want to go to the ocean. That'd be so cool. Whoa, oh, a mega shark. Okay, hi. I didn't know I was just a vestigate. I'm so sorry, dude. This is big misunderstanding. This is big misunderstanding.  Please don't come after me. Oh boy, I do not want to mess with the mega shark. I'm a mere level seven, dude. And that's a big shark. I can't do that. That's the first other big shark that we've seen. I've been the only shark thus far in the game. That's kind of cool. One of my own. Why don't they want to just be friends? They can teach me the shark ways. Small fishing boat.  Mmm. Am I adult? This is the ideal stage for the shark to meditate and harness her pure potentiality. Mmm, pretty. Clever girl. Fin some, lose some. What is this? Watch this, huh? Do I get to do some golfing? Do I get to, you know? Go do a little putt-putt around here? What is that? Is that like a big volcano? Whoa. Yeah, golf tournament fun. Let me get up my driver right now. Hey boys, hey boys. Don't worry about me. Don't worry about a little old me. I'm just here for the ride. Mmm-hmm. And then I come back up and you have nothing to do because I am a shark and I am meeting you. Da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da. All right, just four more. Just four more. All right, only one more. Got him, got him. Finsome, loovesome. All right, we're going to do two more of the thingies. Kill 10 mackerels. Ooh. Ooh, okay. I can do that. You know what else I can do, though, as well. Just kill 10 more humans, I think. Hey guys, don't worry. Don't worry. Don't worry about me. Everything's all right. I'm just here for the ride. I'm just here for the ride. I'm just here for the ride. Everything's fine. Everything's fine. Just gonna wait until I'm fairly close to the health town. Well, also, I'm regaining health as I go. So actually, this is perfect. I can just keep eating. Kind of, kind of. Please don't die. This is actually bad. This is actually bad. I just need one more of you. There we go. All right, mackerel time, baby. Well, let's get them. I didn't think mackerel were this big. Mackerel, well, these are king mackerel, true, I guess. So we have mackerel in main, but they're not this big. Now we're near this big. Fort Clovis has grown bored. Ooh, this is bad. This is not great. There is big makos around here just chomping on me. There's a bunch of mako sharks in here. There's like three or four of them. I just need two more. Come on, there we go. Let's do this one more thingy.  It's just going to be a little bit tough. But on the way, we will try and eat some stuff if we can because that'll help us level up a little bit. And that'll be good. Maybe we'll eat a human or two. Why are you putting your hands up? I'm not a cop. It's time to get the mako. Level 12, dude. Oh no, I wasn't on the right mako. There's two makos over here. This is the hunted mako. I can't fight two of them at one time, dude. That's not fired. That's not fired. It's so fast. Damn, they're impossible to see. It's making little dog sounds. Dude, I've almost got it. I think the other mako might have heard it a little bit.  Yes! First try! Uh-oh. Uh-oh. Well, I guess I'll end it here. We killed the mako shark. We've leveled up. We're level nine. Still a teen, hopefully an adult soon. But good stuff all around. Thank you all so much for watching me become a wonderful shark.   Maybe soon. Thank you guys so much for watching. Hope you enjoyed it. If you did, make sure to slap that like button right in the face. And I will see you guys in the next video. Love you all. Stay cranky. Bye.


Webinars, webcasts, live streaming. These are all different ways to describe digital events, and with Redback Connect, it's all about simplicity and peace of mind. We do digital events differently. Whether you want to deliver a presentation with a single presenter or hold a panel discussion with a few panellists, the first thing to decide is where to present from. You can come to our studios in Sydney or Melbourne where you can have black drapes in the background or use a green screen. You can present remotely from your office or home through a computer and or phone, or we can bring our equipment to the venue where your event is taking place. In short, we can stream your event no matter where you are. We also offer flexibility with what your audience sees as the final product. You can set the layout to video and slides where both assets are displayed side by side, or you can have audio and slides where the slides are given much more real estate, or video only where the focus is solely on the camera feed and you can choose to overlay slides at certain points just like breakfast TV. Of course, on all these layouts, you can control how many interactive elements your audience gets access to, such as voting on polls or asking questions, just to name a couple. If you're looking to deliver an exceptional experience for your online audience, Redback Connect is head and shoulders above the rest. Digital events done differently. So that's the Redback way.


Thank you for coming to this talk. My name is Yang Tang. I'm a maintainer of Quoding S project. I'm from OVN and this is my college job from Google. Hi there, I'm John Bellamerick. I'm also a maintainer of Quoding S and also deeply involved in communities. And as Yang said, I'm from Google. In today's talk, we are going to discuss several things. First, we're going to make a brief introduction about Quoding S in case another one is familiar with Quoding S. We're also going to provide an update for the past year or so. And then we're going to discuss about community bridge, sponsored by the foundation and the Google summer code programs. The reason we want to emphasize those programs that for the past year or so, we have made tremendous progress and we have lots of contribution from different from different school students and they counter a lot of to Quoding S. So we think it's worth to mention to to recognize their contribution and give people some insight on what how things going on in those two programs. And finally, after that, we are going to discuss about the demo plugin in Golang, which is a source-based service discovery, which is the focus of this session as well. And at the end, it's going to be a Q&A session. Thank you. So what is Quoding S? If you're not familiar with it, Quoding S is one of the earliest CNCF projects and it's a DNS server written in Go. So you might ask why do we need a new DNS server? Well, what we found was that traditional DNS servers were really geared towards traditional infrastructure and in cloud environments, cloud native environments, the requirements change very quickly. We have a lot of underlying infrastructure services coming going more quickly than you'd want to reload your buying server. And so we sought a need for a DNS server that could handle those use cases where the use cases themselves are evolving quickly and also the underlying services and things that we want to look up are changing quickly. So this project was started by Meek Gibbon, who I believe was at Google at the time. He's now elsewhere, but he's still our project lead and our sort of benevolent dictator and he does a great job of leading our community. But over the last few years, Quoding S has grown really quite dramatically on becoming the default DNS server within Kubernetes, which has increased its usage quite a bit of course, but also by integrating natively with different cloud provider API services. So you can attach to Route 53, you can attach to Azure DNS, you can attach to Cloud DNS, Google Cloud DNS, and you can do all of those in the same process and have it actually serve up records related to all of those things. And there's also a lot of other innovative features involved like or that we've developed like I'm able to do DNS over Jrpc, which folks are using to put their DNS save on the pushbox. There's all kinds of sort of interesting experiments, but I should say. What are some of those experiments in the last year? So it's been because of COVID, it's been about a year since we've done an actual update to the community. And so it was back in July 2019, we released 1.6.0 and more recently, 1.7.0 and coming presumably already released by the time you see this will be the 1.8. In any case, through that 1.6 cycle, we added a bunch of more integrations like to Cloud Providers, Azure and Cloud DNS, we already had Route 53, we added some additional ACL functionality and improvements in the cache to allow you to search tail options. In 1.7, we pulled out the communities federation plugin, some kind of plugin from the original federation control in Kubernetes, which is effectively dead. And so we removed that to reduce the service area for problems. And we also added DNS64, which is a plugin for helping with IPv64 transition. The big thing in 1.7, that those of you who are familiar with core DNS and have been using core DNS need to know about is that we changed the metric names. So in previous versions, the metrics names didn't follow the conventions that the Prometheus project publishes. And so we revised the metrics names to be consistent with those conventions, which helps fit in with the rest of your metrics. But of course, if you built dashboards of old metrics, this is a transition. In the upcoming 1.8 release, probably the biggest most interesting thing is a little bit under the hood, we have a transfer plugin now. So previously, the zone transfer configuration, transferring zones out, was configured on a per back-end plugin basis. And now we've built a plugin that handles it all for those back-end plugins to make it easier for authors of those plugins to support the transfer. So those are the major things we've done. Of course, there's been hundreds of bug fixes and minor improvements throughout that last year. But those are the big things that are user-facing and invisible. Okay, now I'll talk about the core DNS community update. For the past year, we have lots of updates from the community. First of all, our number of contributors has increased from 150 to outweigh to 238 contributors. That's a big sign to all the developers that come into core DNS. We also have additional maintenance. Now we have 24 maintenance in the community. We have 30 public adopters. By the way, the public adopter only means if they're the company, like Enterprise, they use core DNS and they're willing to reveal their name. We add their name to the adopter's list. But I'm pretty sure that a lot of companies, a lot of Enterprise, they're using core DNS silently. By the way, in case if you're a company or Enterprise, your institution use core DNS and you would like to share your experience with the community, I would like you to add a poll request to public adopters to increase this number again. Finally, core DNS reached a milestone of 6,600 stars. This is a gigantic milestone compared with a year ago. And we certainly want more stars down the road. So if you haven't done so, please just click start to core DNS repo in GitHub. Many people would ask, if I have a question, how do I get help from core DNS community? There are two sources of, two places that's going to help you a lot. It's a GitHub handle. In GitHub, you should be able to find most of the maintenance and most of the maintenance are very active and you can find help every day. There's also a Slack channel, CNCF Slack channel, that's a core DNS Slack channel that's going to find a lot of help as well. There are some additional places you can find, like a website, like blogs, like Twitter, those are all places you can find if you need any help. Next, I'm going to discuss about the community bridge program. For anyone that's not familiar with community bridge program, this is a program sponsored by Link Foundation. Every year, Link Foundation sponsors at least twice for community bridge programs for different open source projects. The core DNS has been fortunate enough to be selected to participate for the past two years. In 2019, one student finished a so-called Google Cloud DNS plugin, which is a very important plugin and is part of the default plugin in coding as repo. In 2020, another student finished a coding self-check on Kubernetes. Essentially, it allows the coding to automatically repair itself if something goes wrong with coding itself. Those are the very exciting contributions from the students. At the end of the day, the community bridge program will sponsor the student. Once the student finishes a project, the Link Foundation will pay a student to the student. This is both financially motivating and it's a very good way to help the open source project, especially for core DNS. As many of you already know, core DNS also participates in Google Summer Code and the people are familiar with Google Summer Code as well. For the past four years, core DNS has been participating in Google Summer Code and many students participated and contributed to core DNS project. There are very interesting contributions, things like a DNS tab, like ACO, which is access control list plugins, all part of the default plugin. Finally, the CEO, Chinaka, he is a student from India. He contributed a project, so-called machine learning by DNS detection. This project is now the part of the core DNS repo, but it is an interesting external plugin that's actually do very exciting things. Essentially, the project the student is doing for machine learning plus core DNS is that many people, when they talk about DNS, they say, okay, DNS is just infrastructure thing. It's not a lot of interesting things. It's not a lot of excitement, but for this student, he basically built a plugin that allows the core DNS to forward the query to an outside server and this outside server is essentially using machine learning combined with TensorFlow to decide if a query is Malaysia's or not. If the query is Malaysia's, the outside machine learning server will return back to core DNS, say, hey, this DNS query needs to be blocked. And then that's that complete whole story, which is very nice. If you look into his website, this consists of many components. It has a very good plugin that's written in Golan. It has a nice UI written in Python plus and it also has TensorFlow integration building a course model. So those are the excitement that has been introduced by this student. So I think it's the worst to mention in our discussion here because as many people are aware that actually there are a lot of things you can do with DNS if you are a little innovative. So that's the thing we want to show. The next slide is we see that the student even provide a nice UI on the left side. On the right side, that's convoluted neural network model this student used to do the detection. It's a very nice start to see people getting this field to combine the machine learning, combine the DNS infrastructure and combine the security in place. And also the student even have a very nice logo as you can see. He named this project as Emil Bridge and he has a very nice website which is a good thing if you have time to know Brazil. Now we start about a discussion for server discovery and the server discovery discussion is the main focus of this session. When people talk about DNS, a lot of people read the question about say discovery say okay in this day and age you'll have sdns out of the place you can define a network and whatever you want. So why is DNS still needed or why do you still need DNS or why do you need to use DNS for service discovery? I think there are several factors. Now first of all DNS is a nice induction. It may not it actually allows you to give a lot of flexibility. For example if you want to move from one place to another let's say you have your infrastructure out on google cloud and in one day maybe you say okay yeah because of some user requests I want to move to AWS. So what are you going to do? Of course it's going to be very hard to do the migration if you're using sdns solutions to make sure that the IP is as the same. With DNS a lot of times it's just a simple DNS record change and you can redirect the user to another cloud or to another place and we want. The DNS is also a very nice distributed system. It may not be the most sophisticated distributed system in nature but it is really scales to internet and it scales really well. Another reason many people use DNS is that DNS is very pervasive in IT infrastructure and you have DNS in cloud vendors. You have DNS in your Kubernetes cluster. You also have DNS with your existing IT infrastructure that's managed by IT admins and because the DNS is so pervasive you can easily wire everything up into one place and use DNS as the central source of truth for all the services and that's why the service discovery has been a nice area for DNS or server. Thanks y'all. So before we jump into how we build our source-based service discovery plugin it helps to have a little bit of a discussion about how queries are within our DNS. So on the left hand side here you see a core file. A core file is the basic configuration file for core DNS. Essentially it's a bunch of stanzas. Each stanza has a zone and a port more or less. So what you're seeing there is for example organization.com is handled on port 53 by the first stanza. On-prem.organization.com is handled by the second stanza and everything else is handled by the third stanza. So when a query comes in off of TCP or UDP port 53 the tree on the right kind of describes how that query, the flow that query is going to go through. So query coming in the top of the flow it's going to be routed based upon the configuration of those zones and the stanzas. It's routed to be handled by a plugin chain which is defined by a particular stanza. So if we look up food.organization.com it's going to go to that routing point and it's going to say okay food.organization.com let's make the longest possible match in DNS labels and of course on-prem doesn't match. organization.com matches dot matches but organization.com is longer. So it's going to get routed into organization.com plugin chain it's going to use so it's going to just get the cash plugin if it's cash to be sent out and otherwise it'll be forwarded on to 123.3.401 which will actually have work best. Now anything on-prem meaning this is a sort of anything falling under the on-prem.organization.com so food.organization.com we get routed to that stanza which would get forwarded and everything else then gets sent through to the other stanza. So this is how you configure different zones to be handled in different ways in a sort of stock vanilla coryns. So then the question is how do we change that behavior? Well we change that behavior by creating our own plugin so it's not going to change the routing but it can add another layer of routing in this particular case. So the demo plugin which is available on our coryns GitHub organization in the demo repository is a plugin that will return a different result based upon the source IP address of the plugin and in this particular case we look at you know 172 zero slash eight and or localhost network and we return 1111 otherwise 888. And that's the wrong deck. So any plugin in coryns is actually pretty simple. It consists of three functions well you can have more but there's three that you need to have. You need to have an init which is what all it does is actually register the setup function with caddy. So what am I talking about caddy? Well coryns was originally was originally a ford web server called caddy but we we're no longer a ford. We haven't been for many years but what we do use is we use caddy's infrastructure. So caddy has it's a going web server and it's it's got a sort of set of primitives for managing servers for handing graceful restart for handling the configuration for handling this whole setup process of plugins and and so we use that for some of our infrastructure on the this the internal server functionality and as it happens one other thing that's that happened in 1.7 I talked about different versions earlier I believe it was 1.7 well maybe it was 1.8 but about to happen is that caddy has gone on to a version that we don't want to to go with so we've actually pulled the original caddy code internally so that's kind of more under our control now but nonetheless the first thing you need to do is you need to tell the the core file parsing functionality what to do when it encounters a particular directive that describes your demo describes your your plugin so that's what the init does it says here's this function you should call setup and the setup function actually parses then that that configuration so like when you set up forward you say forward dot to some particular server name that is that that's what gets passed into this setup function is that dot and then you know essentially all those parameters you passed with that gets called once for each time the plugin appears the directive to register within it appears within the core file finally you need a serve dns method so the serve dns method does exactly what like what it sounds like it basically handles a dns request and processes it and basically either processes it returns the response or decides that it doesn't want to process it and passes it down the function so what do those look like they're actually like maybe less than 20 lines of code um the init function like I said super simple registers the plugin just says okay in our case our plugin's called demo um so what we're going to do is uh register demo and the action there is server type dns is because there's also a http server type because it's caddy we mentioned but so it's just always dns for us but action is basically the name of the function that should be called or a pointer to the function to be called when when you encounter when the caddy parsing routines encounter that directive demo so the setup function on the other hand is passed this caddy controller that's essentially a pointer into the configuration a tokenized version of the configuration file so the c dot next consumes the word demo which is the directive so we just kind of typically consume that and throw it away and then we go through and start to look at all the different options that might have been passed those could be passed directly after it or they could be passed within the within the curly braces it within the core file so in this case we don't have any arguments so we just uh essentially uh puke if we come across something that um uh if you added arguments there then we add this plugin in the setup we add this plugin to the chain so essentially we're saying here's the the handler uh here's here's the the handler to call um when uh when query comes in and it's going down and trying to process it um here's the one that the previous plugin should call in the event that it doesn't want to handle this particular request so finally then serve DNS this is the meat of it this is this is what gets called when um by that that chain when um when a request needs to be handled by this particular plugin um just does a few things one it creates this sort of convenience um struct called a state that's a request object um and pulls the uh the query name off of that that's what name does um since we are sort of uh brain dead we don't allow you to configure it we just hard coded 888 here um and then we just look at the the state.ip that's the client's source ip and if it starts with with one of these things um we we reply with something different and we log in so um obviously this is not a very useful plugin because um that's not an answer we want typically but um normally a plugin would examine the type of the query uh we potentially look it up or it might manipulate it in some way finally we the final piece to making all this work is that we need an actual core file um when we create uh we need to call it super simple um the plugin doesn't get inserted into the chain until it sees that directive we talked about earlier the directive we put in was demo so we have to put that into the core file finally building it so one interesting thing interesting meant in a somewhat pejorative way because i i don't particularly like this but it's just how it is right now is that uh that plugins cannot be loaded at runtime plugins are only loaded uh only built uh done at build time so we have to actually go in there's a file called plugin dot cfg and that file has an ordered list of plugins and in fact not only can they they not be loaded because right it's go it's statically compiled but they actually uh can't be reordered um that's actually my bigger complaint not so much that they that we need to recompile uh because i like statically compile things but um but that we can't reorder so that's my my uh my my little side comment there maybe we'll fix that one day we haven't done it yet um but nonetheless you need to go in and decide where do you want this to fall so that means that um for example the forward plugin comes very late in the plugin dot cfg file because typically we don't want to forward something until we've given an opportunity for uh say the kubernetes plugin or the file plugin to handle the query first so um similarly things that um like um rewrite rewrite comes very early in the plugin chain because rewrite takes the request modifies it hands it down the chain for other things and then it's given an opportunity to um to to do something more with it on the with the response on the way out so you have to make a decision about where your plugin should fit in this case well we are doing a source-based service discovery we're actually um we're actually essentially a backend we're deciding what to return uh based on the query and so um and given that we want this to sort of take priority over what might be in a file or might be on some DNS server out there we want to put this early in the plugin chain so we would go into plug-in cfg and we would drop it in um uh somewhere early in there um and then um finally we just build there's a nice docker command you can use to build so you don't need that go go installed locally and it creates the file for you and and you can go so we don't have a live demo for you today but what we do have is a link to the source code so you can just click on that or visit that in github and um take a look at what what what it is and and give it a try and um after that uh feel free to reach out to us on some of the channels that yang mentioned earlier on slack or wherever it may be if you if you run into trouble thank you finally uh once you've written that demo plug-in and worked it and it's working great and you realize you've got all these crazy use cases that you want to do then please join us and become a contributor um you know we um there's there's lightweight ways like like uh help to help out the project like yang mentioned star us or uh if you if you use um cordy and s which if you use kubernetes you probably use cordy and s even if you don't know it um feel free to add yourself to the adopters or jump in on our github or slack channels um we uh you know if you if you show good judgment write good code and you give us a good solid pr um you know you you'd be a contributor and if you do one that uh that requires um potentially ongoing maintenance then we'll watch you to be a maintainer especially if you had a plug-in um uh because you know many hands make light work um when when there are changes that come in uh or problems with a particular plug-in we like to have the author of that be a maintainer of it uh in the vast majority of cases so um we'd love to have you have you take your new skills and contribute there thank you very much and we'll look forward to the q&a


So, thank you all of you for being here today with us. We're gonna talk about some um uh card hacking topic. And let's go fast because I think we made 20 slides. Let's see. So yeah, who are we? I'm Javier Vazquez. I'm a hardware security specialist. I work at Code White, a German company with phone stuff. I'm from Cadiz, Spain. I guess you can figure it out already. I'm sort of dark stuff. And yeah, I reverse engineer stuff, blah, blah, blah. I like cake when it's not alive and barbecues. I mean, who doesn't like barbecues? So, uh, so hi everyone. I'm Hendrik Fettin at Nature, uh, Ferdi for short. I also work at Code White in southern Germany, uh, among many things I also like barbecues of course, and lasers. Like lasers are fun, right? So, uh, we had to decide between doing stuff with lasers and card hacking. And I don't know. Maybe you can imagine what we went for. So, card hacking status. What's going on? So yeah, uh, besides remote stuff, like, yeah, focus is on the canvas because data, blah, blah, blah.  Some researchers also found remote exploits, like, uh, slashing wheel tires and stuff, but yeah. Yeah, it's like hardware stuff. So, and also some really awesome tools to help understand the UDS protocol. But, is there anything else? So, yeah, chip tuning is like, uh, its own thing, but it has a lot of common with card hacking actually. It is card hacking. And uh, there's issues being cloned, uh, keys being dumped and data being manipulated to get more horsepower or, yeah, that sort of stuff. Yeah. Also, uh, in the internal data manipulation, uh, chip tuners often enable, for example, writing over OBD, which is disabled. That's actually quite a hack. I mean, you need to bypass checks and so I would say signatures. So, that's a cool topic. And yeah, we all know OEM diagnostics, right? They can do also fancy stuff. So, yeah, what's the secret, uh, that might have fell down? So, EDS is not the only protocol. Like, really, there's also tunneling protocol, which is the canvas version of the keyword protocol 2000, which was used on all cards over KLAN. And, both of, uh, series of services, uh, SIDs, which are like actually quite interesting, but people don't care that much about them. And yeah, using these services, you can get a lot of fancy information, even memdums. Want to explain that? So, yeah, uh, let's compare the UDS and TP 2.0 very quick. So, for TP 2.0, you actually have to negotiate a channel where the communication will happen, retain the set tester and the module. So, let me see. Yeah. Uh, first, we have a response, like 200 is always the channel negotiation request.  And on the bottom one, you can see the response, which is 200 plus the target address. And then you can communicate. Yeah, and then you have, like, the transmission. Transmission is just, like, the ID, which is the can ID, you have the frame counter, the frame type, the, and then, like, data, blah, blah, blah, blah. We will share the slides. So, don't worry if you're not getting it this fast. Then, UDS, the only difference between UDS and TP is that you don't need to negotiate a channel. You just, like, podcasts. You have your type of frames. Uh, they're first by this length and the type of frame. But in the end, the data that's in the payload is what matters. That's the SIDs, the firmware, whatever. So, they are pretty similar. They are both, uh, transport protocols actually. And just to make, uh, if it's somewhat visible, uh, that's the difference between TP, KWP, and UDS. There's just, like, some services are, like, divided into more, smaller services like on UDS, we have communication control. On KWP, you have, for example, start com, stop com, disable normal message. All that is handled by a single SID on UDS. You have four on KWP, which is standing protocol. So, that's the only difference on our protocol level. So, here we will shortly list a couple of interesting services. So, the first one is security access, which is, uh, the way you authenticate the tester against the ECU, right? So, the security access will unlock different levels of functionality. It's like a challenge response. Then there's read memory by address. You give it an offset and it will return the contents. And often but not always requires security access. Uh, read and write data by ID is like for, for example, for getting the VIN, the vehicle identification number. Um, you give it parameters, retrieve the data. Uh, request upload is like from the ECU's perspective. So, don't confuse the name. It's like to retrieve the firmware from the ECU. And routine control allows to start, like, custom routines, for example, erasing the flash, uh, triggering all sorts of stuff, like, yeah. There are some fancy routines, uh, we found in some vehicles, well ECU's actually not vehicles. Uh, name it, uh, Bosch, uh, that would allow you to retrieve the, the boot keys in EDC 17 and MED 17.  Uh, so yeah, why all this stuff? Because come, Badger. So, yeah, Glitcher's gonna glitch. So let's take a look at the hardware overview. Uh, it's an MED, the LPC 1768 or PC Espresso. It has external RAM, 128 kilobyte to speed things up, 2db9 for, uh, CAN, 2D back headers, SD card, ECU power controlled by a MOSFET. We have UART, we'll see later why. For GPIOs, if you wanna add fancy LEDs, and it runs in three different modes. A standalone USB, which is a CDC device, USB over serial, or network. And yeah, can be powered with power and has a blinky LED. So that's really fancy. And it's really cheap to make. It's under 25 bucks. Yeah. And we made it like easy to solder, so this, it's really easy to set up. So the firmware consider it a proof of concept. Okay? Uh, the actions are always handled by the CAN Badger itself. So it doesn't really require a laptop or computer, whatever, to perform any logic. It's all implemented in the firmware. Like UDS, CP2.0 browsing, rock, hand logging, uh, just as a start. We have a man in the middle mode with the emulator mode. And we also mentioned that you can have three different modes of operation. That is standalone mode without anything attached. Uh, UART mode where you get a CDC device on your computer and connect with your terminal. And then there's Ethernet mode, which we will, I will go into that, don't worry. But it's for use with the CAN Badger server. So you can have multiple CAN Badgers in parallel. Yeah. So, fancy stuff. Yeah. So, uh, just a quick overview on the protocol analysis. So yeah, many SIDs are already included in the firmware. It's just a switch case. So adding support for additional ones is really a piece of cake. It's extremely verbose. It parses the SIDs and the parameters. Uh, everything is done by the CAN Badger firmware. So no need for PC. Just the serial part. So you need a terminal. And everything is stored in the SD of the CAN Badger. So you can retrieve it later. And it works with UDS and TP2.0. So yeah, for the interactive session. The interactive session is, uh, interactive. So it doesn't require scripting. And it allows you to perform actions on the go. I don't know if you guys saw before we were starting the presentation. I popped that termite and I was doing some stuff. That's actually the, the interactive session. So you start a diagnostic session and then you can think what's your next, what your next move is going to be. You don't need like to write a script or anything. You can just try stuff, see what happens, change something, try again, like with no rush. And there are built-in scanners for SID parameters. So for example, if you want to go and check if there's any hidden type of diagnostic session or do you want to see what offsets are readable by read memory by address or whatever you want to check. There are some built-in scanners for that to make things easy and fast. Uh, let's talk a little bit about the men in the middle mode. It's also, as I mentioned already, men, uh, all implemented in pure firmware. So on the right hand you can see the original traffic on the top and the men in the middle traffic on the bottom where the payload has been changed. And on the left brackets you can see that there's no delay added. So it's pretty fast and we tested it out with like 30 or 40 rules and basically it will match any incoming packet on either port against your set of rules on the SD card and it will like do basic operations like dropping frames, uh, doing math operations, or substituting simple bytes. Uh, yeah. So, um, we thought we could make it even easier to use the cambedger. So we wanted to have cambedgers talking over Ethernet so maybe they could exchange some data uh to each other or just to have multiple ones running in parallel. And this is why we had the cambedger server. Uh it's written in python and here is a small snatch shot. It's actually not themed but uh it looks different now. So on the left hand you can see the connected node and this is where you will switch between different cambedgers. And uh the GUI was really inspired a lot by Burp Suit so you can you have everything in one place and you can exchange data between different modules like the logger. For example send a frame from the logger to the replay tab or create a rule for that. Uh, yeah. So security access hijack. Why? So yeah we were talking about security access and it's now starting to be more known uh so yeah uh just uh test authenticating itself against the ECU. So but you need to know obviously the algorithm being used and the key being used. Since it's random uh you cannot brute force it. I mean the uh the challenge is gonna change every time and after three failed uh authentication items the ECU locks down for ten minutes to thirty minutes. So no brute forcing there. What's the other solution? Hijacking security access. So you just need a tool that is able to authenticate. You don't need to care about what the tool does. It just needs to be able to authenticate. So for that for example we bought a cheap uh clone interface for tuning the cars and every time we want to have access to something like I don't know the restricted diagnostics mode for example or reading some offsets that are not standard we just hijacked the security access. And yeah then we have secret access without caring about that. So how does it work? The combator gets into a transparent mode uh bridge mode so it waits for the security access to happen. If the security access succeeds it will disconnect the external tool and then it will take over the session and give you a nice menu with a lot of stuff to do. So yeah let's try the demo. We are running a little bit bad on time but why not? Let's try the demo. So let's fire up our Super Windows XP. Because why not? Yeah we all love waiting right? Yeah. Okay so in the meantime let's, although being worried we'll do it soon, we're gonna do the demo in a while. Let's let up the, because we're not that good on time. So yeah let's travel to the future on the next slide. So yeah. So we hopefully we survived the demo. So what else can the combator do? So another fancy thing is dumping the TP and UDS transfers. We are, which are used for firmware updates. So let's say a vehicle gets an over-the-air update so that will be encrypted, signed, blah blah blah blah but then it needs to distribute the firmware updates over the network to the different modules. So it does that over the can. Most of the time, not every time. So if it goes that way and it decides not to use encryption, which we have found some manufacturers do, then the combator can just like grab the whole transfer and dump the data. So basically dump the firmware that was being updated. It can also spoof OBD2 data to the one in the middle and the emulator. The emulator is like some other fancy stuff. We will explain later. And yeah, you can use GPIO pins for boot loading for tricord, you know, like some people call it zero-day, it's just on the datasheet.  And yeah, it can manipulate GPS signals via your pins. So why do we mention GPS? Hmm. Well, many of you guys might know those kind of downloads that give you rewards or allow you to track vehicles, for example, from insurance companies and they turn your safe driving into savings. Hmm. Let's play a game. So the thing with these downloads is that they implicitly trust the data that is coming from the car. It's requesting data over like diagnosis protocols and also they're dependent on GPS so they do have some cross validation or some features that require that. And by spoofing the OBD data, you can have your own driving habits. Yeah, well. And maybe if you spoof your location too, it's going to be more money for you. So here we have an Android radio that's not a stock radio. So basically running an Android app connecting to a Bluetooth dongle that is plugged to the car. And you can see that there's like stuff going on, RPMs going up and down. But the car is not really turned on. Hmm. And now I can see that we stopped the camberger. The data will stop changing. Yeah.  So yeah, that was emulator we were talking about. So how does emulator work? So just set up a file inside the camberger's D and tell it to broadcast every 10 milliseconds whatever a request which is a request for a PID which is the data used by these insurance dongles. So it just keeps on making those requests as long as you want it to. You could be like two hours logging all the data that will be used for the emulation which is actually real driving. I mean you just like go around in circles for one hour logging the data. Then you create the emulators. Once you create the emulator, you got the data. Then you use the camberger to create the emulation data. So the camberger will look on which SIDs were used, which PIDs were used, and just like ask you from which one do you want to create the emulation data. So the way that the emulation data is stored in the camberger because like we said earlier everything is running inside the camberger. No computer needed for this. Just press a button. So we created a header that has the IDs, the protocol used, the SID, the PID and then the start offset and end offset. So that's sort of a lookup table. And then it maps everything else in the RAM. So whenever it gets a frame, I mean on every single frame it gets. It will check the contents of that frame against the whole emulation data. If it finds data that can be used for that SID, for that frame, then it will provide the emulation data. If it does not, it will just forward the request straightforward. So the dongle, the insurance dongle really doesn't know if there's anything in between. It's getting all the stuff. And yeah, it's a story using timestamps, so to get stuff real. It will only check for the data, change the data when it actually changes. So to keep the emulation, yeah, what a genius. So the thing is that it will, to reduce the size of the emulation files, it will only log the changes using the timestamp. Yeah, when there's nothing left, then it just starts over. So, yeah. Now we'll do the demo. So yeah, let's do the demo now. Hopefully the- So we'll be having a workshop. Unfortunately it's already sold out, sort of. But we're gonna release all the code and schematics on GitHub, their GPL. You're also welcome to go, hack the stuff. It doesn't have that much dependencies. And if you're like an embedded coder anyway, will be really easy to get set up for you. So. Yeah, all fancy Windows XP machine doesn't want to work because why not? So let's show something else instead. We hope you guys will like it. So how much time do we have left? Okay, we have something. So are we connected to the COMBAT? Yeah, let's actually- So that's the COMBAT USB interface. So right now we have an Bosch EDC 17 ECU connected. It's from Appleswag and Passat. So let's have some fun with it. Just to quickly show you how it works. So yeah, let's start that session. So you tell it your own ID, you tell it the ECU ID. So yeah, we got UDS session established. So then you say, okay, I wanna read memory because I just want dumps. So yeah, let's try to read memory. So you tell it the offset. You tell it I wanna read FF bytes. Oops. We got an error. Service not supported in the update session. Okay, so let's see. Yeah, I don't really know what sessions are there. So let's scan for session types. There we go. So we have like different session types that can be initialized. One and three are standard, 40 and 4F are not. Yeah, I'll cheat a little bit because I already know it's 4F, okay? So let's try 4F. So let's switch to a custom one. Let's go for 4F. So it's established correctly. Okay, let's try to read again. So yeah, read, the same thing. Yeah, sure. And FF. So damn it, now security access required. Okay, so yeah. Again, we already reversed that ECU. We already have security access. So let's cheat again. Okay, so yeah, we're, oh, that was, well, it worked. Awesome. So yeah, level three. So yeah. So yeah, security access granted. Okay, let's see if it's true. Let's try again. So read memory by address. Let's try blah, blah, blah. And let's try FF. Yeah, so this time it worked. So, and we got a lot of fancy ASCII stuff. So that's sort of the way the Kanbager works. Like you can, you know, interactively try stuff. You don't need to script. You can like, okay, let's see if this works. It doesn't. Okay, let's try something else. So it speeds up things a lot. And yeah, so let's like quickly because we need to get out already. Blah, blah, blah, blah, blah, blah, blah. So yeah. So yeah, as I mentioned earlier, code and schematics, our GPL will be published on GitHub. Like give us one or two weeks to clean it up a little bit. But we're gonna tweet about it as well. So you might want to get our Twitter handle. So yeah, we are very thankful for you having us here. Also we'd like to thank CodeWide which have given us a lot of support and trust. Time especially. And of course our family and friends who've been supporting all the way down. Even if we run out of coffee. Yeah, thanks to everyone for being here today with us. And I hope we, everyone in Goose Defcon.


Just gotta be birds.  I just can't. I just I don't know how to stop verticals. I don't know how to stop. I don't know how it's covered for not guarding. What is up with these guys? Super bummer, dude. Hold on. Wait. The next day when the championship since 1971, kiss, marry, kill. Does Henry John Beast? I kill Henry because I never beat him. I think we got to kiss. I think we got to marry John Beast, bro. He knows food spots. He's a good time. All in all, who says no to that, you know? Look at Riley. Oh, that's a beaut. That's a beaut, boys. Ask about me. Oh my God. What team team does this guy have?  I remember it was moving.  This guy's better than 99% of people on head to head.   That was the best three-meter out of the seat.   It's actually nuts. Actually it was nuts. Is maze good? I don't know.  I couldn't lose to him.     I swear to God.  I was like way more locked in than like if I play Henry, swear to God.     It's so bad. I mean, he was open again, bro. He really was open again for a touchdown. I maybe should have fell there, but I feel like I can get a stop. This is what I'm saying. I don't want to settle for three. This is my philosophy. I could have milk the clock and settle for three. Right. But then it's 24 to 21. I feel like that I'm up three points. I feel like I can get my seven and then hold him to three and it's 28, 24 and I'm up four points. That's my philosophy in that.  I want a baseline with no match or anything else.  Oh, good recovery, Lamar. They didn't get better.  I always want to like commit.  Like they're like, I just want to like, all right, I hope he doesn't lurk it. Never done. It's just assuming they won't learn.  I'm like, I'm going to wait today. Literally don't lurk it. I'll say this might be man covers.  He hug Randy Moss for an hour right there.  Oh my God. Yo, that dude had to be on the running back, bro. He had to be on the running back. Oh, like Darrell Rivas rushed.  I swear to God, he did. I don't know if anybody saw that shit, but I swear he took five steps and then soon after the boy ran back. Let's go. Special teams win play. Like you got a stack corner.  You can't get out of there.    Oh my God. Do you try that, bro? Come on, Ronnie lot.   I'm fat fingering way too much stuff right now. Come on, Jair.   Dude, come on, man.   Bro, holy shit, man.  And I'm again.  Fuck. No, we're so dotted right here.   That's why you just like third and 15.   Jesus Christ, dude.   We're just getting how we get a like, how do we get two potatoes? But somehow mean Joe Green is one on one, dude.  We gave up a cover three bomb. We gave up.  Like he tried to go back to the cover three bomb and I changed it to cover two and almost caught a pic.   Tell you that. I mean, we can do 20. We don't gotta do another 50. We can do 20. That was a good game. Yeah, I'll send another game done. All right, but oh, he's got Sefi lead and gunslingers out. He has to fullback. Who did you go block, bro? I mean, I don't know why I didn't run outside.  Well, we're in shambles early.   Like, come on. It's a goddamn cloud zone. It's a man up. It's everything. And you know, you cannot play cloud flats in this game.   Caught yards.   I mean, dude, my running back just was there for an hour. Dude, like, come on, bro. I swear to God, why skip up with his running back on the inter-out?  I just took out my blitzer right on that point. Bridge! Oh my God, man.  Why not? Fuck, like, he's just RPO me and, like, just RPO throw anything right there? Like, what the fuck, man? God, it's just so trash, man. Motion over the blocker. He turns into a hitch. Snap, throw it to him.  He can't move.  Yeah, I think when you motion him, he turns into a hitch. I think so. All you need to do is put the, we're gonna drop another Calvin Johnson pretty soon the way things are going. So then, let's go Riley turn on him and Riley turn on him. There's just no way that's complete. Just knock into him. Don't go for a pick.      And this, like, dog, I just hate running. Like, just me ever running crowdflaps.  Oh, fumboo. I mean, it's just gonna be corner out. Running back wheel here.   No, no, no, no, no, no. I'm holding Y for it. Oh, dog, get through there. I mean, thank you, man. Six ones just showed up right there. Six ones just showed up on that possession. No, he, bro, definitely. He's definitely makes it a good, dude. I'm kind of slowly starting to get hip to his plays but I mean, really that deep corner route, like, or that deep crossing route should not have been or that deep, yeah, that deep crossing should have got knocked out. I mean, Lord, Jesus Christ, bro. They didn't give up.  Shit, man. Six one works again, dude.   I just can't, it's just, I don't know how to stop verticals. I don't know how to stop verticals. I don't know how is cover four not guarding that shit? Like, we put the yellow zone over there. We put the quarter over there. We put every single person all the way left and they just move out the way and cover four.  I gotta guard the tight end side on verticals.  Just when I know it's coming, it's just like the Lord's play. Like, God damn it, man.  Like, you did. God, man, with who? The fuck? Gotta man them up.   Just throw it.  It's the Lord's playing. Game losing plays right there. Give him that up. God damn it, man.  Come on, man.       That's all you got, man.   God damn it, man.   Fuck, man. God, just running away. Fuck, man. Just running away. Fuck, man. I gotta see that play, though. I gotta go lurk that. That was great defense, bro.  We were looking all on the right side of the field. We give up verticals.  We give up verticals.  Now I'll play him again. Stick. God damn it, man.  I spent my whole life subbing this guy, subbing that guy. Guess what? I'm subbing the next guy. Guess what, Chad? I'm subbing somebody else. Sub this guy, sub this guy.    I'll just rerun here.      Yeah, that's it. That's it.   Just run Double Mabel.    Nice, dude. Nice route right there, dude. That's the one.   He is guarding everything by himself, and I'm so afraid of his user. Look how good- Like, dog.   Yo, Keekley's a God.   That's a throw! What?! God, thank you.  Let's go, man. Scream. Come on.  I knew that guy was gonna come pick, too. Come on, good run, though. Come on, Parham. Fuck, man. There you go, 6-5. I don't know where Parham went on that play. Where was Parham? Oh, man. Thank you. Good, good, good, good. Run a lot.  Come on! Another throw away. Why not? Why not? Why not, boys? Why not just another throw away? Oh, yeah. Let's go, Riley. End the game a different way, Riley. End the game a different way, Riley. Gotta go for it. Oh! This guy's a tricky character, bro. I'll tell you that. He's a trickster. You know it, Honcho. You see it. You see it. Jee-jee's, jee-jee's, jee-jee's, jee-jee's, jee-jee's. I get something that dude was cracked. Jee-jee's to him.