Hello, my name is Ewe. Welcome from Malamian, Monk State and Southern Myanmar. I am Mi-Cherry Soh. I'm working as the network coordinator of Monwoman Network and also program the writer of Monwoman and Sharon at GPR Society Development Organization. I have been studying research why there are more women in politics and I have been studying in 38 years, Mon State, the Nendai division and current state and we come out options from women members of the parliament in Mon, and the Nendai group is parliament. So we find out where men have the opportunity, women have the career, such as family, a gender role and hierarchy. This has been made a planet woman to be representing at the parliament. When in our tradition women have the taking care of the children, Sharon is responsible of the woman and everything's related to the service of women as you can see this is and then women think that this is how if they want to do politics where it is not priorities to them and they have to do their work fast and then they can participate and then tradition are also woman work, like information and the development of the technology. They are like we have been shown in the picture, we have the technology like where we can go quickly but women women must keep the tradition and use the tradition way that is also become a barrier for women in representation and this is the same for men it is very easy you to be representative to be a leader but for women it is hard and then the opportunity are also not much if compared than men in our society and when we have the opportunity but given the choice between a qualifying woman candidate and a male candidate most women even women themselves they choose to support men this is happening for a long time and it become in our society gender representation in the parliament does not reflect as this picture in the composition of the population women and bees challenge the state that oh and in monstay this is our study highlight more from monstay in fast parliament we don't have zero percent of the woman and the one of the MPs who joined both and he mentioned this only male are representative in monstay parliament they have been doing very quick on the issue they agree easily and not much challenge and not much debate but in this parliament still currently and then there are five women out of 36 so those women have made a lot of voice and a lot of challenge to them and all the issue not passed easily than before but when it is implementing it is less mistakes when we did not much debate in this cutting we when we implementing we see the problem but when we have been debating carefully so in this year there is no doubt that women think very specific specifically and then and and make it clear make it easy and make it everybody be to think carefully that is make when implementing easy for women and easy to implement i want to summarize when we only have men think and easily pass easily all the issue but when we implementing it takes long time by having women in the discussion and not it has to separate think carefully and with both represent and they take both woman and man voice but when implementing it is easier and the this is the picture for gender balance when we have gender yeah in the up for it is when we only have men the men view more and then when we have women on the woman view and also who you can see in the picture this woman and these have parliament playing more beautiful picture most of when they see and then the every this is all three state mention this and woman and children issue when we don't have woman leaders and then it is difficult there are some issues that mayor and these that not understand enough about the how to legislate when we have women and how long it is getting easier for for them to to provide the service and women and we see some issue more clearly and in more detail than men this is only when we interview men are saying and they recognize that now we have some every state it become woman and then how it is woman voice are very specific and in the future the parliament we have a big for the tanker parliament could be made more woman friendly by providing on-site tanker and then look for rooms for bread feedings we have a lot of space if we care women and then we we provide this and then women will be more happy to participate in the parliament and through my experience currently in Myanmar through the transition we are fighting not only for woman representation in why we want more woman representation it is we would like to change the services and we have a lot of gender based wild land and child rape and trafficking and such harassment so we need enough safe house enough counseling in person and where counseling area and then we need a legal services health care services for women and children and social worker services and where it is survivors and the approach and also during this pandemic a woman struggling when looking at the case if the case become up to double and triple before we are handling eight eight case parliament now it is become over 20 case and getting asking for the services and we need like a developing country like us and then gender balance is not only in the representing but also the services and we have been our country patriarchy and mere dominant for long times and now when we change the democracy and federal democracy system woman representation gender balance woman when we talk about gender balance it is mostly show in need it is woman participation in politics so that is why it has been highlighted and when you when we get make more friendly break the barrier as I present what barrier we have been studied if we can break woman will be more familiar and prior make their easier to join the politics and to represent for the people so this is my contact and then thank you do you want to


Welcome to today's webinar. On Microsoft Donation Program, get your questions answered. My name is Kami Griffith.  We've got Cameron Jones, Corey Bode, actually Rachel Harmon is sitting in for him. He's ill today. And Kyla Hunt, all from TechSoup answering your chat questions. And I'd like to welcome and thank Penny Clifton for taking time to put this presentation today together. Penny, can you introduce yourself? Hi, I'm Penny. I've lived in the Bay Area all my life, and I've worked at TechSoup in Account Management Services for about a year and a half. Outside of work, I love reading, travel, hockey, and recently started scuba diving lessons. That's excellent. I'm quite jealous. I would love to take scuba diving. So thanks everyone for attending. And I'm Kami Griffith. I am actually a former TechSoup employee now just here doing some webinars for them. And really pleased to have an opportunity to share this information with you. I'm going to spend a minute going over the agenda. So again, this is focused entirely on the questions that you've submitted during the registration. And what we found was there were of course some common questions that we grouped together. So after I talk just a minute about who is TechSoup, for those of you who might not be aware of all the things that we have to offer, the questions that we'll cover are related to the donation program basics, eligibility, this thing called title groups which is new to the changes in the Microsoft program, how you make requests, server products, software assurance, something called Get Genuine Solutions, Volume Licensing, and then more about the Microsoft Donation Center. And we'll have hopefully around 15 minutes at the end for live Q&A. But again, please submit your questions that you have via the chat. Know that they will probably be addressed during the webinar. And if they are not, then be sure to put those in the chat for the live Q&A. So quickly, who is TechSoup? We are a nonprofit organization. And as of June 2010, we served more than 127,000 organizations, distributed more than 6.3 million technology donations which enabled nonprofits to save. And this is just crazy, $1.8 billion in IT expenses in 33 countries around the world. And as you know, IT can be a very expensive part of what we do as nonprofits. So it's great to be able to save a little of that through TechSoup. And so our mission, TechSoup is a part of TechSoup Global. We are working towards a day when every nonprofit, library, and social benefit organization on the planet has the technology, knowledge, and resources they need to operate at their full potential. So know that we are here to help you as nonprofits and libraries succeed in what you do. Now I'm going to jump into our questions that were submitted. So we've had about 130 people register for this webinar, and so we couldn't address every 130 questions. So what we did is group them into some categories. And so each of these sections, there are slides, there are questions that are somewhat different but pertain to the same topic. So I'm going to be asking these questions of Penny. So what we want to learn more about, so folks wanted to learn more about the donation program. And I would like to know some details about the program's changes. So Penny, can you address that? Yes, the Microsoft software donation program for nonprofits and public libraries in the United States is one of TechSoup's most popular donors. By June 30th, 2011, organizations in the United States and territories had received donations with a fair market value of over $1.6 billion. Also, Microsoft made some recent changes to its donation program through TechSoup to make it easier for eligible organizations to get the software products they need when they need them. And here are just two of those changes. An organization's first request that includes Microsoft products made after July 27th, 2011, will initiate and set the anniversary day for a recurring two-year request cycle. That day will always be the reset day for that organization's request for Microsoft thereafter. Also, there is now no minimum number of licenses required per donation request. Great. Thanks Penny. So other folks wondered who is eligible and what our organization be eligible for the program? Okay, most United States nonprofits designated by the IRS as a 501c3 nonprofit as well as public libraries are eligible for Microsoft donations through TechSoup. There are some types of nonprofits that are not eligible like educational institutions, political organizations, faith-based organizations, as well as most healthcare organizations and private libraries. If your organization is faith-based but you have a primary mission or program that's secular, you may be able to register at TechSoup with an organization type that is eligible for Microsoft products. All donations can only be used to support your organization's non-religious activity. And public libraries can request Microsoft products through TechSoup for public access computers only. Donated software is only for use on computers. The public served by the library has access to or machines used directly in the management of those public access computers or the library's public access program. There are some organizations that have recently been made eligible to request Microsoft through TechSoup that were not before the changes, hunting or fishing clubs, swimming or tennis clubs, other sports clubs like little leagues, boys clubs, etc., training in sports, amateur athletic associations. Also newly eligible are some private foundations which includes private grant-making, independent, and private operating foundations. Please see your screen for a link to the eligibility quiz. And there's a little picture of what it looks like. Bear in mind, it's not working correctly right now for private foundations, but it should be okay for everyone else. Great, thanks. So the next group of questions have to do with title groups. And I want to know more about title groups and ordering maximums. And can a person request a title from the same line of products more than once? A title group is a collection of products that do essentially the same thing. You can request up to 50 licenses each from up to 10 different title groups each over a two-year request cycle. It used to be the limit was 6 titles period and up to 50 of each every two-year period. Now you can request products from up to 10 title groups and up to 50 licenses from each group. That includes desktop applications, operating systems and upgrades, and client access licenses, or CALS for servers. Now this includes any version, a title group includes any version of products such as the year like 2010 or 2011, language versions like Spanish or English, processor versions meaning 32 or 64-bit, platform meaning Windows or Mac, and class versions like Standard or Enterprise. They are listed there. And the next screen is a list of the various title groups. It's quite a large list, but I'll just give you a little shot there. Now there is a link to a list of title groups. And on the right is an example of a title group. It's the Windows desktop operating systems. Now it's always been Microsoft's intent for their donation program to allow eligible organizations to request up to 50 licenses of a product regardless of year, version, edition, or language. And title groups are now used to most closely adhere to Microsoft's program guidelines. Most eligible organizations won't actually be affected by this change. And title groups were added as part of the product details on July 27. Every product has its own information page, and you can see where it's circled. That's at the top of the product page. Thank you so much. Again, these links that you see on the slides will be provided in the follow-up message if you did want to check out that list of title groups. So now we'd like to hear how many items can be ordered each year, and can we order only once a year? Okay, there's no limit to the number of times an eligible organization can request Microsoft products through TechSoup in the two-year cycle as long as they haven't used up their full quality allotment. Great. And before I move to the next question, I wanted to remind folks or let you know if you didn't hear or attend our webinar last week, we did a webinar specifically on the changes to the Microsoft donation program. So this is a follow-up to that webinar for folks who had additional questions. So I will send you, in addition to all the links that I mentioned earlier, a link to that webinar recording. So if you want to dive in deeper, it's much more detailed on the changes to the donation program. And this webinar is to talk about questions that you have in general. So if there are things that you're feeling like, oh, changes to the Microsoft donation, what's that? Know that there's an entire hour of content that we have that I'll send to you. Okay, next question. I want to know more about server licenses. Okay, after July 27th, 2011, organizations may request a maximum of five server products regardless of title group. As an example, five Windows server licenses, two Windows server licenses, and two Exchange server licenses, and one SQL server licenses. That adds up to five. Also, client access licenses or CALs that give you access to a server, those don't count as a server product. They're part of their own title group because they're offered separately from servers. Now we're going to talk about software assurance. So how do we take advantage of software assurance benefits? And if you order Microsoft software like Windows 7, are you eligible for three upgrades? Okay, software assurance is offered with most Microsoft software requested through TechSoup. Please see your screen for a link with more information on software assurance. And with software assurance, that comes with complimentary upgrades for up to two years on most Microsoft products that you receive through TechSoup. Although there is a one-time shipping cost for some products if you wish to receive disk media, meaning backup CDs or replacement disks, you can also get access to online product training, and you can get special licenses for using some products on your home computer. And you can still request free upgrades after the software assurance two years has expired, but you can upgrade only to versions that were released before the expiration. Software assurance upgrades need to be obtained directly from Microsoft, so they don't count against your TechSoup limit of 50 licenses from up to 10 title groups. All Microsoft products except the Windows get genuine operating systems come with software assurance. Again, get genuine operating systems do not come with software assurance, but all other Microsoft products offered through TechSoup do. So what is the Windows get genuine program? I knew you were going to ask that. Windows get genuine products are for small and medium-sized organizations, and they are full operating systems, not upgrades. They are Windows 7 professional 32-bit get genuine, and Windows 7 professional 64-bit get genuine. Again, they are full operating systems, and they do not come with software assurance. Organizations can get Windows operating system upgrades through TechSoup when the next version is released. The get genuine solutions are for nonprofits and public libraries that are out of compliance with software licensing, piracy, or some other licensing issue. Get genuine software corrects this situation in which an organization has an existing PC with one of the following operating systems or problems. It could be counterfeit pirated or otherwise illegal and licensed, property-licensed Windows operating system, home premium, home basic, or starter editions of Windows 7 or Windows Vista, home or starter editions of Windows XP, Linux, FreeDOS, Unix, or other operating system, or if you have no operating system installed at all. And here is a link for more information about get genuine. How do I easily manage Microsoft Volume Licensing? You can go to a link on your screen to TechSoup's page on Microsoft Volume Licensing. Is there a place within our TechSoup account that we can see the remaining allotment available of Microsoft Donation within the current two-year cycle? Yes, there is. The Microsoft Donation Center at TechSoup. There you can see the anniversary date of your organization's two-year cycle and how much total allotment is still available. You can find it in two ways. One way is to follow the path I'm going to show you in just a second. Okay, first you need to log in at TechSoup.org. But at the top of your screen, one of the options is My Account. So you click that. On the next page you can click Donation History Slash Status. It's kind of on the top right of your screen. And then again on the right of the next page is Microsoft Donation Center. Just click that. And the other way is again, you have to log in. Over on the left side of the screen kind of near the top it says Get Started. Underneath that click Get Products. And then when the screen moves to the next page scroll down and you'll find a heading that says Manage My Account on the left. Inside that box click Donation Status. And then on the next page click Microsoft Donation Center on the right. If you have any other questions you can reply directly concerning your organization. You can contact TechSoup Plant Services at<PHONE_NUMBER>. Or you can email us at customerservice at TechSoup.org. Excellent. Thank you Penny. So we'll rip through that really quickly. And there's already a slew of questions waiting. So if your question is still, if you're still wondering a certain thing related to the Microsoft Donation Program please submit those via the chat at this time. We're going to move on to questions and answers. And I'm going to just go through the list as they were coming in. I know that these have already been answered to the particular folks who asked them. But since our chat, the way that the chat works is you don't see all of the back and forth that happens. The folks out there listening haven't seen these answers. So Penny can you please define an educational organization? Okay, yes. An educational organization would be obviously schools of any level, elementary, middle, high school, college. It's also other educational aid type situations like remedial reading, help with testing. It could be scholarships for students. It could even be student housing. And PTAs are also included in this group. And a follow-up question to that that Susan asked, we are a museum and nature center. We do some educational work but are not a school. Would we be eligible? Yes, you would actually be registered as a museum, not a school. Even if you do some educational work, all museums do. Probably just arts and culture maybe would be a good idea depending on what sort of exhibits you have in your museum. If you have art, well definitely there is a type specifically for museums. But if you are a nature museum, you might be under conservation. Probably either one of those is fine. Most organizations can fit into more than one type. It's just the one in which you feel most comfortable. Great. And one more related to eligibility. What about community centers that have classes? Okay, yes. Community centers are definitely eligible for Microsoft. There is actually a type specifically for community centers. Community centers, it's kind of a catch-all term because you probably do a lot of different things on behalf of a specific area. But yes, community centers are definitely eligible. And one quick question that came through when we were talking about title groups, I'm going to bring this slide back up. A question was by Brett, how many title groups are there? And I guess I found a chapter around 70. So now that within these title groups are multiple applications within each of these groups. And since you'll be getting a copy of the PowerPoint, you'll see this list. And then you can also get to that list via this link, this PDF file. I wanted to quickly address that question. Next question from Christine. We are 5-1-C-3 offering adult aid care services, assisted living and transportation services. Would we be eligible? Okay, yes. Help for the elderly or any adult day care is eligible for Microsoft. There is one type called housing and care for the elderly. You could be in that. You could also, the type you might be listed as is goods and services for the poor. Poor meaning just anybody at a disadvantage, not necessarily economic. But yes, both of those types are eligible for Microsoft. And this is a question from Andy. This is related to faith-based organizations. There are many aspects of our faith-based organization that are secular. However, when I've attempted to change our group's purpose, it warns me that I may have to reapply. Can you address that, Penny? Actually, you don't have to reapply. You just have to re-qualify. What we'll need is just a letter explaining the change. It should be on your organization's letterhead. And it should say, our old organization type was this. Our new organization type is now that. And the reason we changed it is, and then the reason. Another thing you'll need is probably to call us and have us send you a copy of a survey. If you're changing from faith-based to secular, it's just, I think it's six questions, and the answers are yes or no. So then you email us back or fax us the letter and the survey, and then you can be re-qualified if you want to include any literature about the secular activities that you have. You can do so also. Thank you. A couple more questions related to title groups. So Victor wanted clarification that you can get 50 licenses for each title group, and that is correct, up to 10 title groups. So another question, I don't know who this was from, that wanted further clarification. And the question is, and I think this is actually incorrect, so Penny, correct me if I'm wrong. So if we order Office for Mac 2011 in August and get six licenses, can we order Office for Mac 2011 again in May? So I guess that is correct, but they can only then, the second order, they'll only get 44. Is that correct? Yes, that's correct. If you get six of any kind of Office, you can still get up to 44 of any other kinds of Office in the two-year period. Once that two-year period ends, though, everything resets at zero. And it's like you're starting all over again with the 50 licenses and 10 title groups. And again, that resets on the first day, the day that you ordered it originally. Okay, so someone had a question about fulfillment. So can you talk about fulfillment and how the Volume Licensing Center works? Okay, yes. With Microsoft, for almost everything you get a choice. You can get the disks or not. And it will ask you in the checkout process if you want the disks. If you elect to receive the disks, then of course they will be sent to you physically by Microsoft. Whether you get the disks or not, you will be sent an email with download information. And this will have links to go to and some instructions. Whether you get the disks or not, you can, if you wish, download it directly from Microsoft's website. That's where they take you, is to Microsoft. And if you have not created a login before at Microsoft with your organization's contact email, then you'll need to do that. But Microsoft, when you get there, they'll have instructions on how to do that. And once you've done that, then you log in with your information at Microsoft Volume Licensing Service Center. And through that you can get to a list of the products that you've requested through TechSoup. And then you can also download them and get the license keys. So Laurie has a question about the Get Genuine. How many Macs Get Genuine can you order? Okay, well you can get up to 50 in that title group. Even though it does count towards the 50 licenses and one of the 10 title groups, you can only order Get Genuine products one time ever. What that means is, for example, let's say you get 10 of Get Genuine in one of the requests for Microsoft products through TechSoup. In the two-year request cycle, you could get up to 40 more of other operating system upgrades because those are also part of the same title group. But you couldn't get any more Get Genuine ever.  You can get operating system upgrades from that same title group, but you couldn't get any more Get Genuine. So what I recommend is you really know how many you're going to need because, again, you can only order those one time. Great, thanks for that clarification. This question doesn't specifically pertain to Microsoft, but I'd like you to address a loose question. Can we add a user to our TechSoup like someone who can only read and maybe research products? Right now they only have one person per agency. Yes, you can add authorized agents. Just have that person create a login at TechSoup.org by going to TechSoup.org and clicking Join TechSoup up at the top. Bear in mind, this is just for the creation of a user profile, not an organization account because it sounds like your organization is already registered. Once you create a user profile, you can then link it to the organization's account thus making them an authorized agent by using the association code. Now if you don't know what this is, you can give us a call and anybody at our customer service can help you out with that. Victor has a question. He just took a position as IT and is interested in figuring out if what they've ordered in the past, if the OS for Windows is Volume, OEM, or Upgrade. Is there any way to know that? Yes, you can look at donation request history. If you're an authorized agent for the organization, you can actually get to it through the same path that I went over when we were doing the more formal part of the webinar. You go to My Account, once you log in, you go to My Account, click Donation History Status, or click My Account at the top of the screen, then click Donation History Slash Status on the top right. You don't need to click Microsoft Donation Center, but you can. Although it doesn't really include anything before July 27th, 2011, but you can look at all previous orders for any product. You can set parameters by date, or you can actually enter a donation request number. So that flows nicely into Brett's question, which is, I don't see the Microsoft Donation Program link in my account's donation request history, and that's because these changes were just implemented and nothing will show up. Is that correct? Yes, well it could be for two reasons. It could be maybe your organization isn't eligible for Microsoft, but if it is, then I'd say that the reason is there's nothing in it anyway at this point. But once you do place a request for Microsoft, then those fields should populate. Another question from Mark, is there any tech support for any of these titles for Microsoft? Okay, well there is a way to contact Microsoft Volume Licensing Service Center if you need help navigating it and downloading it. Microsoft does at least offer that to begin with. What you get from TechSoup is essentially the same thing you would get if you just went out and bought a retail. So if any product is supposed to come with support if you buy it from a retail store, then if you get it from us, it will still come with that same amount of support. And that applies to all our products, not just for Microsoft. Another face-based organization question, Albert says we are a 501c3 Christian church. However, we want to teach Microsoft Office Suite to assist in getting unskilled people skilled to earn gainful employment. Great work, Albert. This program is geared to the entire community regardless of their beliefs. Do we qualify? Yes, that sounds like it can qualify as a secular organization type that would probably be under job training and assistance. In fact, the survey that I talked about to someone else earlier, one of the questions in it is do you serve everybody? It doesn't matter whether they are a member of the church or a member of the faith or not, if you'll serve anybody who comes in, then yes, that would qualify it as secular. And I just popped up the slide for the eligibility quiz, because I believe that's what you were referring to, right Penny? The eligibility. Great. Yes. Okay, so I'm going to move on to the next question. So Mark says or Mark asks, we are a food bank and when we transition to a new product such as Server 2008, is there any support available as we do the upgrades? Okay, again, Microsoft does offer help in downloading and installing. The phone number for it, let me see if I can remember off the top of my head, it's<PHONE_NUMBER>. And this is a direct number to the Volume Licensing Service Center. It's not a general Microsoft number. And that's where you go if you need help just getting the product downloaded and installed. A question from Kimmy regarding the OS, we have several old computers that were donated and already have software on them. Is that illegal to use? Okay, no, not initially. I mean you probably don't know much about how it got those operating systems, but generally if you get computers with operating systems already on those, they're probably legit. And if you want to improve them, what you actually need is an operating system upgrade, not the get genuine. I mean if you know that the operating system it has is somehow pirated or counterfeit copy or has other licensing issues, then you can have it wiped clean and install get genuine. But if you know that it's perfectly legit, then again what you need probably is an upgrade. So question about server licenses for Marcella, if I need more than 50 licenses, can I request a donation through TechSoup for the first 50 and then use a charity reseller for the additional? Yes, in fact that's what we recommend that people do. In fact, I have a URL for another software donation program. It's called Consistent Computer Bargains. And they are at CCB, Consistent Computer Bargains, nonprofits, and that's plural.com. You might check them out. When people need more than their allotment, we do refer people to them. Great, so we only have a few more questions left that have been submitted. So if you're still holding out, please submit those questions now. And this is a very specific one, so I'm not sure if Penny will be able to answer if this is related to volume licensing. Cheryl's question is, every time I attempt to log in to Volume License Center, the login screen continues to search with no results ever. I have tried to access this on numerous occasions. Have you heard this before? Do you have any thoughts? Yes, sometimes that comes up. There are several reasons why it might be. One is Microsoft could be having a problem. Also, when people initially create an account at the Volume Licensing Service Center, they need to use the organization's contact email that the download information was sent to by TechSoup. You need to have that as part of the login, and it could very well be you either haven't created an account or there is an account for your organization, but it's using an old contact email that used to belong to someone that isn't there. It would probably be best if you called us so that one of our account management specialists can maybe troubleshoot it with you. We'll probably ask you some questions, give you some information, and also the number to contact Microsoft to have the account reset. We can also do that from this end. It may end up being a combination of that, but that is very specific what you're asking, so it's probably a good idea to call us. Great. Thanks folks for submitting more questions. So a question has come in by two different people for two different reasons, but it's essentially the same question. This is regarding why certain groups don't qualify for Microsoft or certain parts of organizations. So we're getting faith-based organizations as well as the staff of libraries. So you could just talk a little bit about Microsoft's eligibility program and why some folks aren't eligible. Sure. When we establish a relationship with any donor, one of the things that we ask them is what sort of organizations do you want to support? And there are hundreds of different types. Initially when people registered the organization, they're actually kind of a bit daunted at how many types there are to choose from. But what these organizations tell us is we'd like to support this, that, and the other types of organizations. And anyone who isn't included on that list simply isn't eligible. And all of our donors have different criteria in this regard. When we started to talk to Microsoft about software donations, they told us specifically we want to support these types of organizations and these types of organizations only. So again, anybody who isn't on that list just isn't eligible for Microsoft products through TechSoup. A question from Bob who wants some clarification on the Get Genuine. If I buy a laptop with Windows 7 Home Premium and I need to get the Windows genuine product to upgrade to Windows 7 Professional, is that correct? Yes. With our upgrade products, you can't go from home to business. You have to go from home to home or from business to business. But for Get Genuine, if you have the home version, that will enable you to get to the professional version. So you are quite correct. Also, I actually didn't answer part of the last question about libraries and public app facing computers. That again is the stipulation of Microsoft. They only want their donations to be used by computers the public that uses the library has access to. So a few more questions about Get Genuine because folks are really interested in this program. And this is a question from Lori to be clear about ordering Get Genuine even though other Microsoft products you can order when you want. Get Genuine is only once. That means I can't ask for 25 licenses and then another 25 at a later point. So is that correct? Yes, that's correct. Get Genuine is kind of a cum clean type of thing offered by Microsoft. If you have licensing issues or no operating system at all, or you want to go from home to business, you have a starter edition, Get Genuine allows you to do that one time. So you are correct. And this is actually the last question I have. So again, if you have any questions that you are sitting on, just send those out to us right now. Kimi's question, how can you tell if a computer has a genuine Microsoft operating system? That, I'm afraid I don't exactly know the answer to. Gosh, we stumped you. Yeah. Oh, Rachel just told me that she answered that in the chat. Let's see if I can find it. Oh, here we go.  Anywhere there is not an icon or a window. Press the F1 key and you will get the Microsoft Windows help. Type Genuine Microsoft in the search box and you will find the instructions. I think that is the answer. Yeah. Okay, great. A few more questions have come in. Let's see, does Get Genuine reset? Okay, so this is a one-time only.  So you can only place an order once, so if you place an order for one, Get Genuine and then next week you say, oh I want one more. Too bad, you are out of luck. You can only do it one time. So order as many as you think you are going to need ever. So you can't order it a second time. Tiffany's question, so I have Windows 7 Premium now but I am confused what I need to do to upgrade. I don't think I understand why I need to Get Genuine. Okay, well, you only need Get Genuine if you have a special sort of situation. It's not for everybody. Let me see if I can find the Get Genuine screen. Looking for the Get Genuine screen. Hold on, I shall get there. This is the whole presentation and fast forward. Okay, I shall arrive. Hold on. Okay, here we are. You really only need Get Genuine if there is some sort of licensing issue. You might have a different sort of operating system that is non-Microsoft. Linux, Freedoc, Unix is another one. You might have no operating system at all. Sometimes people get donated computers that are completely empty or wiped clean. Also, if you have Home Premium, Home Basic, or Starter Editions, you can upgrade. You can wipe it clean of that and do the Get Genuine. Mostly though, it's for counterfeit illegal unlicensed pirated or somehow improperly licensed Windows operating system. If the operating system you have is perfectly legitimate, then probably what would be best would just be an upgrade. Some more questions that have come in. Marisa asks, we are a nonprofit that offers legal services to low income people. We were denied before, but no one can remember why. Do we qualify? Well, it depends. It might be a good idea to call us so you can discuss the matter with an account management specialist. Generally, legal services of type you offer, there is a type for that called legal services to indigents. And I believe it is eligible for Microsoft, but you might be registered as a different organization type. If you call us, there might be a possibility we can change it and then you would be eligible. But not looking at your account, I wouldn't be able to tell you what type you're registered as. But you can log in at TechSoup and look at My Account. Click My Account at the top and then scroll down and click the name of your organization. And that will take you a list of all the information we have about your organization. It also includes address, email, and phone number. But your organization type is also listed on that page. Can a single license such as Office be used for both my work computer and laptop? Yeah, you can use it twice as long as they're not put on computers that are going to be used at the same time. For example, at your workplace if you have both a desktop that you work on while you're there, and a laptop that you take with you when you go elsewhere, you can download it onto both of those. But again, it has to be on two computers that you would not be using at the same time. A question from Bob before learning about Get Genuine, I was able to do a clean install of the Upgrade product on three computers that had Windows 7 prior. I successfully registered the product. Do I need to now order Get Genuine and reinstall? Okay, I'm sorry, can you ask that question again? I guess what he's saying is he had previously installed one license on three computers, and Bob, correct me if I'm wrong, and it successfully worked. So now he's wondering, do I now need to order Get Genuine and reinstall? Okay, well, it depends on why you were able to install them on three computers. It could be you had that many licenses that are more available to you. Occasionally I'll hear about something like this happening, but again, without looking at specifics, I don't know how you were able to. We can follow up with him afterwards if that question needs to be further explained. Okay, thanks Bob for that question. Kevin's question, this is a pretty good one. One organization, three branch offices, each branch office has a separate TechSoup registration. One branch office orders a server product from TechSoup and 50 calves for its use. Can the other branch office order 50 calves on their TechSoup registration for use on that same server system by their branch members? Okay, well, part of a definition of a branch is they have their own server, but each organization that has a separate registration at TechSoup can order individually. If one branch requests Microsoft, it doesn't affect the request that the other branch makes through TechSoup. Now, a lot of the time the branches, they are connected to the parent organization's server. It's just important that if you do one branch needs a certain number of them and the other branch also needs them that they place these orders separately for themselves. It's probably not a good idea if the parent organization, if they have a registration, if they are not supposed to request them and then distribute it to the branches. That's why we allow each branch to register on its own because they can do their own requesting of products. Great. So many, so these are very specific questions and they are good. And I hope that they apply to more than just the person that asks. But David's question is, I do the IT work for my charity group and we have computers that have Windows XP Pro installed from an OEM reinstallation CD. I don't know where the CD came from. I just know that the CD will install. It would appear to be a genuine copy of XP Pro. Should I upgrade or do the get genuine? And one other question that Andrea had related to get genuine, if you could address this as well, Penny, is the cost. How much does it cost? Okay, well the answer to the first question is if you do have a legitimate operating system from Microsoft, then you don't really need get genuine. The XP, I don't know if it's a, I don't remember if Cammie said it was a home or starter version. If it is, then yes, you can use the get genuine. And if it's already a professional edition of XP, then what you would need is just an upgrade. As far as cost, that would actually be on our website. I don't remember offhand what the cost for get genuine is. But if you go to TechSoup.org, underneath get started on the left, click get products. And then you scroll down and on the left you should get to a heading that says Browse by Partners. They're all listed alphabetically. Just go down to Am and click Microsoft. This will take you to a page with some text about the program. Underneath that there's a list of categories. And then all you have to do is pick one of the categories. One of them is operating systems and upgrades. Click on that. And then I believe that get genuine is on the list this takes you to. I can't remember if it's on its own specific list, but the price I believe is $6 per download I think. Great. And if that's not correct, some folks on the chat will send out the correct information. So some questions about the related to the branch question that happened earlier. We're already in the branches. Can this be done under one tax ID? Or do they have to have separate EIN numbers? I believe you're asking a question about branches. Sometimes parent organizations will have a group eligibility meaning that any branch of the parent organization is automatically covered under the parent organization's exemption. Sometimes branches will have their own 501c3 status. Sometimes it's both. Generally if someone is just covered under the parent organization's tax exemption, we like the tax ID number to be the same, but that's just really for our own recordkeeping. If the branch has its own tax exempt status then it can be that specific one. But even if you have the same tax ID number as all the other branches in an organization, that is okay. Great. And we may only have time for one more question, but maybe a second one if we can get this one done quickly. Christian's question, if I request 50 product licenses, is there a single $31 admin fee for the entire order? Or am I paying an admin fee for each copy? So it will be $1,550 for 50 licenses. Can you clarify? Yeah, the latter is correct. $31 is for one license. So if you wanted to get 50, it would be $31 times 50. Okay. And William's question about related to Mac and Tosh or Apple computers, do I need to get genuine for my Apple that I want to run Windows in the Apple OS? I think I'm going to have to ask Rachel about this because she is probably a more, okay. Oh, okay. The answer apparently is we're not sure yet. We have to get clarification from Microsoft on that. Let's see. I'm not sure how long it will take us to get clarification. But it is one we don't currently have the answer to, but we'll at some point my advice is to check back with us by email or phone in the near future. And by then we might have an answer. Great. And just one last question that was answered earlier that I can address. Can I mix and match my TechSoup licensing with the ones I purchased in the marketplace? I need a little more than 50 licenses. So yes, definitely you get your 50 from TechSoup and then you can either get the Microsoft through another donation program or just buy it from the store. So that is all the time that we have. Thank you all for sticking through this hour of rapid questions and answers. I wanted to let you know or remind you again that we did do another webinar last week. I'll send you a link to that recording along with this week's recording. And just to let you know, next week's webinar is Free Windows 7 Curriculum, Basic Computer Training at Your Library or Non-Profit. So for those of you offering computer classes, I know we saw a few of you on the list of your questions. This would be a great webinar for you to attend. And the URL here will find you a link to register. So with that, I'd like to thank ReadyTalk. This webinar was made possible by ReadyTalk which has donated the use of their system to help TechSoup expand awareness of technology throughout the nonprofit sector. ReadyTalk helps nonprofits and libraries in the U.S. and Canada reach geographically dispersed areas and increase collaboration through their audio conferencing and web conferencing services. So I really appreciate being able to offer these for free to you guys. And thank you all for attending. Once I close the window you'll see a post-event survey pop up. Please take a minute to fill that out. We do read all of your comments, so take some time to do that. And again, appreciate your time in attending today's webinar. And look forward to seeing you again at a future webinar. Thanks everyone. Have a great day. And thanks Penny so much. Bye guys. Thank you. Please stand by.


Well come with us folks. Have you ever had a play where you had it all planned and it worked exactly as you had planned it? However, you were not in it. Now in this video, I will show you how to avoid that FOMO Secure a plan for an entry in order to avoid that FOMO that you were just that we're just missing so basically something that has taken off without you and Where can it where can I enter something and well that that play In without a well with minimizing rest now this is LMT defense dog currently the world situation is really helping defense stop if You look at this this is a daily chart And I will show you something when you look at this chart you should see something like this Right see something that has a Resistance at a such a level which is 398 90 and let's get closer to that because last week we played it We had a two week Two week play that we entered About two weeks ago and we decided to close it on Thursday as It was and I'll show you right here Basically the line I just showed you If you guys missed it, I'll go back just for a second just for you guys See how if this is the first video you guys are watching with me This is a resistance.  You saw see that right? It's almost it's on the Daily chart so each candle is a day Now zoom in still in the daily chart I'll zoom in too close to today and we alerted two weeks ago and I took a decision See how we're hitting the same line again. It gets rejected and it got rejected there again Decided to alert the exit there. It was very close to the Last day before expiration not crossing the line that we had however on the next Very next day on Friday. It decided to take off but really take off now I could have re-entered as soon as we crossed This line right this line as soon as we crossed this line. We entered the bull side bull side is Where there is very little resistance to the app side. However, this was Friday Basically, I just watched it and this video is all about what do you do when you just watch it go up? You missed it? Okay, so be it. However, how can I re-enter this play? with a good strategy, this is what I want to show you here and Let's change this to a shorter time frame Put that in five minute and This is today what happened. Let's say at the beginning of the day If you look at the chart This is the end of Friday You know, we all saw this line as soon as we cross and just to recap a little bit of that line that we talked about See on Friday morning how it broke pre-market and then as soon as it broke it here it came above it Now tested it as a support and then it took off now this Setup here above pre-market high Goes up users pre-market high as support and it was our long-term breakout point this on Friday was the very It's an extremely good setup For a and a good entry as soon as you see that it bounces on that You're good to go However, I missed it and I roughed to go all the way all day. Sorry knowing that in this Right here. I exited we had three nineties and Obviously here. We were in four tens and even four four teens at one point. So, you know, it's quite a quite a way up in the money No matter So be it. Let's look for a proper entry now on This morning Monday morning. It had a huge gap up remember I talked about Above resistance now this is the current resistance, right? You all rear this right, so big gap up You see That it came down at the end of day to support. I'm just showing, you know, the yellow line here Now it's blue, but you know, the yellow line is showing you support What I was looking at is and we'll do this together is this, right? It tried to get up to a certain point here. It didn't try to get up To a certain point. It didn't and then some profit taken at the end of the day and it remained flat, right? so this between this line and this line To me is support For anything that gets higher. We opened super high So what I was looking for when I saw this When I was doing this pre-market I saw this. I'm like, oh Wouldn't that be great if we start coming back down? To bridge the gap on the way back on the way down and then we start bouncing after that So you look at this there was upgrade there was a lot of talks about defensive stocks and a huge Gap up morning, right? So many things go in your way. We are on the buyer's side Remember that we were we crossed previous day the buyer's side. So what I was looking for is I Make this let's make this a little cleaner Something that would you know, I'm looking at the mark at this area because I'm prepping My day before the bell, right? So I'm like, okay, if we get a pullback to previous support Sometimes it's a very very defined line straight line Sometimes it's a little channel like it is right now so we get Some downside to that support and about so I'm ready for that I have an alert set if we cross this line on the way down. However, look what it did, right? Let me zoom in a little bit for you here Look what it did. I'll put the the line for you in the area You know see how this is not crossing the top. Sorry here Yeah This is the double top on the previous day So basically this is exactly what it did pre-market it dipped below The double top that we have on the previous day. However, look, this is the open it opens up Higher than the previous day no matter what it did here pre-market which Shows volume and people buying higher We completely bridged a gap from top to the previous day double top Now we're in to go at this level obviously my point was to go remember how we had a higher 433 It doesn't show now because we have a new high of 434 but Trust me on that one. This was in 433's this guy here. So this two weeks out target to me 430 was a very good entry and and strike Because the target was possible to get back To this high that we had early in the day now Remember what I was looking for is a pullback to bridge the gap all the way down We did it because we open exactly at the previous day high and We recovered To this Level and then some this is after hours obviously, but you know this line is pretty much With that line So we have two weeks out on this one Unfortunately the conflict in Europe is not done. There are still tensions in in China versus Taiwan. So If you look at this chart, it is on a breakout 440s are more than possible because they're in this is higher of a whole time high But just showing you missed out the entry on Friday It was all planned. I was Extremely positive about the outlook and the outcome that it would have been so this creates a lot of FOMO You miss out on the entry doesn't matter look for something else this morning Looking at it. All I wanted was a pullback to the support. It did I wasn't going to miss it twice Hope this helped folks. Take care


Miguel Marotinas, thank you very much for being at the WPC TV. You're a former Foreign Minister of Spain, but also you were the EU's chief negotiator for a Middle East peace. Frankly, do you think that the ideal and the idea of a two-state solution is over? No, no. And I think that is the current trend. Everywhere you go, every place you discuss, people come with this idea that a two-state solution is impossible, is over. And I immediately answer that it's not the truth, not only it's not the truth, it's the only alternative. Because it will be a total collapse of the international community of the UN and international level to the Israeli interests. You can imagine they are looking for a new state and an Israeli state living together. How kind of a state with different type of unique state sharing with Palestinian and Arab citizens. And then for the Palestinians themselves. You know, the UN archives has been piled up with 100,000 pages about the Palestinian state. And suddenly the international, even the actual, even the Palestinians themselves, even some political analysts say no, no more a state. That is not going to happen. I think the Palestinians have not only the right, have the legitimacy to have their state. Once Israel and Palestine both are living together, then in this new world they can well make any kind of agreement. I remember Simon Perret with his dream about a European Union system similar of Europe have done to the Middle East. But the way should be through to a state solution. Let me just turn now to the EU just very briefly. You've got Brexit and you have moves to the extreme right in parts of Europe, particularly Central and Eastern Europe. What is the future of the EU? Well, I think the EU should react to the new situation. I think it's an opportunity. Even I think I don't rule out totally that Brexit will take finally place. Well, it's a sovereign decision, British citizens, but there is a process. We have never been confronted to one member state who decided to quit. I know how difficult it is to join the European community. Spain took nine years to join.  Okay, you start negotiation, but negotiations are going to be extremely long. The number of chapter specific items is going to be very difficult in two years' time as they are announcing it is not going to happen. And political event and development will maybe change the final decision. Well, personally, I would hope so. But in the meantime, of course, it's very good for journalists. It's very good for lawyers. It's very good for diplomats. Yes, it's good, but you know what really concerned me more about Brexit is that for the first time in my short life or long life, however you want to qualify it, even when I was a young student going to UK to learn the language, even already UK being in 73, you remember, there was no... The British considered them first British. And then, well, I'm in the European Union, but I'm not for Europe. I mean, I'm part of Europe, but... And for the first time, the new generation, the young generation... They feel European. They want to be European. And so the majority of the new generation vote in favour. So how are we going to forget about them? For the first time in history, the new political, social, demographic generation of Britain want to be European. So we, the so-called EU member states that are of course concerned about Brexit, we should take a second thought about these people. I hope you're right. Miguel Marotinos, thank you very much indeed. Thank you all. Thank you very kind.


Hey, thanks everybody for showing up so early so Yeah, I talk about extensor based Qualcomm Wi-Fi chips and So why even looking at Wi-Fi chips? So in my opinion these Wi-Fi chips are pretty powerful chips So even though they're just intended to be to run to do your Wi-Fi stuff, right? They are still general purpose CPUs so you in theory can run any software on it The problem is the proprietary binaries which come with those chips they make it difficult to run your own code and Why would we even want to run our own code? So what we could do is enable additional functionality. I have a few examples in a few seconds and We could also make security research easier. So In case we managed to enable dynamic analysis security researchers Have it easier to to identify bugs and and yeah report them to the vendors so some examples for Additional features which we want to enable is for example We can enable monitor mode on chips, which is not available by default For example, this is monitor mode on a proc-con based chip running on a Nexus 5 Which is not available by default and then you can use your standout like Wi-Fi tools like like arrow dump and so on we could also Build a complete state machine for Berkeley packet filtering inside the firmware and then compile our Rules for packet filtering on the user space upload them via the kernel to the firmware and run them directly in the firmware So that way we could save some power when we do monitor mode basically And if we have access to even a deeper layer firmware code we can also implement like Stuff which is closer to the physical layer of Wi-Fi So here's an example of a pilot tone jammer, which only gems the pilot tone of OFDM to be very power efficient So now that we have all these these great goals in mind So let's take a few step backs a few steps back and look at the bigger picture so in general there are Two kinds of Wi-Fi chips so full Mac and soft Mac chips. We will look at a full Mac chips in this talk The biggest difference is that full Mac chips run the Mac layer inside the firmware So this also means if you want to change something in the firmware and the Mac layer you have to to change the firmware directly So those it's not possible to do these changes on the driver itself so the examples I have shown in the previous slides of stuff, which we could want to enable this was based on on the the next one framework, so this was I Developed this or together as a colleague of mine back in my time at the University So this enables us to so this framework will be used to modify proc.com chips and we even managed to get deep modifications working as this This Gemma I showed earlier and you can you can get it at next month org and apart from proc.com There was also work done on black at 2020 About Intel based chips and there was also a talk about hexagon hexagon based Qualcomm chips on DEF CON 27 and black at 2019 But this talk is the first talk to Explain extensor based Qualcomm Wi-Fi firmware So some background how to do our Wi-Fi socks Structured so normally you have an application core and then you separately you have your Wi-Fi core, so and optionally at some cases you also have like a Real-time core which handles like time critical stuff like the distributed coordination function And now for the chip which we will look at There are like several drivers Available so there's adh 10k by Qualcomm directly and also a corresponding firmware with that And then there was adh 10k CT by candela tech So this is interesting so candela tech bought the rights from Qualcomm a time ago some time ago and they Have their own driver and their own firmware. So they got the source code somehow from from Qualcomm and added additional features and so basically you have a complete separate is the kind of driver and firmware in addition to the original Qualcomm driver and firmware and Lastly, there's also the QCL QCA CLT driver by Qualcomm. This is used for factory processes and also what you can do is you can use the Candela tech driver and run the Qualcomm firmware. This is also possible So this is the chip and the board I have looked at it's the IPQ 4019. It's based on Development board by eight devices. This board is called Habanero and in the middle of it you can see the the chip we are We are interested in and this is basically a development board for Wi-Fi enabled home routers so What does this board so this chip look like from the inside? So as I said, this is used for for Wi-Fi enabled home routers and one of the big vendors in Germany is also using it. So this is AVM the Fritz box and Apart from this the chip consists of as I explained before also of an application core multiple Wi-Fi cores and the application core runs an open WRT in this case with a pretty old kernel and For Wi-Fi they have one core for 2.4 gigahertz and one for 5 gigahertz and they use a PCIe to communicate with each other So now to the firmware itself As I said, it's a extensor based firmware extensor is Initially was initially developed by Tensilika, but now it was bought for by by cadence and it's The Lendian firmware it comes it consists of a ROM part and a RAM part the RAM part of this firmware is stored in the file system of the open WRT and It contains multiple segments one that later and it's LC77 compressed the ROM can be patched And there is also a code swap mechanism which allows you to which allows the Wi-Fi cord to evict Code from its own memory space to the host memory space And of course, there's no security enabled by default. So no secure boot. No stack can raise no address and website randomization What's also nice is that there is already by default there comes this this debug of s which you can compile into your driver and this allows you to Get direct memory access via this this mem value file so you can directly read and write Memory directly into the chip. There is also a debug mask Which is very useful which you can set for example doing visualization of the The kernel module to increase the verbosity of the driver itself Also the interfaces which are used between the basically the application core and the Wi-Fi core So there are two interfaces The PMI interface the bootloader management and messaging interface is used to input up and it's implemented in ROM So basically to input up it this is used to start up the chip then after boot up The WMI is used to to communicate with The chip and this is mostly done to send commands like please now start Wi-Fi scanning to channel configuration stuff like that so this is how the loading looks like so the driver offers two methods for loading firmware either via the the BMI method or via a copy engine and because in our case we have a compressed firmware we need to use the BMI method and What's basically happening is that the firmware from the file system is passed through the driver via BMI to the Wi-Fi core and it's then uncompressed on the Wi-Fi core itself So this is the the file structure of the the firmware file So basically there are two big parts like this this The supper one and the slower one. They are identified with an IE header and then after this there is The segment header and this is identified with this These magic values here will tell you if it's compressed or not And on which address it should be loaded into the chip And it will also tell you what's the decompressed size of this segment and if you notice already there are in this case the The first part in the second part have the same address. So this this means that they get overwritten Yeah, and then Apart from the segment header There's also some metadata as I just explained it then basically and after this the real data starts And then it's compressed then after this the next metadata starts in the next part Which is then also of the firmware data, which is also compressed so basically Why these two separate parts is my assumption is that the first part is just needed for for boot up and You can also see it's much smaller in size than the second part and after this we can basically override it with the real firmware code and If you look at the driver locks you will see this whole process being done twice and I assume this is done to Load up the first Wi-Fi core and the second Wi-Fi core If you look at the memory layout we can see that it's repeating so if you just do a long enough read of Of your address base you will see these patterns and My assumption is that this is used to realize Different memory access rights So you can have the same memory on different offsets and depending on offset you can realize different access rights so this Then to the extensor architecture, so There are two major things I want to point out about this this architecture which were new to me and which also Came with some problems. So the first one is the use of literal pools So each load instruction. So this is just a load instruction instead of being PC dependent It's basically independent of that and you just calculate an offset to to a fixed literal base to get immediate value and in addition to that there is also Like a windowed registers and so this means that So that way I explained in a second, but what it's used for is basically to Not needing to store and as to save and restore your registers when you call a function So here in this example, you can it's using call eight so that it can be different values here or four or twelve or whatever and But my firm values to call eight and if you load on Value in a 10 and you call a function. It will be available in a two of the callee Okay, so this is how this these window registers look like so basically you have these overlapping sections in your in your New memory space and you have like way more registers than you need it for for one Function and that way they can just shift the window for each function called if you have nested functions and They they can Basically just just rename it and then make it accessible to the next function This is how literal pools work. So now the memory space is horizontal So Assume we have a function my patch which wants to call a function wlan main. So here we This will also be So the assembler for this will look like that does first a load instruction which loads intermediate value into a register and then the call is just using this register to to call the function and If we want to to get this The immediate value we need to know the literal base and then we can look up the offset for This function you want to call your wlan main in this case and then we get the actual address of the function So for example here and this is done for each load instruction So this means or what's what's also the case is that? This this literal base needs to be set up somewhere and this is usually done at the very beginning of the firmware And it this is a fixed value. So for me it was x40 8001 and this is the code how it looks like so you basically Have to start of this a literal pool and its size and then you store it into a 2 and write this to the special register with base and So actually the offsets are negative. This is why you add the whole size to it and then A load instruction later on will have a negative offset So basically the existing firmware does expect that this little pool is used. So if we want and this has Some this comes with some problems if you want to patch existing code Another problem was that This litbase is not supported by disassemblers So for example IDAR 77 added support for extensor, but has Does ignore the the litbase? called for cheat rod there is an extensor plug-in, but it didn't support a litbase either radar 2 ignored litbase has support for extensor and There's also binary plug ninja plug-in, but it ignored litbase as well So what I need to do is create some patches for binary ninja in this case so in this patch, I just ignore the dependency of the program counter and Directly use this this fixed litbase and I have a similar. So this is the patch for binary ninja and there's also and this the patch for for G draw which works the same way and I have A link to a git repository later on where you can find these patches so Now if you actually want to to change some code and the firmware I decided to use to the next one framework I have shown earlier and I wanted to to basically modify it to support Qualcomm based Wi-Fi chips and So this is how the framework looks like it's it's pretty Yeah complicated, but we only need a subset of this to to make it work So what we could do with the original next one was we could extract the ROM flash patches the RAM U code for broken base Wi-Fi chips and we could use C to write our patches and of course we could Call existing firmware functions and then in the end With this whole framework we were able to create a firmware file which we could then run on broken based Wi-Fi chips So how does this this next one framework work on a high level? So we have Our own patches which are in patch.c. We have a wrapper.c. Which is used to to have some stubs for the functions which are Already existing in the firmware and we use GCC and GCC plug-in to compile the files and also The plug-in will Help to create this next month of pre-file and this next month of pre-file basically contains some metadata which we use in later on and For example, we can use this file with an org script to create some linker scripts And then we can use the linker scripts and the the O file to create an overall patch file So this patch file basically includes everything which we need and now after this we we can Use another make file and the L file to create basically a blueprint to Copy out the relevant section of this L file so we might not need everything just the patch we wanted to introduce and the And some some some stuff we might want to override in the original function and the original firmware so now we have this this L file and This make file which is basically the blueprint for object copy. We can copy out the relevant sections Then we can DD them into the firmware the firmware binary So this is how the original next one worked So I need to do some changes to to make it work for Qualcomm So first of all, there was no support for decompression the the Broadcom based firmware had no Compression it was just the whole memory the RAM the whole RAM of the Chip basically uncompressed It also also needed to add support for multiple binaries So as we have seen earlier the the firmware consists of of multiple segments and I needed to add support for that and We also needed support for the lid base. I mentioned earlier And then if we make this happen what we could do is compile and link our own patches we could Patch these this the second segment I showed earlier and then we can compress it back into the second segment add some padding bytes and then write it the The firmware file basically so this is this is the plan So I will not explain the the decompression. This is pretty straightforward to implement I will start with the support for multiple binaries. So I needed to extend the the GCC plug-in which creates this this metadata file the next month of pre-file and So basically what this GCC plug-in does it looks for this attribute and in the source code and this attribute tells Basically where the following the code after this goes into the firmware in which chip this is used and in which firmware version this is used in and I extended this basically to also include the the target firmware file so after compiling where should this go to into so over which segment of the Of the firmware file should this go into So After so basically then after we compile everything we have this this this new next month of pre-file and It basically contains the the address which is here Where our code should go it has basically at the type so here? It's a patch then if it's a dummy It's basically an existing function in the firmware. It's the dot the next column is the dot o file But this will be compiled into this is the name of the text section in the dot L file and now we also added this this The name of this bin file where the compiled code should later on be copied into the add So with this I already wanted to compile some patches. So my goal was to Use this pretty simple patch. So just jump into some code into this function then and then write one two three four basically into this memory location and then jump to the Original code which is WLN main in this case I could use the ESP 32 GCC compiler to compile my my my stuff and And load it into the the chip And I use the debug of s which I have shown earlier to check basically after the chip was up if If the memory address has changed accordingly But this didn't work And the reason is these lip base this this lip base I have explained earlier So basically all the load instructions expect this lip base to be set at the very beginning of the the firmware code and so this means like the the chip which runs the existing firmware code expects a load to to honor this this lip base and I need basically now some way to Tell my code Either like that. There is this existing lip base. Please use this and it's like already this filled up but Unfortunately, there is like no such parameter existing in GCC so we need to do something else and I just highlighted here to all the load instructions, which are problematic as I said The the offsets are not right. They need to Use these this lip base So what we could do as an alternative is just avoid load instructions and handcraft our assembly ourselves So we just avoid all the references And have basically no immediate value. So there's obviously not something we want to do in the long run So I come up with two possible solutions either as a settler we can tell the link is somehow Where the existing lip base is and how full it is or we can use our own lip base value So I decided to go with the second option. I felt like that this is more More flexible in the long run and would what this implies is basically that I set the lip base to zero at the Entry of every function. This can be done using the GCC plugin and at the function exit I need to reset it to its original value So and I needed to do this into the Assembler itself because there is this target dependent feature which is called like Relaxation so if you have like a call to a function this assembler will basically relax this to a load in a call And then we have again a call which is problematic So how does this looks like in the assembly? So I said this relaxation is problematic And after relaxation we basically have these a call is extended to to two instructions to slow down this call So what we would end the thing is that in between those two basically we need to reset the lip base to its original value so that then if I call the existing function that the remaining code can can run as intended and Yeah, it took me a while to find out that I cannot manipulate this behavior in GCC It needs to be patched in the assembler directly because it's target dependent So how does this relaxation look like in the assembler? So basically you have this sort of a lookup table on the left hand side It's looking for a pattern like this So here it's looking for a call 8 and if it finds this this kind of pattern It will be relaxed to a load and a call x8 So and what I basically need to do is find the place in the assembler where this These built instructions so basically the rent right-hand side here. These are called built instructions where those are It's rated through and then they're applied and pushed on a stack and All I did is basically to look like is the current opcode a call x and was the previous opcode a load instruction and if this is the case then I can basically add an Additional instruction which will reset the lip base with an wsr instruction So now that we know all of this and we have patched our assembler. We can go back to our original patching code and we can use this GCC plug-in and the The patched assembler to compile this this much easier to look at code Which is pretty nice and then so this is the how the assembly looks like basically after we have saved our our parameters we will Save the current lip base into a 15. We will write 0 into a 14 and write a 14 into the The lip base value and then we can do all of our load instructions at the end we reset Or we copy back the value with which we have stored in a 15 into the lip base value before we do the final call out So there are still some open problems with this. So this implementation is not very good, obviously I take away two registers for the assembler It would be better to have this based on on on a stack based implementation also There is like this the support of disassemblers, which I mentioned earlier So I have these these these patches, but still it's for example, you cannot use either if you want to And also there is no support in this GCC. I'm using for for naked functions So this is a problem. So what I do is Like you need some way to sometimes to override an existing call and film it to even get to your patch and either you're lucky and it's like They are using the literal pool then you can just override the value in the literal pool but if not if it's like a direct call then you need to some way to just compile like a call to to your own code and You could easily do this with a naked functions, but and this GCC version or like GCC for extents I at least does not have this option for for naked functions And also what's also missing right now is that there was like no text console so you cannot just do a printf and Somehow dump this during in your host system to do some basic debugging But we could implement this ourselves now So basically I have this very creative name now for my framework, which is called QCA mon instead of next one So this is how the folder structure looks like At the very top you have some build tools then Disassembly patches, which I mentioned earlier for Chidra and the banner engine and then there's a folder for the original film Where's and a folder for our patches which you want to apply the the build tools contain the patched assembler and GCC and also the GCC plug-in The firmware Folders basically contains the original firmware and it already comes with a structure which would allow different chips and different firmware versions and There is also a make file which already extracts the relevant parts and decompresses them And then in the end we have our patch folder, which we can use to store our Source code which we want to introduce into the firmware So now to a brief demo So this will basically show the the code I had in my slides earlier, so We just want to set like one two three four Also one two three four into this memory address and then jump to the original code And then in addition to what I've shown earlier. We also need these two lines to basically have an entry point into our Firmware code so all I'm doing here is creating basically Overriding stuff in the in the literal pool to point to to my code so and so everything is prepared In the repository you just need to run make and this will already Compile to the C files and dot-oh files It will also compile the wrapper will create the linker scripts and Create a dot-elf file and then use the this blueprint Make file I mentioned earlier to copy out the relevant parts In files, then we can start reassembling the whole firmware file we are compressing it adding some padding bytes and then Basically creating the the firmware file how it's expected by the by the the Wi-Fi chip so here it's called a firmware minus five dot bin and And We can I will now SSH into this this this board I have shown earlier and in order to access the the debug of s we first need to set up the WLN zero interface now we can go into the debug of s and Look at the memory Location basically without any modifications. So for this I can just use The DD DD to copy out the relevant section and use X term to look at it So here we see that the first few bytes are not one two three four and Now we we install our modified firmware just copy it over via scp and we will Need to Remove and add the PCIe driver to Apply the changes Now we can SSH back into the router Just checking the kernel log real quick. So here it's already setting up the regulatory domain so this looks quite good, so it did not crash on us and We can go back into the debug of s set up the WLN zero first Go back to the debug of s then basically we we can copy out the The same memory location which we just did a second ago and have a look at it via the hex dump Yeah, let's see if you can see here. We modified two whole bytes. Yeah Thanks so with this a Quick summary and future work. So I was able to modify next one frame with the main next one framework to To make it work with the Qualcomm based firmwares I have a demo page patch. I have shown it's in you you can get it via this this location there's also the Patches for by non-enja and she draw in there the GCC plug-in and already a pre-compiled version of GCC and Also the patched in your toes file for the assembler Yeah, so this shows that it's possible to Make modifications on Qualcomm based firmwares There's still some improvements, but I need to do to make modifications even more easier I also want to look at this production software driver Thing I mentioned at the very beginning. So this this QCA CLD So this is basically using this Q-dial software on on a PC to communicate and you can get it from some sketchy Chinese service and then I want to see if I can maybe enable some features which are used in this production software Also by myself and I also want to look into this this code for feature a little bit more So I want to thank Martin court aka problem kaput. So he did some awesome a game by advanced reverse engineering And I had some he helped me out in some cases. So turns out that he did not even reverse engineer the the main processor of the gameboy advanced but also like the The Wi-Fi chip used there and this turns out to be like an older a theorist based Wi-Fi chip which Yeah, he also reverse engineered and a theorist later on was also bought by by Qualcomm and I think like lots of knowledge from back there is still went into their products And I also want to thank Roku aka our cannibal. I used her script to To do done as a being of the the firmware file Yeah, that's it from my side. Thanks everybody. If you want to reach out here's my best Yeah, if you have any questions I have also one more note. I have I found a Firmware file which contains all debug symbols for this IPQ 4019 chip I have no easy way to distribute this without the original repository being taken down But if you want to poke it at yourself Reach out to me. I will send you the link Questions. No, okay, then thanks everybody