All right. Welcome. This song is called Function Hooking for OSX and Linux. My name is Joe. Okay. So these slides are on my blog, timetobleed.com. You can go get them right now if you want to follow along. Instead of giving you guys a long intro about who I am and why I'm cool, I just want to give a shout out to SoftSec for getting my back door in the conference because this is my first DEF CON and I didn't know anybody. And free jump ESP. And I also want to say sorry to the mom and the kids that I elbowed in the face as I was running through Caesars to get to the Apple store for an adapter. My bad. All right. So I'm not a security researcher. I just have a t-shirt that says security. So you can feel free to get on Twitter and call me a script kitty. I'm just Joe DiMotto. All right. So here's the problem. I was running around doing Ruby consulting for a lot of shops and I noticed the common problem amongst everybody was that they're Ruby binaries after running in memory for a long time. Kind of look like that. They're very large and slow. And people want the Ruby binaries to be small, thin and fast. But the problem is that most people are really lazy. They don't want to install custom patches or rebuild the Ruby binary or do anything too complicated. They just want to install some library that will allow them to figure out where the Ruby binary is leaking memory and adjust the Ruby code and then live happily ever after. So it turns out that in order to do that, there's a set of functional techniques you can employ to make this all possible. So that's what this talk is about. This talk is about three functional techniques that I researched and implemented to build a Ruby memory profiler.  So just a quick note before we get rolling, there's a lot of assembly syntax in this. There's a lot of assembly code in this talk. And it'll all be an AT&T syntax. So I can't, sorry, I saw somebody say, oh, I can't read anything other than AT&T, my bad. So to actually do this, we need to know a few things, right? So we need to know about the ABI for the system we're working on. The question we need to start with though is what the fuck's an ABI? An ABI is an application binary interface. So what does an ABI actually tell us? It tells us a few things. Some of the more important things for this talk are it tells us about alignment, the alignment of the program stack, data types, stuff like that. It tells us about calling convention, how functions are called, where arguments live, how that stuff works, and about object file and library formats. The great thing about the ABI's is that they form a hierarchy, kind of like this hierarchy of beards. These beards all are related in some way, they're all parts of each other, and the ABI's are the exact same way. You have the big system 5 ABI, which is like 200 pages, and then as you read it, it has sections where it says like, hey, at this point, open up your architecture-specific ABI and read that one. And the great thing about that is that the AMD64 ABI has a page in it where it says, hey, everything in here is true, but you also need to read everything in the I3D6 ABI. So if you actually want to understand what's going on, you need to read like 700 pages. And there's also ABI's for MIPS, ARM, PBC, and itanium as well. But lucky for us, the x8664 calling convention on OSX is based on the system 5 AMD64 ABI. So there's some overlap, so we actually get saved a little bit. So instead of actually reading all this stuff, we can just distill it down into sort of the main things we need to actually accomplish the function hooking that I'm going to describe shortly. So the first thing we need to worry about is alignment. And all that we really care about for alignment in this talk with function hooking is that the end of the argument area before you call a function has to be aligned on a 16-byte boundary. So the way this is usually accomplished is either the compiler will generate code that never misaligns the stack or you'll see instructions like this sprinkled throughout your code that are just aligning the stack pointer. We also need to care about calling convention. So for calling convention, all we really care about is that function arguments, wow, that color is horrible, function arguments live in registers left to right. So first arguments in RDI, seconds in RSI, et cetera, et cetera. But that's only for integer class items. Other stuff gets passed on the stack similar to the way arguments get passed on I-36 if there's any I-36 hackers in the room. Registers are either caller or quality saved. And that's all we pretty much need to know about calling convention to make binary patching work later. The big thing we need to know more about though is object file and library formats. And we care about two of them. The one we care about is ELF, the executable linkable format. This is the format that was chosen as the standard format in the system 5 ABI for, oh, really? Oh, hey, dad. Sorry, let me turn that off real quick. All right. So the ELF ABI was picked as the standard for UNIX and UNIX like operating systems. So what does that look like? Well, it kind of looks like this. You have an ELF header, you have a program header table, various sections, a text section, a data section, and then you have another table at the bottom. So the program header table indexes different segments. So segments contain sections. And the section header table at the bottom just indexes the sections. You can use a library like LibElf to help you wander through an ELF object extracting useful information. The thing to keep in mind is that executables and shared objects each have their own set of data. So the picture that we were just looking at, this guy right here, this set of sections and data exist for each library, your executable loads. And that will be important later and you'll see why. So a couple sections that are important to know about. You have the text section where code lives. You have the PLT section. This is stub code that helps to resolve absolute function addresses. The got PLT, this is where absolute function addresses are stored and these are used by the PLT entries. There's also a couple debugging sections, debug info and GNU debug link. There's two other pretty useful sections. You got the dinsim and the dinsster. These two sections are used for dynamic linking. So dinsim creates a mapping between exported symbol names and offsets and dinsster stores the actual symbol names themselves. And in addition to those, there's two other sections, the sim tab and the stir tab. Sim tab and stir tab are actually super sets of the information in the dinsim and the dinsster. They include other things like local variables and other symbols that aren't exported. This is useful for debugging. Like if you get a back trace and you want to know what's going on, what arguments the function takes, you'll need stuff from the stir tab and the sim tab. And there's lots of other sections like for stack unwinding and exception handling and stuff like that. Okay, so the other binary format we care about is the mock o binary format. This is the binary format used on OSX. Here's a picture of what it looks like. It starts with a header.  Load commands describe the way the binary is going to be laid out in memory. So there's a segment command. The segment command is a pretty important one. It describes how segments are going to be laid out. And much like with Elf, you have segments and segments contain sections. And we're going to go through some of the sections in a bit. Right, so the man page for DYLD, if you have a Mac box, you can check out the man page. And it has a bunch of APIs for touching mock o objects. So you can iterate through the objects that are mapped into the process. You can play around with them and do stuff. And it's pretty useful. And just like with Elf, each dilib or bundle that gets loaded has its own set of data in the picture that we saw before. So just a couple of sections that are sort of similar to Elf. We have the text section. This is where code lives. There's the symbol stub section. This is just a list of jump queue instructions that are useful for runtime dynamic linking. We're going to go over runtime dynamic linking in a bit, so don't worry. There's going to be a really pretty picture. That'll be hard to see, but if you're looking at the slides online, it'll make a lot more sense. So there's also the stub helper, stub code that helps to resolve absolute function table entries that are referenced by the stub helpers above. The other important thing to note is that symbol tables do not live in a segment. They have their own load command, the LC sim tab load command.   So the die sim tab in Mako, which describes how dynamic functions work, that's actually just a list of offsets into the sim tab. So on Elf you have two separate tables. On Mako you have one table and then you have a set of indexes into that table for things that are exported. All right, so let's look at a couple tools, some useful tools for dissecting objects before we actually start writing codes. So you've got NM. NM's pretty useful. It comes on OSX and Linux. You run NM on your binary. You get symbol values on the left and symbol names on the right. And down the middle there's information about what type of symbol it is. You can get it on Linux. If you want it for OSX you have to go find binutils and build it. I have no idea why it doesn't come standard. So if you just run object dump on say your ruby binary you get offsets on the left, opcodes, instructions, and then helpful metadata. There's also read Elf. Read Elf is obviously for Elf objects. This comes on Linux. Output is a huge amount of information. This is just sort of a small screenshot of what you get. It's really, really useful. And O tool is useful information about Mako objects. We also need to talk about strip. Not that kind of strip. There's a strip binary that you can run. It'll strip out whatever sections you want. You can go through stripping as many sections as you want out of your binary.  So you need to obviously leave the text section in. If you strip the text section you have no codes and having no codes is no fun. You also need to leave in the dynamic file. Okay. So we know enough stuff. Let's start hooking some functions. So functions can be called in lots of different ways on x86. There's two really common ways. One common way is calling indirectly via a register. Like you see on the top. So in this example, rbx will just hold the address of the function you want to call and it'll just indirectly call the function. Or the way on the bottom, it looks like when you run object dump you'll see things like you see on the bottom it's not the actual full address. It's just a 32-bit displacement. So what does that actually mean? Well, we can do an anatomy of a call instruction and get a better idea of what's going on. So this is just object dump output. And as you see on the right there's a call instruction and it's calling the function A function and the address that it lives at is 4363 DC. So the way that's calculated is, so an object dump. This is the address of this instruction. This is the call instruction. And then the four bytes after it are the 32-bit displacement to the function you're trying to call. The way that's actually calculated is you take, we're trying to call A function so that's that address 4363 DC. That's calculated by taking the address of the next instruction that's going to be executed and adding it to the 32-bit displacement. Remember that x86 is a little endian so you need to flip the bytes around before you add it. So hooking A function is actually to replace the displacements that you see and replace the displacements to call your own handler function instead. And your handler function can do whatever you want. In my case, since I'm building a memory profiler, I actually want the Ruby binary to keep working after I'm done overwriting stuff. So I'm going to do my thing and I'm also going to call the original function so that the Ruby VM could do what it was supposed to do normally. Writing the codes for this are, the codes are easy, right? This is just a call instruction. You just do some math and you can check if the 32-bit displacement matches the function that you're trying to hook and if it does, you just overwrite that to call your handler function instead. Right? I mean, like how hard could it possibly be? Well, it turns out that it's actually a little more tricky than just that so you need to be kind of careful. When you're dealing with the 32-bit displacement, overwriting an existing call with another call, that's fine, right? Like the stack will already be aligned because we were going to call a function anyway for a different call so alignment's fine, the registers are all fine, everything's good to go, everybody's cool. But the problem is we can't redirect a code that's outside of the instruction pointer plus the 32-bit displacement because we can only put in a 32-bit displacement so if you're redirecting a code that's far away, you get fucked. The only way to get around this is to scan the address space searching for a free slot where you can M-map a page in to put in a bunch of code to call. So that's how you get around that.  And that works but it doesn't work for everything. So if you call a function that's exported by a dynamic library, that works slightly differently. So we need to talk a little bit about how runtime dynamic linking actually works. So I'm going to describe how it works on ELF, but it works almost identically on Mach O and I'm going to have a pretty picture soon that's going to show the difference between ELF and Mach O. The code is exactly the same, it's just the instructions are rearranged slightly. The function that has a function that's exported, so if you look at the top you can see over there on the far right it says RBNewObject at PLT. RBNewObject is just some function in the Ruby VM.  So if we disassemble instructions starting at that address, you see there's three instructions at the top, there's a jump, a push, and a jump. The first jump is referring to an address that exists, that address lives in the got PLT section, that is actually an entry in a table. That entry initially points at the address of the push instruction. Okay, so I'm going to say that again because the first time I saw this I didn't understand why that was. So initially when you first execute your binary before this function is called for the first time, the initial state of the system is that you have a jump instruction that's jumping to an address stored in a table. The address stored in the table points at the push instruction that comes right after the jump. Okay, now the reason why that is is because after you execute that jump and you land right there on that push instruction, you execute the push instruction which puts an ID on the stack and then it invokes the runtime dynamic linker. Runtime dynamic linker goes and it runs around and it finds the function you wanted to call using the ID that was pushed. It fills in the address of the function in the table. That way subsequent calls to the same function will just land you in that function directly instead of landing you back at that push instruction. Did that make sense? Is everybody cool with that? All right, word. So hooking that is actually really easy.  So we just redirect execution by cruising around finding other people's PLT entries and then with the address that we care about. So how that would work, here's an example. You have this thing, you're calling RB new object. The table entry is poisoned with an address of a bad function. Let's just say the address is OX dead beef and you land in this other function where you can do whatever you want. But the question that might be running through your mind now, I hope it's running through your mind is, hey Joe, in your handler function, you're calling the function you're trying to hook. So shouldn't that be an infinite loop? It turns out that's not because if you remember from earlier, each dynamic object that you load into your process has its own set of data. So each dynamic object has its own set of PLT entries and its own global offset table. So as long as you poison everybody else's except for the got PLT section of the library that includes your bad code, as long as you don't poison your library itself then you'll be okay. Dynamic Lincoln will happen normally for you.  So what about Mako? We just described how it works in Elf, but what about Mako? It's not quite like comparing apples to oranges. It's actually really similar. This is the graphic that I was talking about that's super sexy that I spent a lot of time drawing. Elf is on the top, obviously Mako is on the bottom. The actual assembly instructions that are Elf, you have a jump instruction followed by invoking the dynamic linker as we saw on the other slides. But on Mako, they just put all the jump instructions together and then all the dynamic linking invocation functions together. So they just rearrange stuff, but it's exactly the same thing, it works exactly the same way.  There's a function that I needed to hook free list, but the problem with trying to hook free list is that it's marked as inline, which means that the compiler has the option of inserting the instructions for this function directly into whoever is calling this function. So if that happens, you won't actually see any explicit call instructions in your binary. So what do we do now? Are we jacked or is there a way around this? Well, it turns out that if you look closely at this generated code you should notice something. You notice that there's this identifier called free list, and free list is getting updated to point to the new head of the free list as objects are recycled. Notice that free list isn't defined in this function, so it has file level scope.  Since free list has file level scope it lives at some static address. Add free list updates the free list by just inserting something at the head of the free list. Why not just search the binary for all move instructions that get free list and just overwrite all of those? And it turns out that that might actually work, but there are a few problems. The system isn't actually ready to make a call instruction at that point. What does that mean not ready? Well, remember before we talked about the ABI and how the ABI talks about alignment and calling convention?  If we just implant a call instruction there's no guarantee that the stack will be ready to write registers. So what do we need to do? Well, it turns out that we can actually use another type of instruction instead. We can actually just use a jump. We can insert a jump instruction, transfer execution to an assembly stub that we generate at runtime, and then recreate the instruction we just overwrote, set the system up to call a function, and then do whatever we're going to do whether it's good or bad or whatever, and then jump back and resume sort of like the crusty third hook that you need to pull this off. So there's a checklist of things we need to do. We need to save and restore any registers. We need to align the stack. We need to regenerate the instruction that we're overwriting. We need to arrange for any arguments that we care about to end up being put in the right register so they get passed to the function. We need to invoke our code that does whatever it's going to do, and then we need to resume execution as if nothing happened. So here's an example of an instruction that is updating the free list that we're going to overwrite. So this is just saying hey, you know, I'm going to take RBX and I'm going to write it to the top of the free list. So we can't put a call instruction there because as we said, the system is not ready to make a function call.  So what we can do instead is we can just insert a jump instruction. So it turns out that the move instruction is seven bytes. The jump instruction, including the offset, is just to make everything work out. So this address right there, that's just the address of the assembly stub we're going to transfer execution to. And when the assembly stub finishes, we want to return back to this knob and then just fall through and continue executing as if nothing happened. So here's a shortened assembly stub that actually does this. This is an assembly stub that, when I ran my code, this was generated at runtime. It has to be generated at runtime because this first instruction up here at the top, this is getting overwritten and it's a memory, right? Like everybody compiles around Ruby. And so this could, instead of using RBX, who knows, maybe you're using RCX on your Ruby binary.  This is actually shortened. The real thing is way, way longer and way uglier. But I'm going to provide a link to the code later. That way you can actually check it out if you want to see what the deal is. So yeah, we need to save RDI. That's where the first argument lives if you remember from earlier in the talk. We're going to move the free list into RDI because for a memory profiler I want to know who just got freed. That way I can track information about them. I'm going to save RBX because I'm going to fill it with a value in a minute. I'll align the stack to comply with the ABI. And then I'll move the address of a handler function into RBX. That's why I saved RBX a few instructions earlier. I'll call my handler function indirectly via RBX. And then the handler function will just do something good or something bad wherever you want to do.  And the crazy thing about all this hackery is that when you're done it actually works. You can actually use this. If you have Ruby and you care you can gem install memproff and you can actually use this thing. And all the code that hooks these three things together with memproff. You can go on GitHub, you can read the code, and it's real. And it's actually pretty powerful. These three things can be used to build lots and lots of really interesting tools. So just to give you a quick rundown of some of the cool things you can do with this. So we can do stuff about memory. I can write this Ruby code. I can say hey include my memory profiler, start profiling, run a bunch of code and give me stats. And I'll get stats I can look and I can say hey, on file 1.rb online 25 I'm creating a million objects.  So the tech space output is cool but it's really painful to grok. So my roommate Amon built a web UI for this thing so you can actually traverse stuff and you can learn all kinds of crazy information. You can find who's holding references to what other objects where you're leaking memory. You can look at the sub classes of string in rails. You can explore the socket hierarchy. You can do all kinds of stuff. You can find massive arrays. And since in Ruby all Ruby code is just stored in the heap, I can go and regenerate Ruby code from using these function hooks. I can just grab these things and they're getting created and I can reverse them back into Ruby code which is pretty cool too. You can go and look through Ruby standard library and you can say if you have sockets open to any web services you can see what you're connected to on what port. And that's all pretty cool. There's also performance information too. You can find out how long requests take, which rails control you hit, request information. You get crazy stuff too. You can track my SQL queries. Since I can hook into anything, I can track anything I want. I can track my SQL queries, how many I make, how long they take. I can track the garbage collector, how many calls there are to the GC, how long they take. I can track how many objects are created in general which is pretty useful as well. And that's all cool but what about some evil things we can do instead? The performance stuff is cool but maybe you don't care about performance. You can build a library that is something evil but you'll need a social engineering aspect of it because you need some way to get people to use your library. In a few slides we'll talk about how to get around this so you don't need to social engineering. How would we do that? Well, evil lives. I built an evil version of Memproff. The branch on GitHub is just dnw, the sensor do not want. If you try to build it, it will fail. I put a bug in the make file that way nobody can accidentally go screw themselves by building this. The way I would social engineer somebody to use this is I would say, hey bro, this makes Ruby faster. It does make Ruby faster because what it does is it hooks the read system for a magic cookie. The magic cookie is my name, Joe. It disables the garbage collector. The result is Ruby is fast. But it is now a time bomb, right? Eventually it will eat all the RAM on your system and your system will melt down. If you really want to drill it in, hey, it makes Ruby faster.    You show this to a Ruby developer and they're like, dude, I need this right now.  You can do anything. You could hook, read, and write and phone home with all the data and see a specific cookie. You can do whatever you want. But the shitty thing is that we have to social engineer and that's kind of a problem. This guy also has a problem. Unrelated to social engineering. So the problem with social engineering, at least from my perspective, is that it's painful and I don't want to have to social engineer things if I don't have to, like that. So it would be cool if there was a way to inject these evil libraries into running processes without having to give in people to download my thing and look at some bullshit benchmark. It turns out that there is a way of doing this. There is a project written by this guy called Sean Close or Clouds or something. It's called InjectSO. It injects libraries into running processes using ptrace. This hack is actually super, super clever to borrow a very awesome InjectSO works because it's pretty cool. It's actually pretty simple. It just uses ptrace. Ptrace allows you to view and modify the register set in address space of another process. Any permissions that are set on the memory in that process are ignored. So even if a page is marked as read only, you can still write all over it or do whatever you want. So the way InjectSO works is it just attaches to a target process using ptrace. It saves a copy of a small piece of the program stack. It saves a copy of the register set to save return address of zero. You then set the register set to point DL open. So you have the instruction pointer pointing to the address of DL open. You set up the argument. So you have the path to the shared object, the mode stored in RSI. And then you just let it rip. So you wait and then eventually it'll seg fault because once DL opens done, it'll load in this library that you want it to load in and then it'll seg fault because the save return address is zero. When the seg fault happens, we'll get a signal. So this child process will get suspended. You'll be awoken and you'll be allowed to do stuff to it. So you just restore the stack, restore the register set, and just let the world continue on its merry way as if nothing bad happened. This actually works. It's pretty cool. But there's a couple downsides. There's downsides to both aspects of the ptrace method and the evil DSO method.  It's doable, but it's just really painful to do. Seg faults and running processes might be bad. Perhaps the system administrator has some alert thing set up so that if a seg fault happens, then they get an email. I have that set up on my boxes, so if I get a seg fault, I know that something bad happened. And binary patching in general is hard to do. The stuff that we just talked about earlier, the three types of functional king, those things are complicated. And it's possible to do with ptrace, but adding another layer of difficult in between you and actually doing what you want to do. So binary patching is hard, but doing it with ptrace just makes it harder. The problem with the evil DSO though is getting the user to use your library might be hard.  And you need to poison the app each time it started. And in general, binary patching is hard. But what if there was a way to bootstrap the process? What if we can just combine both methods?  So in order to do that, we needed a 64-bit version of inject SO. But it turns out that the inject SO that I talked about by that dude Sean is only 32-bit. So I was getting ready to write a 64-bit port and I searched the internet a bit and I found this guy stealth ported inject SO to 64-bit boxes. This is his blog post releasing the source code. I did a bunch of trivial cleanup on it and it was suffering from some bit rot. So I did some minor cleanup and I put the code on the githubs. So if you want to copy that, you can go there and check it out. I tested it on a 64-bit Ubuntu VM and it actually works.  So it's pretty cool because like I had this thing, I had this web server running and I just used it. I was going to try to demo that but then I wouldn't be able to give the rest of the talk. So I can demo that. So anyway, using those two things, I think it's kind of cool. I don't know if it's a jackpot or not but it's definitely pretty sweet. So we talked about some attack mechanisms. So what are some defense mechanisms to protect against this sort of thing? Like I said earlier, I'm not a security researcher so I don't know all the up-to-date amazing defense mechanisms that are out there. But between defense mechanisms that are difficult to implement, difficult to understand versus just like, you know, standard run-of-the-mill like Ubuntu out of the box, right? So I went through some of the defense mechanisms that I know about and discussed like really briefly like why they're good or why they're bad or whatever. So I'm sure you guys know about the NX bit and no XQ bit. That's cool but if we just load our DSO and our DSO can just call and protect and just say, hey, this page that was about debug information but most people just use pre-built binaries. Most people just use whatever comes with their distribution of Linux so I can just like look, I can just get that VM, I can download the debug symbols and I can figure out all the offsets myself. You can statically link everything if you want and then you still have the problem of getting over and otherwise but you don't have to worry about your global offset tables getting poisoned. The problem with that is your binaries get pretty dirty. I don't know. Perhaps there's some really crazy legacy C code that if it's put in read-only memory will actually die but in theory that's supposed to work so that would actually work. You can also not load DSOs at runtime. The problem with that then is you sacrifice any and all plug-in architectures that are out there.  All day long and somebody injects a library in it will appear on proctpid maps and you can see whatever evil.so is now running in my process so that would actually work. It's just kind of painful to do that. So anyway, sort of looking forward on more experimental stuff I think for me personally my future research is going to be geared toward exploring alternative binary formats and other crazy things you can do. In the recap we talked about three different binary patching techniques. These techniques leave the original binary in working fashion after they're done. So kind of like teeth whitening, you can still eat food after you're done and just looks a little different, same deal. There's three things that matter. There's alignment, calling convention, and object file and library formats. Before I end this I actually had a couple extra slides of something really weird I found in semester time. So look an alien baby. And I saw this really crazy post to a mailing list. The title of the post was interesting behavior on OSX. This was written by a guy named Steven Edwards on November 29, 2007. This is the link to the actual mailing list post that he wrote. It turns out that Leopard actually has a P.E. loader which is really weird.  So for whatever reason there's a loader for Win32 binaries on OSX. So even if you had all the Windows DLLs in place in the right path so everything could be found, it wouldn't actually work anyway because all the APIs are different. But it's still sort of curious like why the hell is there a P.E. loader in OSX. So I don't know if anybody out there knows the answer to that question but definitely something to check out if you haven't seen it recently on Snow Leopard and it didn't work. But I remember trying this a few months ago on Snow Leopard and I thought it did work so I'm not really sure what's going on with that but it's pretty bizarre that there's a P.E. loader in Leopard.  If you get this talk online and you want to read more about some of this stuff I have a bunch of blog posts describing each of the binary patching mechanisms in much more detail.


Good evening. Once we started the journey of taking sessions on different aspects of law and beyond that. During that journey, we found that we have been able to connect with the resource persons who have not only created the mark with the society, but beyond that. I am Tarunaneti, an advocate who is a member of the Law Commission of India, special public prosecutor for CBI in High Court, special senior panel counsel, Union of India. And he primarily practices on the criminal side. Therefore, as a common person and even otherwise, it always transpires as to whether the pleadings in the criminal proceedings are an essential and vital part, keeps resonating the mind as to whether it will be very important just like civil law or the criminal proceedings do not require the pleadings in the legal perspective. But to understand all these aspects, we had requested Mr. M. Karunanthi, who is a popular resource person down south, even for the purposes of persons who are preparing for the judicial exams and beyond that. And we are glad that people are connecting with us on Sunday and Mr. Karunanthi has agreed to share his knowledge. I would request Mr. Karunanthi to take over the baton and thank you for accepting our invite. Over to you, Mr. Karunanthi. Just unmute yourselves. My sincere Namaskar to Onandal connected here. My very sincere thanks to the organizers and team of Beyond Law. I specifically focus this point, this topic to the young generation of Bharat. With this introduction, let me share my views on the topic that is pleadings, relevancy of pleadings in criminal law. Every lawyer will know the pleadings is an essential element before the court of law. And two by the civil lawyers knows well, know well about the importance of pleadings in the civil law. I want to compare the civil and criminal law. You know well order 6, order 7, order 8 of CPC speaks about pleadings. In order to prepare the plight, in order to prepare the affidavit in support of the interlockery applications as well in order the time of preparing the counter claim. We have to consider, we have to specifically plead unless there are specific pleadings, even any number of any volume of evidences, induced by the plaintiffs or the parties concerned cannot be included by the court of law. There may not be any quarrel over that. Let me begin how this pleadings is connected or pleadings is available in the criminal law. No doubt as available in the civil law, in the court of civil procedure, there is no specific pleadings. There is no rule of construction of pleadings in criminal law. But still the pleadings in criminal law is very much essential and necessary. Let me take my learner brothers and sisters to form number one of the second schedule appended with the court of criminal procedure 1973. The investigation will begin as soon as FIR is registered, no doubt at all. The criminal trial will begin instead of commences as soon as the charges are framed, no doubt at all. The accused will be summoned by the criminal court. Accused will be summoned by the criminal court as per the form number one appended in the second schedule. According to the summons to an accused, that is the form number one may read the relevant areas. Whereas your attendance is necessary according to summons. Whereas your attendance is necessary to answer to a charge of so and so and so. So no doubt accused has been summoned by the criminal court, whether on the police report or otherwise than on police report. This someone will be issued directing the accused to appear before the criminal court. So according to the summons, the accused has to appear only to answer the charge, only to answer the charge. Directly we compare section 227 of CRPC, 239 and 249 of CRPC. Section 229 is the provision to discharge by the court of session 239 and 245 speaks about discharge by the Leonard Judicial Magistrate. Why I am taking section 227 and 239 is according to section 227 of CRPC. Let me read if upon consideration of the record of the case and the documents submitted therewith and after hearing the summons of the accused and the prosecution in this behalf. Judge considers that there is not sufficient ground for proceeding against accused, he said Richard like the same the Leonard Judicial Magistrate or by the court of session has to consider the final report forwarder under section 173 sub clause 2 and the documents submitted therewith. So as per section 217 of CRPC, the charge must be definite and it must be specific. He should not give any miscarriage of justice. There are two provisions in the court of criminal procedure. That is one is 215 of CRPC relating to effect of errors. Why I am telling this there are two provisions in the CRPC in so far as it relates to questioning the framing of charges. When there is a error as well section 464, 215 and 464 speaks about effect of omission to frame our absence of our error in the charges. The charges can be framed only on the materials produced by the prosecuting agency by way of filing final report under section 173 to CRPC. We used to say when the prosecution has marched to the evidences, we used to argue the case that the evidences are some of the oral evidence and document evidence are inadmissible into evidence. And there are some omissions and contradictory nature and they have improved their version. So that means the prosecuting agency has to confirm their pleadings that is by way of documents producing before the trial judge. What are all the documents that can be filed by the prosecuting agency? That is the first document would be information given by the first informant. Then first information report that is FIR and statement of witnesses recorded under section 161 subclass III CRPC Caesar Maggazer's observation Maggazer recorded the scene of crime and the material seized in the scene of crime. As well the confession of an accused and also disclosure statement which can be utilized by invoking section 27 of court of criminal procedure. According to section 2 H of CRPC, investigation means collection of all evidence. Investigation means collection of all evidence. My question is whether the collection of all evidence includes, no doubt collection of evidence includes, statement recorder under section 161 III CRPC and confession of an accused and Caesar Maggazer and some letters received by the investigating officer. Suppose in a case based on a circumstantial evidence, there are two types of cases. One is case is based on IV test account, another is based on circumstantial evidence. In case of a circumstantial evidence, in many sessions cases, extra judicial confession will be placed before the court of law. We have obtained number of judgments throughout our country, decided by various cycles as well by the Honourable Appugscope. More particularly in the state of Tamil Nadu, the accused, the prosecution will forward a letter said to have been given by the village administrative officer to the investigating officer. And indicating that the accused came to his office and gave a voluntary confession and he had recorded that confession. And he is producing the accused along with the confession, extra judicial confession recorded by the village administrative officer and he used to produce the accused along with this document. Whether this document given by the letter given by the village administrative officer is admissible into evidence. Whether the statement recorded under 161 III, confession of an accused recorded by the police officer, disclosure statement and other documents forwarded under section 173 II CRPC can be called as evidence. No doubt my view is dishonorability. But for what purpose is the on discussion? In order to take cognizance under section 190 of Code of Criminal Procedure, only for the limited purpose of taking cognizance of offenses as contemplated under section 190 of Code of Criminal Procedure 1973, these documents can be considered as evidence. But as contemplated under section 2H of CRPC, collection of all evidences are mean investigators. Whether these documents can be considered as evidences, evidence in order to say that the charges leveled against accused has been proved or no doubt there is a bar under section 162 of Code of Criminal Procedure. In a famous case, namely Kaliram versus State, decided by the Honorable Supreme Court, the letter written by the village headman or village administrative officer to the investigating officer is hit by section 162 CRPC. The statement under section 161 subclass III CRPC can be utilized how it can be used. There is a bar under section 162 of CRPC. No doubt confession can be utilized. The entire confession can be utilized. The statement of witnesses can be marked even by the by the criminal court at the time of disposal of property at the time of disposal of property and by the court as well by the civil court. There are decider cases by the Honorable Supreme Court and the Honorable Madurai Benjafai Court also decided in a repetition very recently. Now my reciprocal summation is how these are all can be called as a pleadings. No doubt when a civil suit for bar injunction is placed before the court of law with a specific prayer for bar injunction. The plaintiff ought to have pleaded in the civil suit that as on the date of the suit, the plaintiff was in peaceful possession and enjoyment of the suit. In case of a suit based on a specific religion, he has to specifically plead that he was ready and willing all along. So readiness and willingness has to be pleaded. In case of a suit based on the promissory note also, he has to, there must be a specific pleading. No doubt the pleadings can be amended. As per section order 6, rule 17 CPC, the plaint can be amended. My question now is, FIR has been given, complaint has been given as against two accused. Now the investigating officer has collected many evidences, statement recorded from many persons and they have identified unnervingly against 5%. Whether the FIR can be amended, whether the statement of witnesses already recorded can be amended or what else he can do. This is my question. My answer is, FIR need not be amended. It cannot be amended because first information report is not an encyclopedia and prosecution can improve because by way of criminal, by way of first information report, the investigation has begun. Anyone can set the criminal law in motion though there are some exceptions are there. It need not contain minute details so there can be no prior before the court of law to amend the FIR and it need not be. Like the same, the statement of witnesses whether they are eyewitnesses or for other purposes. They can be examined the second time or third time. Further statement from the witnesses can be recorded. The only thing is true statement of witnesses can be asked to be recorded as per the clear language as embodied in section 161 of court of criminal procedure. Yes, next thing is everywhere in the country, everywhere we move, if A says something about the FIR, the B will say what is the proof? Is there any evidence? So evidence is very much essential. Like the same, if we are moving a court with a specific prior, the law requires evidence. Is it a simple evidence? My answer is law requires legal evidence. That means what? It requires judicial evidence. That means what? The statement of witnesses, the confession of an accused and disclosure statement and extrajudicial confession and the Caesar magazine and letter given by one party to another to the investigating officer can be considered as evidence. But when they are coming to the court and after spawning, if they are giving evidence, if they are giving statement before the court, then only it can be called as evidence. Now I want to say about a mantra of legal evidence. That is section, that is triple five. That means what? The evidence should be as required by the Indian Evidence Act 1872. Section five is the guiding factor. So in between section five to 55. So triple five, we have to remember triple five, section five to 55. The oral evidence as well as the documentary evidence shall be in concerns with the Indian Evidence Act, more particularly in between section five to 55. We must remember that to prove a fact, there must be evidence. And the oral evidence can be challenging if a person examined by the prosecution as an eyewitness. Suppose A committed murder of B, charges A committed murder of B. A has been summoned to face trial in section 302. B is the deceased, C and D are no other than the sons of the deceased. According to their evidence in the court, they have seen the assault made by A. But they neither even complied. They have not taken the injured to the hospital. According to their evidence during cross-examination, they went to cinema and later they came. It was reported by a third person in the street. Whether how to challenge that evidence? How to challenge that evidence? The powerful weapon is the cross-examination. We have to argue before the court as per section three of Indian Evidence Act, the proved. A fact is said to be proved. When after considering the matters before it, the court either believes to exist or considers its existence. It is so probable that a prudent man or under the circumstances of a particular case to act upon the supposition that exists. So whether ordinary prudent man will react in the given case. So it is nothing but conduct of the accused. So the evidence has to be given. Evidence has to be given that evidence must be relevant to the charge. Relevant fact. Evidence must be given. It is a relevant fact to prove the relevant fact. So the conduct of the accused is relevant under section eight of the Indian Evidence Act. The criminal code by way of two types getting cases. One is by way of police report. The second one is otherwise than on a police report that means compliant cases. That means compliant cases, compliant file by private individual and compliant by public servant. In any way the charge must be clear, definite. So also the evidence in support of the said charges must be cogent and without any contradiction and without any contradictions. Now, when the judges, not trial judge, frames the charge only on the basis of the documents forwarded under section 173 subclass II CRPC. Like the civil court, the charges can be amended and charges can be altered even before pronouncing the judgement. The oral and documentary evidences can be challenged by way of whether it is admissible in evidence or inadvisable in evidence with the help of section 162 CRPC. When a complaint is filed before the court, for example under section 138 of India, neither issuance of check nor bouncing of check is an offense. Section 138 of NIAG will come into play only after issuance of notice under section 138 of NIAG that notice must contain, a notice must contain all the particulars, all the particulars about the issuance of check and all particulars when it was presented before which bank, when he got the information from the bank on what date he came to know that the check was bounced. So all these particulars has to be pleaded in the legal notice calling upon the driver of the checks to pay the check amount. If the check amount has not been paid on the particular date, then only cause of action will arise and he can file a complaint under 200 CRPC before the court. Now the question is, if there are barricades of particulars, whether the complaint can be amended, complaint can be amended. No, according to the Honorable Supreme Court, the complaint cannot be amended in the judgment reported in 2023 criminal law page 29, very recently the Delhi High Court was pleased to pass the proceedings, PC, Sangee versus Siddharth, this is the case. I have stated about the powerful weapon that is the cross-examination. In the civil court, as soon as defendant entered appearance, defendant has to file a written statement for the allegations leveled in the complaint and he goes to file this counter for the allegations made in support of interlocked application that is in the form of a pedigree. In the criminal court, the accused need not file any written statement. There is no procedure, there is no provision enabling the accused to file written statement. Then how the criminal court can come to a conclusion what is the defense of the particular accused. It is nothing but it can be gathered from the cross-examination made by the accused, by the counsel for the accused. The defense, no doubt, the charges leveled against accused has to be proved by the prosecution, has to be proved by the prosecution. The theory of benefit of doubt has been developed now. All the doubts cannot be taken into consideration, the doubt must be reasonable doubt. The doubt must be reasonable doubt. Anyhow, it is for the prosecuting agency to prove its case beyond all reasonable doubt. Now, what is reasonable doubt and where from we got it? This was the case decided by the English court in Wilmington versus Director of Public Prosecutor, reported in 1935, AC page number 462 and Miller versus Minister of Pensions in all England reporter 1947 volume 2, page number 372. These two judgments have been followed by the Honorable Supreme Court of India in Gopal Reddy K Gopal Reddy versus State of Andhra Pradesh, reported in AIR 1979 Supreme Court, page 387. And in another case, 1974 Supreme Court, page 1567 came Karan and others versus State of Uttar Pradesh. The evidence of prosecution witnesses can be assailed right from the FIR. The first impression is the best impression. There cannot be any quarrel over that. We can assign the first information report. We can assign the first information report under the prosecution case on many ways. Let me, let me list out the some points praying the court to reject the prosecution. One is inconsistency in evidence, delay in forwarding FIR and other material documents to court, corrections in FIR and other material documents, material contradictions in the evidence of prosecution witnesses, genesis of occurrence has been suppressed, permission to state material factors in FIR, delay in examining witnesses, injury on the accused has not been explained. All the documents relating to the case has not been forwarded under the final report. The medical records of the victim has not been produced before the court. The prosecution case is inconsistent and the motive has not been proved. So by citing all these 12 points, the defense counsel can argue a case to reject the prosecution case and to extend the benefit of doubt in favor of the accused. Where the topic is coming to this case, to these points, one may raise this point. Though not directly the pleadings is relevant to the criminal case, though not directly the pleadings is relevant to the case, insofar as the 173-2 CRPC concern, that is the police case, insofar as the case rest upon the circumstantial evidence and the case filed, otherwise they are on police report, that is the complaint case. The Lennard magistrate or Lennard session judge can frame the charges only on going through the pleadings, only on going through the amendments made in the complaint under section 200 CRPC, made under section 200 CRPC and the documents filed along with the complaint under 200 CRPC. If on going through the complaint under 200 CRPC, if no offense is spread out, definitely the complaint will be thrown out and accuse even cognitions of offenses cannot be taken by invoking section 190 CRPC. As well, in case of, we take section 138 case, check bones case, we have to say on such and such a date, the accused has borrowed the amount in discharge of the said legally enforceable debt, he has given the check in question and the check was presented on a particular date before the particular bank, it was dishonored on a particular date and it was informed to the complainant on a particular date. After the issuance of a statutory notice, it was not honored and after waiting for the period as contemplated under the 138, the cause of action has arisen, how the accused is liable to pay and in case of a complaint against a company, there must be specific pleadings, unless otherwise the complaint is liable to be cost, is liable to be cost, the court cannot take cognitions also, court cannot take cognitions. So also the pleadings in criminal law is also plays vital role, is also plays a vital role. As I have already stated, section 464 of CRPC and section 215 of CRPC speaks about error and effect of omission in the charges. Why the lawmaker have given two provisions to speak about effect of errors in framing of charges, in framing of charges, we have to consider, in so far as section 464 is concerned, it speaks about effect of omission and both in 464 and section 255, the lawmaker speaks about, the provision speaks about failure of justice, failure of justice. So there must be a proper framing of charges, how the charges can be framed, only on consideration of the documents and materials forwarded by the prosecuting agency. The learned counsel while framing the suit, the framing of case is very very important, so pleadings is very much important, like the same, like the same, the prosecuting agency has to record the statements, has to record the statements as well as the necessary documents. So on going through the final report and the documents forwarded, the charges can be framed. Now the March of law is in the criminal law is the development of section, questioning under section 313-1 BCRPC. In the year 2023, as well from 2020 to 2023, there are many number of judgment by the Honorable Appax Court, giving the importance about the questioning of and accused under section 313-1 BCRPC, 313-1 BCRPC, because of its importance, because of its importance. Right from the FIR, there must be a specific plea. We used to say, as against the A1 and A2, there is no overtag during the bail application. Subsequently, when final report has been filed, we used to file application for discharge on going through the entire materials forwarder under section 173-2 BCRPC. There are no materials to frame charges against the souls of accused, so kindly discharge it. When after taking cognizance and after framing the charges, the prosecution is expected to march in the evidence sense. The prosecution will examine many number of witnesses and prosecution will also file number of documents and material objects. After considering the entire materials on raka, the Leonard trial judge has to question the accused under section 313-1 BCRPC. All the incriminating materials has to be put to the accused. We can raise a plea before the Leonard appellate court if, in case of a conviction, that the Leonard trial judge recorded its finding that the prosecution has proved the guilt of the accused on such and such points. The finding in paranormal zones and so on, so to convict the accused is relevant. But there is no question on section 313-1 BCRPC. This has to be pleaded specifically before the Leonard appellate court. And at the time of filing an application for suspension of sentence, court has got power to suspend the sentence, suspend the conviction and suspend the compensation. Even in case of suspension of conviction, there must be a specific pleading. In a case came to a conclusion that no doubt the appellate court has got power to suspend the conviction, but there was no pleading at all. But there was no pleading at all. In Ram Narang case, the Honorable Supreme Court came down heavily and held that there was no pleading at all for the specific prayer of suspension of conviction. And there was some discussion relating to importance of pleadings in so far as suspension of conviction, but the Honorable Supreme Court finally granted suspension of conviction in that case. So the pleading is necessary if we are expecting more prayer, a larger prayer before the appellate court that is like suspension of conviction and suspension of conviction. Now, in order to raise doubt before the court, in order to raise by way of a cross-examination, I have stated earlier, the powerful weapon given to the accused is cross-examination. By way of cross-examination, we can establish that prosecution has not only proved the charges, we can also disprove the charges. In a case from Kerala High Court, the Honorable Supreme Court came down heavily only on the ground of cramped handwriting. The exhibit P1 complaint has been displeaded by the Honorable Supreme Court. There was an argument before the Honorable Supreme Court that the exhibit P1 first information has been given after due deliberation, after consultation, that is why there was a cramped handwriting. The exhibit P1 signature from PW1 was obtained and the entire content has been recorded much later. That is why when the recitals has been reduced into writing, at the end portion, there was no gap between the two lines. It was a cramped handwriting. I have already stated, first impression is the best impression. The Honorable Supreme Court displeaded the first document that is exhibit P1 first information and the entire construction on such exhibit P1 was displeaded and the case was ended like this. The defense lawyers should go through all the documents right from the first information and the first information report and they have to take notes when the document was recorded, when the document was forwarded to the court, when the document was received. In the state of Tamil Nadu, as per the division bench guidelines, the Leonard judicial magistrate has to put the initials and as well, their name, they have to write, the Leonard magistrate has to write their name, date and time of assume. By the judgement reported in 1990 law weekly criminal page 175, Johnny and others first state of Tamil Nadu. After the verdict, there are many judgements by the division bench of Madras High Court relating to the delay in forwarding the FIR. There are many judgements by the Honorable Supreme Court as well by the various other high courts giving the benefit of doubt to the accused. On the ground that there is a delay in forwarding the FIR and there is a delay in giving the complaint to the police station. My question is whether the delay by itself can be considered as a ground to reject the entire prosecution case or some cross examination is necessary or some cross examination is necessary. According to the Honorable Supreme Court, the delay by itself is not a ground, is not a valid ground by itself to throw out the prosecution case, entire prosecution case on the sole ground of delay in forwarding the FIR. Then what has to be done? There must be a specific cross examination to the person who has given the first information and likewise there must be a proper cross examination to the person who had recorded the first information report and the person who had conducted the investigation. Because such a 157 CRPC speaks about the first information report has to be forwarded forth with. But it is a question of fact, if at all there is a delay, the investigating officer has to be drawn to the attention of his attention that the FIR has been forwarded related. What is the distance between the police station and the court concern? There is a delay first, we must admit. There is a delay in forwarding the FIR. Is there any reason? You say yes, there are some reasons. Then we have to put some other questions whether the delay has been recorded, what for there is a delay, whether it has been find place in the case that there must be some positive questions. Unless otherwise, the delay in forwarding the FIR cannot be a ground to reject the prosecution case. We will come to other points to reject the FIR. Why I am concentrating on the FIR? Because the FIR is the first document and the criminal law was a term motion on exhibit P1 first information and the first information report has been recorded only on the basis of the first information. So if there is some corrections, if there is some corrections and if there are some corrections in the FIR and other documents, it has to be brought to the notice of the investigating officer. In Virayan versus state of Tamil Nadu in the case of NDPS offenses, the Madrasai court at Madurai Bench came down heavily. There were material corrections in the FIR, Cesar Magajar and the request made by the investigating officer to the judicial magistrate to send the contraband for chemical examination. So the Honorable Madurai Bench of Madrasai court came down heavily in Virayan versus state of Tamil Nadu. And another point is the defense used to say if the prosecution evidences are cogent, we will say the witnesses have deposed like parrot. So parrot like evidence cannot be considered and it has to be thrown out. If there are some contradictions, then the Lana defense council used to argue the evidence of prosecution witnesses is with full of contradictions. It cannot be relayed upon, it has to be rejected in doubt. If only one evidence has been placed by the prosecution in support of the prosecution case, then we can say it is only solid drive witnesses. So by applying the test of trustworthiness, it has to be rejected. And in case when the prosecution witness categorically says A1 has caused injury on net, A2 has caused injury on the right side of head, A5 has caused right parietal region and so long they have given proper particulars of place of injuries. Then also the prosecution has to suffer because the minute details cannot be memorized. Otherwise these evidences can be considered as a dramatic evidences as held in Selvi versus state of Tamil Nadu reported in 1986 criminal law journal page 736. In case of a minor contradictions, in case of a minor contradictions, those contradictions cannot be considered material. And yet another point, a new point from Meghraj Singh versus state decided by the Honorable Supreme Court. In case the defense has taken a consistent view by way of across examination right from the PW1 who said the criminal law inversion. That the genesis of occurrence has been suppressed. Genesis of occurrence has been suppressed. First information given in the case on hand has been suppressed and the prosecution has not come to the court with the clean hands. Then how to check whether the prosecution is correct or not. The version taken by the prosecution is correct or not. If FIR is doubtful, in the case of the defense, FIR is doubtful. The first information has been thrown out. The first information as projected before the court is nothing but concordant after due deliberation. There are two external checks given by the Honorable Supreme Court. The first check is delay in forwarding the FIR and another check is very, very peculiar fact, very, very peculiar thing. Whether the first information has been forwarded to the doctor along with the post-mortem requisition. If the two tests are satisfied, then it is in favor of the prosecution. Otherwise, the court can safely come to the conclusion that genesis of occurrence has been suppressed. The judgement of the Honorable Supreme Court in Meghra Singh v. state has been followed by the Honorable Madurai Benjab Madrasai Court. Reported in Mahadevan and others v. Inspector of Police Kumbhavanam police station. Reported in CDJ 2012, MHC page number 3953. And on the other points also, the prosecution can be rejected. We can say before the court, the test identification parade, how the reliance can be placed on test identification parade. As per section 9 of Indian Evidence Act. Resguised section 6 of Indian Evidence Act. And we can say the adverse inference can be drawn by invoking section 114 of Evidence Act. In one provision, the relevancy has been specifically stated. Let me take to section 27 of Indian Evidence Act, section 27 of Indian Evidence Act. For the benefit of viewers, let me read section 27. How much of information received from accused may be proved. Provided that any fact is deposed to as discovered in consequence of information received from a person accused of any offense. In the custody of a police officer, so much of such information, whether it amounts to confession or not. Section 27 speaks about, not only speaks about confession, but also statement. Because the word, whether it amounts to a confession or not has been used. As relates the lawmaker, so specifically consciously into this bed. As relates distinctly to the fact thereby discovered may be proved. As relates distinctly to the fact thereby discovered may be proved. So also we can argue before the criminal court, we can argue before the court criminal court. That the disclosure statement from the mouth of so and so and so cannot be considered. It has to be liable, it is liable to be rejected on the ground. That the recovery, the recovery of so and so material object is not related to the case on hand.  The investigation officer has recovered a cell phone or a laptop from the accused. The prosecuting agency has to come to the court with the faulty evidence. How the laptop or mobile phone or whatever it be the recovery is relevant to the charge. Section 27 can be utilized by invoking section 27. The prosecuting agency can argue only when the disclosure statement and the evidences and documents or material object discovered from out of the disclosure statement is relevant to the charge. Unless the disclosure is relevant to the charges leveled against the accused, the evidence is liable to be rejected. The evidence is liable to be rejected. One can say sorry you stated that the someone has been issued. Someone has been issued to the accused only to answer the charges. Sir in many cases, presumption class is there. As like in 138 of NIAG and Provenction of Corruption Act and many other enactments. What can be done? No doubt as per article 21 of the Constitution of India, presumption of innocence is the basic. Presumption of innocence is the basic. But in case of many enactment. In case of many enactment. TIRANA 4B, COSCO, NDFES cases, Negotiable Instrument Act, Schedule Castal and Schedule Tribes Act. In D.V.C. Dowry Prohibition Act, Customs Act, Essencial Commodities Act, Foreigners Act, Indian Forest Act and Indian Poisons Act 1919 and in many acts there is a presumption class. still the fundamental fact has to be proved only by the prosecution, still the prosecution has to prove the fundamental facts. So also in order to invoke section 106 of Indian evidence, in order to invoke section 106 of Indian evidence, the fundamental facts has to be proved, has to be proved by the prosecution and then only the presumption class will come into play, will come into play. Suppose I said that the powerful weapon is a cross-examination, powerful weapon is a cross-examination. If in a case there is no cross-examination is made, there is no cross-examination then according to the Honourable Supreme Court, the evidence in chief has been admitted, evidence in chief has been admitted in case of monogram versus state, in case of monogram versus state decided by the Honourable Supreme Court. The Supreme Court has taken note of the cross-examination made in a case of a capital punishment. The Supreme Court recorded that there was a nice and wonderful cross-examination and it shows the length and breadth of the practice of the Leonard Council appointed by the legal legal aid and the still the application was rejected, it was in monogram versus state and very recently the Honourable Madrasai Court heavily came down, heavily came down and recorded that there was no proper cross-examination, there was no proper cross-examination and the Honourable Court recorded a conviction and in a case reported in 2021 Bhani Muni SCC criminal page 475, the object and purpose of cross-examination has been summarized and the principles have been summarized, principles of cross-examination has been summarized. I will quote some important judgments, in 2021 volume 3 SCC criminal page 149, Raghish and another verses, state of Uttar Pradesh, the Honourable Supreme Court has gelled, it is to be noted that Dr. Anshad question which put to him, one is required to consider entire evidence as a whole with other evidence on record, mere one sentence here or there and the two to the question asked by the reference in cross-examination cannot be considered state alone and I want to stress upon when the prosecution has requested the court to treat a witness as hostile, to treat a witness as hostile, what has to be done, whether the prosecutor can simply read the statement recorder under section 161.3 and cross-examine or the prosecution has to examine, cross-examine the witness who turned hostile, the division bench of Madurai bench of Madras High Court, in Kannan alias Mannanai Kannan and others verses Inspector of Police, C5 Karimade Police station and I will read the few lines, mere repeating of section 161.3 statement in cross-examination of witnesses who turned hostile can never be substantial evidence and the Honourable High Court recorded the purpose of treating witnesses as hostile and cross-examination is to be on some material points and there are many number of judgments, many number of judgments on the point of there must be a proper cross-examination, there must be a proper cross-examination. I want to conclude with remarks that in case of, I have already stated, in case of notice under section 138 of NIA and drafting the complaint under section 200 CRPC as well under section 156 subclass 3 CRPC that is pre-taking cognizant stage and the post-taking cognizant stages also in case of application of 156.3 there must be a specific pleadings then only the Leonard Magistrate can order for investigation by the police or directly the police to file a report after conducting investigation as like as when a negative final report reaches the Leonard Magistrate as decided by the Honourable Supreme Court and as per the rules framed by the Honourable Madrasa Court in criminal rules of practice 2022. The Leonard Magistrate has to send a notice to the first informant and the victims and the victim can file a protest application. The protest application has to be in the form of complaint under section 200 CRPC. Very recently in Winubai case Honourable Supreme Court has held the complaint must state all the facts how the insofar as the charges are concerned when the occurrence taken place, where the occurrence taken place what was the act of the accused who committed the offense as against the court. So the charge must be clear charge must be definite prosecution has to come to the court with a definite case and with a clear case like the same in the complaint there must be a pleadings then only Leonard Magistrate can frame the charges as well if it is a protest application. If it is the protest application still we have to drop the application as a complaint under section 200 CRPC then only if the Leonard Magistrate if not satisfied to send the protest application to the investigating officer for investigation there is no bar for the Leonard Magistrate to take cognitions of offenses and to proceed with the case in the manner known. So if the Leonard Magistrate to take cognitions of offenses there must be a specific pleadings in the complaint though there is no specific rules specific rules relating to the construction of the pleadings still the we have to concentrate though not named as the pleadings we must specifically plead in the notice complained and application for suspension of sentence and suspension of conviction and in the protest application as like as we have to specifically cross-examine the witnesses in order to get the benefit because all the benefits cannot be eroded in favor of the defense in order to reject the prosecution case the benefit out out in order to get the benefit benefit arising out of the doubt the doubt must be a reasonable doubt that is why I request there must be a specific denial what has to be proved by the prosecution we used to say in the civil court we used to say one admitted facts need not be proved then what has to be proved by the prosecution is it's only a disputed fact so we have to dispute each and every fact the prosecution has to prove a fact by leading by marching oral evidence as well documentary evidence so the the defense council here heavy duties also on the defense to to disprove that to we have to specifically put questions then only the doubt can be considered as a reasonable doubt and only on the reasonable doubt criminal court can extend the benefit of doubt in favor of the accused and acquittal can be recorded I will circulate the notes to the the organizers of this webinar and it may be useful for all my sincere thanks to the organizers for having given me this nice opportunity I don't want to take much time on Sunday my sincere thanks to the organizers as well as all the participants here thank you one and all thank you for the free flow of knowledge there are two questions which have come the kindly explain section 314 CRPC and limits their upon section 314 it is nothing but a written arguments it speaks about arguments can be advanced before the court by in return form section 314 and the section 315 CRPC we can also request the court to examine the accused as a witness but many times it may be a suicidal one another question sir the next question is whether charge intersection 147 and 148 CPC can be framed against one accused at the same time or can be framed very recently regarding the conspiracy and unlawful assembly I want to say in order to frame the charges in order to frame the charges for unlawful assembly five or more persons but the the conviction need not be for more than five persons as well for conspiracy even the complaint I omitted to say the application under section 125 CRPC as well application under the provisions of the domestic violence act can be amended charge it cannot be amended once the investigating officer can move for further investigation under section 173 so there is no question of amending the charge it but charges can be amended in a case in the state of Tamil Nadu there was a final report making allegations against few accused few accused and accused were summoned trial was on other accused were arrested in connection with other offenses in some other district they were the investigating officer in a second case record and confession from the accused and as from the as called out from the confession of the accused in other case they came to a conclusion that they only committed the offense with the help of the present accused it was informed to the investigating officer in the first case they have moved an application under 173 CRPC the further investigation was ordered and final report was filed so there is no question of amending the charge but charges can be amended or altered even before the judgment is pronounced regarding the minor offense major offense regarding major offense one minor offense I want to say what is major offense or what is minor offense has not been defined in the court of criminal prosecution 1973 the in order to record a conviction definitely there must be a charges unless charges are framed the conviction cannot be recorded but still conviction can be recorded if the the offense the Leonard judge wants to convict the ingredients are well within the offenses already framed that then only as per the section 222 section 222 the both the offenses must be cognate offenses both the offenses must be cognate offenses and the ingredient of both the offenses must be more or less similar unless otherwise the conviction cannot be recorded explain the investigation without jurisdiction sir can you please explain the investigation without jurisdiction can you give any example that is the question post could you explain the if there is any investigation without jurisdiction what will be the effect thereof suppose suppose an application FIR was registered for the offense intersection 138 of NIR we can say we cannot investigate it can be caused suppose an application intersection 18 the FIR has been charged the registered and final report has been filed under section 188 IPC we can say they have no jurisdiction compliant by public servant only maintainable in so far as section 188 IPC is concerned they have no jurisdiction thank you for sharing your knowledge nice nice nice meeting thank you very much thank you uh