Ephesians chapter one I'll begin reading at verse one read to verse six and we'll get into our study. Ephesians chapter one beginning at verse one Paul and Apostle of Jesus Christ by the will of God to the saints who are in Ephesus and faithful in Christ Jesus grace to you in peace from God our Father and the Lord Jesus Christ blessed be the God and father of our Lord Jesus Christ who blessed us with every spiritual blessing in the heavenly places in Christ just as he chose us in him before the foundation of the world that we should be holy and without blame before him in love having predestined us to adoption as sons by Jesus Christ to himself according to the good pleasure of his will to the praise of the glory of his grace by which he made us accepted in the beloved and so I'm going to give to you as I normally do when I begin a study a bit of a prolonged introduction and share a few things with you concerning this book that we're about to embark on an in-depth study of Ephesians is a letter that intends to encourage believers to know who they are in Jesus Christ it's a book that is filled with promises that God has given to his children in this book Paul reveals his shepherd's heart for these people he begins this letter by calling to their memories that they have been blessed by God notice verse 3 he points out that Jesus has blessed us with every spiritual blessing in the heavenly places he begins this way because he's concerned for them these people that he's writing to these Ephesians are spiritually rich yet they're living as if they were spiritually bankrupt and that's because they don't yet understand how blessed they are in Jesus Christ they have yet to understand that God is provided for them in every way several years ago now the LA Times reported the story of an elderly elderly man and his wife who were found dead in their apartment autopsies revealed that both had died of severe malnutrition although investigators had found a total of forty thousand dollars stored in paper bags in a closet today there are many Christians who are spiritually living below where they could be living so Ephesians reveals our riches in Christ and teaches us who we are in him you see pastor Paul wants all believers for all time to know that they are rich in Jesus Christ and the church including us should know that we are rich beyond measure in Jesus in Ephesians the word riches is used five times grace is used 12 times glory is used eight times and in Christ or its equivalent around 35 times so Paul obviously intends to instruct the church on how to understand the work that God has performed on our behalf when he gave his son Jesus Christ to die on a cross for us now this kind of understanding of what Christ has done what he's accomplished what he has given to us this kind of understanding takes place through the teaching as well as the application of the word of God you see in our day such a discipline of actually being taught and applying is not really that attractive to every Christian there's a growing number who actually resist Bible teaching because for them Bible teaching is boring some of the things that they may hear even disturbs them and it makes them uncomfortable they don't realize that that is falling into a prophetic word that God gave through the apostle Paul in 2 Timothy chapter 4 at verse 3 when he said a time will come when people will not listen to accurate teachings instead they will follow their own desires and surround themselves with teachers who will tell them what they want to hear he speaks of satisfying their own desires what they do is they seek those who will satisfy their desires and support the errors that they hold and many churches today have discarded teaching the word and promote other things because they're aware of this this has given rise to what has been called cafeteria Christians many have turned away from the riches of God's word and are instead in a constant search for contentment in shallow human teachings and this reveals that they have yet to understand what Christ promised to his followers in John 4 13 and 14 Jesus said whoever drinks of this water will thirst again but whoever drinks of the water that I will give him will never thirst but the water that I will give him will be in him a well of water springing up into everlasting life and they don't understand that they don't understand John 6 35 when Jesus said I'm the bread of life and he who comes to me will never hunger he who believes in me shall never thirst well the Ephesians needed to be reminded of what they have in Jesus and I believe the church today needs to be reminded also so let me give you a background here of this book Jesus commanded his ministers to take the gospel throughout the world in Matthew chapter 28 as well as other passages so in obedience Paul came to the city of Ephesus it's recorded in the book of Acts in chapter 18 verses 18 through 21 he came to Ephesus on what is called his second missionary journey now when you look at the city of Ephesus and I believe I have some pictures of it Ephesus was one of the most beautiful cities of the ancient world it was on the southwest coast of Turkey and was a commercial center of ancient Asia Minor during what is called the Roman occupation from 129 BC to 262 AD the city swelled to over 250,000 people it was the second largest city and cultural center in the Roman Empire next to Rome itself Ephesus was famous for magic it's harbor and one of the seven wonders of the ancient world the temple of Diana it is estimated that the temple measured approximately 377 feet long by 180 feet wide using an American football field for perspective the layout of the temple was longer and wider than a standard sized field it was considered the first Greek style temple to be to be made completely of marble and was built with more than 100 marble columns standing 40 feet high the entire project took over 120 years to complete kind of like the work they're doing here on the street you notice how long that's taken they they built the empire state building in less than a year now when when paul by the way i've been to Ephesus marina i've been to Ephesus on two different occasions i i believe that there were pictures being shown so that you could see the city apparently i i think they were yeah like there's the temple right there and all of that we i've been there obviously the ruins they have a they have an amphitheater there that seats 25 000 and they're using it now for rock concerts it's kind of amazing and and they have a library the library of celsus it was one of the largest libraries of the ancient world it contained between 12 000 and 15 000 scrolls again i mentioned the amphitheater at seated 25 000 it also had the most advanced aqueduct systems in the world and so when paul entered the city the first thing he would do is he would go into a synagogue in acts chapter 18 90 19 through 21 it speaks of how paul first came into the city of Ephesus and in that passage luke revealed that he he was reasoning in the jewish synagogue which is what he would do by habit and he would go and speak to them about the lord jesus christ and when he first did that he received a welcome and was asked actually asked to stay longer but he wouldn't do it instead what he did is he left two of his fellow ministers behind a man by the name of aquila and his wife priscilla and they remained behind to minister he came back again on his third mission and he returned and stayed for three years and there he laid a very strong foundation that's found in acts chapter 20 verse 31 so paul when he would come he would preach and his preaching had a great impact on the city but it wasn't always favorable he had to leave Ephesus after igniting a near riot over the practice of idolatry you see that in acts 19 in acts 1926 there's a man by the name of dimetrius who was a silversmith who earned his living in making idols and all and he said you see and hear that not that not only at Ephesus but throughout almost all asia this paul has persuaded and turned away many people saying that they are not gods which are made with hands and so paul was arrested eventually and was put in jail when he was in prison paul wrote what are called the prison epistles Ephesians Philippians Colossians and philemon are what are called the prison epistles and so this book here is one of the prison epistles over her history Ephesus had great teachers and great leaders as we already noted paul ministered in Ephesus aquiline priscilla ministered in Ephesus john the elder the one who wrote the gospel of john is traditionally believed to have pastored in in Ephesus as well as young timothy so when you read uh first and second timothy you're actually reading a letter that is also to the church of Ephesus and so it was a very influential church that had a large impact over time it was a very significant church and one other letter that it has that has been written to it is found in the book of revelation when jesus wrote his letter to the church of Ephesus a church that had left its first love and so this is a letter that is written by paul to speak to these Ephesians to let them know what they have in christ and you can if you take the time which i'd encourage you to do you can piece together so many things that help you understand what is taking place in this magnificent city this city that is one of the most beautiful cities in the ancient world a city that the apostle paul came into and poured his heart out to the people of a church that paul stimulated a near riot for his proclamation of the gospel and yet a church that was built that was that was blessed that ultimately had great preachers and teachers but never listened to the word that jesus gave it when he said i have this one thing against you you're leaving your first love and so we're going to have an opportunity to look at the book of Ephesians if you are into um ways to get a hold of the the direction of the church you can actually divide Ephesians or the letter you can divide Ephesians using three words into three sections sit walk stand that is how you break up Ephesians sit seated in jesus christ walk the walk of the believer and then finally stand in spiritual warfare and we're going to be seeing all of those things eventually we're going to be getting to chapter five and uh when we get to chapter five that's a chapter that i'm going to take a little time in certain sections because it's a it's a chapter that deals with christian and and family marriage and family and it's one of my favorite portions of Ephesians as we look at the uh the christian marriage we'll be seeing that and i'm going to pray that people in our church will take the time to come especially for that section so that we can share with them some things that help us in our marriages and so with that said we'll begin now our study here in the book of Ephesians i'll begin with the introduction found in verses one and two and then move through until we get to verse six so we'll begin with verses one and two it's uh actually introduced in the common way that letters were written at that time it begins with the author of the letter paul it has the secondary which is to the saints so the first is the person who's writing then secondly it is to the the people who are being written and then third it's a blessing grace and peace and so he begins paul an apostle of jesus christ by the will of god to the saints who are in uh Ephesus and faithful in christ jesus grace to you and peace from god our father and the lord jesus christ typical introduction salutation and blessing notice as we begin paul begins by identifying himself paul an apostle of jesus christ this is a typical way that he began letters in he begins nine of his letters by by identifying himself in this way paul an apostle now the word apostle literally speaks of one who has been sent out or somebody with authority originally jesus chose 12 men he called them his apostles we know that judas fell through treachery and a disciple named mathias replaced him you see that in acts 126 paul became what has been called the 13th apostle and he was one who was uniquely chosen by god and refers to it in that way because he's an apostle of jesus christ by the will of god and so paul's calling to this position was not from man and he's pointing that out in his introduction it was not an appointment from man it was an appointment by the will of god you see man only recognizes the call of god but it's god who is the one who calls in appointments it's like john 15 16 where jesus said you didn't choose me i chose you and appointed you that you should go and bear fruit and that your fruit should remain that whatever you ask the father in my name he may give you you didn't choose me i chose you in the king james and i ordained you well paul is one who says i was not called an apostle by some vote by some committee i am called to be an apostle by god himself paul an apostle by the will of god my position in calling comes from god and then he says to the saints who are in Ephesus and faithful in christ jesus now when he says to the saints the saints speaks of god's part saints are those who have been set apart the word saint is a common word to speak of a believer it's used 96 times to speak of believers there are the saints but that's god's part he's set you apart faithful speaks of man's part faithful speaks of man's part in that those who have personally trusted in christ have exercised faith in him so god has called you you have entrusted yourself to him and so your saints and you are those who are faithful and it's been said either you are a saint or you're an ant there's neither you're either or and so a saint is somebody who's been called by god it's a common designation and that's what you you may not see yourself this way but i have to tell you and some of you ought to begin to realize what you are you have been set apart by god to serve him if you understand that and live that every day you're going to grow in the things of the lord in mighty ways you have been called by god there i've talked to so many people who have said well i i'm no saint well not in the way that human beings use that word probably not you're saying you're not perfect and i get that you're not i am and this is let's just admit that shall we no you're you're saying you're no saint but you're trying to say in fact that you're still a human being who's moving along the road i get it i understand but from a biblical sense you've been called by god and that is a common designation for you you ought to live up to the name god has called you and god is using you what is your part to be faithful to him we'll see that in some detail in a moment but he speaks out in this way to introduce this to the saints who are in Ephesus and faithful in christ jesus notice in christ jesus you see when you're saved you enter into a living relationship with jesus christ and we know that it's not a religion it's a living relationship with god himself and that's what makes us christians in john 15 verse 5 it says i'm the vine you are the branches he who abides in me and i in him bears much fruit for without me you can do nothing so we are in the vine the true vine we abide in jesus christ in 1st grinthians 12 13 for by one spirit we were all baptized into one body whether jews or greeks whether slaves or free and have all been made to drink into one spirit and so we are we are believers we are in christ jesus now when we forget that we have a living relationship with jesus christ what happens is we can become very religious and our lives begin to be filled with things that we think we need to do and when we fill ourselves up with things we need to do we begin to lose the joy of grace in romans 14 verse 17 it says the kingdom of god is not a matter of what we eat or drink but of living a life of goodness and peace and joy in the holy spirit and so in christ jesus we're saved and we have the peace and joy of the lord and he wants to remind us of those things immediately he goes on and he speaks concerning in verse 2 grace to you and peace from god our father and the lord jesus christ grace always precedes peace and both come from god to those who believe in him in romans 5 1 paul said having been justified by faith we have peace with god through our lord jesus christ so he gives a blessing grace to you and peace and then he moves on into the body of his letter verse 3 blessed be the god and father of our lord jesus christ who has blessed us with every spiritual blessing in heavenly places in christ we'll look at that for a moment blessed be the god and father of our lord jesus christ who has blessed us he opens with praise because god has been good to us and psalm 68 19 blessed to be the lord who daily loads us with benefits the god of our salvation he says god has blessed us with every spiritual blessing in the heavenly places now this is what jesus promised us as followers and that includes both chou and gentile he had said in john chapter 10 verse 10 the thief comes not but for to steal and to kill and to destroy iam come that they might have life and that they might have it more abundantly blessed be god who has blessed us with every spiritual blessing in the heavenly places notice he says we have every spiritual blessing made available to man and the gospel reveals these blessings are for those who receive christ as savior when he speaks of spiritual blessings this is interesting this word spiritual is an interesting word word it it the word spiritual is a greek word pneumaticos it refers to the working of the holy spirit it speaking of the origin of the blessing that believers receive the origin of the blessings come from god the spirit so if people desire the spiritual blessings of god they first need to come to jesus christ so to those who by faith come to trust in him spiritual rest and spiritual blessings belong to them and that's what paul is reminding the effusions of paul is telling the church that god has now listened already provided for them what they need he's already provided you might want to note that in your heart if not on a note god has already provided for you what you need he is saying they need to make use of what they already have in him when we understand that it changes the way that we pray i heard the story of a man who was an art collector perhaps you've heard of this he was an art collector and there was a particular painting that he wanted so he sent one of his uh his employees out to seek for this particular painting and the employee did his due diligence he was he hunted the internet he did everything he could to find this particular painting this man wanted the man had an amazing art collection but he wanted this one painting and so after some time his employee came into his room and spoke to him and the man said well have you found the painting and the employee says i have sir he says well where is it and the employee said you already own it this man already owned the painting that he sent someone seeking for he had so many things he never even realized the thing that he wanted most was already in his possession and there are a lot of believers exactly like that you're always asking god for certain things not you only we ask god god i need this and we forget wait a minute he has already supplied those things for me i'm not accessing them by faith i already have those things the things that i'm asking for are things he's already he has blessed me with every spiritual blessing in heavenly places and why do i constantly go back asking for the same thing that i already have possession of i'm simply not walking in why is that well that's what he's saying he's saying you need to know what you have in jesus christ when you received christ you were made heir to tremendous spiritual blessings the bible says that in jesus believers have already been abundantly blessed and the blessings that we have are spiritual blessings and they're blessings that originate in heavenly places various places in scripture you begin to to read concerning the things that god has provided for us for example in first Corinthians chapter one verses five through seven Paul said to the Corinthians in everything you are enriched by him in all utterance in all knowledge even as the testimony of christ was confirmed in you so that you come behind in no gift waiting for the coming of our lord jesus christ in second Corinthians 5 21 he says he has made him to be sin for us who knew no sin that we might be made the righteousness of god in him in Colossians 2 verse 10 you have been given fullness in christ who's ahead over every power and authority and peter in second peter 1 3 said his divine power has given us everything we need for life and godliness through our knowledge of him who called us by his own glory and goodness the church already has these things in christ but the church isn't living as if they understand they possess that and that's why i was thinking that a good book for us as a church to start the year would be to go through Ephesians to see how god has blessed us and to begin to walk in those blessings that we've already received in him to learn to do that he says we've been blessed with every spiritual blessing in the heavenly places in christ though we live presently on earth we are blessed to be citizens of heaven it's been referred to as dual citizenship we are sojourners we are pilgrims we're living out here but our real home is heaven in Philippians 3 20 it says our citizenship is in heaven from which we also eagerly wait for the savior the lord jesus christ so as mentioned as heavenly citizens we have what is called a dual citizenship we're yet to reach our heavenly home but we still receive blessings from heaven many years ago now i was in spain first time i ever went to spain was in 1975 and i went through europe i was there for three months and i went through backpacked europe with a friend of mine and we were living on ten dollars a day now this is back in 1975 so you can imagine um it was in it was an interesting three months i i was already skinny at that time i weighed 155 when i started i weighed in two months i was weighing 145 because we weren't eating you know we were walking nine hours a day and and and hardly eating anything at all and so i was down to skin and bone and so by the time i got to spain uh i i needed some money so i wrote home i called home actually to my mom and i said mama um i had left some money in my bank account and i said mama send me some money and so my mom sent me some money through american express and i went to mid in madrid i went into the american express office and i went up to the counter and i and i said i have money waiting for me and uh i'd like to make use of it and so i was able to take something that was sent from some other place and make use of it at that time and that's kind of how it is with us with the blessings god has given to us we are we are we are residents of heaven but we live right now on earth we're pilgrims and we're sojourners but the blessings god is sending to us are our blessings that we go and receive we we go and make claim to them they belong to us they've been sent to us they are ours and and so you have been blessed i have been blessed by the spirit by the lord spiritual gifts and and and blessings that come from god they're from heavenly heaven they're of heavenly origin their gifts that the spirit of god has made possible for us but what we need to do is understand that they are ours and then receive what is ours by faith and say lord i i i would like to make access to that and so he has given to us these things you have plenty of things and we're going to be looking through them in some detail this is just your introduction but we have these things and their blessings from heaven he points to them for us notice in verse four just as he chose us in him before the foundation of the world that we should be holy and without blame before him in love so the concept of god choosing he has chosen us in him is deeply rooted in scripture it is taking the taking of a smaller number out of a larger number the church has been called or referred to as the called out ones that's what ecclesia speaks of the called out ones we've been taken out of the world so that we would serve god and become heavenly servants and citizens so he's chosen us he's taken us from the larger the world and he's brought us into relationship with him and you see this concept of choosing i'll touch this very briefly in in the bible through the old in the new testament it is seen in god choosing israel this concept of choosing is seen when he chose his prophets his servants and you also see this when jesus chose the apostles in in in deuteronomy chapter seven seven and eight it says the lord did not set his love upon you nor choose you because you were more in number than any people for you were the fewest of all people but because the lord loved you and because he would keep the oath which he had sworn to your fathers has the lord brought you out with a mighty hand and redeemed you out of the house of bond men from the hand of pharaoh king of egypt so the lord chose you that he was speaking to israel as for servants you see that in Jeremiah chapter one verse five a prophet when he said before i formed you in the belly i knew you before you came forth out of the womb i sanctified you and i ordained you a prophet to the nation nations and then you see the apostles as mentioned in john 15 16 when jesus had said you haven't chosen me i have chosen you and so when he says in verse four he chose us in him before the foundation of the world god determined all who believed on jesus would be saved he didn't choose some to be saved while others he left to be lost forever scripture clearly portrays god's desire for all men to be saved you see it see that in the most famous new testament scripture john 3 16 god so loved the world that he gave his only begotten son that whosoever believes in him should not perish but have everlasting life you see it in first timothy 2 verse 4 where it says god will have all men to be saved and come to the knowledge of the truth you see it in the old testament book of isaiah 45 22 where god says look unto me and be saved all the ends of the earth and so god has determined that those who believe in jesus christ are to be saved his choosing isn't based on man's logic it's rooted in his omniscience his foreknowledge he knows all possible plans for salvation and he selected the best one of the systematic theologians that i will inquire of very famous one is named uh schaefer lewis berry schaefer and schaefer said this he said having a plan and knowing all of its details god could then foreknow all who would be saved or elected and also all the facts that relate to their salvation now that plan would include giving man a freedom of choice for which he would be responsible god does not violate man's ability to make moral choices that he will be held responsible for if you think immediately of man like poncho's pilot and judas the scariat they made a willing choice and they suffered the consequences for doing that when you look at this in this way that he's speaking of when he uses the word he has chosen us and in verse five speaking of predestined us to adoption when you look at those those concepts and all you consider the fact that god has we'll say omniscience he knows all things he has foreknowledge he knows what will take place i've always considered his foreknowledge uh to be like a delayed telecast um i was in line many years ago marie and i were going to see a movie and this is years ago and there was a contest that had been played between two different teams in all and and i knew the results of that contest i already knew the results of it and there were two little boys young boys in front of me standing in line arguing about this particular game and one was saying i think that the rams one will say the other guy was saying i think dalas one oh no so i was there i was and i knew the result of the game and so finally one of the kids said i'll bet you i'll bet you that so-and-so one the other guy knew i'll bet you this other i already knew the results so i turned to one of the kids was was uh betting on the rams naturally and i said bet on the rams and bet big why because they won and and i knew that already but this hadn't been televised yet so these kids didn't know it and so that's kind of an easy very simplistic way of looking at it but i see the lord as knowing the results of the game before the game is played and anybody else knows it god already knows the results and in his choosing he chose those who are going to come to him in faith that's just makes sense it's logical to see that it's in the way that the lord uh he sees things he sees things differently than us it's like what it says in isaia 46 9 and 10 remember the former things of old for i am god there's none else i'm god there's none like me declaring the end from the beginning and from ancient times the things that are not yet done saying my council shall stand i will do all my pleasure god has a full scope of knowledge and he makes choices and he has chosen us to be in his son now god through his spirit by the word and by the preaching of the of the gospel calls people to faith in him in psalm 34 verse 8 o taste and see that the lord is good blessed is the man who trusts him isaia 2 verse 5 oh house of jacob come let us walk in the light of the lord revelation 22 17 an invitation the spirit and the bride say come let him who hears say come let him who thirsts come whoever desires let him take the water of life freely so god does not violate your will he appeals to it by the gospel and convicts you with the holy spirit he sovereignly calls us he desires to bless us and he has a purpose in choosing us now verse 4 tells us the purpose of him choosing us is that we should be holy and without blame before him when he says we should be holy we should be separated to him we should not be part of this world system when he says we should be blameless the word blameless means spotless unblemished because we have his nature when you're born again you should be living a life that reveals that he chose us that we might be acceptable suitable or fit for himself so in Philippians 2 15 Paul says that you may be blameless and harmless the sons of god without rebuke in the midst of a crooked and perverse nation among whom you shine as lights in the world you see when you go to work when you're in your neighborhood when you're in the store when you're at the gas station when you're rolling through that stop sign wherever you are you are a testimony of the grace of god you are a testimony of the grace of god we ought to always remember that because he's chosen us to be holy and he's chosen us to be blameless we have a purpose and it's not that you can't live a holy life and it's not that you can't live a life that is unspotted from the world you can am i saying you can be perfect no of course not am i saying that god by his holy spirit can sanctify you and and make you more and more like him over time as you yield yourself to him and forsake things that take you away from him absolutely and what is the choice that we should make to walk in his ways that's what he has called us to do and so god intends that for us now in verse five he says having predestined us to adoption as sons by jesus christ to himself according to the good pleasure of his will having predestined us to adoption as sons by jesus christ to himself from the very beginning god intended to send jesus to die on the cross for us revelation 13 verse 8 speaks of jesus as the lamb slain from the foundation of the world so god is determined that we would become his children through jesus christ and notice he says in verse five we have become adopted children of god jesus is the only begotten son of god we have been adopted into his family let me share with you a little bit about that as we're about to come to a conclusion we have become adopted children of god according to roman law the person who had been adopted had all the rights of a legitimate son in his new family and completely lost all rights in his old family in the eyes of the law he was a new person so new was he that even all debts and obligations connected with his previous family were abolished as if they had never existed when you were brought into god's family all your debts and obligations the things that you had done wrong and were sinful in have been completely forgiven can you live that way we ought to we ought to don't let me be practical practical about this for just a moment don't give in to your lying heart the heart is deceitful above all things and desperately wicked who can know it if our heart condemns us god is greater than our heart and he knows all things when you gave yourself to christ the blood of jesus christ his son cleanses us from how many sins cleanses us from all sins you mean even the sins that i have yet to commit when jesus died on the cross every one of your sins were still yet future you hadn't even been born yet you hadn't even had opportunity to sin yet when he died on the cross he died for all of your sins when you came to faith in christ the blood of jesus christ cleansed you from every stinking sin you've ever committed every single one and this is where the end amen this is where the enemy rips the body of christ up reminding you of what you've done in the past reminding you of what you've been reminding you of how you were and not only does he do that through your own heart he can do it through family members or friends he can do it by those who knew you at one time who say you haven't changed you're the same way and you can be convinced within yourself yeah i'm lost i'm no good i've never been any different that's a lie that is the biggest lie one of the things that i can tell you was somebody who's walked with the lord now for quite some time is this the devil is a liar but jesus christ will never lie let god be true in every man a liar when god says it it's forever and it's true and when god said you're my son or you're my daughter when god said i completely forgive you that is complete that is it it is finished it's over you're brand new in jesus christ and paul wants the ephesians and and by application we want to know that we too are forgiven we are brand new in jesus christ i'm not what i was i admit what i've done that's how i got saved god forgive me a sinner but i am not that man anymore that man is dead it's like that man is in in a casket and that casket has been closed and it's been placed in the ground and it was buried when i got baptized it's done it's over it's gone i'm brand new in jesus christ and we need to understand that and i remind myself of that i remind myself of that i am not what i used to be i am not a liar i am not a thief i am not profane i'm not an alcoholic i'm not a druggy i'm none of those things i'm a moral man in love with christ and that's what god has done if any man be in christ he's a new creation we need to understand that the church i think has forgotten that in many ways you see we received a new life in christ in romans 8 14 through 16 as many as are led by the spirit of god these are the sons of god you didn't receive the spirit of bondage again to fear you receive the spirit of adoption by whom we cry out abba father the spirit himself bears witnesses with our spirit we are children of god that word abba you go to israel and you will hear the little children saying that to their dads to this day abba the word abba is is his daddy his papa that's what the word means and so when he says we cry out abba that's speaking of a tenderness that we have a relationship with god he's like that gentle loving father perhaps you never had but he's that and as you look to him now he's your daddy he loves you well the blessed fact is when we receive christ now this is powerful we have god's life in our soul his spirit gives life to our spirit we become what scripture calls partakers of the divine nature and second peter one three and four the apostle said his divine power has given us everything we need for a godly life through our knowledge of him who called us by his own glory and goodness through these he has given us his very great and precious promises so that through them you may participate the word participate speaks to being a joint partner you may participate in the divine nature having escaped the corruption in the world caused by evil desires while human parents can adopt a child and love them as their own child but god is imparted to his children his own nature that's what it means to be born again john mccarthur a very orthodox and good teacher said this he said to be saved to be saved is to have the very life of god in our souls alexander mcclaren a great cleric of another time said the very purpose of christianity for which god has sent his son and his son came is that we poor sinful weak limited ignorant creatures as we are maybe lifted up into that solemn and awful elevation and received in our trembling and yet strengthened souls a spark of god that you may be partakers of the divine nature means more than that you may share in the blessings which that nature bestows it means that into us may come the very god himself when you're born again you are born again not a perishable seed but by imperishable the word of god and what happens is you become you you come to life with the very life of god within you you have been given his life within you now that means that we become partakers of what god would have us to be and he dwells within us our nature is transformed you have a new nature and that new nature is from god and so that's what makes us children of god we've been brought into his family through faith in christ washed in cleanse and now his holy spirit dwells within us has given us the new nature that's what it means to be born again that's what it means to be a child of god and now we have his life within us and that is all according to the good pleasure of his will so salvation and its blessings accompanying it is what pleases god and then he goes on in verse six and he says it this way as he closes to the praise of the glory of his grace by which he made us accepted in the beloved the reason that god has saved us is so that in the end it brings glory to him his salvation is of grace and because it is it eliminates all human boasting man cannot save himself so when he is saved the glory goes to the god who saved him 1 Corinthians 1 27 through 29 says god chose the foolish things of the world to shame the wise god chose the weak things of the world to shame the strong god chose the lowly things of this world and the despised things and the things that are not not important to nullify the things that are so that no one may boast before him god salvation is of grace it eliminates all human boasting and we have been saved that we might bring glory to the god who saved us so we are made acceptable by god's grace through Jesus christ by his unmerited favor and that should give us a heart to rejoice and praise him not only on the face of the earth but for all eternity you have been if you've given your heart to christ born again you have become partakers of the divine nature god has made you into his child by faith you received christ and to as many as received him to them gave he the power to become sons of god even into those who believed on his name you gave your heart to christ you have gone through the what is called regeneration this is a heavy book we'll be seeing more of this as we go through but the holy spirit has dwelt within you you have the new nature that has been imparted to you and the blessings that you now have are blessings that god has secured for you through Jesus christ and what we need to learn to do is to walk in those blessings that god has already given to us and when you begin and i begin to just say you know what as a child of god i know the lord has plans for me and right now it may seem like uh like everything's going against but i know in the end that god will have victory so i'm gonna hold fast and learn whatever lesson i need to learn because whatever i go through is conforming me into the image of christ no what no matter what i go through at the end it's going to answer the prayers that i have prayed when i have sincerely said god make me like you so one of the things i've learned to do and i'll close with this thing i'm learning to do and have learned somewhat to do is to give god time to show me what he desires to do instead of being impatient thinking oh you didn't move there for you i don't do that those who wait on the lord renew their strength and so as i wait on the lord i say lord i know that you want to do something i'm going to trust that you will and even though i don't understand the route that you're taking i do know that what the result will be is what i've asked of you i want to be like you and if this makes me more like you then whatever it is may it occur because at the end that's all i want because i am being conformed into the image of jesus christ and if this is the way it's going to happen then praise you jesus that's the way it's going to happen and at the end you look back and you say all this time that i thought i was abandoned or all this time so many times i thought i was alone in fact that was not that was not true at all god was beside me every step of the way he never abandoned me he never left me he never forsook me he was there carrying me half the time and i didn't even know it and that's what happens at the end and i can share that because one scripture teaches that and two i have lived through that and i'm living through that now now the lord is always in charge every step of the way and he always takes you exactly where you wanted to be and sometimes you didn't even know that's where you wanted to be and then you go well this is what i prayed for lord you see one last thing you know when i first got saved i used to say oh lord jesus i want to get married i want to be married oh please bring and so i would pray for a blonde because i like blondes i would pray for blondes when they walked in the room i'd say in jesus name i've claimed that one for me she will make me happy oh lord and god had different plans you know i wanted a blonde and and the lord said i'm going to keep her in the oven a little longer than that and he brought me my marie those who wait on the lord show renew the strength those who wait on the lord god has a way of bringing that what you wanted but didn't know exactly what it was but it's always the right thing you know god has a work he's doing in us guys and i think as we go through this book we're going to begin to open our eyes to some of the wonderful things that he's already done that we just haven't seen yet i'm excited to go through the book of aphesians and we'll pick up next time at verse seven our father we've


High school before Cooper was born music today, isn't it nine days? Yeah Okay, thank you Okay, we have the Are they already Is our need to be built they need to be built so those two meter sections are going to be built


My name is Cecilia Vicuña, I am an Andean animal, I come from the Andes, and my medium is the place where art and poetry find a way to expand into the limitless. If you ask me where I draw inspiration from, from life and death, mostly from the notion that death is always near us and is a freeing force that gives life its pulse. So most of my work tends to disappear or speaks about disappearance as a source of joy, renown and transformation. My mother says that even before I could speak, I was already making art. So something in me knew that there exists something called the pen, the pencil, the brush and instinctively needed to go there and speak while this gesture that is really like a continuation of the energy of your body, the continuation of the energy of your soul into whatever medium. So for me there isn't one medium, but all mediums are available. The main creative ritual that I know of, all the rituals of the body are something so incredibly beautiful. In New York there is a sort of boundless energy from the unfulfilled desires of millions of immigrants that have been coming here for perhaps two centuries or more. This bubbling energy that you feel here can be very oppressive if it becomes pressure, but at the same time it can be something that soothes you into becoming yourself because how else are you going to be able to say something when there are 20 million people trying to say something? I have loved the Brooklyn Museum since I first came to New York in 1980 and its pre-Columbian collection is one of the treasures of the world. So I hope this installation of mine not only brings attention to the immensity of this textile tradition that people say is the most complex achievement in terms of textile anywhere in the world. And that has been really forgotten and overlooked. In most museums that do have a pre-Columbian collection, that room is usually empty. Most people ignore or have no idea of the richness of that universe. I hope my disappeared people shows people that there is a universe about to be discovered.


So, I am Elise. I often go by Elise Zero Two online. The talk I'm holding today is on breaking the black box security coprocessor inside of the Nintendo Switch. So a small bit about me. I am a security researcher with a strong interest in Nintendo consoles. Back between 2018 and 2019, I used to maintain one of the largest FOS custom firmware solutions of the Nintendo Switch. In this talk, I will be presenting my research of the almost black box security coprocessor present on the Tigra X1. Our end goal by the end of the presentation is to be able to sign code to run at the highest security level offered by the coprocessor. We will do this by building up an exploit chain around a vulnerability in the authentication realm that was discovered by others. I started my research before this vulnerability was known, but it is what we will build up to being able to exploit in this talk. Before we start though, I would just quickly like to remind everyone watching to stay hydrated as it's incredibly important. So, the Tigra X1. The Tigra X1 is an SOC produced by Nvidia. It's used in a wide range of applications. Back in 2018, an exploit that I assume a lot of you have heard of, known as Fousage, a layer was published. It affected the USB stack in the boot room and allowed for us to gain arbitrary code execution on the boot processor, which at the time completely broke the boot chain security model. This led to custom firmware being developed relatively fast and Nintendo being Nintendo. Nintendo don't like custom firmware. So, in November 2018, they attempted to regain control of the boot chain by utilising the security coprocessor to set control again. So, what is the Tigra security coprocessor or the TSEC from here on once? The TSEC is a security coprocessor found in a lot of Nvidia hardware. But the Tigra X1 is what interests me because of my interest in Nintendo consoles. It's a Falcon V5 microprocessor with a cryptographic coprocessor built in. Nvidia basically just took a design they already had and decided to slap a crypto coprocessor on the chip for security. We can assemble and disassemble firmware for the Falcon V5 microprocessor thanks to work already done by the Envy Tools team because the architecture is shared across quite a few Nvidia devices. The TSEC has its own memory space, split into data and instruction memory. The instruction memory is 0x8000 bytes long whereas the data memory is only 0x4000 bytes long. There are also three security states that execution can happen under. No secure, which is the default, low secure and heavy secure. Now we will look at the details of the cryptographic coprocessor inside the TSEC a bit closer. It has 828-bit crypto registers. It has 64128-bit hardware secrets. There's a DMA controller which can be used with an override to lead or write to crypto registers. Hardware secrets have an access control level and crypto registers also have an access control level. However, the crypto register of access control level changes based on instructions. Typically the output register from a crypto instruction, the permissions for that register will be made from a bit twice and of the ACL of operand one and operand two. So the minimum amount of availability between the two operands. There is also a hardware 128-bit AES implementation. So more in the security modes. As I did mention, the TSEC has three security modes. No secure, low secure, which is relevant to us as it is centred from heavy secure mode and finally heavy secure. So no secure mode. This is the mode that the TSEC enters after initialisation. Firmware run in this mode is unsigned. You can load any firmware blob in is no secure and just run it. None of the hardware secrets are readable. However, you are able to load any hardware secret into the crypto registers. But as I said, the crypto register will inherit the access control level from the hardware secret and you won't be able to use the crypto register from no secure anymore. You are intended to initialise context to enter a signed heavy secure firmware blob from no secure. So heavy secure. For heavy secure mode, as I said, the firmware must be signed. The memory pages for the heavy secure blob must be marked as secure. If you enter a heavy secure firmware blob, it will always result in execution starting from right at the start of the authenticated pages. You could jump 200 bytes into the authenticated blob, but you will still actually start execution at the start of the page. You can perform crypto operations with some of the hardware secrets. Upon entering heavy secure, you need to go through the auth rom. This is done by jumping into pages marked as secure, which triggers the authentication rom via secure faults. That results in the authentication rom, which is in silica and taking over control. Our end goal is to gain arbitrary code execution in this heavy secure mode. As I mentioned, there were attributes on instruction memory pages such as them being marked as secret. You are able to mark pages as secret by writing to the TLB. However, you cannot mark pages as authenticated. Only the authentication rom can mark pages as authenticated. Entering a new group of pages marked as secret will trigger a secret fault, as I mentioned. If the auth rom succeeds, the pages marked as secret will also then gain the authentication flag. They keep the authentication flag until execution falls outside of the range of authenticated pages. If you attempt to read memory from the pages marked as secret, it will return the constant OX dead 5 EC1. Prior to firmware update 6.2.0, Nintendo's firmware for the T-sec ran during the bootloader consisted of only three stages. Boot, keygenloader and keygen. Both keygenloader and keygen are signed and execute in heavy secure mode, whereas boot executes in non-secure mode and sets up the context. Keygen is encrypted using a key seeded by a hardware secret. The key is generated and the blob decrypted by keygenloader. Keygenloader is signed but unencrypted. It's not very interesting at all. It calculates a CMAC over the boot payload to verify integrity. It optionally decrypts keygen and then optionally runs keygen. So, as I mentioned, keygenloader attempts to calculate a CMAC over the boot blob. It expects the boot blob to always be at the base of instruction memory, so zero, because this is how Nintendo have it. They load their firmware rights at the base of instruction memory and they assume their boot blob will always be at the base of instruction memory. The size and expected CMAC come from an unsigned metadata structure, which is positioned right behind the boot blob in the combined firmware blob. Can we bypass this check somehow? Actually yes, trivially and in multiple ways. The simplest one and my favourite one to do is to control the entry point for the TSEC. You can set the entry vector to wherever you want in instruction memory and the TSEC will begin execution from there after a reset. Nintendo assume that the TSEC will always start from zero at a reset. So, when they verify their boot payload, they verify it from the base of instruction memory, but the TSEC doesn't have to start executing at the base of instruction memory. Thus we can just append our own boot blob to the end of Nvidia's firmware blob, set the entry vector to that address and suddenly we've bypassed this check completely. This brings our vulnerability counter up to one. Next we will look at a stag smash inside of keygen loader. Up there is the function signature I made for the keygen blob. This is what it would look like in Pseudo CE. So, to validate the boot blob it will copy the boot blob from the base of instruction memory, as I said, to the base of data memory. The size of the boot blob comes from the metadata structure passed as an argument to the boot blob, passed as an argument to keygen loader by the boot blob. The structure is completely unsigned and just trusted, not checked in any way. We can control starting stack pointer two making this slightly cleaner. We can smash the stack vulnerability counter two. This is why you should always make sure to keep your mem copy sizes validated. So, building up a rub from that stag smash, I will explain how I did that. I appended my rub chain to the end of the contaminated firmware blob that I made. I patched the size of the boot blob in the metadata structure to be the total size of the contaminated firmware blob. I then calculated a starting stack pointer that would overlap with why the rub chain is at the end of the combined firmware blob. Now we have gained rub inside of keygen loader. Now we will use the rub to be able to get the key to decrypt the keygen blob. So, to obtain the key for decrypting keygen, we need to do four main things. First, we need to call a function to generate the encryption key. It leaves the key in crypto register one. It requires register 10, which is the first argument to be one. It also requires register 11, which is the second argument to be none zero. For the second step, we will call a function to be the key from crypto register one and write it to data memory. This function requires that the first argument be one and the second to be 16 byte aligned. The third step is to bring the t-sec out of lockdown and then finally we want to return to our success handler. So, our rub chain looks something like this. I hope it's readable from there. The first address is a gadget that sets register 10 to one and then returns. The second address is the function to generate the key. It also leaves a 10, 30x10 aligned pointer in register 11, thankfully. The third address is the same as the first. It sets register 10 to one and returns. The fourth address is a gadget that will write the crypto register to data memory. The fifth address is the exit handler for keygenloader. This one is very important because the t-sec is in lockdown. We're not able to read any of the memory from the boot processor. It will just return that constant to x, d, e, a, d, 5, e, c, 1 value. So, we have to exit lockdown. The sixth and final address is the success handler in our one secure boot payload. If we run this, we can then read the decryption key from DEMEM via DMA from the boot processor. The keygen blob is ASCBC encrypted and we can now just decrypt and analyse it. That's quite obviously not the key. That's the Blake 3 hash of the key needed to decrypt the keygen blob. So, now we have a decrypted keygen. We can explore it a bit. On the right up there is my PseudoC function signature and just an overview of what it does, like initialisation. It takes a 16 byte key seed and an unsigned 32 bit integer key version. It then calls a function to generate a key, passing both the key seed and the key version as arguments. After this, it clears the active signature and all crypto registers. Looking closer at what the function that generates the desired key does, we can see if there's anything interesting in there. Right at the top, it checks the host1x register for a magic value that's written by the bootloader. This is completely irrelevant but that value does have to be written by the bootloader for it to work. Then it will load the provided key seed into crypto register 0 and then optionally run one of the two present key generation algorithms depending on your specified key version. Both algorithms will write the result back to the key seed pointer that you give as an argument to keygen. Remember that. Finally, it will always write whatever is at the key seed pointer to the for SO1 MMI registers. If the keygen algorithm was run, then it will be the output of the keygen algorithm, otherwise it will just be the input key seed. Now, something here might be standing out to some of you already who were seeing the thing that I said before. The key generation algorithm writes the result to the seed pointer that we provided. We give that seed pointer to the keygen algorithm for it. There is zero validation done on this address. It's just an address passed and it will use it for the input seed and then it will write the result back to it. If we can control enough of the output of one of the algorithms, we could potentially smash the stack by pointing the input seed to overlap with the return address from the function on the stack for the function that calls the generate keys. Key version 2's algorithm is significantly smaller and it also only uses Hardware Secret 0, which is readable from heavy secure mode, compared to the other key generation algorithm which uses Hardware Secret 0x3f, which is not readable. If we can obtain Hardware Secret 0, we could theoretically control the outputs of the key generation algorithm and get the key generation algorithm to give us whatever we want as the output. This increases our vulnerability counter from 2 to 3. To obtain readable Hardware Secrets, the optimal setup would be a signed firmware that doesn't overwrite a crypto register before we're able to gain Rop and also has a gadget for then writing that crypto register to memory. Thankfully, exactly that is provided on an HDCP firmware for the shield that Nvidia left in is a debug thing in one of their firmware builds. Thanks Nvidia. This increases our vulnerability counter to 4. So, that blob, it starts with a return instruction. As I said earlier on, with heavy secure payloads, if you jump into them, it always will start your execution from the start of that heavy secure payload. You can't jump past that first return instruction. Well, you can, but it will push you back there anyways. The pages do not lose their authentication status until the program counter actually points outside of the page range for as long as the program counter stays inside of an authenticated blob, then that blob stays authenticated. As I said earlier on, Nvidia took something that was not meant for security and slapped a security coprocessor on top of it. We can see this here. You can branch without linking into heavy secure blobs. To those of you who don't know what branching without linking is, typically when you call a function, your return address gets pushed to the stack and then when that function returns, the address is popped from the stack and that address is where the code execution will continue from. If you branch without linking, your return address is never pushed to the stack because it's not treated as a function call or it's just treated as branching in the code, and you're allowed to branch without linking into heavy secure blobs. So, push a rob chain onto the stack, branch without linking to the payload, gain rob as soon as the blob returns. The blob starts with a return instruction. We have Rob inside of this blob right from the beginning before anything else is done. Again, thank you Nvidia. But yeah, as this works for all heavy secure blobs, this is a hardware vulnerability. This cannot be fixed without a new revision. There is a new revision, but not in any of the switches. It's in a completely different tech rep. To mitigate this, most heavy secure blobs will clear crypto registers and the active signature before returning, rendering this in most cases fairly useless. But still, this increases the vulnerability counter up to five and being the first hardware vulnerability of those five. So, obtaining readable hardware secrets. Now we have a rob chain that will write the secret into DMM for us to read out. You can see it on the right. It's fact five assembly, but it should be fairly easy to understand with the comments. So, we have one more problem there. If we run this, the hardware secrets will get written into the data memory, but the t-sec will still be in lockdown and this firmware blob contains no gadget that's easily usable to exit lockdown. So, if we want to exfiltrate those keys from memory, we need to exit lockdown somehow. One more solution, keygenloader. So, keygenloader, as I mentioned earlier, will bring the t-sec out of lockdown at the end. However, keygenloader brings the t-sec out of lockdown no matter if keygenloader was successful and running or not. Always when keygenloader exits, it will exit lockdown. So, we can just load in the keygenloader payload right afterwards, call it with values that prevent it from decrypting or running keygen. It won't do any keygenloading. It will just behave nicely for me and bring the t-sec out of lockdown. This brings our vulnerability counter out to six. And here are all of the Blake 3 hashes for the readable hardware secrets. There's a lot of things that can be done with these secrets. These are obviously not the secrets, they're the hashes. And now, back to keygen. We have hardware secrets zero now. Again, thank you Nvidia. We could reimplement this algorithm for the key version 2 and attempt to brute force a seed that fulfills our output parameters. So, to create a valid seed, we cannot control the first four bytes of the seed. It is always the return address for whether gen key functions is called inside of keygen. The first four bytes of the output will be used is the first address in our rock chain. Our rock gadgets will discard the middle eight bytes. However, the final four bytes are actually used in a gadget. So, our requirements for the seed. The first four bytes of the seed will be the return address for our rock chain. Our first rock chain entry will be 0x940. Luckily for us, the address bus is only 16 bits wide. If the address bus had the full 32 bit, which it would have been a whole bunch harder to calculate a valid seed, but because the address bus is only 16 bits wide, we only have to match the low 16 bits of the first four bytes in our seed to get a working rock chain because the address will be decoded as the low 16 bytes, no matter what's in the high 16 bytes. The final four bytes will be used as the parameter for a gadget, as I mentioned. It requires that the lower four bits be 0. Bits 16, 17 and 18 represent a three-bit register selection, and we want crypto register 1, so bit 16 must be 1 and bit 17 and 18 must be 0. So, calculating a valid seed. We can now attempt to find a valid seed now that we know our output requirements. My very, very, very unoptimised algorithm takes about 10 seconds to find a valid seed. With the seed, we can completely control the output of the key generation algorithm, and with the seed pointing at where the top of the stack will be when the generate key function is called, we now have rock inside of key gen. So, exploiting key gen. Key gen doesn't clear crypto registers when it gets called. I don't know why? Do the Nintendo developers know why? Probably not. There is a gadget for using the seasigank instruction with crypto register 1 as the key. Crypto register 1 is not polluted when we obtain rocks, so any value we load into crypto register 1 before getting rock inside of key gen that value will persist in crypto register 1 when we finally have execution. We can use this gadget to generate a signing key. So, the sigank instruction. It's a bit of a strange instruction, so let's take a close look. It takes two arguments, an output crypto register and an input key crypto register. Unlike the regular AAS instructions inside of the t-sec, seasigank doesn't derive the access control level for the output register from the input register. It is always just a constant that allows you to read it from heavy secure mode no matter what the input ACL was. With this, we can encrypt the active signature using non-readable hardware secrets and still read the output of the operation. So, the hardware secrets that I was not able to extract because they're not readable in heavy secure mode, we can utilise those here a bit. So now, the topic of fake signing keys. I would like to preface this slide by stating I did not find this vulnerability. It is publicly disclosed on switch rule already and credited to the list of beings on the screen. Cluto, Hexkey, Shuffle 2, Sias M and Mode Sazer independently. Got that from the wiki, so just trusting it. So, when authenticating pages, you provide both a 16-byte signature and a 16-byte seed. In every single Nvidia signed heavy secure blob, this seed is just 16 null bytes. The authorom does not validate the seed at all. You can pass whatever seed in you want and if the seed works with the key, it's okay. Using Hardware Secret 1, because Hardware Secret 1 is the hardware secret that the authorom uses for its operations, we can use that as the key for the C-sigank instruction, which will encrypt the current active signature using Hardware Secret 1. Hardware Secret 1 is what is used in the authorom, as I said.  Using Hardware Secret 1 as the key for C-sigank will give you a fake signing key. You set the seed to the signature of the firmware where C-sigank was executed. So, in our case, the signature to KeyGen, that is the seed and then using that fake signing key, which we have obtained, we can sign and run any code in heavy secure mode and have full access to it in every way that this is the highest level of execution you can get on this security coprocessor. So, we have ROP inside of KeyGen. We want to build up a ROP chain that will allow us to obtain that fake signing key. First, we will load Hardware Secret 1 into Crypto Register 1, then we will move the stack to a location where we can overlap it with the key seed, we push the success handler onto the stack, then we push the values of the two registers that later get popped from the stack by a gadget, we push our C-sigank gadget to the stack, we push another value that will later be popped from the stack to a register, and then we move the current stack pointer into a register as it will later be read from that register in a gadget. We place the controllable parts of the seed in three separate registers that the KeyGen blob will store on the stack for us nicely when initialising itself, thank you Nintendo, and that will nicely assemble our seed for us. We finally set up the calling arguments for the key seed that will live on the stack, and the key type 2 to run the KeyGen algorithm that we want, and then we just call KeyGen normally. Here you can see what the assembly for all of those previous steps looked like, it's commented. We load the C-secret1 into the crypto register 1, and then set up the rock chain. I will talk now please so you can hear me from here, but this is our seed that we're using here. We have a lot of excess room in the seed for brute forcing, so I'd like to make two parts of my seed's magic values. With that, we now have a fake signing key stored in the SOAR1 MMIO registers that we can read from the boot processor. Implementing the signature validation algorithm in Rust allows us to sign firmware blobs. This is a screenshot of my tool that I wrote to sign firmware blobs to run in heavy secure. The blanked out parts are the fake signing key and the seed, which would be the signature for the KeyGen blob. In conclusion, I discovered and presented six vulnerabilities today for the exploit chain, with one of them being a hardware design flaw that can't be fixed. This impacts boot chain security, general security, DRM, such as HDCP and Widevine, for all devices that use this version of the T-sec. All of the code is available on GitLab under the link displayed on the slide down there, and it obviously contains no secrets or firmwares for legal reasons, as those are not my property, they belong to Nintendo. However, the key seed that I generated from the hardware secrets does not belong to Nintendo, so there's enough stuff on there for you to go generate a fake signing key yourself in a matter of minutes if you want to. Thank you for being here for this talk today. Again, I would like to remind everyone to stay hydrated as it's very warm and important. If anyone has any questions, I'm willing to take them, but there's a bit of a balance of questions I will and will not answer, because I'm treading legal ground here. First, one question from my side. Who wants to use Nintendo Switch now in the future? Have you any questions? Hi. Can you hear me? Thanks for the talk. I have a question about the verification part. I think it was the key-gen loader part where the verification starts at the address zero or the base address. What I didn't quite get is why the verification stops at some point, because you mentioned that you load your code somewhere into a higher address and the verification starts at the zero or the base address. And why the verification would stop at some point and would not consider your own code to verify? Because they're trying to backwards verify their boot blob, which is unsigned. They're validating just the boot blob to make sure that the unsigned boot blob was not tampered with. They're doing it from a heavy secure payload so that they're trying to make sure that their boot chain wasn't compromised. And it knows the size of the boot payload from the metadata table. So it just dismantles a mem copy and then checks that. It's a fixed size, right? It's a size in a metadata table, yes. Okay, awesome. Thank you. More questions? I don't know. Yeah, hi. Also thanks for the talk. This is more a general question. When you're looking for gadgets in some firmware blob for ROP, do you do this with tool support or do you write your own scripts or can you elaborate a bit on this? Thanks. I didn't quite understand that. Sorry. So when you're looking for gadgets in firmware blobs, how do you do this typically? Completely manually. I've spent probably thousands of hours on this research. It's a custom architecture so there's no tooling for finding gadgets. And the gadgets I need are fairly unique so all of the gadget hunting was done by Paul. Wow, I think this requires another applause. Yes, more questions? I don't see them. So maybe you have some questions and more privacy later on. So maybe you are available. If anyone wants to ask me something afterwards, I'm more than happy to do so and I can discuss more outside of this room than I can inside of this room. Thank you, Elise.