A warm welcome to all, and especially to Marius, who will now talk about the Avatar 2 reverse engineering framework for firmware. Thank you. All right. Thanks for the introduction. As stated, I'm Marius and I'm here today to talk about Avatar 2. I develop it as part of my PhD studies over at Urocom, and if I say Avatar, I don't refer to a movie by James Cameron or a metal band note, I refer to the actual Avatar 2 framework. Let's see how I try to communicate with you about the framework. So first, I want to tell you a little bit about binary firmware analysis in general. Want shortly to discuss the tooling landscape to see what other people have done and are doing. Then I actually introduce the high-level concepts of the Avatar 2 framework itself, and in the end, I'm going to give you a couple of examples to show how the tool can be used and is used by us in fact. So let's start. Binary firmware analyzers. Why are we interested in analyzing firmware of embedded devices? Well, as we know, the amount of embedded devices is steadily increasing day-by-day, buzzwords like Internet of Things and so on around. In the end, these are just interconnected embedded devices. Misconfigurations, bugs and vulnerabilities are common on those devices, and I would say that a majority of the reported wounds we find so far on those devices are mainly misconfigurations on low-hanging fruits like disclosed private SSH keys, misconfiguration in the web server, or just simple bugs in the web server itself. However, we hope that in the future someone is going to change and vendors may be secure their software more, and then we need to actually hunt for more complex bugs, which are also still in there in firmware. However, when we want to find more complex bugs, we need more sophisticated tooling to succeed. Of course, we can sit down and reverse engineer a long time, but at some point in time, tooling will greatly benefit us. However, they are especially compared to desktop systems and a lot of challenges present for firmware analyzers. Most of all, there are a variety of platforms, a variety of different boards, system on ships, which all comes with their own memory layout and their own hardware peripherals, which may be mapped at certain addresses and may behave completely different on other devices. Furthermore, there's often no operating system level abstraction. Some of the firmware is based on Linux, however, there's also a lot of monolithic firmware around which just use non-kernel at all or have some small, tiny kernel-firm-bedded systems. In both cases, the hardware interactions will be embedded in the firmware code itself and not as part of the kernel. This forms actually a problem because when the firmware access hardware, it might be we are memory mapped in port output or it might receive interrupts from the hardware, for instance, when new data is available on a bus, we need to somehow fetch it in our analyzers and our tooling. On top of that, there are just a variety of architectures, like not only a lot of platforms but also a lot of windows and architectures are around. We have on desktop systems, mainly x86 and x8664 around. On embedded devices, we can have all the different architectures from ARM, MIPS, PowerPC, even sometimes Spark. And just to give you one example, please don't attempt to read the next slide. This is just a list of the microarchitectures defined by ARM. And this is just ARM itself, not the third-party windows for ARM, which are making system on chips. These are around 30 different microarchitectures, all with tiny differences in the architecture, which is quite challenging to grasp in a generic tool. And there are even more challenges, which we are facing in comparison to desktop systems. Binary analyzers on desktop systems normally greatly use this instrumentation. So it instruments the software under test or under analyzers to add certain hook or address sanitizer, for instance, checks during runtime that everything is going fine. And on embedded devices, this is challenging due to two reasons. Once again, the missing abstraction of the operating system. And furthermore, quite often, the code only restyles inside the read-only memory of an embedded device. So what does this mean, read-only memory? We will need to flash it to change its contents. However, then on the other side, firmware might be encrypted or signed by the Wendor. So instrumentation is harder than on desktop system. Likewise, emulation is challenging. While on modern desktop systems, all hardware interactions is handled by the kernel, which can be easily abstracted by an emulator, we don't have this comprehensive possibilities for embedded devices. The reason for that is that there are a lot of peripherals around which interact differently with the hardware. And as a result, being able to emulate all of the underlying hardware of the embedded device is a lot of implementation effort. Likewise, fault detection. When we, for instance, fast test desktop systems, we most of the times rely on observable crashes, like segmentation faults or error handling of the gelepsy for heap corruptions and so on. So we get a physical output or we got a noticeable output when we corrupt memory. On firmware, this is different. Firstly, even Linux-based embedded devices are not, or most of the times are not utilizing gelepsy. So heap protections are way smaller, if present at all, and some devices may not even contain about the memory management unit, which at the first place enables the notion of sack faults or invalid memory accesses. So in this case, the firmware might just continue to execute it, also we corrupted the state of the program. Another big issue is interrupt handling, because a lot of firmware is basically designed in a way that it runs continuously inside a single main loop and just checks memory contents. Those memory contents are updated by interrupts handlers and will derive the execution path of the main loop once triggered. If we go with static analyzers, we will need to define where those interrupts are triggered. Furthermore, as we saw before, there are a lot of different microarchitectures around, and microarchitectures have a lot of small, tiny changes and single instructions only present to this microarchitecture. I mean, for instance, coprocessor accesses on ARM cores are varying from core to core, or from microarchitecture to microarchitecture. So this showed a little bit the challenges we have in the field of dynamic firmware analyzers. Let's look at the tooling landscape. Compared to desktop systems, the tooling landscape is, due to the challenges, way smaller, and especially smaller when only considering open-source tools. Furthermore, while a lot of static analyzer systems for desktop systems exist, they may exceed their bounds when being applied to embedded firmware, because they need to approximate the environment, which is not always possible in the embedded case, and it is also possible to infer the behavior of peripherals and interrupts. In the following, I will show you four open-source tools which are aiming to analyze firmware. So obviously, this is not a comprehensive list, but gives a glimpse of what has been done and what kind of different approaches are out there. So let's start with PHY. PHY is a symbolic execution engine for MSP430 firmware, which is based on CLI. So CLI is the main symbolic execution framework here, which basically operates on the LLVM immediate representation. In order to have PHY working, the analyst needs to specify explicit analyzers, memory and interrupt specifications. The analyzer specification hereby defines, among others, the memory layout of the firmware under analyzers. Furthermore, the memory specification specifies how memory should react when it's read-to, read-from, and write-to. So this is basically a way to abstract memory mapped IO, so that when particular memory cells are accessed, symbolic values or specific concrete values can be injected into the analyzers. The interrupt specification is, well, defining at which points interrupts Kultukur and which interrupt handler should be executed. While this is a great work which doesn't need any presence of a physical device and Kult successfully analyzed quite some MSP430 firmware, it required the presence of the source code of the firmware because that's basically the way how CLI works. So unfortunately, source code is not that often available when we are analyzing firmware. So let's have a look at binary analyzers tools. First there is Firmadine, which is a binary analyzers framework based on QIMU, a popular full system emulator, which also enables user-space emulation of single processes. However, in this context, QIMU is used as full system emulator and brings a lot of architecture which can be emulated and additionally a lot of hardware boards or hardware layouts. Firmadine targets ARM and MIPS firmware in specifically and uses an instrumented Linux kernel. So basically it takes the extracted Linux-based firmware, puts it inside the QIMU emulator and runs it with their own implemented kernel. This kernel allows automated analyzers or allows plugins for auto-analysers of webpages and secure network monitor or protocol implementations. Additionally, interesting is that this framework has capabilities to automatically throw known exploits, mainly known from Metasploit against the emulated firmware and quite interestingly, a lot of exploits found on one devices can be propagated to other devices, which basically means that there is also a huge code base shared among different kind of embedded devices, at least in the Linux-based world. Yeah, unfortunately, the downside here is that it's only worked for Linux-based firmware and only if there's not two specific kernel modules around because if the embedded device needs to do hardware interactions, this will move to specific hardware peripherals, this will most likely be done via specific kernel modules and if they can't be emulated, Firmadine fails to succeed. Another interesting project which was released this year is Luakimu, which is as the name suggests also based on Qimu. It is considered as work in progress and the example released together with the tool was targeting a BCM4358 chip firmware. So these chips are Wi-Fi chips used, for instance, in a lot of smartphones. They're enabling Luakimu the prototyping of custom hardware platforms or boards in Qimu Jagong with Luakimu and also add instrumentation capabilities based on Luakimu for different events inside Qimu. Unfortunately, as this only emulates the firmware alone and there's a lot of hardware interaction going on, especially during initialization function, this requires either a lot of modeling or trial and error to prune out execution paths which are not relevant for the analyzers or for the analyst. So the last tool I want to talk about is Avatar, the first one. So as some of you may have talked, if I'm talking about Avatar 2, there must have been a first Avatar. And this tool was based on S2E, which basically is again a combination of Qimu and Klee, which allows symbolic execution from Qimu emulated firmware. Additionally, Avatar utilizes open-mode CD and GDB and allows partial emulation of ARM firmware. So with partial emulation, it basically means that the firmware itself or parts of the firmware itself are run on the board, inside the emulator, and specific hardware requests like memory mapped IO are forwarded to the actual physical device via the connection of open-mode CD and GDB. Additionally, Avatar provided ways for orchestration so that you can, for instance, start executing on the device, then transfer the important states, so the important memory layouts and the registers inside the emulator and continue execution inside the emulator or inside S2E. This allows basically to skip all the initialization function of a board which are not interested for analyzers. Additionally, and quite obviously, as S2E is using Klee, it also brings symbolic execution and selective symbolic execution for firmware. Unfortunately, Avatar 1 was heavily tied to the S2E infrastructure and it requires in every setup the presence of the physical device to succeed with the partial emulation. So what did we learn from looking at those four tools? First of all, there's a lot of focus on the ARM architecture. Then really, the majority of tools are utilizing Kimu's emulation capabilities as a basic block for building up their framework. Unfortunately, the resulting frameworks are then heavily bound to Kimu, so they don't see any ways or don't define any ways to get the analyzer state of the emulator into another tool. This missing way of transferring states of analyzers is at the same time a little bit the motivation of the Avatar 2 framework. So in a very big picture, it's a framework for dynamic multi-target orchestration and instrumentation. We will see what this means with live demos later on. The focus of Avatar is on firmware analyzers and the full thing is an open source and Python-based framework, which we released in June this year, so it's quite new and it's a research project. So we try to have a clean and usable code base, but sometimes some things may be a bit fragile. In comparison to Avatar 1, Avatar 2 was redesigned and re-implemented from scratch to especially focus on better usability and a better abstraction of targets. It is developed by the software and system security group at Eurocom, specifically next to me, the main developer, Darionizi, Aurelian Francion and Davide Balzerotti. The main goals when we designed and started to write Avatar were to have the possibilities of target orchestration, separation of execution and memory, and state transfer and synchronization capabilities. Target orchestration means that we orchestrate different kind of frameworks with abstractions inside Python. Those targets could be anything, debuggers, emulators, other frameworks, and we easily want to be able to add new targets to the Avatar 2 ecosystem. Furthermore, we want a clean separation between execution and memory because this is basically the core concept or the main requirement to allow IO forwarding or remove memory, so that the analyzer runs inside one target and operates with memory of another target. Furthermore, state transfer and synchronization is important to us because once we are starting the analyzers in one specific target, we don't want to keep the analyzers local to that target. We may be or may want at a later point in time to switch the execution, for instance, from an embedded device to an emulator. And for doing so, we need easy ways to transfer the state. So we came up in the end with a framework which basically consists of four components, the Avatar 2 core, which is a Python library and is the main interface from the analyst to the analyzers. Inside the framework, there are the so-called targets, which are the Python abstractions of so-called endpoints. Endpoints hereby are all the things you want to have as endpoints, so emulators, frameworks, debuggers. However, targets and endpoints are not talking directly to each other. They are disconnected by an additional layer of so-called protocols, which we can also see here in this picture, where we have the Avatar 2 core at the top which defines and orchestrates a set of targets, which all talk via execution protocol, memory protocol and register protocol to the distinct endpoints. So the question is, why did we add the abstraction for protocols? The idea is quite simple. A lot of tools actually have similar ways to communicate. For instance, both KeyMode and OpenMode CD offer a GDB server to talk to the analyzers framework or to the software under analyzers. And by separating the protocols into purposes, like execution or memory, we allow the clean separation of those different concepts during the execution. Oops. So let's move on to the implemented targets, which could also be a small quiz of no-yo-open-source methods. On the top left, we have the ARCAFIDGE, which is actually the mascot of GDB, which is quite interesting because this fissures users to spit water from under the water surface above and shoot at single bucks and put them down. So I think it's a quite matching mascot for GDB. On the bottom left, we have QEMO, which is the full system emulator that we just talked about a little bit more. On the top right, there's the PANDA framework, which is a reverse engineering framework based on QEMO and aims to allow repeatable reverse engineering. It does so by basically recording all the non-deterministic IOs occurring to the software under emulation and then later on those non-deterministic IOs can just replay to the very same software from the same initialization state, which will result into the same execution. The advantage of doing so is that the resulting memory footprint of a record is way smaller than an instruction or memory trace. Additionally, PANDA allows a plug-in system which allows to hook different functions or different events inside QEMO to add foreign analyzers. The last tool on the slide is the ANGER framework, which is as of now still under development and will be made public or will be merged into the public branch soonish. And ANGER is basically a symbolic execution framework which provides quite powerful symbolic execution engines. Capabilities, sorry. Oh, one thing I forgot. We also support a fifth target, which is not represented on this slide, which is OpenOCD tool to talk to JTAG interfaces, which then in turn can talk via the JTAG protocol to embedded devices. So just a little bit of background knowledge. JTAG is debugging port present on some embedded devices. And if it is available, we can use OpenOCD to dynamically debug firmware on the target device. As we've seen before, a lot of tools are based on QEMO. So if we want to have them easily integrated into the avatar ecosystem, we need to have our changes more or less locally. That's what we did. So we changed QEMO a little bit to work with avatar and to forward the state and memory and so on. And all of the changes are located in one single subfolder, which will make it straightforward to implement new QEMO-based targets for avatar 2. More specifically, the changes which we did, or the most notable, is the addition of a configurable machine, which is similar to the Lua-based port description present in Lua QEMO. But hereby, the configuration of the hardware we want to emulate is defined in a JSON file, which is automatically generated by avatar 2 based on the specifications the analysts did in Python. And it allows, in general, a flexible configuration of the different hardware you may want to emulate. Additionally, we added a new peripheral, the avatar peripheral, which communicates with avatar 2 via Pothix message queues and basically allows the removed memory from inside QEMO. So the idea is that if QEMO or if there is a peripheral with memory map.io, which you can emulate, you will use the avatar peripheral, which will then forward all memory reads and writes to the avatar 2 framework, which will then dispatch it, for instance, to the physical device. A couple of other features I want to highlight about the framework is that we aim to design it architecture-independent. This basically means that we have a subfolder inside the framework which just deals with architecture abstractions, so that the framework can work with those architecture abstractions local to any analyzers. As of now, we have abstractions for ARM x86 and x8664, and we are currently developing another one for MIPS. Avatar 2 uses an internal memory layout representation, so just the layout, not the memory contents itself, in order to be able to push it to different targets or to configure the JSON file needed for the QEMO configurable machine. Furthermore, avatar allows modeling of peripheral reads directly in Python, so you can move on and script your peripheral directly in Python if you know how it has to behave or if you just want to have something which statically returns the same values because you don't care about the specific peripheral. Additionally, we want to keep the avatar 2 core as small and maintainable as possible, but on the other side, there are a lot of tasks which have to be repeated during an analyzer. For instance, we frequently want to assemble or disassemble instructions, so in order to enable it, we added a flexible plugin systems which also has already a couple of example plugins, for instance, an orchestration plugin which automatically orchestrates the execution of targets. In the normal way, you would write an avatar script you explicitly define when you do what, while in the orchestration setting, you would just define a set of transitions and avatar 2 will automatically change the state around according to your defined transitions. Likewise, there's an instruction forwarder which basically aims to deal with those unemulated instructions, so small micro-architecture-dependent instructions. So once avatar encounters one of those instructions, it will not execute it inside emulator, but on the embedded device, so that the state changes at least there accordingly. So after this kind of high-level talking about the framework, let's go directly to the examples. I will in the following show two use cases, how to use avatar as a dynamic instrumentation framework and three how to use it as a dynamic orchestration framework. So if you want to write an avatar script, you normally need to do three or four things. First, you need to create the main avatar object, then you need to define the set of targets you want to deal with in your analyzers. Optionally, if required, if you have more than one target or a chemo-based target, you need to define a memory layout. And last but not least, you need to specify an execution plan. So let's start with a simple demo, which basically is a demonstration for Hello World. So we have here on the left, I hope the font is big enough for everyone to read it. An execute table file, A.out, and a Python script, HelloWorld.py, which we see here also on the right. So if we execute A.out, basically nothing happens, it just exits with the error code 42. On the right side, we have our full analyzers, well, analyzers and instrumentation on one side. So at step zero, we create the avatar object and define the architecture for this analyzers. We add the concrete target, which is in this case a GDB target. Then we not only add the target, but open as a sub-processor the endpoint, the GDB server where our avatar target connects to in the end, which is basically just executing this A.out file. We initialize the GDB target, which will connect to the GDB server and thus all the initialization functions. Down here, we have some shellcode, which we want to inject into the target. This shellcode is basically just a shellcode for a simple, yeah, HelloWorld output on STD.out. So it basically just does syscall write HelloWorld. Here is the interesting part of the framework. We instrument GDB from the outside. We advise to write memory at the current location of the instruction pointer. The memory we write has the length of our shellcode, is our shellcode and raw memory. After we wrote this, we want to continue our execution. So let's see if the demo gods are with us. And here we go. We had HelloWorld as an output. While this is just a very simple demo, it directly demonstrates the instrumentation capabilities of our tattoo. And especially what I really like is the possibility to script GDB from the outside, without having to execute your Python script from inside GDB. So you can say here on the right side, the full analyzers you're doing are centralized in one place. Let's continue with binary instrumentation on a real target. As a real target, we choose Highway, which is a PLC rootkit, which was presented last year at NDSS. And it basically injects, or this basically works based on code injection on a normal commercial of the shelf PLC. The PLC itself has multiple boards. We can have a look if everything works and we can see it. So no, no, here we go. So this down here is the open PLC, which we can power cycle very shortly. Well, what's the right one? Okay, sorry for that. I forgot to do it beforehand. Okay, so this demo is very fragile, which is going to show up. But here we basically have our PLC starting to boot. We see several boards here. Here on the side, we have a human machine interface board, which basically deals with all interactions to the exterior worlds, like SD card, the physical switch, the network interface, the USB interface. On the top here, we have the IOS for this programmable logic controller. So here you can connect the different IOS. Right now the PLC is booted. Everything is fine. It has no IOS detected. All the status LEDs here for different IOS are disabled. What's special here is that on the lower board, which we can see here, is the Cortex M3 MCU, which is just responsible for dealing with updates, or mainly responsible for dealing with updates of the exterior world. So updates of the GPIO state. And this Cortex M3 MCU, interestingly, also has an enabled JTEC debug port. So we can easily solder some things and have here on the side our JTEC interface connected to this PLC, which will lead us to the demo. This device is particularly interesting because parts of the firmware are residing inside SRAM. So the board initializes, and there we go, perfect. And firmware is loaded into the SRAM. So this basically means we can instrument those parts of the firmware, which we also did by re-implementing the proof-of-concept implementation of HAWI. So here we basically do the same, create the avatar object, load the assembler plug-in, add an open OCD target, set a breakpoint at the main loop because we want to skip all the instrumentation, all the initialization function. We continue our execution until we eventually hit this breakpoint. This is done by the way. And once we are here, we are going to inject some assembly code. So this assembly code is rather simple. As stated, it's just the proof-of-concept implementation of the HAWI malware, not the full implementation, but it already shows, or will show, that we can diverge the execution so that the PLC, the human-machine interface thinks certain inputs are enabled. And we do so by hooking an interrupt handler, which is executed frequently to check the state of the IO board and modify the state manually. So let's see if this works. I think I forgot to mention to say that we tried to have both Python 2 and Python 3 comparable code, so let's use legacy Python in this example. And here we go. So the camera is now off, so I cannot show you, but on here too, let's start it to blink, which basically symbolizing that input is present, also clearly no input is connected to this PLC. I added a picture of it just to be safe, that in case this demo doesn't work, we can see it. Let's move on to the next example, which aims to improve fault detection on embedded devices. This work is part of the what you corrupt is not what you crash paper by our research group, which will be presented at NDSS next year and is a joint work in Siemens. In parallel to this talk, we uploaded the slides so you can go and check out the paper. If you're interested in more details of what I'm going to say here. In a nutshell, this paper investigates the challenges specific to fast testing embedded devices, which are on the one hand fault detection and instrumentation, which we already talked about, or one additional problem is scalability. Fast testing greatly benefits from having the possibilities of running multiple instances of the same software and fasted in parallel. This in the embedded case would mean that you need a few tests traditionally, just a lot of different embedded devices. Furthermore, in the paper, we evaluate different strategies of fast testing of embedded devices. For instance, physical rehosting, static instrumentation or binary rewriting. In the end, we try to give some approach or give some direction by utilizing partial and full emulation of firmware using the avatar 2 framework. For this paper, the setup has two targets. On the one hand, STM32 L152-AE development board, which we have here. It's a nice board which has nice features like directly having a JTAG interface embedded and even providing serial access to it over USB. On the other hand, the target we are using is Panda, the reverse engineering framework. We as target software for our tests, we used expert or an instrumented version of expert with artificially vulnerabilities. The analyzer itself orchestrates in the sense that the initialization of the embedded device is run on the physical board and the emulation of the main loop, of the main part of the firmware is done inside Panda. For the analyzers, we wrote five Panda plugins which check or verify during emulation the state of the firmware by mimicking already existing techniques which are used for analyzing desktop software. For instance, we have something similar to a ShadowStack implementation or some tools with checks or one plugin which tries to check the consistency of the heap by tracking malogged freed and reallogged objects. The big advantage of these approaches is that there is no need to modify the firmware. For evaluating this, we did 100 fast session of one hour each in quite some different setups. We fasted the baseline against the native board, then we used partial emulation with forwarding of IO to the board, we used partial emulation without the board but with another and we utilized full utilizations. With the plugins we called detect previously undetected faults and quite interestingly the full emulation provided better performance than native fuzzer due to the fact that even inside the emulator the clock speed of the emulated firmware is higher than on the actual device. Now the next demo is actually a subset of this work. It shows the record and replay features which we have when using Panda. This is especially cool because normally if you analyze or dynamically analyze the embedded device you need the device physically with you, physically present. However, by utilizing Panda we can record one execution and replay it later to the inside the emulator without the need of having the device present. So let's look this up in a demo. So first of all that you believe me the software running on this guy is actually the XML parlor as I stated. So we are just looking at the serial output and writing XML file to the serial input and here we have echoed the XML file itself and the main loop of the firmware just brings us back the documentary. So fine. This works so far. So let's look at the avatar2 script for recording this. This is a little bit more we are more huge than the avatar scripts we saw before. We define new targets here, the Panda target and OpenOTD target. We add different memory ranges one for the read only memory with the firmware sample we fetched one for the RAM for size 14k pages and several ones for memory mapped IO whereby we want to emulate the serial interface with an avatar peripheral. Down here is an example how to use the orchestration plugin so basically we define a starting target add a transition and start the orchestration. This orchestration will automatically transfer the state from the board to the panda board once this specific address is hit in execution and will synchronize the RAM range. Once we are there we are beginning the record and going into an IPyton shell or continuing the execution inside the emulator and going into an IPyton shell for dynamic or father analyzers. So, we need to specify a trace name. Okay. And the demo is not good with us this time the GDB protocol was unable to connect. Too bad I don't have time to debug it right now. However, trust me this works and on top of that I prepared already some records before which are impressingly unspectacular. So, we have runreplay.sh script which basically just executes the panda with the configurable machine with the configurations automatically generated by avatar. Let's see at least the replay works of a previously recorded execution and here we go. We have a replay completed successfully and a lot of debug output about the configurable machine the number of executed instructions and the number of replayed non-data IOL. Okay. Let's move on. The last example I want to show you is some work in progress where we basically want to leverage symbolic execution to complex software using avatar. So, for this we inserted in artificially bug because we are still in testing phase inside Firefox and executed Firefox concretely inside GDB until the function of interest. This is particularly interesting because Enger itself won't be able to run complex software as Firefox or would be needed to create it with a state. We analyze only one thread and once we hit the interesting function we automatically extract the memory from GDB or the memory layout from GDB, sorry not the memory and copy just the layout into Enger while then the memory content itself are copied on read. So if Enger accesses memory it actually copies it from GDB to Enger. Reason for that Enger itself associates a lot of meta information with the data and this world if we would dump the full memory contents into Enger this would exceed the amount of RAM we have present at least on this machine. Furthermore we symbolize the symbolic arguments and start our symbolic exploration. Our preliminary results here are that we had approximately 10 minutes of runtime in the script for just executing 36 basic blocks accessing 21 pages uniquely and we found the bug. Let's recap the example we saw. We saw 5 examples dynamic instrumentation of GDB dynamic instrumentation of a PLC fault detection on a development board together with Panda. We didn't saw the record but the replay of the development board in Panda setting and we very briefly saw symbolic execution with Firefox and GDB. Note that some of those examples are already available open source and the ones which are not will be most likely be made available within the next months. So let's wrap it up. Dynamic film analyzers is still a very challenging topic and I don't claim to have or that we have solved it completely. However, Avatar 2 tackles some of the challenges and tries to improve the state of the art. Additionally, one interesting thing which we recognized is that multi-target orchestration. So the concept of having different emulators and frameworks interacting with each other during the same analyzers is a concept which is not limited to film only but also desktop software analyzers can benefit from it. As it is almost the end of the year, we also make some plans for the new year for the next year. We basically want to move our main development to GitHub. Currently we develop in a private repo which is a little bit sad because keeping it in sync is a little bit hard. Then we want to introduce proper versioning of the Avatar tool and, of course, add more and exciting targets to enable more and exciting analyzers. So if you're interested in helping us or just want to have some question, feel free to contact us. Either an IRC on-mail, just talk directly to me. And one small disclaimer, we may be looking for people to join our group in the near future. As I'm running out of time, I just print the acknowledgement shortly and I guess we can move over to the Q&A. Thank you. And the first question goes to the internet. So does the framework support the complex x86 system like the Intel ME? So the framework itself is not executing any software itself. Instead it uses underlying tools to or other tools and targets to execute software. So if you execute concretely on GDB, using GDB on your machine, the tool is just fine. What you probably need to do is to augment a little bit the register definition inside the architecture or inside the architecture abstractions. Next question goes to microphone 4. I haven't heard about Panda before, but as I understand, you can record and replay executions and that includes like executions on partly the real hardware and partly in QE. Could you use it for debugging as well, like also like reversible debugging, like for example you step in the code and then you jump back to a certain point of the recording? Actually, yes. The original purpose of Panda is just reverse engineering of software just executed on inside the emulator and it also has, or I don't know how far the development state is for stepping back, but I think they were working on it. And in general, while replaying, you can always attach to the replayed execution with GDB or another tool and start working on it. So, that's what I'm saying for your reversing purposes. Thank you. Does the internet have additional questions? Then we go back to the microphone 4 again. Thanks. First of all, I have two questions. Is the Panda released now because I guess it's part of the source and we instrumented and have a modified version of Panda inside the Avatar 2 framework but you can also get it under github.com slash panda. So, second I remember the problem with Avatar 1 which was it was slow and I want to know what are the improvements in Avatar 2 regarding the speed. Yeah, that's very excellent questions and we improved the speed quite a lot. Unfortunately, we couldn't see it in the demo of recording the execution here but let's say in Avatar 1 the main bottleneck was memory interactions with the physical device and we had some time on benchmarks, the of the 14K pages which we needed for this example took in Avatar something around 2 to 5 minutes while here we are done in 1 to 5 seconds. So, it's a significant speed up but still not fast enough to cope with real-time requirements. Thanks. Okay, next question goes to the microphone too. Hi. Hi. Embedded systems rather often have real-time components. Could you then, for example, just hook into a free Arto's thread to just analyze non-time critical parts? Yes, this should be possible. I mean, in general we have to investigate more a little bit real-time dependent embedded systems. We currently put it a little bit out of scope but it's for sure one input we will look to in the future and I think hooking real-time critical parts may be just working. Thanks. Okay, yes, Internet. Hedions would like to know if there is a roadmap to MIPS for MIPS support to Avatar 2? No, there's no roadmap currently available. We started implementing it and it gets improved a little bit side-on-a-side. If someone wants to step in and help with it we are happy. I can tell what has to be done to enable BIP support and well, in general, we are working on it but sorry, I can't tell a specific time when it's going to be ready. Okay, any further questions? Nope. Thank you all. When you leave, please take your trash reviews and other belongings with you and wash your hands.


Well, as you know, this is for a cover story that will appear the week after next on Mrs. Reagan. That's what I understand. And this part of it is sort of your perspective on a number of things that have been going on. The piece, as my other pieces on there have been, that will be shall we say on the serious side of the First Lady, I hope at least. Now she has told me in one of our conversations that she feels these days more like her own person than she did two or three years ago. Do you have any sense of that happening? And if so, how does that appear from your perspective? Well, yes. I'm sure there had been a change a few years ago. First of all, that absolutely uncalled for attack by some in the media with regard to the refurbishing and painting a few walls in the White House, which hadn't been painted for 30 years, that was very upsetting to her. And they were painting an image or creating an image that I think even now those who did it realize was a false image and that isn't the way she is or her personality. And I think the little episode that happened to me on March 30th, she didn't get over it as quickly as I did. And now I think the other that images out of the way and picking on her in that way anymore. And I think there's been some recovery from a kind of a traumatic shock on the other. So yes, I think she's, yes, I've been able to see it that she's more herself. But more her own person, I mean that indicates some kind of change, not as a woman, not in her relationship with you insofar as man and wife, but a change as a public personality. Well in that way, yes, to, after the other was to now, to find herself in the things that she's very much interested in, particularly the program of the young people and the drugs, which certainly is hers and her undertaking, I mean. And she's most sincere and deeply involved in that and of course her continuing interest in the foster grandparents program. So I think in that sense, yes, that all those things, they were kind of left over here with the other things that were going on, but no, she's, she can't help but be aware of what she's been able to accomplish and do in those fields and it's considerable. Even apart from that, I'm not trying to diminish that in any way, but in addition to that, some of your own political advisers have mentioned in private that in the 84 campaign judging by the data, she was much more of an asset in straight political terms as a public personality than she had been in 80. She also appeared in public, in the political sense, to be more self-confident and more outgoing. Well, if you'll remember in 1980, these other things that I was just talking about hadn't happened and since then in connection with those programs, she's always, there's been a shy side to her and the very calls on her for appearances and for public gatherings and so forth, particularly in connection with the drug programs or the, our programs to eliminate drugs, she can't help but have gained a confidence about public appearances and so forth in doing that. Before, she was very reluctant. I remember that very well. Yes. I realize that she still does not involve herself in policy matters, economics, foreign affairs, but she does give you advice and I think she always has on certain important subjects. I think I'm talking about political and administrative subjects. For instance, she mentioned in one of her conversations with me that after the 84 election, she suggested to you that you consider seriously important changes in the cabinet. Obviously, you, in that case, did not take her advice, but do you seek her advice in such matters? Do you seek her advice more often recently than perhaps in Sacramento or in 81? Well, let me answer this in two ways. First of all, a part of the image making that has taken place and false image making has been one of trying some way to suggest that she is some dominant force behind the scenes and well, the, an example of that was that incident at the ranch when someone asked a question of me and I was, I paused for a second about how I was going to answer that and Nancy literally to herself said, well, you know, like that's what we're doing or something. We're doing the best we can. And she wasn't cueing me to an answer and actually what happened was and I'm sure this could happen to anyone that I heard what she said and I thought that's, that's a good answer and I, I repeated it. Well then they have it played that I was stymied for an answer and she had to cue me. This was all a part of that other thing. So that, let me lay that to rest. Now on the other hand, we've been married 32 years. Yes we talk. And yes, I, I don't have any things that I keep to myself. I'm just that way that I go upstairs and talk about what took place in the day and problems that I'm facing at all and she talks and I talk and I just find it that is very normal. Well, wasn't there another myth about her years ago, at least as I got to know her in the 80 campaign, I think there was still another myth kicking around, which I, she and I have joked about it. I call it the Miss Goody Two Shoes myth and she kind of, so she almost fed that myth by occasionally coming across as not knowing enough or not being interested enough really to even to have opinions. I always felt that she did herself an injustice in that respect and that, and more recently I think as part of this business about her being more her own person, it's become clearer to more people that she has well informed opinions on some subjects and she certainly is always trying to guard your flanks politically. I think there's no secret about that. She's very protective. She is a nest builder with an intense family loyalty that grew out of her own rearing in the doctor's family. Yeah. She and I talked about that too and how she was very eager as a young girl to have a real family life again and all that. But in the process, don't you have the sense that she is becoming increasingly an advisor in addition to being first lady? No, not increasingly or anything of the kind. It's just as I say, we have a very open relationship between us. I find myself, and this has been true as long as we've been married, long before I was in this activity, that I think when something unusual happens or something important to my life or something that I hear about my first thing in my mind is, wait till I tell Nancy. I just, it's that way between us. And I think again what you said about the self-effacing thing, I think that was a reaction to this image-building about somehow that I stand and wait for instructions. That goes back to Sacramento. And it does.  And somebody wrote a book even and invented all sorts of things about her that are absolutely false. So what I have chosen with journalistic license to call Miss Goody Tushu's business is almost a reaction to that other thing. Yes, yeah. Well, she mentioned to me, we've had three conversations as you probably know recently for this article, she and I, she mentioned to me that building up to the decision to run again in 84, that you had to court her, I think that was the word she used, into that decision. Now was that a difficult courtship job? No, not really. When she understands something that I want to do, that settles it. So there was never a point, as I understand it, where she was saying, no, let's not, and you were saying, yes, we must. Never, no. But she did have some ambivalence, some reservation or two that you had to work around? Oh, not really, except that it was a thing of remembering 80 and the whole hassle of the campaign and everything was, you know, are you sure that we really want to do this, that kind of attitude? Well, with the new self-confidence that she shows in public, and here again, I'm talking mostly about political matters, not so much the anti-drug program, although one may flow from the other. She is saying things that in 80 she would not have said. For instance, in her interview with the Los Angeles Times, she stated a view on abortion in those cases of pregnancy caused by rape. It attracted a little attention because she had not spoken on that before. She has also been more candid, as in the Betty Beale interview, about family matters. How does that sort of thing sit with you? No, I understand. The thing happens to me, too. I understand when questions start and you can say something that someone grabs on and makes maybe more of it than it was in your mind when you said it. The question of abortion, for example, I think there are facets to that question which people can be unsure of how they feel. I have, as I say, for me, and I think she accepts this, the only way that I can justify abortion is in self-defense. We recognize, in other words, abortion is the taking of a human life, in my view, and no one has been able to introduce any evidence that that unborn child is not a human life. Does a few minutes between actual birth and prior to birth mean that something has suddenly come alive that wasn't alive a few minutes before? To me, I say, well, when could it be justified? In our Judeo-Christian tradition, self-defense has always been justification for taking life.  Now, I know that a number of people feel much the same way about abortion. But then they say, well, now, wait a minute, self-defense, could that include other things, just as you would have an ability to defend against rape, do you have a right to defend against the results of rape? Well, I'm content in my own mind that the life of the mother is the one justification for it. And I think that in answering that question, and Nancy was probably saying just what I have said here, you could take this if you wanted to and isolate it from any of the rest of the conversation, and I could see a headline appearing, President says abortion is justified if, well, I haven't said that at all, so I've told you I think it is a human life that is being taken. Well, that interview in which she used the term estrangement, and then your son Michael's response, led to a series of phone conversations between you and Michael. In retrospect, did that turn out to be a good thing? Did that sequence of events perhaps clear the air between you two and serve to repair any bit of static? And I speak, of course, as a fellow with three sons of my own, and I know how these things can go. Well, again, none of us are going to, what she was principally trying to say simply was that the whole summing up of it was that we're not going to talk about family affairs, so I'm not going to violate that either. But we'll be together soon, we'll go to California, and we're just not going to comment. Well, many people have remarked on the unusual strength of your marriage, how close you two have always been. You said on camera during the campaign, I believe, that you can't imagine life without her. Do you think as part of that, that Mrs. Reagan sometimes feels or acts overly protective where you're concerned, you alluded to that yourself a moment ago, in effect that she sometimes acts in a maternal way towards you? Well, no, I can just tell you that there is a great sense of loyalty that she has and extends to family, all of us. And yes, she, I'm quite sure she just couldn't help it, as I say, she's a nest builder. And she can't help herself from feeling protective in that way. Well, it's been suggested by any number of pop, psych artists that another side of this unique relationship between the two of you is that your children, particularly the older two, have sometimes felt, in effect, left out that you two were so close and so self-sufficient emotionally. What do you think of that kind of speculation? I don't think so. As a matter of fact, I think they, as they've grown up a little, they all understand because they have discovered that the same protection and protective feeling goes to all the family. No, I don't think that or that, I don't think that any of them feel it. The bonds are very close. And you refer to this as an unusual relationship. Well, I happen to think there are just millions of marriages throughout our country and many more, I'm sure, throughout the world. But I know a great many people that I think have that same bond of love and that same close relationship that we have. But yes, we're both very fortunate. Well, then again, she always says that you're the eternal optimist of the two. And that's sort of part of her function to live in that a little bit. Yes. And I always tease her about worrying. And it's almost kind of a family joke in the family. She uses a line from a joke sometimes about me. When I say something optimistic, by the same token, I joke at her that she worries if she hasn't got something to worry about. What is the joke that she uses? Larry, I can't. It's always good to end these things with a joke. I can't tell. But it's a joke that just is based on optimism versus pessimism. It's not the old pony story, is it? Are you going to print that? Well, I've printed the pony story several times. It's the old pony story. I got you. Okay. I'm Matt Willem. Thank you very much, Mr. President. Happy new year. All right. We'll bump into you out there. Thank you.


So, this is the theorem we wanted to prove last time right. So, the idea is pretty simple this is let us say suppose this is the point z naught and we create an analysis which should entirely lie oh enter into 0 then analysis must lie entirely inside z naught otherwise it will not make any sense to have because f may not even be defined there. So, let us pick up an analysis which is this one. So, this is the domain D and this analysis that I am picking up this is centered at z naught inside D and this I will cut by making a single slice here. So, that it becomes a single curve the boundary of this analysis and I traverse this boundary counter clockwise starting from outside going here then coming here then going down here. So, this is clockwise then going back on this and then continuing counter clockwise completing this circuit and we use the standard trick that at this point instead of running over the same cut twice you just separate them by a very tiny amount. So, that it is this traversal is very well defined everywhere and let us call this region. So, that is the region which is encompassed by this curve R.  Therefore, by Cauchy integral formula if there is a point let us say any point z here I can write f of z as the integration along the boundary of R of f w divide by w minus z. Now, let us look at the boundary. Boundary is this, this, this and this. Now, as this two parts tend towards each other their integral around those parts will cancel each other out. So, what will be left with the limit is integral counter clockwise on this and integral clockwise on this inside circle. So, let us say this these are both circles centered at z naught. Let us say this is beta this distance and this distance is alpha. So, then I can rewrite this as now the first part is familiar here the integral is on w's which are on the outside circle and z is inside that is z is closer to z naught then these w's are. So, let us just rewrite this a bit because I want everything in terms of or expand around z naught.  So, this is standard or familiar thing that we did for power series also. So, therefore, I can rewrite this as and in this integral w is running over the inside circle. So, absolute value of w minus z naught is smaller than z minus z naught. So, I can expand this, but taking out z minus z naught and then doing it and now we can use the uniform convergence of this power series in the region of interest to swap the integral with summation and we get summation k greater than equal to 0 integral of I got I forgot 1 over 2 pi i here. So, there is 1 over 2 pi i everywhere and if you just change this summation or by replacing the index k with minus 1 minus k. So, just redefine k to be minus 1 minus k. So, this becomes k this becomes k plus 1 and then you get there is bit of a problem here because these 2 integrals are over different circles. So, I cannot write it exactly like this. So, let me still go with a split definition. So, we are almost there well actually we are there because now this is a Lorentz series. We also have the value of the coefficients of the Lorentz series that it is for the on the positive side it is these integrals on the negative side it is these integral. So, that completes the proof of the theorem, but actually we can do one step better and make these 2 integrals over the same circle. Do you see the reason? In fact, let me state it this way let me just write it as equal to sum k going to minus infinity to infinity 1 over 2 pi i integral. I can replace this integral over circles of radius alpha or beta by a circle of radius r as long as that circle lies inside the analysis not inside the region the domain D. Exactly, so this function that you are integrating f w over w minus z naught to infinity k plus 1 is analytic inside that analysis because f is analytic this is analytic why is this analytic? Because it never vanishes and it is inverse of an analytic function w minus z naught absolute value is always non-zero. So, this is this is the product of 2 analytic so this is an analytic and since it is analytic inside that analysis is integral over any circle inside the analysis it is going to be the same that is why caution and so we have a uniform definition of the constants of this expansion circle around it not yes. Yes, so it is defined see it is we are only see we are if you integrate around this circle on this circle the function is well defined and inside this this and this this another look at this analysis inside this analysis function is analytic the complete not at f w what f w divided by w minus z naught to the k plus 1 is analytic. So, if you cut make a cut here and look at that region the integral around the boundary of this by caution the integral is 0 and therefore, the 2 integrals are same of course, the same thing does not apply here because w minus z naught can become 0 in this integral not this in not in this integral, but inside the region inside this disk where we are doing the integral it can become 0 or here inside this region the delta r it can become 0. So, you cannot this is not 0 this is not 0. So, that is the Lorentz series expansion of an analytic function around a singularity and it expansion makes sense only around a singularity because if the point z naught is not a singularity then is expansion is simply a power series and this expansion is defined on the analysis which lies inside the domain and this the inner circle we can shrink to as small as possible and outer circle we can expand to as large as possible that does not matter. So, that will be remain the same. So, this gives us a more general way of expressing an analytic function specially it allows us to study the singularities in a much nicer way the power series always avoided singularities whereas, this actually uses a singularity to expand the function around it. So, we can study the behavior of an analytic function around a singularity using Lorentz series we cannot do that using power series and that is something that is going to be very very important for us because singularities of an analytic function are going to play a very important role. In fact, you already see this is an analytic function with a one singularity at w equals z and you already note that it has a very interesting role to play that it actually gives me a value of f at z. So, we will see as you move along more and more usages of analytic function around a singularity, but first let us address the singularity themselves a bit. So, we saw zeros of an analytic function we the most important thing about them was that zeros are isolated and every zero has an associated order with it. That is the order of the first few term that first number of term that is zero in power series expansion that is the order of the zero. Can we say same thing about singularities? Can we say that singularities of an analytic function are isolated make you guess and there is a very simple you mean to say they are isolated that is what you have to answer yes they are actually not okay. So, analytic function of course, if there is a domain associated where it is analytic the rest of it. So, presumably there are it is it may or may not be defined see it is possible that that analytic function can be a continued more in a larger domain. So, whatever it can be continued more and more and more whatever maximum possible continuation is there after that what is left is places where it cannot be analytically continued which means that these are singularities. So, are those singularities isolated well okay let us take an example analytic function this is analytic inside unit disk what about the singularities they are everywhere after that there is completely singular behavior there is nothing outside there. So, this immediately shows that singularities of an analytic function need not be isolated. Now, when the singularities are not isolated those are not very interesting cases because that is a complete mess we are typically not even going to be interested in those regions. So, we will only be interested in those singularities which are isolated because those are the interesting singularities.  Now, isolated singularities also have a very nice property that we can write a nice Lorentz series expansion of the function around that singularity in a small region and the analysis is just the punctured disk because there is only one singularity which is right now sitting there. So, we just puncture that and that analysis is the Lorentz series expansion of the function which means that we can study the behavior of through that Lorentz series we can study the behavior of the analytic function around that singularity completely we know the exactly how its value behaves around that singularity. So, we can let me just write it down because it is important we can write and we will use this observation to study the behavior of the not only analytic function, but also because we can study it around the singularity we will be able to say something about that singularity itself. So, let F be analytic on D with isolated singularity now using the previous observation let us write F as say some disk punctured at z naught of radius r. Now, when I say inside you take it to mean that it is punctured at z naught. So, what can we say about the singularities? Well it turns out there are going to be three types of singularities which I am going to describe now and these singularities characterized by behavior of F around z naught type one is called removable singularity this is actually not a singularity this is a phony singularity this occurs when the in the Lorentz series expansion the all the negative coefficients are 0. So, actually Lorentz series is a power series. So, actually there is no singularity there. So, then why do we even call it a singularity? Well technically in the we can a singularity is defined if the function appears to be undefined there. So, to take a most silly example of this if you look at the function z square by z at z equals 0 if you are treated completely dumbly z square goes to 0 and z goes to 0. So, it is 0 by 0 therefore, undefined there are not. So, silly examples also I mean there are for example, sin z by z that is also 0 by 0, but of course, you all know that we can remove it, but why do we know that we can remove it only through this actually even this an argument that this is not really a singularity at z equals 0 is by plug in the make the Lorentz series expansion of this and show that all these are 0 all the negative coefficients are 0 and therefore, it is non singular it is removable. So, this is a just a formalization of this whole thing clear. There is a nice character I said that these are characterized by behavior of f around z not. So, how are these removable singularities characterized as? So, f has a removable singularity at z not if and only if f z is bounded around z not and when I say around z not is taken to mean a small enough disk around z not and the proof is fairly straight forward.  So, let us assume less than equal to epsilon z minus z not the absolute value that is a very tiny disk you need to show that absolute value of z is bounded that is pretty straight forward use the definition f is at this Lorentz series expansion all the negative a k's are 0. So, only the positive a k's survive. So, a 0 will be a 0 and the other ones a 1 will be multiplied with an absolute value if you look at the absolute value of this epsilon, epsilon square epsilon cube the higher coefficient and since epsilon is tiny is all converges to some finite value this is less than equal to sigma k greater than equal to 0 a k epsilon and this therefore converges to something well of course here one is assuming that f is analytic on d. So, there is a non trivial analysis on which this is convergent if it is not convergent anywhere then of course there is no point talking here of anything at all or if it is convergent inside an analysis which is this it is epsilon is much smaller than r. So, it is certainly convergent and it converges to some finite value and therefore this is bounded by some value the converse if f is bounded around z naught that is that is another way instead of using the counter positive if f does not have removal singularity then that is not going to work directly because what might happen is that infinitely many of a k's are non 0 negative a k's are non 0 and then somehow those sums converge to something well one can argue that if they do not but you need to measure on with infinite sums one would like a more direct and simpler proof here which fortunately exist you can definition of exactly you want to show that a k's are 0 for all k less than 0 what is the definition of a k a k we saw was 1 over 2 pi i integral of w minus z naught equals an hour which is can be any circle as long as within this. So, I can choose it to be epsilon as long as 0 f w divide by w minus z naught to the k plus 1 d w if you look at the absolute value of this is going to be less than equal to forget about constants this is bounded f w. So, there is some c constant c such that absolute value f w is bounded by c this is in absolute value epsilon to the k plus 1 right. So, this is and this as you integrate once you take this out and integrate you get 2 pi epsilon. So, basically what you will get is a k you will get to be order 1 over epsilon to the k epsilon to the k plus 1 here 2 pi epsilon comes after integration the 1 epsilon cancels out forget about 2 pi's they are all constants and this is also a constant. So, all gets absorbed in this now as you send epsilon to 0 what happens for negative case they all go to 0 neglecting z 0 of course, because z 0 is singularity. So, you do not know what it is happening, but that is good enough because you do not actually have to take this go to epsilon equal to 0 we are showing that a k cannot have a non-zero value because we can make choose any small element epsilon to make it smaller than that. So, that is pretty straight forward. So, these are sort of silly singularities as I said they do not even exist what is more interesting is and actually the most interesting kind of singularities are type 2 these are called poles a k is not equal to 0 when a k is non-zero for a finitely many k less than 0 and that has to be non-zero value. So, the examples of this 1 by z is the simplest possible example here a minus 1 is non-zero. So, what with as with zeros we have an associated order with a pole it is equal to the largest value of n such that a of minus n is non-zero. So, this is almost dual of the order of a 0 and how is a pole defined by the behavior of f around z naught it has a pole around z naught if and only if as you send z goes to z naught the absolute value of z goes to infinity. Now, this is a bit of a loaded statement because when I say z goes to z naught I can take z to z naught along any path that is very important not only one path. So, it does not matter which path I take it to z naught f z always diverges and the proof of this is again fairly straight forward if you if f has a pole at z naught then just pulling out the definition f as a Lorentz series expansion with let us say pole of order n. So, which means that there is if f has a pole z naught then I write f z as a minus n by n plus i degree terms and now if you see that if you send z naught z to z naught all of this in particular this diverges these will also diverge, but the rate of divergence here will be faster than here. You can make this argument more precise by considering if you let because sometimes this argument are subtle one has to be very careful when making this arguments. So, just to emphasize that I define g z to be z minus z naught to the n times f z what is g of z naught that is not 0. So, then I can write f z as g of z by z minus z naught to the n now you see that clearly as that goes to z naught this is non-zero and this goes to 0. So, clearly diverges it does not matter what path I take and conversely if you assume that f z diverges around z naught everywhere I mean it stands towards infinity then how do I show that f has a pole at z naught this is a little trickier not straight forward although pretty simple. So, again define g is of course likely differently to be 1 over f z then what can we say about g z g is analytic around z naught because f z does not take value 0 around z naught and is bounded why is it bounded because absolute value f z around z naught is very large. So, therefore g z is bounded around z naught. So, it is analytic and bounded around z naught of course g z naught I am saying it is not clear what is the difference I do not I am not even defining it right now, but the fact that it is bounded and analytic around z naught means that I can work the type this is a type if at all it has a singularity at z naught is a type 1 singularity which means it is removable and if it has a removal singularity at z naught it means it is g z naught can be defined in a unique way and how is it defined in a unique way well just take one path and send this this is going to diverge the g of z naught has to be 0. Now, g is analytic function in this disk it vanishes at z naught. So, it has a 0 at z naught now every 0 is isolated of course we know and there is an order associated with this. So, let g have a 0 of order n at z then we can write g z as z minus z naught to the n times h z with h z naught not 0 that is by definition of the order of 0 and now I can write f z as 1 over now here h z is analytic around z naught it is not 0 around z naught. So, 1 over h z is also analytic around z naught and n here and this shows that f has a pole of order n because 1 over h z I can write as a power series around z naught and which does not vanish at z naught. So, this is going to be a Laurent series with a minus n being the largest or smallest non-zero coefficient why is g bounded because of this in a small disk because of this property you have z naught and you look at a small disk here look at this region as this size shrinks absolute value of z goes to infinity. So, at some point let us say absolute value of z exceeds 10 everywhere it will be because no matter where you approach from any point no matter how you approach z naught you are going to diverge. So, for every point around this in a small enough disk the absolute value of z is say at least 10 and if absolute value of z is at least 10 on that disk g z is at most 1 by 10 mean the absolute value. So, it is bounded no at what z naught z naught equals 0 you are saying summation k greater than equal to 0 1 over z to the k. This is a Laurent infinite Laurent series yes and as it goes to z naught there is absolute value go to infinity does it that is type 3 singularity these are called essential singularities when a k's are non-zero for infinitely many k less than 0 of this kind the example is as just law you gave or e to the 1 by z scope you want to write is that there is a sequence of points tending towards z naught. So, each of this point is closer and closer to z naught that is what I mean here I am not writing it very precisely. So, essential singularities is a bit completely bizarre behavior they diverge they do not diverge as you go from z to z naught depending on what path you follow you can get any result that you want we prove it in the next class, but just to convince you of this let us look at this one. If you approach it from the positive real axis what happens approach towards 0 from the positive real axis goes to infinity approach towards 0 from the positive imaginary axis minus infinity positive imaginary axis. So, z is i y so you get e to the 1 over i y y tending towards 0 what is the absolute value of this e to the 1 over i y what is the absolute value of this is always 1 does not matter what y is. So, if you approach it from the positive imaginary axis towards 0 the absolute value stays at 1 and this is not the end of the story as this theorem says you can get any value that you desire as the limit depending on what path you chose to approach what same story absolutely same story this is true for every essential singularity and essential singularity is defined as infinitely many a k is being non zero which is the case here. So, we will continue this in the next class


Thank you, Edgar for the introduction. What I'm going to do though Edgar is actually talk in a slightly more Narrow way about some of the work that we've been doing at LSE cities around this conference and obviously Begin to make some speculations about the issues that you're talking about relating some of the trends in social change and urbanization and health to do with design and the physical world and in particular to do with Density and sort of compaction and what effect that has on the individuals who live there This is work, which I've already alluded to has been led by my family Taylor and other colleagues here at the LSE but very closely done together with colleagues from different departments from Hong Kong University and All their names and their work is acknowledged in the report What we did is really began to say What it's happening behind these big statistics. We've just had a session where big issues of macro Areas which we can't even conceive of in India or China are beginning to grow and of course this is depicted in this diagram of the world as it urbanizes And all you need to see from wherever you are in the room is where the white Areas are show you where growth has happened in the last 20 25 years or so and in the dark green Where urban growth is going to happen according to the UN in the next 20 odd years? And it's very clear where that is going to be it's going to be in the areas that one class was referring to today Where there's a very dramatic shift in the way the economy is working it's tending to be in areas like Africa parts of Asia where Growth and urbanization is actually not necessarily happening with jobs at the same time and certainly not industrialization or Manufacturing so that raises a whole series of an important issue So what we've wanted to do very much in the spirit of the work that we've done at the LSE Urban age for a last number of years is understand what shape what form Does this growth take and what effect does it have on individuals and particularly begin to ask the question about the impact? Not just on social inequality, but on health inequalities Now this is an endless infinite city. It's 22 million people It's Mexico City and it never ends and this is one way of making city So we have to be careful here. We're not talking about one uniform type One uniform morphology of city because this is another way of making city It's a city of enormous density It's one of the densest in the world and it's obviously Hong Kong This happens to be a part of the city very close to here one side So the question for us is what difference do these environments actually make to the way? We live it's not just a question of the size It's also a question of the speed and the pace of change because the provision of many of the facilities Which have even been talked about today let alone health ones have to be put into a context When you think of it over time, this shows you the numbers in growth per hour Well known perhaps that in places like Lagos or Mumbai We're talking about 40 50 people moving into these cities or being born in these cities per hour. That's one Every minute and a half that I speak a new person moving in but cities like Hong Kong are still growing not as much as Of course as they used to something like seven but put that into the context of London, which is one Person per hour that you begin to understand how the system works. So the provision of Facilities and the shape of the city is exactly the center of the research that we've done But there's some basic Elements that we need to understand the issue of age was referred to already this morning by dr. Chow and by other representatives of Hong Kong, but of course, it's a global situation If you look at what has been happening in the last 40 or 50 years Basically people's life expectancy has increased with the enormous exception of course of Africa Perhaps strongly influenced by the spread of AIDS over the last years But it's not just a question that life expectancy has improved for a whole series of reasons that we can understand But it's also a question of what's happening at the other end of the scale in terms of children and child mortality And even there and particularly and it was talked about this morning by dr. Chow What has happened in the case of Hong Kong is that child mortality has dropped very dramatically in a short space of time But it's very different in very different parts of this city and we'll come to that in a moment So what we did with our team is to try and remap effectively to try and understand What are the health patterns, but also what are the education patterns and what are the wealth patterns in a hundred and twenty nine? Metropolitan areas around the world Some of the state of course is available Many of you will know it at the level of the nation You will know that you know the the UK and the United States compare in certain ways What we tend not to know yet is how different metropolitan areas not just different cities But extended metropolitan areas actually compare and what you see here And it's shown in great detail in the report is the darker green are basically areas that perform better in terms of whole combination of health indices which are to do with life expectancy and child mortality and the numbers you hear Are the numbers you see sorry are the actual life expectancy and what you see is that? The red areas the orange areas are at the worst end of the scale not surprisingly given where they are But there are differences there are regional differences, and we heard Athar earlier talk about the regional Inequalities that are beginning to show up in areas like China of course in India And just look at the differences in terms of life expectancy even though we accept that life expectancy in and of itself Is not the only criteria that matters between Ho Chi Minh City and Hong Kong These differences exist between Paris which has a similar life expectancy to Hong Kong and say Bucharest or Moscow or elsewhere Clearly in Africa, but even in the United States and the whole of Africa Do you see these enormous differences relatively close by hence this distribution of life expectancy? Which is really quite different with the African cities way down there and Johannesburg Average age today 51 mainly because of AIDS I mean this is a shocking difference and I'll come back to the fact that these differences what you find at a regional level You also find within cities themselves, and that is an important component In fact, this has been said it was talked about in the first session so I can be very quick about it London the city I inhabit with many of us take part in in many ways has a rich and well-off West and a Pretty messy not necessarily just poor but pretty messy East London. This is what an Indic index of deprivation which shows low education Unemployment and a whole series of other factors looks and basically most of East London if central London is over there is more Problematic with respect to West London. Here's the famous diagram if you take the underground line In Westminster it's been talked about you basically you lose a year on average as you go east now Importantly and linking to a session tomorrow It's over here It's in this part of London that 9.3 billion pounds of public money is being spent on the London Olympics And of course, this is very much Stephen O'Brien sort of territory that he was referring to before now in the report You will see this listing in many ways of the three Factors now I don't want to in any way either go into this in detail or say that this is it The point that this is a starting point for research which goes underneath the skin of the city So at one level we've looked at in the in in the cities here on the left the nation the population We've looked at health Education and wealth all three parameters. It's quite interesting to see what the correlations are and Between one and the other and clearly education health and wealth are connected Particularly at the top end of the scale But what is intriguing is that it's the high-income Asian cities which perform pretty remarkably if you look at it at the scale Some European cities with London in fact at the bottom Come next and actually the North American cities which figure at the top come certainly third So that is quite interesting But what's happening inside the cities is where I want to go in a moment But what we have found that out of the 129 cities over 90 percent over 90 percent Growing up in a city is better for you than growing up outside the city We found in places like Mumbai for example that the chances of living longer getting better education And having access to services is considerably higher than elsewhere And I think this is an issue that needs to be understood and discussed So what does this mean in terms of the work that we've been able to do? With HKU and our colleagues there in this city well what we were able to do and this is what I challenged dr Chow with before is to actually map some of the data was actually available What we've also heard today through Christine Lowe is well the data is here. It's a very sophisticated Country in terms and city-state in terms of information available, but how is it used politically to actually? Effect change well the first thing we did is that we simply mapped the social inequalities and the darker Colors you see sort of lower income groups Sorry in the purple colors you see so lower income and you see Hong Kong Island here here to trace you Kowloon and Shenzhen up at the top You see that there is a marked pattern as you would tend to expect everywhere if you did this in Chicago You would have one area south Which would be one color and another area north which would be another that was something we heard about Loprado today east and west was very very different here It's like pockmarked you have areas of intense wealth and then areas of intense poverty one next to each other as close Said earlier so what you expect that what the so what is what actually happens when you translate this Into health inequalities. It's a one-to-one correlation. You'd call it we looked at Premature mortality that means people who died before the age of 75 of course in a city where you tend to live to over 80 That's significant and there's some areas which clearly are problematic And if you look at child mortality despite the fact that in the city it's dropped so dramatically It's one of the best in the world What actually happens that in some areas you have nearly twice the possibility 1.6 to be precise of actually dying as a child than you do in other areas. So how does a government actually introduce? Policies which make a change well one of the issues that needs to be understood and we spent a lot of time focusing on Here in Hong Kong particularly with Joshua Bolshover and his colleagues at the Department of Architecture Was the density issue there are cultural dimensions of this that we heard in the last debate Which weren't I think followed up perhaps as much as they could be There are cultural issues of how you live in different areas, but I think even there You can't assume that everything's okay, and that there isn't a perhaps a limit In terms of the way that you actually live. So this is New York for example This is may perhaps an unfair picture of the densities of Hong Kong But that's what you see when you get off an airplane and it shocks you We tend to look at the urban age at density in different ways This happens to be London shown at a certain density at exactly the same scale That's what happens in New York, and this is what your city is like So the densities are a factor of three or four times higher But that density of course makes it one of the most sustainable cities in the world It has a fantastic system of public transport so what we then did in Working with other colleagues and other departments here at HKU was to work very closely an Understanding what people actually think we went to ask a series of residents young middle-aged and older How do they feel living in some of the densest areas of the city and these are some of the answers Some of the questions. I think we have best transport here I moved into the area just because of this is one of the residents another one says although Hong Kong is dense It is still convenient the notion of convenience is a big issue that you actually in a way compromise certain Things that in other countries and other cultures we think are perhaps more important here There's a trade-off in terms of convenience if you can be within ten minutes of work That's a good thing because that in many ways is what you want to value We don't have to spend a long time traveling to the destination I mean it in wise it's good enough So obviously that is one of the byproducts of that density now if you look at this without going into detail at all It is quite extraordinary if you compare how people move what we call in the trade modal splits in Hong Kong There we go nearly 93% of all daily trips are either taken by walking or taking one form of public transport That's a fantastically high figure. We'd be so pleased if in London or New York We actually got anywhere near there. In fact, it's only the really low sort of developing economies of say Mumbai which actually perform anything like that. That's because people are living in slums and cross the road to go to work It's a completely different economy and we need to understand that and let's not forget that in a place like Sao Paulo You have commuting times of over four or five hours What happens is that the rich therefore find other ways of getting around now? This is instead a statement of what someone says living in one of the dense areas here time matters in Hong Kong But not only for the rich so you have actually a system which is designed in a very different way So we looked at these three areas of greater density, which some of you will recognize both in Kowloon and Hong Kong Island and Asked a few questions. This is where I'm going to wind up Edgar. It was interesting to hear From these questions and these were not people that we chose who were already Unhappy or unfortunate was really across the board. So for us, it's a new work Which tries to get at the skin the quality that I mentioned perhaps that Richard Senate was talking about before We got these sort of statements about actually what's it like to live in areas like this and clearly the issue of air quality Becomes incredibly significant here. The air quality is not so good and I always cough You know when you see pictures like this of what actually happens Simply because everyone has got an air conditioning unit on it blows hot air into the next one So you then you have to put on your air conditioning unit even even if you didn't need to have it So proximity has its own effects. This is of course incredibly dramatic And it is a not just a cultural issue. It's a land value issue if land is so high You can only afford a space which is as big as four times of this lectern where I'm standing You can touch the flat next to yours if you reach out your hands It's one of the comments made by there and you know this in Kowloon is represented of it now as I conclude I think probably this statement By one of the residents in Saiying Poon says more than anything else. I'll read it out I wasn't experienced. I was so happy that I invited my colleagues to my home. The gross floor air was merely 300 feet It was so cramped that everyone sat in rows as if they were at the cinema They said I had overestimated myself Since then I've never invited anyone to my home now think of this impact in terms of the psychology And the relationships that you have with others and I know Mazda and we will talk about the impacts of density and form on Well-being at that level Therefore and I would say these would be some of the concluding remarks that we take with us Relating very much to the question Edgar you raise the public of design and public space is that this matters Even more in a density what happens outside how you can use the outside For the social competence that Richard was talking about becomes very very important Particularly where you have an older or a younger population as we've seen here now Paul Yip who collaborated and is here and wills Be speaking tomorrow made this very simple point the success of a city cannot be measured only by its financial prowess The mental health and the well-being of its residents must also be considered I think in the research that we've done together Some of these themes are beginning to become clear Is there a limit to density probably actually there is is it happening in Hong Kong? Possibly and particularly for the new immigrants who are coming and many of us or the conditions that they are living in now This means that perhaps one needs to reconsider planning Policies and putting design at the center of that and not at the margins of it And in that sense, I think we need to really understand how design and particularly public space makes a difference in making healthy cities Thank you very much You