Folks, I'm DuPay here, and today we're going to be looking at the Poneable.kr level ND5 calculator. This is a 200-point challenge, and this is a live hack through, so I haven't seen this before. So let's dig right in. So it says, we made a simple ND5 calculator in network service. Find a bug and exploit it to get a shell, download from Poneable.kr, so I did that. Interesting. Hit the service, shares the same machine with the Poneable.kr web service. Interesting. So there may be something interesting there, and it's running at that location. So I have it here. This has a file on it. So it tells us it's an L32 bit executable, dynamically linked. It didn't give us libc, so that's interesting. But OK, so we're running strings on it. Joy. So we can see, so these BIO curl right push, these are, I believe, OpenSSL function calls. It's been a long time since I've done OpenSSL programming, but they all start with this BIO, binary IO maybe. But do that. Anyways, ceiling, exit, SRAN puts time, and then it looks like we come now to the actual less than or equal to u, percent zero 2x. This looks like part of a format string. md5 data, percent x, welcome to free md5 factoring service. Are you a human? You put a captcha, create a wrong captcha, welcome your authenticated. Encode your data with base64, then paste me. Thank you for using our service, echo date, along. So this, so I think then this is anything interesting off there. So let's just run it locally to make sure we can run it. Are you a human? Input captcha, if I say hello, it's wrong captcha. Okay, I think it means we should copy and paste this and welcome your authenticated. So it wants base64 data, so let's echo hello world. So if you don't know base64 coding, you should look at it. If you've done a lot of md5 of your data is this. Thank you for using our service. All right, that much stuff. So when we think about what are possible ways, and actually I guess the other thing we should do is check and do this net hat here to make sure we can actually get the same thing here. Are you a human? Input captcha, base64, so there's like two parts where we can actually give data to this program, the captcha and the base64 encoded version of our data. So whatever exploit it is or the way that we can exploit this means that we have to do that using our input there. So, okay, nice, our data is the same, that's good. So then let's look at our binary. So, are you know what, let's do a redial, we'll run a check stack on it, a partially root, so it's using a canary and NX, but it's not a positioned independent executable as long as we have a fixed memory location, that's good. Okay, so non-executable canary means an overwrite on the stack is probably less likely interesting in here. Really a bunch of 30 different sections, headers, stack. So these are all of the library functions. So the global offset table is fairly large. So we can see that this md5 and dit, these are all in the open SSL library functions. So there's gonna be multiple libraries that's gonna call it open. So who knows, maybe that'll become handy for us. The dynamic symbol table and it does have symbols, so that's nice. So we'll get some, that'll at least be easier when we're reversing this binary. All right, there we go. All right, so start at main and it's got a nice main function, so that's easy. All right, let's use this decompiled version. So again, our handy-dandy set debuffs as we talked about before, it's calling puts, welcome to the free md5 calculating service, seeds. Okay, so this was my suspicion that using this, so it's seeding SRAM with the output of time. So maybe because we know that it's executing on a certain server, that we need to use the time of that server to try to do some guessing. That's just my initial thoughts on this.  So this is that capture that we looked at, then do a scanf, and you can see that it's using this memory location, we couldn't notice that memory location is, yeah, so it's so small that it hasn't got that as a string yet. So we do that as percent d, then we go back, see that it does that, so it does percent d. So read an integer, which is gonna be the thing that this input into bar four is not equal to bar eight. Oh, it's an integer effect, so yeah, that's fine. Okay, that seems very, and we may have to think of this my hash function, see what's going on there. That seems straightforward, no overflows there. And then welcome, you're authenticated, put it out of this, it's for the case we need, process hash, inputs, system and go, facts, take, date, it's a log, interesting, we need this log, I guess I must have restricted this log file. So let's first look at this myHash function, this mode, right now I'm just trying to get a general feel of what's going on, I don't think. I don't think there's any way we can modify or mess with this value, so I'm not certain that we even know the indebtors are not here. The log stack canary, setting up the stack canary, we know it's calling brand, seven times, stuff with brand, it's generating that brand number, based on the time. So if we needed to, we can, that number is 100% different, so let's run this hash program with that upgrade to see what's going on. So yeah, we can see it first called time, so we saw that call the time, then it's calling srand with the result of that time, then it's calling brand, let's say seven, seven times, sort of one, two, three, four, five, six, seven, scan it, put it in, get care of your data, yes. And then we get, okay, I read that in, it calls mm open, it calls vf64, gio-new, vpush, step-like, three, three, all, close malloc, 53, and then update, that's for your dev to process hash function. And so as far as the easy to start, you're at 14, that's where we are, stack. So, while get charactered, not even when you're clearly missing apps on it, you can figure out what's going on. x, move, variable 20c, gio-to-x, load that, address here, it's in vcx, it's in c1, it's in v5, it's in c1, it's in c5, so it's like, oh, this is what I'm saying, so it's probably gonna be a really complicated instruction, you don't see it, it's gonna work properly. vcx recognition, sort of context, vcx repetition, so for the number of repetitions, vcx in this case is store the contents of vax into a vpi.2 incrementing, or decrementing, ei, that makes sense, oh, it's basically big M-sentence setting, the characters, this part, what it's seen, so basically an M-sent for the character, what it's seen, it's done with that, really calling get character, this loop is just looping over gets into their form. So, f gets, okay, so calling f gets into their x, so what does, so get s, reason at most, one last in the side of the character, so it's gonna read in 3nmx and then put in the last zero, so it can't use any tricks or whatever. So, it's gonna call that, and then it's going to load effectively the rest of the block into vax into the vx, vx, vpi, and then it's going to, so it's gonna set the number, so, just saying I want to have, ask in local block, it's ready to, so then this result, it's basically, I guess the question now is what happened to my foot again, so it looked like it did, so arc zero, so we're argument one, okay, so what I think I should probably do to get a better handle on what's going on and what this data is, is sort of debugging this, it's sort of going through hash, and then we can get a process hash, it's because I know what's happening, and this is essentially calling memset, and it could be that memset, oh yeah, so that's single step, it's called get character. Oh, so this is cleaning up all of the, so I can put the data scan app to read in the character, so I put in the character, then I put it in line, so it's just being simple, right, now we're searing out the dig buffer, so now we've moved everything on the stack, and we look the stack pointer is sort of variables, the call into f gets is this buffer, which is 0804p0p0, so that's gonna be, okay, perfect, so I just actually picked up this trick from an article I just read, doing info symbol on the address, tells you that this is gbump, so we know that that's gbump there, and then, so then we go to f gets the character bumper into the string, okay, so that's gonna read up to 400x characters, I'll just step over that, now it's waiting for 400x characters for me, so what happens if I print through x, so now, if I check that out, now I can see bunches of a's, right, and then I know less than 400, so 400x is what people want, so a good amount of gbups, right, so I just read in all of that, where am I, so now I am in just all that gets, now I'm going to, apparently the code reads and clean my buffer again, I have to call base64d code so the stack has this 0804p0p0 and then this fmfmcfpc, so this is the stack variable that we're passing in the base64d code, so at this point I kind of want to treat base64d code as purely a black box just to see what happens, I may need to dig in here to figure out exactly what's going on, but what I want to know is when I give this 400x in something that's not base64d coded, how does that actually output into my buffer, so of course I didn't sort of move up, so this is the nice thing, you can use the BT or the backtrace to show you the backtrace on the stack so you can move up the stack and then go next instruction from there, so that would, so now that just got called to now the question is I want to look at my stack and figure out what happened and what changed, so if I tried to make, let's say I tried to basically work decode my data, take out the canary, so I definitely overrode it, it broke significantly open, so yeah you can see that my backtrace is completely messed up, okay, so this is good, so I've not only overrode the canary plus, so yeah, I'm just stepping through, so now it's going to take, so what's dax, here dax is two FF, so this is the size, put it in size and then it moves to the stack, takes the edX onto the stack, load effective address, eB minus 20C, okay, so it's going to calculate the NB5 of all those characters, tell us, it's going to calculate NB5, it's going to get the result back, five is probably something we can't, that's when it's going to change because the NB5, looks like the size being passed to it looks like it's calculated correctly, basically for the X2FF, there should be the size of the buffer, so I was wondering what the size of the buffer is, it's fine, okay, so 2MC, so I gave in, 767, okay, so I did try to A64 decode the whole of my A's, so I can give it, I guess I can give it whatever value I want, I guess the question is what's the A64 decode, I can only give 400X, 1024 characters basically for coding, so I can, pretty much control and basically decode the string to inject what I want into the code, the question is, what am I doing with that, so because we have this lovely area, so I should get this action failed, it's clearly this section should fail because I put the free on the free, that string that we just allocated, to EDP minus zero XC into EAX, because the section failed into their second one again, so I actually can calculate the distance between X2 and Y3, 12, the white space is not significant, the work size would be, obviously, the A64 decode, I'm not good to be sure, so what I'm testing here is, again, I control what that's going to be, so 92, okay, so 692 characters we're doing, it's going to be my basic support output, and that'll be decoded into 512 plus four, so that will let me go right there, okay, so I think I'm seeing a path forward, but I want to just look at this, just to make sure my input is correct, but right now, if we look at minus 12, so we can see the canary is 0, 0, 6, E9, 0, 9, 0, 6, and the buffer should, okay, our buffer, we have all of our 61, so we're overriding all of the input, all of the 616161616 and all that kind of stuff, so, okay, so now that we have this problem where we'll keep hitting the stack, right, so now, if I continue, I'll eventually get stack-smatching-detected-action-determinated, and this should be the same case, but I'm not sure that I'll get the standard error, so this is why we have to be careful when we're testing it locally versus not trying to go here, and say, I don't even know what you're up, it doesn't show us, okay, so it says stack-smatching-detected, so I, oh, that'd be 5.0 or 5.0 terminated, okay, so what, so I think I see the way forward now, I believe what we're gonna have to do is, so we have the Canary on the stack, so basically there's, so this Canary is randomly generated when the process starts up, and so the idea is we need to, in order to successfully create a raw payload and be able to control this process, we need to deal with and defeat the Canary, and so there's two main ways to do that, one way is if you, so a process gets a Canary value only when it starts up, and then it gets a random Canary value, so if you have a server that allows you a lot of different requests, and even if it forks your request, the Canary will still be the same in the child port, so there's a really cool, it's called a BROC, or blind BROC, there's actually a way to figure out if you can brute force the Canary bit byte by byte to figure out what the Canary is, unfortunately we don't have that gear because we don't have that continual trying capabilities, so the other way that I'm thinking is, thinking about this whole program and what is the other thing that it does, well clearly this input capture is something that is incredibly dumb in terms of an actual capture, this is not gonna stop a human from detecting this, so what, because obviously it's not gonna stop a program from attempting this because they just copied this in case of the name, but we know that the SRAN function is seeded with time and then the my hash calls ran a certain number of times, so is it, I'm wondering if it's possible to essentially try to determine what's the Canary based on what the hash value is, so if we could maybe, yeah, try to reverse engineer and go backwards, but I'm not sure, so I'm gonna pause it here and do a little research to figure out the different types of ways of working Canaries. End of back, so I did some research, I looked at how Canaries are generated on Linux systems and essentially they're read from dev, you random, so I don't feel like that's the approach to take, and so basically the Canary is randomly generated every time we, it should be randomly generated every time we talk to the process. Going back, let's see, to the service there, shared the same machine with our web service, and why that's input, it's running there, okay, so digging around, I kind of found this calculate decoded length, which is supposed to calculate what the length of the decoded string is going to be, the base 64 string, so that they can, and this is used with base 64 decoding, is the first calculate that, the length of that string to save it as decoded length, which is then returned from the function. This is used in process hash because we're calling this, then we're storing this in the decoded size, then we're passing this decoded size in the count can be five. So I did some experiments and I saw that when we passed in garbage, base 64 values like this, so I believe when I checked this, when we put in garbage base 64, it doesn't actually copy the contents, but what I just had a thought about is what if, so if we can control this value that's base 64 decoded, we can then control this mv5, so we can basically be able to mv5 more stuff on the stack than the actual copy thing. So essentially I'm wondering if this is kind of a hail-nary, if we can essentially leak maybe the canary byte by byte using this mv5 calculation and then calculate it from there, but that would actually require the canary to be constant, but I think this is interesting. Interesting approach, I have no idea if this is gonna leak anywhere. I also look through this stack check fail function to see if there's some way we could maybe corrupt that, and I'm not 100% sure that they're gonna leak it. So it goes. So let's see, I've been thinking about if this decode gets us into this buffer, this buff on the stack, questions I don't really think that anything, anything we want to, I'm not sure we don't believe we don't use anything that goes above that buffer, so we don't, so you can see here that our write is going up, it's the only thing we're gonna over close in an area, we don't over-flow any of the other variables, so. So anyways, let's just see if we can get in some bad values in here, so I was looking up essentially how this decode like is a pretty dense function, so I'm just gonna assume it's similar to this code that I found here, in fact I'm playing times three by like four, so essentially what I want, let's see, I want to give it some invalid input that's not basically four proper coding, I'm gonna see what the input's gonna give this value as a company of six percent, it's a character that has 10 characters, I'm gonna do five data of eight characters on the stack at that location, I remember those have been zeroed out, so this makes sense, so I want this value to be what I want, in a process hash, I want to do five, 12 plus four, basically I want that length to be five, 13, six, 84, so let's see what happens if I do 16, I have six, 84, carbon values, two, two, one, so five, 13, okay great, so this NB five should be NB five with a whole block or everything that's on the stack, plus, and actually I'm just looking at this, so we are basically working, so I wanna look, examine, EVP, so everything is all zeroed out, as you can see, so I should be doing, so EVP, so this address, basically plus five, 13, that's going to include, so the five, 13th byte is, I think it should be the zero byte of, so that's that 80, 204, that should be the same value, it should be beginning, so now if I do a, right before counting NB five, you can see there's gonna be five value of this, 201 character, so value here, step over that, it's gonna return, so that's the string, so I believe this is the same string that I had, and now if I do this, you can get the same value, because I'm essentially reading some value on the stack, so if I do, I can examine the same, and then now, if I want to do, so that was five for 13, if I wanna do five for 14, six for 85, I'm being scared, and so what that means is that this tells us that the last character of the area value is always the zero, zero, so let's restart this, okay, so this then should give us the calculated value is, should be 202, so this is gonna get us the NB five of all the zeros plus the second byte of the variant, so continue, it's 642 code, so now we can see that this is still old zeros, okay, value is gonna be here, so then I continue, it's instruction after that, so actually, the NB five, so now the NB five is different because it includes that value, that extra value, and we'll see that that value should be different every time, so then the question, and really why I'm doing this is I wanna see my connected there server what is this NB five value going to be and it's gonna be different every time because essentially what I'm leaking here is the NB five of all those zeros plus the second byte of the variant, so if it's the same hash value, I can actually break and force that value, so we can see that the NB five now is different and then let's see what happens when we go back one more time, so it is different every time, so this is a good validation on our part that we're not using a static memory, we can see that what we do is in 684 characters, we get this 70 zero A, which I believe should be the NB five of all, but when we give one more character 685, this gives us different NB fives every time we're doing it, so the interesting thing is I could, so if I was doing this in a loop, I could essentially use this NB five and so now basically I can brute force what's all zeros plus all different bytes, I could NB five that's why 256 tries, and so I can figure out at least that byte of the canary and I can actually keep doing that byte by byte if the canary value is not changing, but I know the canary value is actually changing, that is where now we run into this problem where now, so I've validated that that byte is, and even if I say I do like a pre-init attack and figure out all the NB fives of all the possible values or something crazy like that, it still doesn't help me because it gives me this NB five of the data before it's actually, so anyways, this was my attempt, maybe I think the other thing is gonna be to study this, their hash function that they're doing, like so I definitely know that if we go back to the main function, if we go back to main, we know that we're calling time, which outputs if we look at that, this returns the time as the number of seconds that's being epochs, so this is the next time same, so this is a second value, we're passing that to SRAND, which with this value, it's the SRAND value is setting it's arguments as the C for a new sequence, it's for a brand, we see this in our keyboard by SRAND. Yes, okay, so basically the output of brand will be the same, so I believe, let's see if I'm not sure this will work, I think if I do this netcat very quickly in multiple terminals, it should give me this roughly the same value, if I don't believe that it's possible to, I mean maybe I'll look at it, I don't think it's possible to reverse the Mary value based on this SRAND value, but I'll get the thing that's possible, see the leaks are super difficult to hear, I'm not sure how you can get a leak. Get a leak, maybe there's something on this stack that's interesting, I think zero out all of our buffers, so really nothing on this stack that's of interest to us, maybe there's some stuff higher up above the community. Okay, I'm gonna dig a little bit more because it's just gonna be me looking at things and trying to come up with ideas, but before I try anything out, I'll definitely turn the camera back on. Thanks. All right folks, I'm back, so what I've been doing is reading up a lot about a lot of good articles about how to mess with and change the SSP, so I actually think right now I'm on the right track necessarily, so in the sense that I don't think it's gonna actually get me to leak the pointer, but I wanted to play around with it, I think it's familiar with, see what I can change, so we know from looking at the program that we get this stack smashing detected dot slash hash terminated, and the interesting thing here is we get that remotely, and what we can actually do with this is we can, so the way this works is actually by doing a lot of digging, happens is, let's see, fatal, or the fire fail. Yeah, so this is the command that gets called when your check fails, so it calls a libc message, and this too means to execute, and this is the string we're passing in, dollar sign s, which is the message that we're passing in, and then percent s, so the message in this case is gonna be stacks actually detected, and then now it's going to pass in here for the secondary event libc-rv-0, so what that actually does is that looks up in the process, where's rv, and then dereferences that to go to rv-0, and the really cool thing is I calculated up here, I went in debug and I looked at, so this is my buffer that I can overwrite, and this is the target buffer, where rv-0 is, so using this I should be able to change that value, so essentially what I'm gonna try to do is, I'm gonna try to, I can leak some bytes from the remote process, so this can give me some idea about how random the process is being, and how random maybe the libraries are. I honestly don't know that this is going to lead us into a beautiful exploitation scenario, but who knows, we might as well try it in Z, and so while I was doing this, I figured, well, this could be interesting, so even if this is, one of those things where it's nice to see that, hey, try to see all of the bad paths, because this is part of why I wanna do this video series, it's very easy to read some of these walkthrough and just think that these people are brilliant, they just do X, Y, and Z and they get the flag, but oftentimes you have a lot of false starts down a lot of paths, but in the meantime, you're learning a lot of interesting things, so what I'm trying to hear with this script is I'm trying to, so what I realized, and what I'm gonna try is, I think what I can do is basically change the RV value on the stack to point into that global variable, that Gbub that gets all of my data, and from there, I can construct my own RV pointer to leak whatever I want from the process, so I think I should be able to do this correctly if I pass in, so here is, so I'm gonna base 64 encode my payload, that's what's gonna be decoded and copied onto the local buffer on the stack, and doing so will overwrite, so I should have calculated this correctly where I have 512 As in the buffer, then I have VCDE, which is going to be the canary value, and then I have 68 apps to get that up to where I calculated the RV parameter is, and then I get RV, and for now I should put in this value because I wanna see this baby crash, so I wanted to try to dereference that inside that code that we just looked at, and so, and then what I'm trying to do is I'm trying to append essentially a null byte and then my own value because this, the program's using math gets to read in all of my input into the global buffer, so I should be able to put in whatever variables I want in there at the end of this, and I'm hoping it's gonna base 64 decode just the things before null byte, which I believe should work, but this is why we test these things out to see what's going on, so I think with that, I have what I want in line, guess what I do, and so I'm gonna set that line, and then I'm going to see, so this will, I added a debugging clause at the beginning, so it should be a debugger for us, capture. No, we're not actually interacting. See, regex, that on there, you queue a bit, to receive regex, right, let's choose my regex, see where it needs to be, oh, foiled again, my silly capture. Silly but understandable, so the problem was, the end was considered optional because of the question mark, which would be good, now we can read that in, so okay, so the thing I really want to check is what happened to, so maybe we'll examine a lot, we can see great, okay, so we did get our zero byte in there, and this 0804B0B0, awesome, all of that got in there, and then the other stack looked like, so we have our, so here we have 512As, then we have our canary, we just overwrote, which is BCBE, then we have 68Fs, we have our 09807060, so if we continue, we should continue, then we'll get into a, stack smashing detected, which is exactly what we wanted, hash terminated, so let's start this then, so let's go the backtrace, I need to figure out the value, and it's going on, why is my break month not getting set, start the process then, so now that I'm here at the beginning, I can go backtrace, which is the, I guess I need to alter its value, so what's the difference between, there's what's the difference between, we've got to work, we want to write, there we go, so now I got this dereference here, where it is trying to dereference this EAX, okay, so I don't actually have to use, so now I'm changing the arc B zero pointer on the stack, apparently it doesn't use the arc B pointer, it looked that up, it just wants to know where arc B is, and then figure that out, so then the question is, okay, so basically now I can read any memory location, the process, which is really my goal here, so the question is, I want to read the catables, what about like, let's say what's the value here, like what's the underscore stack check here, so it's saying that, that's smashing detected, space, okay, so it's like you're printing out all that, yeah, it makes sense because of those values, so f7, 3B, 60, 80, f7, 3, 5, 20, 6, 0, so this is going to print out all of the, and I guess I could do this entire table, but it'll stop one, obviously it's an old value, so basically it's doing stack check all the way down, so now the question is, what are those against the real program, and do they, so stack smashing detected, and really what I want to do is just like, pair this, space, so 60, 28, so f7, 4A, 28, 60, f7, 4A, 60, 40, so f7, now the question is, what happens when I do this again, f7, 47, 8, 8, 6, 7, 4, 8, so now, read out values, so for instance, if the flag was somewhere inside this binary, then it would be very easy to see that we could then read the flag out with this exploit, because now here we're leaking bytes from the process, the key problem though, is that it's clearly killing my application, and so that is not too good, so the question is, how do I use this to then control the structure pointer? Because I can read memory right now, but I can't actually write out memory, so I think now that I've proved that this does work, and I can leak out memory locations, that's good, but I need to do, and I did, so I guess I should, I did go through and look at my hash function, I know it must exist for a reason, I think that's the one thing that really makes sense, but it's pretty clear, gets the hash, uses a buffer on this, it creates a 32 byte buffer on the stack, and then it calls ran, and it puts, so 32 bytes, it does eight, four bytes of random integers, and then it creates this, so you can see the return value of dax, which is a far 30, I think it's in the sense of counter or simulator, and it's ebx, so it's the 16th four byte offset, minus the 18th four byte offset, plus all of these other additions, so it's basically combining all of those values that have attracted to try to come up with one value, and of course, so one of the things that you could do is you could say, hey, is this, and because we know that this is seeded with time, so we know where this is called, hash, it's called here, it's seeded with the current time, so you could figure out the current time just by, you know about where it is, you can use brute force, a bunch of values, and keep trying, but I don't fail to see how this actually helps you, and furthermore, once using, so yes, this my hash will create some values on the stack, I tried looking for the canary before we do our overflow, and see if we can find the canary anywhere else that maybe we could try to, I would fit some interesting things online that had a CTF challenge walkthrough where they tried overriding the, so looking at the, if you could corrupt any of the other values afterwards, if you could print out the value that you could control like something on the stack, then you could control the argument to the format string, then you could do a print death order though here, but I don't see that here, so I think for now I'm gonna address and work on this while today, so we'll see and I'll pick back up at the later point, thanks. All right folks, I've made a breakthrough, so basically I spent the time thinking, and actually not thinking about this project, and doing other things, I'm just about to start dinner, and I said, you know what, let's go back, look at it for a little bit, and I was just thinking, okay, so we're in this program, what are our inputs to this program, and so I was like, okay, maybe I'll review this MyHash function, and I remembered something that I had thought about, but I didn't think about it at the time, so the interesting thing when looking over this, you know, this is a slightly complicated function, P2 plus four plus 14, one thing I didn't notice is that, I mean I did notice, but didn't mention or pop the forefront of my brain, is that this, okay, is that the, there is no P2 above zero, which means I thought, hey maybe there's an overflow here, and that the canary is actually being leaked in this hash to us, and further on when I thought about it, I thought, oh, that actually makes sense because we couldn't get it to where it would give us the same canary if we did it at exactly the same time, so then I just quickly tried to debug that to not debug it, but to verify my assumption, so what I did was I put a break point at the beginning of MyHash to fetch out the canary, where you can see here this execution in the canary is 339C0500, and then I set a break point right after where it's accessing this, and it's accessing 00005339C0500, so what this means is this means that the canary is actually being included into the hash that's being set out for us, and so because this is all just a mathematical formula to get the end value, what we can do is we can actually end, and because it's being seeded with time, we know that we can predict that, which means we can predict all of these random values, and which means we can ultimately get the canary, so this is super awesome because I can definitely see a path forward now, so the idea is going back to our 95 calculator, okay, so the idea is with this input capture, this is the goal, so we need to be able to, and this may need, we may need a few times to do this because it depends on what it thinks is the kind of time and I think the trick I'll use is that we'll use, we'll be executing this exploit from their server, so that that way it'll be really, really quick, and we obviously want to check this locally to make sure we can do this locally, so now what we need to do is essentially, okay, what we'll need to do is get the same, be able to get the same variables out of the brand, the question is, the question is the Python random the same but see if not I need to do some, so I need to make sure that I get exactly the same, that we still have a lot to go, so hopefully I'll be able to do that. But if this and this go around, we're like, honestly I'm super tired about thinking about the problem, but now I'm really stoned, and we're good, let's see that, so it's, I mean, using the same random number, very, very easy, I really dug deep into the, it's good to report that my investigation is just typically, the areas are secure, so I basically have to try to do the 24 bits of entropy, so if you have the first byte, the area is only zero, so it would have required 16,000,000, so it's not something that's one zero. Strongly believe this is an important first step, it's so terrifying that what, because if we're not generating the same random values, we're gonna be so close to, we're gonna be like, good, they're the same, awesome. Cool. So we can use this, it's a g-w-c random number generator, the trick is what are we gonna do is we're gonna try the prime time and just see if we're, right at the new times. So, g-w-c, just like that, so, okay, 4 bit, I think we want to get some, it's all we're gonna use, around 30, so we're gonna keep it at, around 30, so it's two plus, 3 plus value 4 minus 6. I'll be able to easily test this once I've got this done. Test this in a number of ways. Without the solution that I have, I can work in all the kind of time I'm debugging it. I can plug it in here and test these. So they're going to definitely want to do that. So the result is equal to 5 puts values 1 to 2 minus values 3, 1 to Mary, 1 to value 7. So this is the song, this is the song, basically the form. So I can't do the song, I can't do the song. This is welcome. OK, and of course, if I'm making a math mistakes, I will be super embarrassed later on. Actually, I'm 7, so I believe, let's say, I believe I have the values here. So I should be able to say, take this here I got, basically, I'm going to do the second memory. So now I need to verify that I've been working. This should be my hash, this should be my math. Ooh, I've got sql, see all. So now that we've got 3, so basically I have, I think it's probably the result of getting all of those over close and everything correct. So this is just, is there a relation between this and sql? It did work. It's an unsigned thing. Oh, OK. Now we've got in-patch, so we'll check this. And this is good. Now I'm going to find that slip check. So we've got the binary process hash function. So let's see if we can be done. This is where the sql registers. Oh, perfect. OK, yeah, this is super easy. Microphone in my segment. So I was thinking, OK, what's on the stack? So what's going to be the argument to? Obviously, we control it on the stack and we know we can shove additional data inside of our base 64 encoded payload. So we can figure out exactly where that it is. We can know exactly where that is in memory. That's the fixed memory location. We put that on the stack. And then now we've jumped to system. So now we're going to jump. It's second-�all because it can't read what that really didn't bring to view. So I do want to call system. We'll call system. And after that, so we'll get to system. System will make that, so it will be a ret. So it thinks that the next value should be the jump. So the next value will be the return value of where system will return to. Obviously, we don't want system to return anywhere. All of this base is even more encoded. So that's only exactly where it's at. So we go for the return to system. And we can see that we have this big, the same VIP. And then on the second-�all, it's a call. What's the deal, yo? OK, so single step. So it's the OT and input system. Since it's getting single step, you can do program in dash. So awesome. All right, so I think if we run this within their system, it should be good. Let's try this remote. If I'm calculating this to be in real time, it's going to be all good. So it's going to be a really good example of the stuff that we're doing with this. So I call this, it makes a lot of you learn some things. I don't know how you do it.


l right, 30 all another point As draper serves another let By the way, don't give away any scores if you do you will get timed out for five minutes. So just don't do it Second serve for draper is a fault. I'm sorry first over the fault second serve now second serve Into the back of the Diminore phone ever draper is wide and Diminore gets a match point 3040 Alex Diminore To take one for the Aussies again He's our man He's our main man. So I mean go if we lose him. We've got no We need him Match point Diminore serve him draper Here's a fault second serve draper He serves in the back of the Diminore back in ever draper into the back end of the demon as draper into four hand in To the back of the Diminore again to the fauna draper Diminore with the backhand again to the back end of draper into the fauna Diminore for now from draper is wide and Diminore gets a win It was a battle And look, I gotta give massive credit to draper He is a lot of fun.  I think he's a really fun player left-hander. He's kind of like Shapo, but more consistent But he ran out of legs against the demon and Diminore takes the win But man, that was not easy and I think draper in 12 months time. He might have won this match. So But I like draper. He's a good player very good player That second set tiebreak though. That was the difference But yeah, we'll take the win. We'll take the win demon demon fans will take the win But no good Unlucky for draper. He should have won that second set And he made me nervous.  That was nerve-wracking He's a player though. Definitely a player All right. Yeah, let's go to the demon. Let's go Said them in a four nice That was a fun match to watch. Yeah Now I liked I think draper is gonna be a lot of fun Katie boulder by the way getting a getting a lot of hugs by randoms You can definitely see the potential. Yeah for sure for sure I'm a person my life that she wants calmness in life. Okay? positive energy fair enough Her oh you're talking about tan. I'm confused. What was going on? Yeah, congrats to us congrats the Aussies. We got one back We got one, but it wasn't it. That was not easy. That was not easy but um Look draper draper is definitely an excitement machine and With a little bit more consistency this dude's gonna be scary. He's got a great serve that that lefty serve is a weapon and He's gonna sign there. He's gonna sign things even though he lost and that is just a that is a sign of someone who is a very Very good guy signing autographs despite losing good on him Congrats on Alex's win. Thank you Maria for the five All right By the way again You are leaving us. Don't forget to subscribe. Thank you for humoring us. It was a bit of fun today We set up with quality shot we talked about How we could make things a little bit more fun for you guys and I appreciate all the fun Yeah, exactly quality shot credit mate I'm glad thanks for playing along mate and having some fun to be honest It wasn't really a that fair of a fight.  We can go double enough and I'll put it on the line for against Brody But look again, it was all fun and games. So hopefully Hopefully you didn't take it too personal my my my banter and if you did It's all right. You'll be you'll you'll be fine. It's only words But yeah, appreciate it Thank you and thank you for quite a thank you quality shot for playing along and mucking around with us Go subscribe to quality shot tennis if you haven't already But it was big day big big day tennis Brody was great to watch today. Yeah, great tennis all round and we'll talk. We're talking the discord We'll talk offline quality shot whether or not you want to go double enough and Thanks cam even though you made me more famous by calling out my name big time Hey, look Lexi. You're one of the regulars. So I think people know you anyway, but You're also one of the people that got one against me. So I'm gonna I'd have to find out where we are you all hiding at some point one point everyone disappeared Tomorrow we're watching jokovic Jabal Elk res I don't know who else but others will be played so we'll probably cover a few more matches I'll be not and I'll not be draping the Union Jack over my door today Look, you did it. Bolter got a great win. So did Brody. So you know, it's not a bad day for the UK worst day for Canadian but You know Wasn't a terrible day for the UK. He's still got some dubs Ben is good. Most people support their country At least most of the time. Yeah, I love banter. I love it. I love the I love the ban I love I love that you guys got around it Imagine deminol vs. Keroson quarter finals. Whoa. Yes, please Joining in from Sri Lanka at two in the morning good. Good. Good. Good. God Thank you staying up late Can I placed four bets and made 15 cents you love to see it? Congrats Thank you for the five But then you just spent it all on the donations so you should have just written in the chat But thank you congratulations to you. What else we got? We're gonna stick around for about Well, we're gonna stick around for a little bit longer because why not? It was a great day for the UK. Yeah, look Bolter beating Pleskov was a huge win And I think Brody beating Schwarzman was massive too. So it wasn't it wasn't a terrible day Watson won as well. I mean we forgot about her. So You took three dubs Let's do it again with Russian YouTube commentator and his players all wait Come on too soon too soon too soon The banner around this game made it worth watching. I felt like I had a skin in the game so fun. Yeah, that's a lot Most of the time break a draper versus deminol. I don't think people would have been bothered But I'm glad hopefully it made you care about it That was the get that was the aim of today was to hope to get you guys Involved a little bit more than usual make you actually have have some skin in the game So I hopefully that that was what happened today get you guys get you guys Into the matches that maybe aren't as popular as the big boys, you know I think odd auto has a great chance that Elkhraus tomorrow. Yeah, I think so, too Granovich lost to curious. Yes, he did. I'm a little overwhelmed. It's only day four Yeah, it's a it's been pretty hectic the first four days for sure No, you could certainly make the cities Yeah, no, he's got a good draw for sure. He's got a good draw I made plenty yesterday and you provide great background noise while I was at work support the channel Thank you class appreciate it. No orders making fun of it But thank you appreciate that Otter's gonna take out Elkhraus. Oh All right Happy that you guy won got the L. I got the dub. Yeah. Thank you appreciate that Crested him and all well done drape.  So, you know, he did well to almost beat him and all you know Time to exercise some wheels says Dawn. Okay. Good luck Watson good chance tomorrow only you've on that's gonna be interesting great call of the day sleep well pleasant Thank you. David appreciate it Johnson could beat Norrie Maybe I mean, I think Norrie's gonna I think Norrie has a great chance and he's not gonna waste it. So What was the Aussie versus Brit score? 3-1 I think today was a treat. No, I think it's 3-1 in the in the tournament so far Ozzie's he's got three wins to one loss Murray beat Duckworth Kubla beat Evans deminore beat Draper and I think there was another Aussie battle as well. What was the other ashes battle? I know we had another one as well Kira's beat job Kira's beat job So 3-1 to the Aussies But we still got another battle Alex deminore takes on Brody. So there's another one there And possibly Tom Janovich might take on a Brit which could happen. I think So 3-1 Aussies in the lead at the moment Deminore will go through if he plays like he did today No, I'm sorry. I mean, I'd love to see deminore get to a quarter-final finally. I Miss buddy at Wilburton. Yeah, I miss that too. I miss buddy Forget Kubla slapped Evans. Yeah Steph and Thompson. Yeah, but Steph's not British. We're doing the battle of the Brits Aussies in the Brits Thank you Deb appreciate it Deminore should beat Brody Okay, I don't want to get too ahead of myself He made the quarter-finals of us open. Sorry. I would love to see you make another quarter-final Put some food in your fridge so you can eat more than toast to sustain energy I haven't even eaten toast today We've been live for 10 hours and I've any I've eaten a banana and a drink of tea No, that's all right, Val, you might have just joined When is your boy versus pair a parry one-handed backhand versus drop shots gonna be a lot of fun Yeah, tomorrow At some point Tommy Paul minus two hundred over the big V. Yeah, I Mean the big V is coming over five setter. So he might be a little tired Did you realize that if you live in Western Australia get two or three more hours sleep? What I'd be going to bed at like What five in the morning? There's no difference between four in the morning and seven o'clock. I mean for me.  Yeah, of course Cam is a stamina of me Farrah when it comes to streams, it's just I mean, what else? What am I supposed to do? You gotta sleep? What would I do that? Who are the favorites now besides the big two? Sidney pass probably Who's winning Kira's or Steph? I think Kira's can win in five, but I I mean Sidney pass a Mo Farrah Mo Farrah. I don't know who that is. Yeah, I Can imagine doing all this Kira's caught a final would be epic. There'll be five sets all day Are the bad lines people Tim Hanman's fault Thank you. Well, how are they? Why? Rowdy, why would they be Tim Hansen's fault? Thank you for the donation Can you survive without no sleep due to his golly abilities? No, I'm just I'm just silly She'd always sleep Don't don't copy me It's not a good way to live Is Mia awake? Mia is on holidays. Mia's gone down to my parents for the week because of my stupid Sleep schedule so she's actually getting spoiled down at my parents for the week Do you add I think mom and dad took her out yesterday to have a Bath in a groom so she got she's getting super spoiled She's having a great time down there. You suffer for your art. No, it's not a suffer It's not work if you love it, right? It's only work. It's only work if you're not enjoying it You know or if you're doing it for the wrong reasons, then you're like slaving over that. This is not work This is fun. This is fun. So I don't feel any of that You know I've worked many jobs where it's like I'm working for the money or I'm working for the paycheque and It's a grind this. This is a pleasure. This is a privilege. You know for me. I'm very lucky But I get to do something that I get to do something. I love, you know, watch tennis scream and shout support Players and have fun and chat with you guys and muck around. It's an absolute privilege. You know 10 hours 10 hours a day, I love it and exactly I would have been up anyway Illinois, you're exactly right. I would have been staying up anyway to watch all these matches Even I didn't have a YouTube channel. So that's what I was doing five years ago before I started this channel. So Yeah, it's why this channel exists because I was watching matches alone Merca or Yelena, I don't care about that really Thoughts on Flipkins playing her last Dennis match. Yeah Sad, I guess retirement said boys sad to see but I think she had a good career. She was a good doubles player too, right? No worries Laura Hey, thank you. We're a man for the 10 appreciate that Um Tim Hammers the tournament director is responsible for picking the lines people. Well, there you go So I guess imparted is his fault Thanks, can't know where he's Dutchy. We'll see you later. Have a good one Maybe they've getting angry. Yep The BS Russian one of her faves. Oh, look at that. The Sun's coming up. How beautiful What a beautiful sunrise. I'm gonna go to bed Thoughts on Monica Salas unique play style. I never watched it. So I can't really comment I don't have anything to say about it Thank You Romero appreciate it. I hope you get a million subs soon. That'll be that's the goal I mean like, you know 100k will be awesome and it's unthinkable, but I want to try and get to a milli I mean, why the hell not right?  Yeah, I do as well Why don't we have osteopenco memes or gifts? Um? Yeah, we might have to get some right. We might have to make some Sooner or later the tippers will be great to cross maybe this year. Thank you for the two. Maybe this year Maybe it's this year Gascade one. Yep. He did win No worries to death appreciate it the referee picks the lines person you Need to do a better job choosing. Yeah, they I mean, I don't think the referee picks a lot I think the lines people at this round open they go on a rotation basis So I don't I'm yeah again. It's again the lines people have not been good this year for sure a lot of mistakes. I Understand that I meant I missed that one Is okra is on the upper half of the draw the lower half he's up the top in the jokovic section quarter-final with jokovic on the on the cards What do you think about personality of city pass? I I mean he's different and I don't mind different difference good I mean, I'm different, you know, I think difference good being the same is kind of boring, right? You know, if you're just trying to you know, do what be the same as what you know You know, if he was the same as everybody else, you know, if he was the same personality as every other tennis player ever existed He'd be boring. So I like it. I think he's unique. You know, he's got his own way of thinking. He's got a different brain a Bit a different way of thinking and it's interesting. He has very interesting answers to questions Unbelievable unbelievable unbelievable unbelievable unbelievable. I don't care about what they were saying. Hey, thank you peaches for the five Appreciate that. Thank you Why not replace Hawkeye completely with place them with Hawkeye completely? I Like the lines people being there, but I just hated them making so many errors Like easy.  How are they missing these? I Get the whole like close call, but when it's like really really obvious. It's crazy All right, everybody. I'm gonna sign off because I am Knackered but before we sign off Before we sign off. Let's have a look. Let's go through the recap of what's happened today So So about a lot of matches today We've had a little bit of an interesting day today with a couple of sets here and there but Most of the big guns getting through but dropping some sets So let's start on the women's side with the results from today So Igor Shriyantek number one in the world. She won in three sets very tough match for her against a lucky loser LPK as we know her now. She goes on to the next round plays corn a We also had Pagula the number eight seed winning in three sets as well against Dart Paula but also she won in straight sets in the fourth number four seed there So I'm going to help also winning in straight sets the number 16 seed Kavitava 25th seed she won in straight sets as well Biggest upset of the day on the women's side was plush Kava She lost to Katie Bolter in three sets number six seed who was the finalist of last year. She is gone and Big big upset but great win for Bolter over on the men's side We had Rafa Nadal. He played a three a four-set match against Barencus Again, Rafa just getting through in four sets. I don't know if you should be worried or not But Rafa gets through so he's through the number two seed We also had Taylor Fritz number 11 seed getting through in straight sets Stephanos Sidney pass beat Jordan Thompson in straight sets with Nick Kirios winning in straight sets against Kronovic Those two guys play each other in the next round Shapavalov He lost number 13 seed semi-finalists of last year lost in four sets to Nakashima And they were the big matches From the day big matches Seeds are falling all over the place Now tomorrow we have some big matches happening on the center courts Starting with center court Jabour. She's taking on parry the Jabour the number three seed Then we've got Djokovic number one seed taking on the 25th seed catch Menovic and Followed by Norrie the number nine seed taking on Steve Johnson on court number one We've got Heather Watson taking on you van followed by Kerber the 15th seed taking on Mertens the 24th seed Followed by the number five seed Elkara's taking on Otta the 32nd seed and on court number two We have Tiafo the 23rd seed taking on Bublik followed by Sakurai the fifth seed taking on Maria Followed by probably the match of the day tenth seed sinner taking on the 20th seed John Isner So they're big matches tomorrow.  Of course Let me know though on day four. What was the biggest shock for you? Was it the raffle lost another set? Was it chapeau going down? Was it maybe I mean Shriontech was a massive shock for me that she had to play a long extended match against a lucky loser, but You let me know what do you reckon? What was the biggest upset of the day or maybe the biggest surprise for you today? Okay What about the memberships? I'm sure we'll get I'll have a chat with quality shot YouTube's a little bit weird with membership. So we'll try and figure it out and Figure out we might do double or nothing if if that's something that Quality shot wants to get into but well, I'll chat to him and we'll figure out won't be today It might be tomorrow the next day, but you met the memberships will get we'll get paid and full at some point I'm sure if we can figure out how to do it All right Mega stream tomorrow. I don't think we need to do a mega stream tomorrow because The matches that are happening that are the big bus blockbusters. They're all sort of happening at different times So we might not have to do a mega stream tomorrow Today we've done double headers back to back to back. So we've watched six big matches, but yeah All right, Chauncey versus DuBois final, maybe Yeah errors for memberships. Yeah, it might be errors. So yeah, we'll figure something out Is this versus a sinner match is gonna be awesome. Yeah, we'll keep it on that one Last year's women's finalist losing what a shot was a shock. Yep, Pushkova party Sabalenka all out of the tournament. So a lot of big names and then her catch Shapa Valov and Baratini out on the men's side. So it's it's yeah, all the semi finals are losing on from last year or Not playing from last year We'll keep an eye on Paul versus the big V. We won't watch that exclusively, but we'll keep an eye on it for sure When are we starting tomorrow? I have no idea, but we're gonna be starting at some point. So make sure you Put the notifications on so you know when we go live Auto versus it Alcares is gonna be a massive match. Yeah, for sure FAA is gone as well. Yep quarter-finals of last year's very Obviously Medvedev as well not not here Federer not here I'll be a had Cobra. Yeah, I'll be a put up with Cobra. Unfortunately Doubleheader seemed light compared to the mega stream. Yeah, doubleheaders are a little bit easier for me I guess but still tough. I just want to watch one match by itself. Can we do that tomorrow? I want to just watch one matter at a time tomorrow just to kind of give myself a break from Screaming constantly for 10 hours on end with no break Yeah, buddy's in New York City playing golf.  I don't know what's called Who got the gift of membership just now? Oh MGG thank you so much for coming a member appreciate that Yeah, thank you oh Hang on a second it worked Seraph Thank you so much for the five gift of members We got dreamt Curos Brian MG and Min all got members. So there you go There you go, welcome to the goat club everybody who just got a membership on behalf of Seraph so there you go. It does what it did work. There you go. Congratulations To the five lucky web three Gifted from you gifted the members. Hey, man. You're one of us now. You're in the goat club now and so is MG and dreamt Curos and Brian So congratulations guys welcome welcome to the goat club. That's it goes in the chat.  Thank you both Seraph is a six-month member For gifting some members appreciate it.  Ah bugger I think some of some of the memberships would have expired because it's only a month So if you're a gifted member it expires after after a month, but you can use all the emojis and you can use all the Whatever you can jump in the discord you get access to the discord forever. So jump in there the private members on the discord It's reasonable 30 in the evening where am I where I am okay for enough cool All right I'm out of here. Thank you everybody for sticking around.  I know that I mean Diminel one Diminel wins in four golf wins in straight sets Rafa one in four Shriantek one in three sets and It was a big day day for Done day five coming up tomorrow.  You deserve a rest and I'll move you back in about Probably about 12 hours time to do all again, but day number five a day for done Big wins from Diminel golf Rafa and he gets to be on deck there through I'll see you tomorrow


Hello and welcome to the session. In this session we will discuss about the vectors, a quantity that has magnitude as well as direction is called a vector. This is a directed line segment which is denoted as vector a b or simply we can say vector a and this point a from where the vector starts is called the initial point and the point b where the vector ends is called the terminal point and the distance between the initial and terminal points of a vector is called the magnitude of the vector which is denoted as this or this or we can simply write a. Next we should discuss about the position vector. Consider a point p in space with coordinates x, y, z with respect to the origin o, 0, 0, 0. Then this vector o, p with o as the initial point and p as the terminal point is called the position vector of the point p with respect to the origin o that is the position vector of point p is given as vector o p equal to vector r equal to x i cap plus y j cap plus z k cap and the magnitude of the vector o p is given by square root x square plus y square plus z square. Next we have direction cosines, alpha is the angle made by the vector r with the positive direction of x axis, beta is the angle made by the vector r with the positive direction of y axis and in the same way gamma is the angle made by the vector r with the positive direction of z axis. So these angles, alpha, beta, gamma are the direction angles and the cosine values of these angles that is cos alpha cos beta cos gamma which are also denoted by l m n r d direction cosines of vector r. We have cos alpha is equal to x upon r where r is the magnitude of vector r. So from here we get x is equal to l r since l is cos alpha. Then we have cos beta is equal to y upon r. This gives us y is equal to m r and cos gamma is equal to z upon r. This gives us z is equal to n r. So the coordinates of point p are given by l r m r n r. The numbers l r m r n r proportional to the direction cosines are called the direction ratios of vector r and they are denoted by a b c. So these are the direction ratios of vector r. So from here we get a very important relation. l is equal to a upon r, m is equal to b upon r and n is equal to c upon r. This is a very important relation. Next is the types of vectors. A zero vector is one in which the initial and terminal points coincide. This is also called null vector. It is denoted by this. A zero vector cannot be assigned a definite direction as it has zero magnitude. A vector like vector a a or a vector b b represent the zero vector. The next is the unit vector. Unit vector is one whose magnitude is unity. A unit vector in the direction of a given vector a is denoted by a tap. Then we have co-initial vectors. Two or more vectors having same initial point are called co-initial vectors. Then collinear vectors, two or more vectors are said to be collinear if they are parallel to the same line irrespective of the magnitudes and directions. The next is equal vectors. Two vectors a and b are said to be equal if they have the same magnitude and direction regardless of the position of the initial points and they are written as vector a equal to vector b. Next is the negative of a vector. A vector whose magnitude is same as that of a given vector be it vector a b but the direction is opposite to that of the given vector. So if we are given a vector a b then negative of vector a b is b a. Next we discuss about the addition of vectors. A vector a b simply means the displacement from a point a to the point b. If you consider this triangle a b c now let displacement from point a to point c given by vector a c would be equal to the displacement from point a to point b that is vector a b plus the displacement from point b to point c that is vector b c. So when we add two vectors we see that the initial point of one coincides with the terminal point of the other. This is the triangle law of vector addition. Now when we take the sum of the three sides of this triangle in order that is we have vector a b plus vector b c plus vector c a their sum is equal to zero vector. If the two vectors a and b are represented by two adjacent sides of a parallelogram o a c b in magnitude and direction then their sum that is a plus b is represented in magnitude and direction by the diagonal of the parallelogram through their common point. That is the side o a of the parallelogram is the vector a side o b of the parallelogram is the vector b and the diagonal o c of the parallelogram o a c b is given by the sum of the two sides that is vector a plus vector b. This is called the parallelogram law of vector addition. Next we have the properties of vector addition. The first property says for any two vectors a and b vector a plus vector b is equal to vector b plus vector a this is called the commutative property of vector addition. Then next we have for any three vectors a b c vector a plus vector b plus vector c is equal to vector a plus vector b plus vector c and this is called the associative property of vector addition. Next we discuss about the components of a vector the position vector of the point p with reference to the origin o is given by vector o p equal to vector r equal to x i cap plus y j cap plus z k cap this form of any vector is called the component form of the vector and here x y z are called the scalar components of r and x i cap y j cap and z k cap are called the vector components of vector r and whenever we have a vector a lambda be any scalar then the product of the vector a by the scalar lambda is given by lambda vector a this is also a vector collinear to vector a now the magnitude of the vector lambda a is equal to modulus lambda into magnitude of vector a now addition of vectors and multiplication of a vector by a scalar together give the following distributive laws according to which we have if a and b be any two vectors k and m be any scalars then k multiplied by vector a plus m multiplied by vector a is equal to k plus m multiplied by vector a whereas we know that k and m are scalars the next property says k multiplied by m into vector a is equal to k m multiplied by vector a the next one is k multiplied by vector a plus vector b is equal to k multiplied by vector a plus k multiplied by vector b and also one very important point is that the unit vector of vector a is given by one upon magnitude of vector a into vector a suppose we have two vectors vector a equal to i cap plus 3 j cap and vector b equal to 2 i cap plus 4 j cap then vector a plus vector b is equal to i cap plus 3 j cap plus 2 i cap plus 4 j cap equal to 3 i cap plus 7 j cap let the sum of these two vectors be given by vector c now if we need to find the unit vector in the direction of the sum of these two vectors that is we will find the unit vector in the direction of the vector c so for this what we do we find the magnitude of vector c which is given by square root of 3 square plus 7 square that is equal to square root of 58 so the required unit vector c cap is given by one upon magnitude of the vector c into the vector c that is equal to 1 upon square root 58 into 3 i cap plus 7 j cap that is c cap is equal to 3 upon square root 58 i cap plus 7 upon square root 58 j cap next we discuss about the vector joining two points if p1 with coordinates x1, y1, z1 and p2 with coordinates x2, y2, z2 are any two points then the vector joining the points p1 and p2 is the vector p1 p2 which is given by vector op2 minus vector op1 from the triangle law of vector addition and this is equal to x2 minus x1 i cap plus y2 minus y1 j cap plus z2 minus z1 k cap this is the vector p1 p2 now the magnitude of vector p1 p2 is given by square root of x2 minus x1 the whole square plus y2 minus y1 the whole square plus z2 minus z1 the whole square suppose we have two points p with coordinates 2 3 0 and q with coordinates minus 1 minus 2 minus 4 then the vector joining the points p and q directed from p to q is given by pq equal to minus 1 minus 2 i cap plus minus 2 minus 3 j cap plus minus 4 minus 0 k cap this is equal to minus 3 i cap minus 5 j cap minus 4 k cap this is the vector pq next we discuss the section formula we have two points p and q position vector of the point p is vector a and position vector of point q is vector b then the position vector of point r which divides the line segment joining the points p and q internally in the ratio m is to n is given by n into vector a plus m into vector b upon m plus n and now the position vector of the point r dividing the line segment joining the points p and q externally in the ratio m is to n is given by m into vector b minus n into vector a upon m minus n we are given the position vector of point p as i cap plus 2 j cap minus k cap and position vector of the point q as minus i cap plus j cap plus k cap and the ratio m is to n is given by 2 is to 1 that is this is equal to vector a let this be equal to vector b then the position vector of r dividing the line segment joining the points p and q internally in the ratio m is to n is given by n a that is 1 into i cap plus 2 j cap minus k cap plus m b that is 2 into minus i cap plus j cap plus k cap upon m plus n and this is equal to minus i cap plus 4 j cap plus k cap upon 3 this is equal to minus 1 upon 3 i cap plus 4 upon 3 j cap plus 1 upon 3 k cap this is the position vector of the r dividing the line segment joining the points p and q internally in the ratio m is to n this completes the session hope you have understood the concept of vectors addition of vectors and multiplication of vectors


Okay, well, welcome to the wrap up session of the Q3 hackathon in 2020. Again, it looks like this is going to be another record-breaking hackathon with thanks to all your contributions. So I'm just going to spend a few minutes just wrapping things up. Obviously, if you're in the Pacific time zone in the U.S. like I am, I still about nine hours left in the day. So expect more contributions to come in for people mostly in North America as in Europe and APAC and other regions is already the September the 4th. So just a quick recap. I mean, first of all, thank you not just to participants who contributed MRs, but people who led office hours or tutorial sessions. I mean, all of it was done basically on day one like, like to just have those mostly in day one so people have a chance to watch them and work on contributions. So I mean, after the kickoff session, we had a couple of office hours from the runner team with Steve reviewing a couple of MRs. One of them was actually on documentation, which I'm glad Steve selected because that showed you some of the review. I mean, part of the review process that's involved in documentation. A lot of times it involves feedback both from like engineers and also from technical writing team who are more of like technical document experts in terms of like a grammar and documentation style, but sometimes in some cases they need to check with the engineers to check the validity of the documentation update. So I think one of the examples show that and he reviewed another one in the second half of the meeting. So I mean, recordings all posted on YouTube channels, but you can access it directly on the hackathon page as well. So feel free to watch the recording if you're interested in contributing to runner in the future. On the package office hour call, we actually had a couple of like very active contributors who were able to look at some of the MRs that were sort of in the queue for review. And actually we found out there were about four or five of them that the ball was sort of in our cord in terms of reviewing. So we're able to sort of repeat the reviewers to get those process going. And Tim also talked about some of the things that are up and coming in where we want community members to help us with. So we had good discussions there. And the next office hour was with Sam and Jeremy on migrating pajama components. And if you haven't watched the recording, I mean, they talked about not just the UI and front-end side of things, but Sam actually walked through a demo and showed that for, I mean, one of the epics they have, I guess they have two epics for pajama components. And I think between two epics there are about 1,000 issues. And Sam picked up one of the issues and in about 10 minutes he was able to complete submitting an MR. So a lot of the MRs we've seen a lot of them come in to really take like a 10, 15 minutes. So if you still have time to work on something if you're interested in front-end or UX, go watch that video. Or I mean, even after hackathon, I mean, like I said, there are about 1,000 issues. So plenty of other things that you should be able to work on. And release management. I mean, Jackie, she's a product manager for release management group talked about release management stage in general, but also areas where we want community members to contribute. And we also talked about some of the triage and review process within the release management team as well. So I encourage you to get to know more about release management and some of the things that we look forward to creating members contributing to by watching the recording. So that's all on the, they're all posted on the hackathon page. So this is a screenshot that I grabbed like a few hours ago. So moving right along. So, yeah, so this is sort of the running tally of what we accomplished so far. And if you look at issue number 41 under the hackathon project, we have a list of, I mean, at the top, you'll see a list of issues that we encourage community members to work on. And then we also have a running inventory of MRs that have been submitted. I hope, hopefully I didn't miss any of them, but it won't surprise me if I go through my inbox again. There are some items that I missed, but as like 30 minutes ago, I think there were like a 243 MRs submitted and the day is not quite over for a lot of places. But so, I mean, already we surpassed the record from the last hackathon, which actually, obviously, I'm very happy, but so much surprise. I wasn't quite sure if we will hit across the 240 threshold even this morning, but we did. So we're at 243 plus. And out of the 243 MRs submitted, 75 have already been merged. Like there's a couple of hours ago, I haven't checked since then, but so already a lot of MRs been merged. So thank not just the contributors, but reviewers who promptly reviewed and merged MRs and provided feedback when necessary. Just like in the past, MRs were not just for the main GitLab project, but other projects in GitLab like charts, runner, Giddily, GDK, GitLab UI and our website. So definitely appreciate community members contributing to lots of different parts of GitLab. And like I said, it's very possible that I may have missed your MR. I apologize if I did that and feel free to ping me like on the issue or find me on Gitter and let me know that your MR is missing from the list. I definitely don't want to lose track of any of those. So just let me know. So probably the last slide here, but just a few more like the logistical stuff. So on prizes, you again have this screen shot of the prizes available for grand prize and second place prize along with the merge MR prize, which is given to everybody who has MR merged by the 15th. So the only like one of the things that we try to do is be respectful of everybody's like a time zone. So we didn't specify like which time zone that you're supposed to be working in while you're submitting MRs over two days. But the one deadline that we have, the applause for everybody across all time zone is September 15th at 2300 UTC. So check your time zone. So what 2300 UTC translates to, but your MRs must be merged by that time on the 15th. Ping us if you need any help by meeting that deadline for whatever issue, whatever reason you have issues getting things merged. Because I mean it's possible that there might be delays for whatever reason like the review process wasn't swift enough or responsive enough. Just let me know and then happy to make exceptions if needed and if it's appropriate. So keep that deadline in mind. And the hackathon date for key four. I mean, I think why I like this is, I mean, I like doing this hackathon in the early part of the week. I'm not close to the 22nd, like near the release time. So I think reviewers have a little bit more bandwidth. So I'm going to stick to the first week of the month in December. So for those of you in the U.S., it'll be a week after Thanksgiving, I believe, and a few weeks before people go up for the Christmas holidays in many places. So keep December 2nd and 3rd in mind and I'll probably update the hackathon page sometime in the next few days. And as usual, I'll look for announcements on Gitter, Reddit, LinkedIn, Twitter and other social, or whatever other social channels that you pay attention to follow, to follow GitLab. I'll be making announcements. And most importantly, if you have any like a feedback from this event or suggestions for the next hackathon, including like tutorial session topics and others, please let me or David Plinella know, either on the GitLab.com or on Gitter and happy to hear and listen to your feedback and make the event even better next time around. So I think that's it, except again to thank you. I'm just going to pause here for a second to see if people have any questions or comments. Well, if not, for those of you who are still working at things, I'll let you get back to work. And for those of you who it's already December 4th, I'm sorry, September 4th. I mean, thank you for all your contributions. And I look forward to talking to you again soon. Thank you.


So with anxiety, this is us and we all know what that feeling of anxiety is like. It's a really really horrible feeling. Most of us have it in our stomach. Some of us have it in our neck and our shoulders. But it's a pretty horrible feeling. Now, what we'll notice is if you ask somebody who has anxiety, they're gonna tell you, well, where do we typically feel anxiety? We feel it in different types of social situations where we're about to go and give a big talk in front of many, many people. All these people in a big auditorium, it could be really, really intimidating. One of the biggest social phobias, but doesn't really matter where it is. It can happen in all sorts of situations. Maybe this person is about to go here and give a talk. Now, with anxiety, we need to start figuring out how it actually operates. Because if we get an idea of how anxiety operates, then we'll have a chance to do something about it. And the first thing that's going to happen with anxiety is that anxiety is going to deposit a little thought in here. It could be something like, first thought would be, well, I'm not good enough. Now, that's the first thought that happens. But anxiety will not just leave you with one thought and that is by design. If anxiety were to go away and leave you with that one thought, anxiety itself would start to get anxious because if you had enough time to be with that feeling and you had enough focus on that one thought and that one feeling and you had enough presence with it. Okay, so we're talking about time here is one of the factors. Draw a little egg up and focus, right, giving our attention to it. Love. If we gave anxiety all these things, you would notice that it goes away. Giving our focus and attention to that one initial thought, we would process the thought in other words. Anxiety will not allow us to do that. So anxiety comes back in very quickly before you have any time to process this thought or this feeling and it's going to give you additional thoughts, secondary thoughts. Before you know what this is full of second thoughts, it could be something like, well, what if I crumble in there or it could be something like, well, what will I say? Now, when we're trying to learn how to do this, we really need to slow everything down. We need to learn how to focus and bring presence to our feelings and our one primary thought. If you were to ask this person, what's bothering you? Tell me why you're not feeling good, why you're feeling anxious. Chances are they wouldn't be able to tell you because they're up in this fog in their mind. This is the fog of anxiety. Not being able to clearly identify why you feel anxious because your focus is switching around thoughts. This is only three thoughts. There could be multiple thoughts here. So we need to really get to the root and to do that, we sit with the emotion. The emotion will tell us very clearly. This is the main issue I'm having right now. It's this. This is the really juicy thought that's that's causing a lot of the problems with the anxiety. The rest of these are kind of distracting us from the main issue. So what we have to do in other words is slow it down, but anxiety is very clever and it is going to make us look for the solution up here in our intellect and this is something very important to know. When we're trying to solve the problem of anxiety from the intellect, we're going to solve it down here. What will happen is you're going to come up with a whole bunch of secondary types of thoughts, intellectual answers for the anxiety. What they sound like are well, don't be silly. Another favourite is what's wrong with you? What's wrong with you? Okay, these are intellectual answers to try and deal with this and they are actually related to this guy. Anxiety is also causing these intellectual answers to the problem. We cannot solve the problem of anxiety intellectually because you will notice about these thoughts that come in from the intellect. They're very impulsive and another thing about them is there's no feeling. Okay, there's no feeling in these corrections. There's no feeling. So again, we need to slow down. So what do we do with this? Well, we need to go down to the solution and we need to slow everything down with anxiety. We need to find a quiet place, maybe a chair somewhere, and we need to get into our centre. Okay, we need to get into our centre and we need to sit down, find a place and just sit down nice and calmly. And what we're going to do here, close our eyes and we are going to start to bring attention to the feeling, the emotion of anxiety that's right inside us. Bring all our attention, our time, focus, presence. We're going to shower this feeling with presence and love. And we will notice that when we do this, we can start to do some real work on this primary belief. So we can start to say, well, do inquiry. Is this true? Is it true? It's a question we can start to ask. Another one we can start to ask is, who owns this thought? Because none of these anxiety-ridden thoughts are ours. None of them are original and none of them are creative. They're all universal thoughts. And above all, the last thing I'm going to say on this is we need to forgive ourselves. Forgive ourselves. Presence and love. No judgement about having the anxiety itself. When we do that, anxiety starts to fade away.