It's to do massive numbers on the other guys until their numbers are so small They match the PP size of anybody who doesn't commend at the end of a duty. The other members leaving too quickly is no excuse How do you expect to move quick enough to avoid AOE? So if you can't even move quick enough to tell your allies they're doing a great job and that their glamour is sexy Is that uncharacteristically nice of me?  That's right Why you thought only the DPS have the DPS boy I could slap you with my overflowing glamour dresser Damage is the name of the game in Final Fantasy 14 and the entirety of the game is designed around everybody dealing it Including the tanks and the healers if the DPS rules are contributing 60% of the damage tanks and healers are the ones who fill in the other 40 so if you don't contribute you belong in the garbage shoot so don't get so hung up on the roll names Everybody is a DPS what I mean specifically is that one not only is FF 14 a cooperative game Which means anytime you waste is not only yours But also anybody else in your party as well and to every combat feature in FF 14 is designed with dealing damage in mind Healers and tanks get skills that actively promote doing more DPS Hell sage is a healer whose skills actively benefit from doing DPS and most importantly of all in rage Enraged is what happens when you overstay or welcome in a dungeon or boss arena And the residents have run out of things to talk about and are just really ready for you to leave So they can finally go poop without being worried that you're gonna steal all their old dream work to DVDs That is to say you're either forcefully kicked out or alternatively they instantly murder you How do you prevent this from happening you murder them first of course And then you pop in a copy of Shrek 2 so you can watch the castle siege again And guess what the later and later in the game you get the more and more frequent in rage Just start to appear and they'll have more and more health too So if somebody decides they just don't feel like they want to cooperate in this team game They decided to play and now the boss has an eighth of its health left and is about to destroy the entire universe Princess Fiona isn't going to be the only one who will need a hero Hopefully it's been drilled in your head now that DPSing is essential not just for the jobs with the title sticker But also anyone in a fancy robe or edgy trench coat as well now that you know that how does one go about dealing max deeps The first most basic thing is to do your combos press a button see another button light up press that one Congratulations, you have successfully completed a combo and doing so will reap a myriad of benefits from putting damage over time on your target Gaining mana doing your taxes or any variety of other additional effects But mostly it all achieves the same goal of dealing more damage Secondly when I press these skills that the game labels as abilities and the community to calls off-global cooldowns or OGCDs for short more like OGCDs nuts. I personally call them free damage buttons They cost you nothing and there's literally no reason not to press them while your normal cooldown is rolling But this one has a long cool down. What if I need it later?  It's free damage the next rule of DPSing is knowing your ABCs This means mashing away at your keyboard like a tickle monster working double time more specifically It means that the best way to make sure you are doing the most damage that you can is to always have your global cooldown going Even if it means accidentally pressing the wrong skill like the single brain cell that you are because if you're always pressing buttons Even the suboptimal one you are doing more damage than if you weren't and doing damage is always better than not doing damage Yes, even skathe. Here's a live example with my two subjects Jan and Chloe They both deal 1 million damage and suddenly the boss flies out of melee range Jan sits there waiting patiently for the boss to Return before she can start doing a million damage again Meanwhile Chloe is pressing the deal one damage at a range button the entire time. They're waiting I ask you puny viewer which person is dealing more damage right now. Yeah, but it's only one damage Who's dealing more damage as if any fight is going to get so close that dealing who is dealing more damage Sure it might not look like much But it's going to matter when they fight the boss that has 3 million and 2 health and they wipe all because the other DPS Decided they don't want to press buttons. It's such little DPS. It won't make a difference sure Jan now one of the best things You should do to improve your damage in Final Fantasy 14. It's this it's really simple. I want you to lean in It's a super simple thing here come close. I'm gonna say the thing. Are you ready? Okay, here it goes read your tooltips the little block of text that literally tells you what your skills do Honestly, you would be surprised how many people queue into an expert dungeon and never realize they have a skill that can Attack multiple targets even all the things I tell you in this video the combos the range attacks the aoe damage skills the free Damage buttons the best way to know what your job is capable of is by reading your job skill tooltips yourself So you better read your goddamn tooltips because if I see another player not knowing about their aoe combo and a mob Pull at level 80. I'm gonna grab the nearest ether item bash you so hard You're gonna be teleported to the final resting place of every year appears used under garments with all that out of the way You'd think I'd covered everything you need to do to be an ultimate clearing badass, right? Unfortunately not waffle face because the final responsibility every single role in Final Fantasy 14 shares is not dying Oh sure the healers help but most of the time your own survival is on you and only you and that means making sure you Do the fight mechanics and don't take avoidable damage like it's got the cheese touch I'm sorry. Are you in the middle of your cast? You want to try and hit that purple parse like the big man?  Congratulations, you're now better at the game than you were five seconds ago. Oh, and now you know how to DPS You're welcome. Oh finally my cue just popped No, one of the other party members withdrew a thaw


Good morning everyone for the last station of this morning. We'll have Philip Kaluza with we will talk to us about Bootstrapping another IK texture using LLVM IR Please welcome him. Yes. Hello So in the last session Sylvester told us about Yeah, mass building the devian archive using Clang standard C compiler for the LLVM project and I want to talk to you all about Yeah, what I'm planning to do on top of this work and taking it in a bit of a new direction This is very experimental and much more work in progress even than the rebuilt with Clang work, so Bear with me. I I'll introduce what I've been doing and Hopefully this will be interesting to some more people than just me Yeah, so I'll structure the talk Talking again a little bit about LLVM for those that I did not follow the last session Maybe in the stream What I'm planning to do with it And what this would give us and what problems we will have I will talk about the pinnacle project That's been done by the Chromium developers I will show a little bit what what my experimentation has yielded and In the end I invite you all to discuss with me If this is interesting and if we should take us in new direction Just a quick show of hands who here has had experience with building stuff with Clang Linking with the LLVM linkers Okay So I'll try to introduce the concept Since my last step conflict talk was a DC7 allow me to reintroduce myself a little bit My name is Philip Kalutza. I did study at the technical University of Brunswick in Germany Since 2010 I finished there and Teaching there still a bit courses about system administration Of course promoting Debbie and doing that Since 2011 I've been freelancing. I'm now based in Berlin. I'm just yeah general IT consulting work So what is LLVM? LLVM stands for low-level virtual machine, which is not really anymore It's they started out with yeah, just describing an abstract register based machine for Having some some code within a compiler tool chain that is Above the the emitters for certain hardware architecture and but Quite below the SSA trees in the compiler So a number of medium and low-level optimization steps you would want to do in a compiler tool chain You can do very well on the LLVM bitcode or the Compiler internal binary representation of that It will evolve from there to become infrastructure for building compilers optimizers static analyzers you can emit C code again beautified and And Yeah, the many research projects are taking this in very many interesting directions at the moment The kind of assembly language for This very virtual hardware architecture is called IR immediate representation if you Assemble this assembly language into Some binary code they call it bitcode because it's not quite aligned and Basically Except for the compiler itself or the lower parts in the tool chain can read Either both formats or at least the bitcode format Again and do their optimizations transformations and so on in there IR and bitcode are roughly Mappable one-to-one mappable so For a certain IR you can actually generate a number of different bitcode files But you can always get go back to the same IR Sounds formatting That you had before doing that Yeah, the LLVM tool chain As I said contains emitters for Different target target architectures MD-64 x86 for 32 bits arm Those are the ones I played with there's quite a number more So of course there's just in time compiler for that and also an interpreter which Can just run through the bitcode interpreter wise If you use the LLI so LLVM interpreter binary to run something Normally if it's not on a very obscure architecture, it will try to to run through the JIT engine and so I'm interested in using this whole system and Taking it into the direction Yeah Can we use this for code distribution? Let me Okay, before I wanted to show the compiler pipeline Again quickly, it's pretty clear. So we have preprocessors that's included in the Clang binary Compiler you can also GCC style Call out to different preprocessors compilers if you like to both of them Will if you if configured correctly output bitcode and The whole tool chain can call out to different linkers They've kind of standardized now on using gold the shipping and plug-in for gold that can read the LLVM bitcode And if you link together a number of object files using this This gold plug-in it can actually do the first number of Link time optimizations there. So link time inlining is one of the big topics, of course that Will be very interesting to do there They also have a LLVM link Which just links together bitcodes With with other bitcode outputs bitcode again LLVM LD which is a bit of a hybrid can can run in both modes Yeah, so and so we can we can output ELFs dot SO files or something or a bitcode Which we which are also not named dot SO in the tool chain really quickly The LLVM compiler and the Tool chain so the Clang compiler and LLVM tool chain Have BSD star licensing Apple didn't like the GPL anymore at some point The GCC also said was very skeptical if Making the whole core of the compiler more modular Would lead to people circumventing the GPL there so They for a long time. They said no no plugins for the GCC tool chain Reluctantly they're opening up after they found a nice legal hack on how to ensure that most GCC plugins will still be GPL and so In in GCC something is slowly changing and it's becoming more modular, but only after big players Especially Apple said well, let's Go with this new Interesting research project LLVM Back that and we have BSD licensing licensing and we can do whatever we want with it. So at the moment, I don't care about the Politics here one way or the other but it's important if we're talking about LLVM to know historically that this was a factor in Why this ecosystem system exists and for some Debbie and developers I imagine it will be important in Thinking if they want to support the whole thing So what I want to do I Want to use the compiler tool chain let it output LLVM bitcode and Ship these in Debbie and packages Yeah, so we would have Debbie and packages for a new architecture That targets this Yeah abstract low-level virtual machine and Then we could do things with this on the target machine LLVM bitcode in itself though is not a hundred percent Architecture independent I will come to that in a bit, but as far as possible I would like to Yeah, target generic subset and be architecture independent in in what we are creating there How do I go about this First it's possible to register bitcode itself as an executable format with the linux kernel That breaks in very interesting ways once you're inside a chrude or chrude or Other build system build infrastructure But in general this is possible which means that the old cross-compile problem of One of these binaries is supposed to run During my package build and do something useful and the other of these binaries is supposed to be generated for the target target architecture and my whole Automate setup is not really set up to do something sensible with this or Differentiate between the two of them this problem goes away if we say well, we have bitcode we can Execute that so this is a problem that we should solve but Would mean changing every debut source package there is and making them all really clean cross-compile clean and I'm a bit skeptical on the prospects of that, so I worked around that Yeah, the packages we are getting out of there we can look at also a bit like arch all packages for Java bytecode or the CLI so Don't that bytecode monabyte code We ship we generate them also on one machine and ship this this bytecode in devian packages and We already know and assume on the target machine We need something that helps us execute that Excuse me But yeah, yes, yeah the the the code is Cal and the Common language infrastructure is the CLI But I want to generate this from existing source packages. I want to use existing see later C++ code not change it as far as possible and Basically, we're just targeting a different is a instruction set architecture that are very Different but not as different as these stack based Systems are like Java and CLI So what does this give us? So first I'm a developer. I like to fiddle with my development environment and I like to to get this Yeah Into a point where I can do new and interesting things with it and That's certainly It's the case it has been has proven very interesting Also, but annoying We would get a large repository of software that we have compiled under very defined conditions that we can say This software we have Indebian as LLVM bitcode. We know that this bitcode comes from a clean built the and and Should do what it does. Well On the target machine not on the target architecture, we can start Optimizing there we can decide on what functions we want to inline Based on how much cash pressure we expect. Yeah, so Even if I target and the 64 an atom and Core i7 have vastly different properties there and It is interesting to Yeah, try optimizing this Really when we know what machine it's going to run on we could Use this to try to bring up new ports faster. So if there's new Architecture like arm 64 being created The LLVM guys usually are there pretty fast and so once we have the Linker and LLVM interpreter just in time range and so on running there We could have a bunch of our toolchain available on the new ports and Of course something like the Raspberry Pi port Need and have happened in this way if we had a toolchain where we Do very late post installation optimizations LLVM has been looked at for GPGPU computing I'm not really too deep into that topic, but if we can reuse parts of our toolchain there That might be interesting Yeah, I talked about the late inlining already LLVM is not really well suited to doing all of that so Yeah, it sucks a little bit and I'll try to explain why it's not Aimed to be a code distribution mechanism originally We until now there's no compatibility guarantees in the LLVM bitcode That has been Pound also to be a problem in the LLVM community. I'm not sure How much better it's getting the compiler? Assumes a certain target architecture before it outputs the bitcode we will need to work with the compiler To make less assumptions The bitcode includes a lot of details about calling conventions and Liga details So the The things is that that the whole toolchain should work against linking parts of a Microsoft VisualSeq project so all these options for Linking details and so on are included in that bitcode the LLVM bitcode allows for uninitialized variables to be present there Which you wouldn't do in Java or that net bitcode bite code But they said well see so it's undefined we want to be able to carry this This is undefined state around with us So let's put this in the syntax So in a way the LLVM bitcode is a bit too low-level to do that and Of course as a caveat The old Java adage of write once debug everywhere Could apply here as well Yeah, the front-end compiler Generates just quite a lot of details in knowledge of What linker would link this together and What was the target architecture to run this so actually we want We will have two linking phases one during the compiler for them in package one on the target machine and For the first first linking face. We want to make the linker a bit Dumber Other things that might happen Just linking together LLVM bitcode is more like a static linking Until now we don't have tracking of this library Will be linked in later. You can just leave some symbols open while linking but the information of Well on the target machine Link in this thought as a whole please We don't have so This is something we can work around but if we want to make it really clean so that We don't have just a lot of static links lying around on the target machine later And the target machine can can simply Apply security updates. This might be addressed very detailed might need to be addressed very very detailed on our tool track Early preload is not a thing at the moment. It is however a very interesting To work with LLVM IR. There's just lots and lots of papers coming out in the last years Just working in this modular ecosystem playing with it taking the tool chain in new directions And I really want to get in on that for Debian. It is possible to define a LLVM bitcode a bi that's architecture agnostic where the bitcode doesn't really Include so many details about the target machine that this will run on the chromium project has done that They have the now NACL maybe you've read about that native client system Where they built a really nice sandbox on for running natively? Compile C or C++ code That targets This sandbox so you cannot do system calls or a very limited number of them you cannot exec or link in arbitrary arbitrary code from the target machine and Then they know as well this actually really annoying for our developers if they have to compile everything three times Into 32 bit into 64 bit and I'm 32 bit. That's one say I'm supporting at the moment so they started to Think about also shipping LLVM bitcode just targeting this architecture and The compile if I understood the paper correctly actually is happening within the sandbox, which is interesting And so they also went ahead and defined of just a number of Constraints on the bitcode so that they could say okay, we're confident that this bitcode will really be able to to run on different machines Just from the document. They have and they're saying well Yeah, the in our pinnacle machine the address space is 32 bits Addresses are always 32 bits wide They're the integer but bite order Low-end and I think these are reasonable assumptions To make about your target system. Yeah, it does mean once you start making these assumptions that you cannot just link in Lip GTK the native version on the target machine. Yeah, this this needs to be clear to us if we're doing this work If we want to link against 42 bit MD 64 lip GTK We need to tell our compiler to target that if we say well, we want to link In on the target machine other LLVM bitcode Which also falls within the set of constraints. That's very possible to do that. So I see this Project within Debbie and Possibly if it goes anywhere at all going in one of two directions The first I've dubbed architecture LLVM Which means we assume that we run let's for now say on a Linux kernel We have system calls that we can call we generate LLVM bitcode with an API to be defined Like I just showed on the pinnacle slide similar to that but not assuming we run in the pinnacle sandbox so What would be the point of doing that well the universal OS as they been as we like to call them in Has just a whole bunch of software and we would have the option of linking and optimizing that on the target That would give us the advantages for porting and so on they were talked about earlier We might constrain that project even further though I've dubbed this Possibility architecture of pinnacle and we just assume that we run in the pinnacle sandbox So we can call we can use less C code unmodified We can not do And in a limited number of system calls We might have a lip see running in there and the pinnacle guys actually have something like that That tries to solve a lot of problems with a very small set of Sus calls and that would mean that we jump onto the bandwagon of the pinnacle project and just give them Yeah, lots of Debbie and love Export lots of code that we have into that environment and for now pinnacle is just a browser sandbox, but I'm Pretty sure that some people at Google are thinking about also using that to a sandbox code on the server. I Don't have any proof of that, but I would if they I were them So if that becomes popular It would be nice really to say well then we have lots of Debbie and coach to to work with a third option would be To compile a lot of As many packages as possible and then Lindsay and Jack or something Which packages could live within the pinnacle constraints and mark them just to be complete, but I think for now The scope of this should be limited to one or the other we should find a clear way to go forward on this Okay, I wanted to Give two little demos so the one is really Some small code a little secret my course So I just copied it from from some example here just does a multiplication does a print F That's So It's cut off a little bit, but I think you can get the gist of it. Yeah, sorry So this is not very interesting code, but it does compile into Some bit code That would be the mullet dot oh and the dot s is the representation here No, that's not actually so this this is the LVM IR and I broke my demo I had a copy of this Compiled on on a Raspberry Pi and It's possible actually to to run this on We're using the LLI to run this on My input machine, so Okay, yeah, the bitcode does include the triple that this is compiled for and You have to override so this the a out BC is the one compiled on the pie and I don't know So if you want to call execute the bitcode that is That is from a different machine. You have to to Overwrite this. Okay. Oh all these tools have to M Help yeah, all these tools have nice different command line options. Was it m-target? I Think I'm out just right. I should have tried this again this morning So if I override this to Run on The PC here that would help here. Okay, this demo doesn't work I Did get something sensible out of that so but This was just to to show that this it could be compiled so I just took the LVM I Are or bitcode generated on an arm machine and Rendered here so Unfortunately, I lost my bash history a few days ago. So that's why I have to The other demo I had been hoping to show And maybe this one goes better is I Now will try to build in a shrewd and Yes I tried to build in a shrewd which gave me a lot of trouble and now I built it on this MD64 machine Hello binary and so what I did is to set up the the clang and Also, I had to do some some hot linking hacks like Sylvester before me set up clang to call a custom linker that is a wrapper around LLVM LD and I called Yeah, after a bunch of Bunch of tries I got it to run the whole automake system within the debilt and I'm not going to show that yet because it's pretty fragile And it generated me for me this nice. Hello package. So If I do this in a 32-bit install or if I set some more parameters, it will generate the hello package targeted at a 32-bit style bitcode and If we Look at user bin. Hello. This is LLVM IR bitcode now So the whole compile to chat toolchain at the moment Really with a lot of hacks, but it's starting to work that I really can get a devian package out of that So of course this is arch MD64 for now have defined the new architecture and if we Run this then we notice actually that new hello is nicely internationalized so That's the stuff I have to show for now. I've started compiling some Some Libraries, but as I said for the libraries there's still some theoretical work to be done or file format to be to define to be defined for carrying some some more information on to the target machine What would make my life easier is? We've talked about that a little bit in the past if user bin should be multi-arched I would like to have an alternatives mechanism for Yeah, at least for the toolchain The multi-compiler problem that we talked about before This is something I will be also working on next because I think this is important That not that you don't have to manually install some simulings into your your built environment It's better if we have a standard alternatives mechanism here and For me it would be interesting to install to be able to co-install a new hello from With LLVM bitcode and natively combined and AMD64 can do hello But this is just something I think we can think about in general in the demian project if this help if this happens It would help along this project a bit if it doesn't Well, then it doesn't I would like some help in general though When I started working on this it seemed like Interesting simple idea It's not simple and it's a lot of work and if somebody wants to help with this Please contact me. Let's get in touch with the other people For now we've just discussed Just using reusing the package LVM mailing list And you can get in touch with me personally and talk about this everybody's invited if you feel like your employer might be Interested in doing something with this once it's there Yeah, I'm available for contracting. So if somebody pays me I can put a lot of a lot more time into this of course Yeah, and I would like to end with a quote nice quote that I found on the LLVM mailing list About people doing weird cross architecture stuff with LLVM and I Didn't note down who said it but the quote is it isn't LLVM's fault that people want LLVM to magically solve all of C's Portability problems and I think that's important to remember. So we cannot Just do magic here, but we we can use this new and exciting tool chain into new directions and yeah, I would like to get this running and Hope this you guys will be so as excited about this as I am Are there questions? Do you think it's worth all to do this? What do you feel is it more important to do the concept arch LLVM? Is it more important to do the concept arch pinnacle first? Are there related ideas you want to talk about? Yeah, as I said we yeah as I said, we would need to target a specific subset IMAI we would define in our Forbide yeah little and you and 32 bit as we do when we target a specific 32 bit machine Yeah, one day we might decide okay. Everybody has armed 64 machines now or Intel 64 But nobody has 32 bit machines anymore Then at that point it might be okay to just Yeah, target Say, okay, we make a new archic architecture LLVM 64 and now their size off is Yeah, I think what you're trying to do is that you still can link at Against as I said earlier the native natively compiled natively running libgtk and with this concept We will not be able to do that. I totally agree for me It's not so interesting to do that for me It's more interesting to see what we can build how we can build a little LLVM universe out of all the Debbie and sauce packages Yeah But if upstream moves there and then says okay We try to make this really architecture independent then of course that would be nice and really exciting The past discussions that I've seen Do not make me hopeful Hello again Yeah, so yeah, this is a really interesting idea and we talked early already earlier this week and I did a thesis on a more compact encoding for this IR So I had to struggle with a lot of these details and I had to generate a lot of IR so that I could Get a benchmark for my compression basically and I think that It's really ambitious to get a single IR for All the being architectures and you could easily just make it easier by just targeting one architecture at a time Or you could just generate native code like a silver service ruling with Selang And that's just save the IR to the side because then you could still use that for debugging you could generate the Debug information for that You could do static analysis all sorts of stuff with that and Then one by one you could maybe start running that IR also Okay. Yeah That would be equivalent roughly to changing the compiler tool chain and Debian to use Clang and Rebuild all of them in on multiple architectures I think it really depends on the use case and and this Idea of keeping the bitcode around for for debugging is actually I added after I talked to Lindy because it's I think it's an interesting idea So you use the whole tool chain you generate a target specific binary For me at the moment it's out of scope because I feel like that would be too much doing too much at once With the resources I have but the important thing is I think that we get all the stakeholders in this talking And if we as a Debbie as a Debbie and project feel we can do that Then let's do that Thank you very much. We are out of time. So thank you


kumunity谢谢 v Every players means in groups, in the coming years PF doiti pияхinidha through programs and production of While we wanna be responding to you what where. w. K32 pandana w 2 Kake to Molima구� lununudu mwillistist kwaca mpi niha upia niскome winessню wa minmali. Pinwezi na kwa ya kuaya w ne risa datuu sindu kabotu. Yb Would you Guys to be reminded, our running mate is just as bemba as he is, так samo ni. than he is. Than he will ever be. Zambians must understand that time has come to identify citizens who thrive on public office and taxpayers money. Kijini na yubu na naweza niweza kisha pana nusimita kufu na Kikyo hensha na naweza Yubu rikainu kutu na kutu na inusil Yubu na kutu na nusil na kutu na enesia We want to emphasise, even to those who are referring this process, the ECZ, that this particular win is going to be determined not by you who are counting the votes, but by the votes that will be cast and we will not allow any level of manipulation of the people's will. We shall not permit any level of manipulation and just for you to understand the mode in the country is that PF will be knocked out in the first round. Mark my words, PF will lose this election in the very first round.


from No Start to Press, and I edit textbooks, so today I'm going to talk about flocking, and one of the things that you may think about when you come into this room is what is flocking? So flocking is individuals coming together as a group and moving together. So you'll see flocking in the form of birds literally flocking together, fish schooling, and you may also see flocking in sci-fi movies. So usually alien invaders will come together in a giant flock and will start swarming and attacking. And the thing with movies is usually they're not realistic at all, and that is the case for flocking. So in movie flocking, usually there's one central point of command, and that's really an issue because that's usually what the heroes target in movies when they want to take down the flock and then they win and everything's happy. So there are problems with that, and what goes wrong with that is usually there's one central point that's communicating where individuals should be in the flock. So it's making computations and sending out radio singles, or there might be some queen like in the alien species if they're an insect species that's telepathically telling everyone what to do, all the drones. And when you take down that central command or the queen, then they might just stop moving, the individuals might just drop dead, or something more catastrophic could happen. They just explode in Hollywood fashion. Now this isn't true to life, like birds don't have little antennae coming out of their heads, and fish usually don't have a queen that's communicating to them, and both usually don't explode, hopefully. So a lot of the systems that we think about being centralized really aren't centralized. So for instance, you may think our brain controls our whole entire body, and that's the centralized system, but in actuality our brain's not really micromanaging our individual cells, it's really controlling organs in major systems.  So this is how flocking kind of works too in real life. The birds will have some rules or instructions that they're following, and then when they come together as a group, interesting behavior emerges, and you start to see patterns, and that's called emergent behavior in biology. So now that I've told you about flocking, I'm going to show you how to actually create a flocking simulation that's really simple. It's really, really simple, and we're going to use NetLogo to do this. And NetLogo is a programming language that's sort of based on logo, and it's agent-based, which means that you have an agent and you tell it what to do. You give it instructions, and these agents are called turtles. So you can see a turtle up here, and that's a little triangle on the screen, and we're going to tell this turtle what to do, and they're going to be a whole bunch of turtles, and we're going to tell each of them individually what they should be doing and give them some rules, and then hopefully we'll make it flock this way. Well, we will, for sure, because... So we're going to do it with three simple rules, which I'll go over in more detail pretty soon, and how we're going to do this is we're going to change one property of the turtles, and that's it, that's all we're going to do. So we're going to just change the turtle's headings, which is the direction that they're facing. So very, very simple. So I'm going to go over some NetLogo code just so you know what's going on. So in this code, we're telling the turtles to... One turtle to look at its neighbors, because we don't want it to look at everyone around it. Like, we don't want it to change its heading for everything, and we're going to tell it to basically draw a radius around itself, and that's vision. Vision is a variable that holds the units of the radius, and then we're going to tell it to look at the other turtles in that radius, because otherwise, if you just tell it to look at all the turtles, it'll look at itself too, and we don't want that. And then we're going to assign that to the constant neighbors using let. So that kind of looks like this, and they have a circle around themselves, that's the vision, the radius field, and the turtle that we're commanding is the red one, and the turtles are the neighbors, are the purple ones. So that's sort of the basic of how this is going to work, and we're going to tell all the turtles in the simulation to do this. So the first rule is to tell the turtles to align together. So we're going to do this by taking all the headings of the neighbors and then averaging them out, and then telling the middle turtle to turn so that it's also facing the same direction. So this is taking all the headings, and then the average is a dotted line, and we're going to tell the turtle, turn. So once we do that, we get all the turtles are traveling together across the screen very slowly, so you'll see that. Yep, so that's cool, right? Okay, next rule is to tell the turtles to stick together. We want them to have some cohesion. It turns out coheses is not a word I found out during this presentation when I was making it. So they're going to cohere together, not coheses. So we're going to get them to do this by checking, do I have any neighbors around me first? And then they're going to draw a smaller circle around themself called minimum cohesion, that's the area that they want other turtles to be in, and my boyfriend called this the lonely zone, because turtles get lonely when no one else is there. So that looks kind of like this. So there are no turtles in the minimum cohesion area, so this turtle is really lonely, and it wants to go near all the other turtles around it. So we're going to do this by taking the average point where its neighbors are. So we just take all the average X coordinates of the neighbors and all the average Y values of the neighbors and average lows. We calculate an average point, so average X and average Y is the average coordinate, and then we need to do some trigonometry. NetLogo is really useful though, so it does some trigonometry magic for us, and we calculate a heading for the turtle from the point it's at to the average point, and then we tell it to turn. So calculate the average point, calculate the heading using the fancy function, and then tell it to a little turn. And when we do that, they start grouping together in the center because that's the average point for all the turtles in the simulation. So that's cool, right? And the last rule is to tell the turtles to separate. Basically, we want them to have a personal bubble. They don't want to run into each other, so we're going to draw another radius around the turtles and tell them that's their personal bubble. If any other turtles are in that personal bubble, any encroachers, then turn away from them because we don't want them to be there. So this is sort of what that looks like. There's a neighboring turtle that's in the personal bubble of that turtle, so it turns away from the turtle that's encroaching in space. And you do that, this kind of looks similar to the alignment you'll see, but the turtles are trying to travel in parallel, so they'll start making an interesting pattern that's kind of similar, but it's important. And when you put all of that together, you get flocking. So the turtles come together in groups and then they merge and they'll separate. And that's what that is. Okay, so this is technically the end of my presentation, but I actually have some more content because I talked fast enough. So extra examples. So this is the same simulation that I just manipulated the variables a bit. And in this, there's no cohesion, so they're not really forming groups. So they're just sort of aligning with each other and then they're trying to stay separated so they're trying to fly in parallel and kind of makes the cool screensaver-ish effect. I thought that was fun. And then in this one, there's a lot of cohesion. They all want to be together, but then they still want to also align and separate. So you'll see like two turtles at a time kind of wiggling out of the group. And then once they reach a certain point, they separate from each other and they go back into the group. So it's cool. And then last example. So here I've added a predator, which is the giant white triangle and it's trying to eat all the turtles on the screen. And you'll see with blocking, they all sort of group together. And theoretically, when this happens, it should make it so that it's harder for the predator to actually get the turtles because they're all trying to fly in the same direction and they're theoretically going to all warn each other kind of like not purposely, but warn each other that there's a predator and to get away. It doesn't work so well in this because we're only changing the headings though. That's something to know. And so if you're interested in flocking and doing something yourself, you can download that logo and they're actually flocking programs in there. They're built in, so it's pretty cool. You can manipulate variables and stuff. And you can also make your own flocking simulations by changing things like speed or the angle in which all the turtles can see because you can make these shapes sort of figurations if the turtles like consider eyesight and stuff, whether they can see a view, they like search stacking. Yeah, and that's it. Thank you very much.


So, hello everybody and welcome to our talk, an event handling system for serverless platforms. I'm Jules, not the award-winning Jules, the other Jules, and I'm working for IBM Cloud for almost two and a half years now, and I'm in the Cloud Foundry team. And yeah, what is this talk about? So this talk is a story about bringing two technologies that are considered as two distinct technologies together, which has a positive effect when working with serverless platforms as a developer and it may have positive effects on the costs when working with serverless platforms, depending on the use case. Okay, so we'll first go through the fire exit announcement. Please note the location of the surrounding emergency exit and located the nearest lit exit sign to you. In the event of a fire alarm or other emergency, please calmly exit to the public concourse area. Emergency exits, stairwells leading to the outside of this facility are located along the public concourse. For safety in an emergency, please follow the directions of the public safety staff. Okay, let's come to the agenda. So first, Simon will give you an introduction to platform as a service and function as a service and the motivation behind this project. And I will tell you more about the problem that we're facing here and example how we try to solve it and what we actually implemented and finally give a conclusion. Okay. All right, that's my kickoff. So thank you. So my name is Simon. I'm also working on the Cloud Foundry team. I'm kind of leading the Cloud Foundry efforts inside of IBM to some extent. And the motivation for this talk really, for this work, a body of work was that on the IBM cloud, and I'm pretty sure it's similar for other vendors that are out there. We do have a separate set of technologies that a customer can use and mix and combine in order to accomplish certain use cases. About a year back, we kind of started looking into a scenario where we have, it was originally driven from a pure serverless standpoint. So we wanted to have an application that was constantly emitting events and those events were coming out of the sensor and it was kind of like it was a student implementation to some extent. It wasn't really industrial strength at the time, but the problem that it really surfaced at this stage was that the serverless platforms themselves, they just execute whatever you give to them. There's no filtering. There's no nothing. And of course, that's in the true nature of what a serverless platform does because it is reactive to events. You send it an event and you do something, whereas Cloud Foundry or platform as a services are more for, let's say, long running, always on kind of applications. So I'm guessing that everybody in this room knows this picture, at least I'm hoping when you're here at the Cloud Foundry Summit, I'm not going to talk a lot about it. But basically, the key thing is Cloud Foundry provides support for long running applications and as well as tasks, but in our case, we really focus on long running applications. It has automatic health management and cloud native programming model where you only worry about your code and nothing else and so on and so forth. And the functions as a service, the way how this works is a little bit different. I'm using the model from a project called Apache OpenWisk, which is another open source project, that the IBM Cloud is actually building its serverless offering on top of. So the way how this works is a little bit different than Cloud Foundry. There is this concept of a trigger and then you have a concept of what is called an action, which is basically a thing that will get executed when the trigger gets pulled. So that action can, of course, also be implemented in a variety of programming languages. It could be a Docker image, it could be like a Cloud Foundry application, some kind of a function, that sort of thing. But what happens is whenever the trigger gets killed, the action engine picks up that action and actually starts running it. And that might mean it will provision a container on demand, execute that action as part of that container, the whole nine yards. That has a bunch of side effects, right? So first and foremost, it actually introduces an event-based programming model. An event occurs, something happens, event occurs, something happens, event occurs, something happens. When nothing, no event occurs, nothing happens, which has a cost benefit at the first side at least, right? It has a cost benefit that says, oh, if I'm not getting traffic through the night, I'm not going to pay for my application that's run, or I'm not going to do anything, you know, I don't have to pay for idle times, I don't have to pay for these kind of things. The second advantage that the serverless platforms claims are saying it's inherently scaling. If I have a lot of events coming, it will inherently scale, whereas for example in Cloud Foundry today, you have to build a management function to do that. It's not that you cannot do that, you can, but you have to build a management function that does exactly that, right? Say, okay, I define a threshold, more than 3,000 requests per minute, then give me another instance, like scale it up, it's a management function. For a serverless platform, that's not really needed, because it just happens on demand, yeah, and then, of course, it has some, well, apparent cost effective, a cost effect, because you only charge for what you need, like if you have no traffic on your app, you're not going to pay anything because nothing is running, right? At least that's what it looks like at first sight, right? So then we said, okay, is this really the case, and basically, there is this scenario that is called an event storm, and let me quickly do a show of events, who understands what an event storm is? Well, Andrew, you don't count, anyone else? Okay, so there is a scenario called an event storm, and I'm just going to talk about this. What we are going to show in this talk, it's an artificial example where we try to artificially create an event storm, and then try to bring those systems together in order to see how do they best mix and match, and all the magic that has happened, which is what it's going to do. Okay, thanks, Simon. Okay, so what are event storm scenarios? An event storm scenario appears when a set of IoT devices or any other events source is generating a large number of events in a small period of time. And when you think about how many smart devices we today have, it's usually, it could be the case that such a scenario appears, right? And what's the problem, actually, with an event storm scenario in case of serverless? Well, so today we have the event source, and if an IoT provider, for example, uses serverless, all the events are facing directly on the service platform. And this could potentially lead to a system overload, which slows your system down, the execution time increases, the customer gets charged for that, and so on. So a lot of downsides on that level, on the technical level. And what about all these events that are coming directly to the serverless platform? Are they actually relevant? So in many cases, not in most cases, it depends. They may be just not relevant and can be ignored. They're just noise. So let's just say a simple example. You have a dog and you have a GPS sensor and you want to make sure he doesn't leave a specific area. So you're just interested if, so the GPS sensor is sending all the time events to the service platform and you always check in your function, hey, is the dog still in my area? Yes, don't do nothing. Is it still in my area? Yes, do nothing. Now the dog leaves the area, then you check, does he left the area? Yes. Now you want to inform the customer, maybe, hey, your dog just left the area. And that's actually the only event that you are really interested in. And that's what you need to cover today in your function. And of course for all these unnecessary function invocations, you also get charged to pay for them. And that's what we try to avoid. So what is our example solution? So we want to do a cloud platform based solution. And most of the cloud providers today offer both, they offer platform as a service and a function as a service, but they run next to each other. So what we want to do, we want to combine those platforms to handle those events from scenarios. And on the platform as a service side, we want to have an event handling system which is filtering all the incoming events and stripped them down to an amount of just relevant events that are triggering the serverless platform so the developer at the end can just focus on what he really wants to do in his function. And yes, such a system needs the ability to scale it definitely. And it should be able to filter, de-tuplicate and all that stuff. So that's the target state that we want to reach.  So think about every morning at six o'clock when everybody in America gets up, you would have an IoT device that sends out whenever the light bulb or the, you know, the light gets turned on in all of the houses, right? So this is like all of a sudden you get a lot of events and if you want to process them with a serverless platform, that's just probably too many. And most of them are if you, particularly if you're looking at some kind of an alerting scenario, you're not interested in them. This is not what we used. We actually built a cool car, but Jules is going to do that. Okay, so we had a target state that we want to have and what we did, we started a student cooperation project and we're free students including me. So I did my master's beside my full-time job at IBM and one of the students built that nice car and applied a bunch of sensors at it and like a temperature, a humidity sensor, infrared sensor, gyro sensor, a compressor, pressure control. So a lot of stuff. There was some adenos inside and respiratory pipes, a really cool thing. And yeah, so the motivation for that was actually the automotive and smart cars, connected cars. So that's why we built that. And we had to, we wanted to build a proof of concept. So really an MVP based on a specific scenario. And in that scenario we had this product car which was generating different types of data and it sent that data directly to the IBM cloud and from there we used the IoT service as IoT gateway and we consumed all the incoming events in our event handling system which was based on Cloud Foundry to filter them and strip them down to really just relevant events that are actually triggering the serverless platform.  So that overall was like a feedback loop. And we'll come to that later, you will see a demo what we actually did. Okay, so let's take a look at the event handling chain and how it looked like. So we had events, we had the X position, the Y position, the Z position, temperature, the main unit temperature and so on. But we were really just interested in the Y position, so in the gradient of the car. And then we had a filter and applied a filter rule which said, okay, I want to include all Y position events which has value greater or equal to X. And just, and after the filter we had a correlation which said, okay, I want just those events that are hold for a specific period of time, let's say like five seconds. If we have an events with the Y position of equal or greater than X or let's say five seconds, then we will trigger the serverless platform which will compensate the gradient of the car. Okay, so let's take a look of an example. Let's say you have like 100 million events monthly and you apply a filter, you may halve them, so you just have 50 million events monthly. And if you apply the correlation rule, you only have 10 million events monthly. So that would be like 90% saving, yeah, you stripped them down to 90%. And which could be quite a lot in specific scenarios. So let's take a look at numbers. So on the IBM cloud, if you have a standalone serverless platform, you would pay for with a basic rate of 0.00017 cents within, and you have an execution time of let's say an average execution time of one second with 100 million execution, so 100 million events means 100 executions, that would be like $425. And if you now have this event handler, which is a microservice architecture of 10 instances, and let's say each has 512 max of memory, you get charged a per gigabyte hour with 7 cents, that would be like $225, but now you would have only this 10 million executions and that would be just $42 on the serverless platform side. And sum this up, you would be at $268, which would be a saving of let's say 40%, which in specific scenarios like events and scenarios could be quite a lot. Okay, so let's take a look at a demo that we, so at the demo with the prototype car and what we actually did, let's start the video. So we had a UI where we could set up the event correlation chain, and we had the filter and we could say, okay, I want to apply a specific filter rule, so include or exclude something, events based on a threshold, and we also could apply the correlation rule based on the time that we want to have, and then we hit the activate button and we are ready to send data to the IBM cloud. So here the car stopped to move, to change this gradient, and we had the main unit which was sending all these events to the IBM cloud. And in the IBM cloud, we could see the locks in the UI of the specific components, and here we see all the coming events that are sent by the prototype car. And here for example, we have the filter locks. We could see how many events were excluded. Here are the correlated locks, which showed the events that actually triggered the event-based platform. And finally, in the service platform dashboard, which was in this case OpenWISC, we could see also that events that triggered the service platform. So then we had like a small dashboard in our event-based platform, and that red bar shows all incoming events, and the blue bar shows all outgoing events. So it visualizes how many events you actually filtered out. And you can also see the numbers above. So here. So that ran for a few minutes. Let's let it run a little bit. So I actually cut it a little bit. So now you see it went up to 149, let's go a little bit back, there we go, 149 incoming events, and only 10 events actually triggered the event-based platform. And that's more than 90% that was actually filtered out when we run that scenario. And finally, the functions in the service platform compensated the gradient of the car, and that was the feedback loop. Okay. Okay, so how our microservice architecture looked like. So we had, so all these blue color components were actually CF instances that were the instances that we developed ourselves. And we used different technologies like Golang for the back-end and Node.js for the filter and the correlation, and AngularJS for the front-end. And we also used services on Cloud Foundry for the message bus and the IoT gateway, that's actually the yellow ones, and the green one is the serverless platform. And as you can see, that's the 10 components that we needed to implement this system. And yeah, let's go to the conclusion. So first of all, we had a higher cost efficiency, right? In case of events from scenarios or if you know that you produce a lot of noise and you know that you can ignore most of your events. And the second thing is that we have a more efficient handling of events because now we have a specific component that's just there to handle events. Of course, we have a reduced network load on the serverless platforms and improved performance too. And another important thing is that we have a combination of the best-fitting programming models, so that was the thing that the programmer of the functions doesn't have to concentrate anymore on how he handles those events in the function itself. He can just focus on what the function needs to do. And just to add to that very last sentence, because I think really this should be the takeaway message from this session, right? So whenever you get confronted these days, and I mean, I personally do get that a lot, we probably do too, like having something like a pass platform or Cloud Foundry and having something like a serverless offering, in neither case is an either or, right? It is always an and. And it's because a lot of the customers that I talk with, many of the times it's like, oh, should I use serverless or should I use pass for this kind of stuff, right? And the question itself, obviously, is not really smart, but I think this talk or this conclusion really shows that if you pick the right tool for the right job, you can actually combine the strengths and get things moving forward. And I think that's really what the takeaway of this talk should be for those who have not realized that. And hopefully we made it a little bit transparent with the demo. Yeah. So we have like five minutes left. So of course, if you have any questions, this is the time. You mean as like the filtering function as part of the OpenWiz platform, maybe, I mean, this is kind of what it's a natural thinking to have such kind of like an event correlation or event filtering mechanism as part of a serverless platform today to the best of my knowledge. I don't think any of the serverless platforms today have anything like that. I might be wrong, but I don't know. If we would push it back to OpenWiz, it kind of defies the purpose of our talk to so that you can actually combine the two, right? But yeah, I mean, it's a valid request. At this point in time, I'm not 100% sure whether, like, there's no active work going on to push this into OpenWiz, but I'm not ruling this out at all. Of course, I mean, for, this is just the, like, I mean, the attention of this exercise was really to say, can we combine this and what are the things that make sense and combine them both from a technology standpoint, fair, as well as from a, you know, financial economical pricing standpoint. And yeah, of course, coming from Pivotal, if you want to implement, like, you would have probably implemented that correlate or some way of your spring platform. That's a natural and obvious choice. Sure, you can do that. Do the math and see. Yeah, I mean, do the math and see if it works out, if it makes sense and what the right, what the best solution would be. Yeah, it's, I mean, I think it really heavily depends on the signal-to-noise ratio that you would have for the serverless platform. Because you're right, I mean, we cheated a little bit on the math, right, in the sense that we did not count how much investment it takes to actually write that correlation application and, you know, there's a development cost associated with it that if you really do it properly, you should have probably accounted for. So we cheated on that piece, but so no, we don't have, like, we didn't, we just try to exemplify this as a thing, but my gut feel is as soon as you have something like a higher than 50% signal-to-noise ratio, it's probably paying off. But this is not scientific evidence. This is my gut feeling, right? More questions. Okay, then thanks all for attending and enjoy the rest of your Friday afternoon.


Hopefully this will work Okay, so what I'm going to talk about is root kits and also ways to detect your kits I've developed a freeware tool called vise that does that so if you came to See a bunch of hookers taken away by some policemen. You're in the wrong room So as he said my name is fuzan up If you came to black hat, you know, I'm also Jamie Butler. It's in your program. That's no secret I'm at root kid calm everything. I discuss here. You can download from root kid calm But wait till Monday or Tuesday of next week The source code for all the root kid stuff I will talk about is on root kid calm So you can have that and change it or whatever Vice the freeware tool currently is downloadable in binary format So what we go do we'll go talk about hooking and how a lot of really lame root kits Hook and user land and so forth Then we'll go talk about the tool vice to detect it Then we'll go talk about direct kernel object manipulation, which is incorporated into FU and a demonstration Pardon our voice today. It's pretty pretty dry So just we'll cover a few general overview of an operating system This this talk applies mainly to win 32 But you could also apply all the root cake technologies and concepts to a Linux or spark or whatever so in a win 32 type of environment, there's user land and That's supported by kernel 32. DLL and NT DLL DLL. So whenever you write a program That's the libraries you link to and you use the functionalities exported by those DLLs Once those DLLs get a hold of your request, they eventually call down to the kernel through some means we'll talk about in a moment The kernels what implements though the low-level functionality to allow these APIs to work So it's the current only all the work kernel 32 and everything is just basically a pass-through So tax scenario Rootkits are not about How to exploit a box there? There's been other talks here FX and Alvar and other talks at black hat Where are experts at shellcode and so forth so I won't talk about how to gain access the first time But a root kit is for is to maintain access so hide your presence You want a remote command-to-control channel? That is undetectable by IDS's and by the kernel itself and maybe Intrusion in the most part for the ones I write they'll exist in the kernel So they act as part of the kernel And we'll talk about while until recently most through kits were nothing more than a chosen program This is probably like an 80s thing they would They would replace ps or ls or something that when an administrator would run the command They would get a chosen version of the executable Of course companies have come along and for the large part solve this problem and Now rootkits evolve to filter data by hooking functions in memory This way they could achieve the same results by hooking a function You can change what that function returned So for instance if it's you're asking for a list of processes on the machine by hooking you can filter out your Your rogue process that you do not want displayed Hooking can be done at many different places the import address table is one And I think we'll have a diagram of that a moment. You can hook the system call table You can hook the erupt descriptor table really. This is only a few places. You could hope there's quite a multitude So this is just a diagram. I don't have a a light pan. So sorry I can't point out the relevant features on the slide But this is the green represents the big green box represents a program that's running and It needs functionality from another DLL. So it does it has stubs in its code Called the import address table when the loader loads the program into memory it will Set the appropriate function address for these functions there and other DLLs in this IIT table And that's a blow up there. They're either exported by function name or by ordinal and the one two One one two two three three four four represents the address in a different DLL that function would actually be located at So This is the normal control flow Code in your program goes and the application goes through the IIT the IIT calls Into some DLL Such as kernel 32, etc You can inject them with DLL into another process Through a couple different means we won't cover those but they're well documented And it's also a rootkit comm there's at least Three different rootkits that use DLL injection to hook things so in this case the The rootkit is changing the IIT entry so that the program control flow changes to it Instead of the original DLL Now here's an example of a system call hook so in the I Guess my left There's the system calls being made. That's an application asking The operating system do something on its behalf It passes through that major magic barrier there now. It's in kernel mode In kernel mode, there's a function called in the kernel in TS kernel There's a function called chaos system service chaos system service will resolve the the number of the function you're trying to call so for instance like ZW create key for creating a registry key. Maybe that's function number 3b It uses that as an index into the system service descriptor table and That just contains function pointers each there's a blow up of each table entry and They're merely Function points there index by call number the function is Represent here So you go through the call table to the function in question With this control flow Now if you have a rootkit Obviously, you can divert that control flow to yourself This is the same as a user land IT hook more or less It's just a little bit more complicated because not as many people seem to know how to write kernel code and Can get some things wrong? This is an example of a more advanced technique where After going through the system call table it still goes to the correct function Which is represented there at the top However, the function has been hooked by immediate jump and The immediate jump jumps to the rootkit and then the rootkit has control once again This is a lot more advanced technique. It's sometimes hard to get correct quick overview again in case This is an animated slide that represents it may be a little bit better So kernel 32 dot DLL runs for a while. This function represents create file W to create file on the file system It eventually calls into NT DLL calling the function NT create file That runs for a while and then it calls into the system So at each one of those places on the slide you could have hooked at the beginning of the function You could have hooked at where the function made the call you could Hook the IETs etc Once you're in the kernel Linux the the interrupt for requesting service of the kernel is an update on Windows it's into E So if you hit entry, then that's when you'll jump to a system chaos system service Which will resolve the number of the system call that you wanted and also where your user parameters are and so forth Just for reference in the EX register is the system call number in this case it would correspond to NT create file and In edx is a pointer to the user supplied parameters So once in the system call table again, it's just an address and It jumps off to the real the real function in question This slide is an anime, but you could have hooked in T create file by overriding push ebp move ESP into ebp and X or You would have to at least overwrite that many maybe the The push also Because a jump is a five-byte instruction. It's at least five bytes So you have to overwrite at least the first five bytes of the function so When we get back home, there's a whole lot of rootkits that are user mode rootkits and User mode rootkits aren't the way to go if you want to write a rootkit because they're they're fairly trivial to find By hooking the IT and so forth. They leave a really big footprint That you can look for Because you know the range of the DLL and so forth so you can look for jumps outside of acceptable Range and then flag those so vice was to take care of that also Hooking even in the curls Usually a bit. It's a little bit old school now. It's been around for at least six years probably in public source stuff And maybe in the Linux world even longer than that. I'm not familiar with that so Vice detects kernel hooks One three two API hooks and inline function patching what I mean by that is when you would Overwrite the first five bytes of a function. That's inline function patching Also, they're not on the slide is if the driver driver device drivers in memory have a table of function pointers also so there's Whenever you talk to a driver, you're talking through our request packet So like when you use net stat to list all the available ports You're talking actually under the hood to TCP IP dot sys and you're passing it RP underscore in J underscore query That's one of the orps. You'll pass down to the driver Well, there's a function pointer within the driver object that describes which function handles or the address of the function that handles that particular Erk See, you can also hook there. However, I haven't currently come across any public root kits that do that in the Windows world and I'm doubting it's done much than the Linux world. I'm not sure of the format of the LKM structure So I'll try to get to a vice demonstration now and show you how it works and that you can use it when you go home Okay, well, let's turn that key. I'll try to show it in a minute if I have extra time The key's not installed right now. So To save the day I have backup slides So here's vice versus hacker defender Hacker defenders are very a very good root kit. That's on the kit calm I believe it was written by holy father and He's a he's very knowledge. Well, I've discussed Rootkit stuff with him in email Here's the vice output. I'm not sure if it's completely readable But all these slides should be on your CD also the things there with the embers glue a Little icon. You'll see it's hooking. There's something hooking kernel 32. DLL and actually that turns out to be In this case up way up top of the screen is NT DLL So you might say well NT DLL is not a root kit. That's correct But the way it's on used in the system It actually hooks other Windows API as occasionally and so therefore it is a hook and that's what vice catches So the thing with the Swiss army knife a little icon That's that's all the functions that vice called hacker defender hooking when possible vice will output Where on the file system? You can find the the hooking module in question So that will allow you to go to the file system and delete that bad on DLL or whatever off of the system In this case, it couldn't resolve hacker defender vices You know a project still in the works and maybe in the future. We will be able to resolve that on the file system So you can see it hooking things like create process and so on so forth It also gives you the address and memory Vice does so if you wanted to go and reverse engineer it yourself and figure out exactly what their function does you can do this Here's vice versus vilequish vilequish is another popular root kit every kid calm and Love said about that How many red KDM's paper on frack 62? anyone Okay, he stated that vice could not catch his root kit called NT illusion Which is an entirely user land? root kit This was correct at the time he tested There was a bug and vice and vice had not had any development on it since it was first written in mid-April However, now that bug is fixed And as you can see it catches NT illusion That's not where the here is not only their cast catching the illusion it also lifts up where on the file system it is So you can go delete it So that that was sort of root kit spin and hooking We talked about how hooking is detectable and now we're going to go into a little bit more of What consumers are currently doing in the world of you know trying to prevent viruses trying to prevent root kids And so on and so forth Everyone's running to third-party personal firewalls and also host-based intrusion prevention systems So what are kids kids are host-based intrusion detection system hips being host-based intrusion prevention system What are they there for? They're there to detect what process is a rolling system. Maybe if the new process is started Block access, you know the things like net cat and so forth from running But files are created or deleted or modified that may be important to a hips like don't let anyone write to the Wnt or window system 32 directory because that's probably gonna be a bad thing Hips also keep track of network connections made and possibly deny those connections and They try to do a little bit with privilege escalation And they look for buffer overflows and so forth However for a lot of these different pieces of functionality Hips and the current security products rely on the operating system itself So if you lie to the operating system You lie to the hips Here's some different functionality that's built into the operating systems today that allow our hips to work If it allows the hips to work it can also probably You could use this as a starting point to where to look to try to unlink our hips for instance in your kernel So you can register a risk provided callback functions For instance, if you want to be notified every time a process is created you can register An address to be called in that case and the kernel will do so That works for threads also Images loaded into memory. There's all these all these different pieces that hips use to detect new things coming in to the kernel or coming Into the process listing You can hook these You could remove These are nothing more than a linked list of functions to call you could remove Hips product from that link list probably without a whole lot of problems Some hips actually hook the system call table you have to do that especially on Windows if you want to if you want to filter or in registry key access because there's no easily There's a user land API that you can call for a callback when a registry key changes or any of its children But it doesn't provide you much useful details. It just says hey something changed and you would have to reparse all the keys to figure out exactly what it was that changed and Therefore you'd have to sort of keep state like before and after That's not very useful. So hips for the most part. Just hope the system call table directly Hips can hook user land API functions how many saw the Frack article on bypassing third-party Windows Buffalo Flow protection Okay, that was done by myself and two other anonymous co-authors I'd like to thank and They know who they are So anyway Some products were hooking the user land API's and we wrote some shellcode and so forth a totally bypass Their their implementation of Buffalo Flow protection at the API level and then you can query the kernel, of course so if you want to Know what network connections are open you can query the kernel. I'll tell you well, there's a problem with a lot of these hips designs and it Goes back to the Frack article really requires that they'd be on the execution path of Any malicious code and they have to know where the execution path would be ahead of time so There's no reason that We have to use the API's In in the kernel or even in user land so the ones that we know that they're watching We don't use those API's and I'll introduce deek deek common a second which uses absolutely no API's to make its changes it may use to make API's once in a while to gather information but This is really the non information that would never be blocked anyway So let's talk about the operating system design quickly Intel has four Privilege levels or four rings as you see here demonstrated However Microsoft and other OS vendors Do not use all four of these rings. They only use two. There's ring zero, of course Which is completely privileged code, which is the kernel itself or device drivers or LPMs Then there's ring three Ring three is all applications So when you're running in ring three For instance Ring three is just ring three like the hips doesn't have any more Privilege than you do at that point if it's only implemented at ring three, which is the case of some of these One 32 buffer on-flow protection mechanisms When zero you have access to all of kernel memory So everything that the kernel uses like objects to keep track the kernel is more or less So, you know, it's a big accounting arm So it's keeping track of all the processes all the ports and so forth and it does this in Structures that it calls that Microsoft calls objects. So these are kernel objects not to be confused with C++ objects So once you have this no separation of powers, there's only two privileged levels Every single device driver has access to all these accounting objects that the kernel has access to Therefore you can modify it just as much as the kernel can you just have to be very careful how you do so You have to understand what the structures are How to find them what they do and how the kernel expects them to look So if you don't understand those important details, you may modify an object in memory and cause a blue screen There's so many third-party device drivers. I mean, there's your printer drivers your fax drivers all these different things and That really should be different levels of protection between the two between the kernel and the drivers So the next generation of root kit technology is Decom that's a play on obviously Microsoft's terminology, but in this case direct kernel object manipulation So what does it do? It modifies objects directly in memory Never going through API's so there's one on API's to For instance add a seed to a token in a Windows process Well, the first of all the kernel is going to see if you have the appropriate privilege to add that seed And it may stop you there also The hips or other third parties may wrap around That function flow the function control flow and try to intercept that call and limit you there But if you write just directly to the memory, there's nothing to stop you So you can use deco to hide a process add a privilege to a token add groups to tokens Cool application is to fake out the Windows event viewer so that if I if a user I Should say if a process spawns another process such as netcat if the administrator has Detailed process logging turned on any Windows event viewer. They will see An event that says that administrator or whoever you're logged in as you know just started Cmd or reged at 32 or whatever Well If you change your token to look like someone else's just by changing a couple bytes Then the administrator be thrown off because it'll look like you can make it look like system did it So system just spawn netcat now obviously that's gonna be a red flag to any Halfway competent administrator However, it's not a point at possibly the user account that you subverted It's going to be a red herring that they're going to have to chase for a couple weeks probably before they really figure out What happened and maybe they'll never figure it out So another thing of deco we could use it to hide ports currently the fu root kit does not hide ports But you can do it So obviously the implications of hidden processes hidden process can have Potentially full control of the system. There's no accountability defeats the Heads and hips type of paradigm and it can skew the results of forensics it all depends on how How advanced your forensics are but you only have to be overcome the slowest Forensic tools for the most case So how do you go about having a process in the Windows kernel? Here's a Here's a picture of how the objects look in memory the E product of the kernel has a processor control block It's represented there at the top within there's three key pointers One is to the current thread ones to the next thread ones to the idle thread So you need to find your current thread because that's going to lead you to your current process So you go to the processor control block follow that pointer to the current thread That's represented there by the E thread block that's sort in the middle of the diagram the E thread block or object contains a K thread object completely embedded within it at the beginning of the E thread object and that contains a pointer that Leads to the E process block every process in a Windows Operating system has to have at least one thread and it has an E process block so These structures are for the most part undocumented If some of them now are becoming a little bit more document, however, they change a lot between versions of service packs And also major versions of the operating system So you have to do at first when I did this two years ago is all reverse engineering Now you can use windy bug Load up the symbols appropriately for whatever version of the kernel you're using type DT space in T bang underscore object name and If you don't know what the object name is you can wildcard it to try to narrow it down I will tell you that not all the object members are documented like Microsoft may just say oh, it's a It's a P void and so you don't know what it actually leads to And of course that takes a bit more time to figure out so within the E process block there's a There's a list entry structure it contains two pointers the first one's called a flank and The second is called a blink a flank is a forward link and a blank is a backward link So this list of E processes if you would just keep following the flanks. It's completely circular Also, if you just keep keep following Well, you'd have to do like De-reference blank and then add for to get to the link behind you and keep following the chain that way You could go backwards through the list also So if you want to how to process the criminal Processor control block is located at a fixed address Also, if you don't trust that because I haven't verified that since 2000 You can use the FS register to always get the address of that curl Colonel processor control block also Within there we talked about that you can get the current thread running and there's the assembly command Well, you would just move that into like EAX the FS colon bracket 124 and That would get you to an E thread the E thread takes you to the K thread and the K thread takes you the E process block So to how to process All you need to do is change the E process block in front of you to point to the E process block behind you and the E Process block behind you to point to the E process block in front of you and I think I have a demonstration that graphic So here so I don't have a pointer But we're trying to hide the current process. So if you just it's the E process block that's in the center So you would want to modify the flink behind us to point to the flink in front of us and that's represented there Once you do that half the game's done now you have to change the Blink in front of us to point to the flink behind us like that So you just tell your neighbors. Hey You know point around us So why does this continue to run? well, it turns out that the the scheduler and windows is extremely advanced and It's thread-based But however the reporting mechanisms are process-based So you can edit the this E process block and all your threads still get scheduled because They're often their little thread cues and so they'll continue to run I'll just cover this really quickly because Linux isn't my strong point. I haven't looked at it since it came out with a new threading model in Linux 2.6 But within the Linux kernel you could do a similar thing. However, there's sort of a gotcha at the end The Linux kernel contains an array of tasks trucks So each task truck represents process a task truck contains a link list With the pointers previous task and next task that you can also follow around the circle And it contains two other vital pointers, which are previous run and next run to determine the list Are the ordering of when to schedule process? so How to process you just remove it from the previous task and the next task Like demonstrate in the E process block exact same concept you leave next run and previous run alone Does anybody know what happens when you get this far right? Speak up. Okay, the whole process freezes So nothing your process continues does not continue to run and the reason being is because the way that Processes get scheduled time on a Linux 2.4 kernel in which case the scheduler walks around the previous run and next run List so it follows the next or I'm sorry it follows the previous task or the next task list Walks around this link list Going to each task structure within memory Based upon it calculates a goodness value for the process and based upon the goodness value It assigns it in order or the number of jiffy's and so forth in which to run or to get CPU scheduling So that's when it puts it into previous run and next run The ordering there well if you're never in the in the next task listing Then you'll never get your goodness value calculated. So you'll never get scheduled again because This the scheduler can't see you This is probably all different in the 2.6 with the threading model There was a root kid on after I hit this problem There's a root kit that I found on lawn that was open source. It is a fairness more gear I believe is the name and This person had come across the exact same problem I was having and they figured out the only way to fix it was to Or the way they were going to fix it was to patch the scheduler so with this But the solution did was the inlet process is always the first process that has no No parent process So the parent processor or polar parent process in the task drop is null Well, they modify that to point to the hidden task drop That way they modify their scheduler to always go there and look at these hidden task drops and Calculate goodness value for them But if you go through all that effort, they'd probably be better ways to hide your process so You it should be noted that you can't just choose these listings arbitrarily and not expect some problems These lists especially on a multi-threaded environment or a multi CPU especially environment These lists are shared resources. So you have to Use some kind of synchronization objects to try to get access to these lists if you want to Completely modify or modify my completely safe manner In windows if you want to modify the list of active processes, there's a non-exported symbol called PSP active process Newtex the kernel every time grabs that newtex and Once it has it then it can modify the list PS loaded module resource is to guard the list of device drivers Problem is obviously as I said these symbols are not exported So we have to find another way to come up with synchronization One way you could do it is you could hard hard code these addresses of these newtexes and That would vary a lot between each version of the OS and Maybe potentially each reboot could also have an effect here This isn't probably the best solution another way you could go about it is to try to search For a known pattern in memory You know that there's going to be certain functions within the kernel that have to access these newtexes in order to operate safely So you could do a search