What's up everybody, I'm EvilRabbit, we are here on AssettoCorsa at MegaTamara, cruising our way back to basically the hill section to discuss the age old discussion that is on my YouTube as well as many other Drift YouTubers, why Drift in third person. So we're going to tackle that today, we're going to do a little bit of talking about it and give you guys a little bit of insight on why I personally do it and why I think other YouTubers do it. So like I said, make sure you follow me on Instagram and Twitter, I'll just find the description box below. Let's go sliding, let's have a little talk. We are ripping through this tunnel, have to slow down. Oh grinding gears, there we go. So we're going to the hill section here at MegaTamara. So a lot of people have been commenting on my videos about why do I Drift in third person, I hate third person, things like that in nature.  The reason I and I think other YouTubers Drift in third is because well, what you're seeing, oh my, we are going off a hill. What you're seeing right now is first person with neck function. Now, as it looks very cool and very entertaining to watch, if I have a car chasing me, you're not going to see them unless I add the cinematic camera angles and a lot of tracks don't have those. And sometimes it's just a lot harder to actually get those angles so you can see a car that's chasing me. Now I would have to spend a lot of time chasing people instead of leading for it to actually look, you know, like a cool video because otherwise it just looks like I'm drifting by myself, whether my buddy Christmas or my buddy Taylor or Dave or any of the other guys, any of the usual stuff that guys do are, you know, behind me, you wouldn't even really know. Now, if I was in an Oculus, I could look out the more out the side window and you'd be able to see them and stuff like that. Blue needles. I forgot this car's blue needles were rock of my S13 that is public. But you wouldn't be able to see people behind me. So for a video aspect, I mean, if you guys enjoy seeing this first person angle more, let me know down in the comments. I'm going to leave a poll up on this video. So watch this video, take the poll and let me know. But so what you're seeing is just neck function of content manager here on Mega in an S13 having a blast. Actually, I love this 13. It parties hardcore for sure. So we're going to switch it up once we get on top of it, we're going to switch it up to third person and you guys are going to see the difference in what, you know, obviously it looks like with the pivot camera and stuff like that. And I want you guys to make the judgment yourself on what you guys think is better. Do you guys prefer it first person like this or do you guys prefer a third person because if you guys notice my recent video tanning the A90 versus the original Supra, you could see when Nate was behind me or chasing. Yeah, I had the cinematic view up also, but Rocky has a very good cinematic view. So now we're going to switch it up. We're going to go here, going to switch up that beautiful third person. And we're going to switch up cameras. There we go. And we're going to send it here in third person with the pivot cam going. So you can see a lot more, you can kind of see where I am. And if somebody was in my door, you definitely see it. So for a visual aspect for a video for you guys to watch to make the video more visually appealing, I feel third person is definitely the way to go. And I feel like that's what a lot of other YouTubers like AR12, Slaptrain, and you know, some of the other drift YouTubers or even the Twitch streamers, you know, a lot of them drifted third person because to me, this is personally more visibly appealing for you guys to be able to see more of a car, be able to see the angle, see where I am on track, how close I am getting the walls, dirt drops. And like I said, if somebody was chasing me, how close I really am to them or if they're how close they are to me because like I said in first person, you wouldn't even be able to see somebody chasing me if they were in my door.  I can drift in first person. I spend a lot of time in first person when I'm just drifting with my friends or just chilling. And I use my oculus a lot too. But for videos, you know, I want you guys to make a judgment. Do you guys prefer this, which you guys are seeing, the third person with the pivot camera, or back when I was in first person? Do you prefer, we're going to try to read this in fifth, the first person angle. You know, I want you guys to answer the poll, let me know. We're going to go come back to that poll and, you know, a couple videos and stuff like that and we'll see what everybody thinks because, you know, it's been an age-old discussion on my channel for a very long time from back in the Forza Horizon 3 days and the Forza Horizon 4 and Motorsport 7 before the drift camera came out. Because before the drift camera came out, first person was very static. So the drift camera, the drift head motion, stuff like that, or here on the set of course, it was real head motion or like what I was using, the, you know, neck function of Content Manager, it's a game changer and then Oculus is just even more of a game changer up there. So I want you guys to take a look at this clip and the clips before. Kind of a long handbrake drag. And give me your full impressions on it and what you guys truly think you like to see more because if you guys prefer more first person, then without a doubt I'm going to start throwing some more first person at you.  So let's head over back to the main part of Tomata Circuit, do the same thing, drift it in first person and drift it in third and give you guys the opportunity to see what it looks like totally on both so that you guys can get where I'm coming from when I say I do it to make the videos look a little bit better and make it basically more visually appealing.  Alright, the inner part of Tomata, the big main part of Tomata Circuit that everybody drifts. So we're in fourth, third, a little left foot brake, a little handbrake to get around there, left foot brake in that, there we go. Seein' nice and smooth.  I can drift in Oculus. It's not a preference of drifting third to first, like I've been explaining. It's more of a visually appealing, I don't know how close I was to the wall and you guys will never know either. Unless I have the cinematic angles up, which if you guys prefer maybe first person with cinematic angles up top, then, you know, I will, you know, do my best to throw the cinematic angles up top and also see overhead views and third person, stuff like that, on top of the first person drifting. If that's something you guys like to see also, you know, I'll leave that in the poll as well. But take the poll, let me know what you guys think. That's two full laps here at Tomata. In first, a little bit more handbrake.  I love first person because you get to see the interior, you can see the detail work, you know, the energy you've already had in steering wheel and things of that nature, but we'll never know how close I am to that wall. So let's switch up cameras, switch up views, go to third and we're going to come over here and we're going to switch into the new drift mode. We're going to rip the same thing but in third. So there's more to see. You can see actually where I am on track. How close I'm coming to, say, grass or the outer edges and stuff on that nature and the biggest thing is in tandems. There's definitely a big difference in what you can see. So, follow me on Instagram and Twitter. Take the poll, let me know what you guys think. Down in comments as well. Take the poll so I can get a good tally so we can go back to it and bring it up in another video and, you know, see what everybody is saying because I'm very curious because I get that question a lot. I get those comments a lot about, you know, why are you drifting in third and I figured I would come out here today and kind of give you guys a little bit of an insight on why I do and I think a lot of other YouTubers do.  You know, drifting in third person is actually what I feel sometimes because you don't have that sense of rotation as much. Yes, you can see how far you are to a wall and stuff, things of that nature but being in first or in an Oculus is a different type of view. So make sure you follow me on all social media. Make sure you tap that like button and subscribe. I do appreciate all the support. Hopefully you guys are wanting to support the channel and myself here. All you gotta do, tap that like button and, uh, well, hit that subscribe button, come back, watch the content and bring this stuff for you guys, especially during these uncertain times, hope you guys are all staying home and safe. We are, even though I do work on my normal day-to-day job but doing every precaution I can to keep myself healthy and safe. Hopefully you guys are doing the same. If you guys are essential worker, big thank you to you. If you're on the front line in healthcare or anything like that. Major thank you to you guys for doing what you gotta do to keep people safe and healthy. So, as always, I like, thank you guys for watching. I'm EvilRabbit. That's a wall. I'll see you guys on the track. Wall tap, maybe? Oh! Wall tap to grass. Red.


Okay, welcome back after the break. Just before we went for a break, we were looking at the doctrinal significance of Resurrection and what it means to us today. So that was chapter 11. We completed chapter 11. Any of you have any questions? Any doubts? Anything that you'd like to add? Any thoughts on chapter 11? The silence. So what should I take the silence for? Did you all understand? Did you not understand? Are you all able to hear me? We can go ahead. Go ahead. Okay. Okay, so there are no questions. Nothing anyone wants to share. Anything you want me to explain again? Okay, if not, we'll move on to chapter 12. If you look at your notes, it's basically just a few sentences there with a few scripture references. And it says at the end of that lesson, it says that, you know, that the end time events or the details of the return of Christ and His rule on the earth will be taught in the course that is called as the end times. I think that is in your second year. So here we're just going to basically very briefly look at the end time events. We also have a chapter on this in doctrinal foundations. So if you really want to, you know, more detail study, then you can let me know. We could do that in when we're doing it in doctrinal foundation. I think it's just going to be the next chapter or two more chapters. And then we will be doing about the end time events. Okay. So we talked about Christ's death, His resurrection, His ascension to heaven. And that is not the end of what God has for us. He has promised to take us to be with Him. He also has promised that Christ will return just the way He was taken up, the same Jesus will return again. And we read about this in Acts chapter one, verses nine to 11. So can one of you please read Acts chapter one, verses nine to 11, please. Acts chapter one, verses nine to 11. After He said this, He was taken up before their very eyes and the cloud hid Him from their sight. They were looking intently up into the sky as He was going, when suddenly two men dressed in whites stood beside them. Yes, you can continue with verse 11, please Subashish. A man of Galilee, they said, why do you stand here looking into the sky? These same Jesus who has been taken up, taken from you into heaven will come back in the same way you have seen Him go into heaven. Thank you. So when we see that Jesus was taken up, the disciples are still looking, gazing, staring into heaven and the sky.  That means in the same way you saw Him go into heaven. So Jesus will return for His Church, for His people to take us to be with Himself and we know that this is referred to as rapture. And the rapture will take place before the seven-year tribulation that the people of the earth will face who are left behind. But those who believe in Christ Jesus will be raptured up and will not go through that seven-year tribulation period. John chapter 14 was 13. Ephesians chapter 5 was 27. 1 Thessalonians chapter 4 was 13 and 18. So can each one of you read these verses please? John chapter 14 verses 1 to 3. Ephesians chapter 5 was 27. And 1 Thessalonians chapter 4 was 13 to 18. John chapter 4. Yes, go ahead. Go ahead Zillotoli. Okay, John chapter 14 verse 1 to 3. Let not your heart be troubled. You believe in God, believe also in me. In my Father's house are many mansions. If it were not so, I would have told you I go to prepare a place for you. And if I go and prepare a place for you, I will come again and receive you to myself that where I am there you may be also. Thank you. So here we see that Christ will come again and receive those who believe in him and we will be with him where he is. Thank you. Ephesians chapter 5 was 27. Ephesians chapter 5 verse 27. I read, in order to present the church to himself, in all its beauty, pure and fortlessness, without sport or income, or any other imperfection. Thank you. So when Christ returns, he will present us his glorious church as people who are holy without blemish, without any sport or wrinkle. Okay. 1 Thessalonians chapter 4 was 13 to 18. In one of you read that please. 1 Thessalonians chapter 4 was 13 to 18.  But we believe that Jesus died and rose again. And so we believe that God will bring with Jesus those who have fallen asleep in him. According to the Lord's word, we tell you that we who are still alive who are left until the coming of the Lord will certainly not proceed those who have fallen asleep. But the Lord himself will come down from heaven with a cloud command, with the voice of the archangel and with the trumpet call of God, and the dead in Christ will rise first. And that we who are still alive and are left will be caught up together with them in the clouds to meet the Lord in the air. And so we will be with the Lord forever. Therefore encourage one another with these words. Amen. Thank you. So Paul is talking about the rapture and what's going to happen when Christ returns. He mentions about this in 1 Thessalonians chapter 4 was 13 to 18. How Christ will come and how those who are alive and those who are will be caught up with him in the clouds will meet the Lord in the air. And those who are also dead will rise first and then those who are alive will also be caught up with him in the air. They will meet Christ and will be with him. And we know that after the rapture happens will be the seven year tribulation period. And after the end of the tribulation period we know that Jesus will return back and he will establish his kingdom here, the millennium kingdom here on earth where he will rule and reign and we all will be here on the earth will rule and reign with Christ for a thousand years. And then during this millennium rule we know that Satan will be bound.  So Revelation chapter 20 verses 1 to 4, can somebody read that please? Revelation 20 verse 1 to 4, then I saw an angel coming down from heaven having the key to the bottomless beat and a great chain in his hand. He laid hold on the dragon that serpent of all who is the devil and satan and born him for a thousand thousand years and he cast him into the bottomless beat and shot him up and set a seal on him so that he should deceive the nation no more till the thousand years were finished. But after these things he must be released for a little while and I saw okay man till three or four. Yes, it was four and I saw thrones and they sat on them and judgment was committed to them and then I saw the souls of those who had been beheaded for their witness to Jesus and for the word of God who had not worshiped the beast or his image and had not recipes mark on their foreheads or on their hands and they lived and ringed with Christ for a thousand years. Thank you so that's basically just in very very brief about the end time events or the promise his promise return okay but we will be you will be doing a more detailed study about this in the course the end time end times and we will also be studying a little more about this in the doctrinal foundation okay so any questions any doubts on this chapter it's very brief though it's basically it's crisis ascended he will again come back in the same way we saw him go into heaven we know that there is going to be that's called a rapture when we when Christ will come in the clouds and those of us who are alive who know him will be caught up in the air those of them who are dead will resurrect will also be caught up in the air with him and then after that is the tribulation period that happens which is for seven years the first half of the tribulation which is basically the coming of the antichrist and you know the false prophets that will arise that's mentioned in Revelation chapter 13 was 11 so approximately during that time another man will come up in the forefront as a great spiritual leader somebody who's respected admired by everyone and we see that the second half of the tribulation he will be revealed as the false prophet and that's this is what is spoken about him in Revelation chapter 13 was 11 and then shortly after the antichrist and the false prophet come to power on the earth you know in heaven Jesus Christ will take the scroll that is in their hands and begin in the hand of God Almighty we we read this in Revelation chapter 6 was 7 and 8 where the seals will be opened the opening of the seals and you know the first four seals will be opened and God's judgment will be unleashed on the earth and it will bring about large scale destruction and death okay we read about this in Revelation chapter 6 7 was 7 and 8 and the remaining two seals only the first four will be open in the first half the tribulation the second half tribulation there will be the other two seals that will be opened during the first half the tribulation there will also be the two witnesses so while the four seals are being unleashed upon the earth God will simultaneously raise up two witnesses in Jerusalem to deliver people from the judgment so we see that the mission of these two main witnesses is to inform people that the judgments taking place are directly from God and you know anyone who chooses to follow Jesus will be saved from a greater judgment in hell and these two witnesses will perform extraordinary miracles to prove that they are sent from God and we see that because of their witnesses many Jews and Gentiles will accept Jesus as their Lord and Savior during the tribulation those who are left behind we read about this in Revelation chapter 11 verses 5 to 6 and then we see that the persecution of the Christians will happen those who are left behind you know Antichrist will use his influence to persecute the Christians their faith and there will be intense persecution that they will face they will die horrible deaths again this is written in Revelation chapter 6 verses 9 to 11 then the two martyrs the two witnesses will be sorry two witnesses will be martyred their bodies will be left dead in the streets of Jerusalem you know so we see that you know there will just be left dead over there so but however after the three and a half days after three and a half days they will the breath of life from God will enter them they will stand on their feet and they will cause terror to those who are seeing it and then there'll be a loud voice from heaven which will say come up here and there will be there will go up to heaven in a cloud and all their enemies who you know martyred them will look upon them in awe and they'll be really amazed and stunned we read about this in Revelation chapter 11 verses 11 and 12 and there'll be an earthquake in Jerusalem then Satan will be thrown down to the earth and the second half the tribulation which will happen which will be opening of the the fifth and the sixth seal and there will be you know mass devastation that will be happening on the earth earthquakes that will happen and you know many people will be killed because of this and they will realize that it's God's judgment upon them the world leaders will be filled with fear they will long to escape the judgment of God and then we see that satan himself will indwell in antichrist and antichrist will destroy you know destroy Babylon the great that's spoken about in Revelation chapter 18 verse 10 but if you really see this you know all the nations the powerful nations will fully cooperate with antichrist supporting him his world government so now since satan has possessed antichrist he will declare war against this nation which is symbolically referring to the Babylon in the in the bible and will be successful in destroying it and we know that antichrist will declare himself as god you know he will overtake the Jerusalem temple which by this time will be rebuilt in the same format that god had given David and Solomon had built it and his so the world head headquarters will move will now shift to Jerusalem and we see that the idol of antichrist will be created he'll desecrate the the temple the altar the sacrifices there will be the mark of the beast and then you know you know putting on the mark of the beast on the forehead then we see the opening of the seventh seal and the seven trumpet judgments the seven bowls of plague when the seven trumpet is sounded then antichrist will initiate his plan for war against god and then there will be preparations for the war at Armageddon and then we see the battle of Armageddon in the second coming of Jesus and satan of course will be defeated and he satan antichrist and the false prophet will be thrown into hell where they will be there for a short time we read this in Revelation chapter 20 verses 22 and 3 and all the unbelievers who participated in the battle of Armageddon will be killed and sent to hell and then we see that you know the thousand year millenium kingdom will be established here on earth where Christ himself will fool and after the thousand year millenium kingdom we see that satan will be released from you know from the from hell and he will deceive many again and then there will be the final the battle of Gog and Megog the final judgment of satan heaven and earth will vanish and then we'll have the great white throne judgment and a new beginning so that's just basically very briefly that I've just gone through because you will be learning in detail about the end time events but if you want me to explain anything then I could do that can you please explain Revelation chapter 20 verses 4 to 7 when thousand year effects yeah that's a that's a very good question so Zillatoli's question is you know saying that can you please explain Revelation chapter 20 verses was 4 and was 7 right Zillatoli yeah verse 7 actually okay verse 7 when the thousand years have expired or has ended satan will be released from his prison I was just thinking why would God release satan again so we see that in the thousand year millenium kingdom only believers will be part of that you know millenium kingdom where they will experience you know the you know they will experience the rule and the reign of God and during that time children will be born and children will have the privilege of being born into a perfect world where there will not no suffering or poverty everything will be available in abundance for them but in spite of the perfection in their lives in spite of you know the perfect loving rule of Christ we see that you know they will find themselves tempted by their sinful nature that is inside them because you know they are you know still human they're born in sin but we know that during the thousand year period you know these children who are born the youngsters millions of them were born will not commit any sinful deed in spite of their sinful nature that is in them the two reasons why this will happen the first one is because God will not permit any sin absolutely no sin no disobedience like we read in Revelation chapter 19 verse 15 he says that he will rule them with an iron scepter with an iron hand you know there will be perfect obedience and also they will not you know give into the sinful nature will not yield into temptation because satan is lying bound in the abyss and there won't be anyone to deliberately tempt them to sin against God but we see that soon as satan emerges from the abyss he will you know begin his job of deceiving other people once again so at this time the whole new generations that are born during the millennium you know will have an opportunity to prove their loyalty to to Christ but those who give into satan very sadly will fall into his trap so you know this a time where you know God also wants to to it's like a part it's so to say not in a very negative way but God will allow this as a final proof that the heart of man is desperately wicked and can be changed only by God's grace you know so people who have been living in the perfect environment perfect government of God's son they will rebel against their king it will show that they obey God during the millennium because they did not have any choice but when they have a choice are they really able to prove their loyalty to Christ okay and so we see that satan will lead many in his final attempt to rebel against God but during this last stage or this last rebellion it really will show who is totally loyal to God who's totally faithful to him and those who are honestly seeking him and wanting to follow him compared to those who just followed him because of the iron rule or the iron scepter and they had to obey there's no way they could disobey and so God wants to know who totally him who belong to him and who are loyal to him yes and also to show that man's heart is utterly wicked and they can only be saved by the grace of God it's a good question but this is a answer which can be a little hard for all each of us to digest but that's how God has ordained it in his sovereignty in his plan in his will thank you for that observation and questions literally very good question anyone has any other questions so just basically briefly went through what is going to happen at the end time events it's not a detailed study anyone has any questions any doubts no questions so all of you are going are happy that you all will be raptured that we all will be raptured we don't have to go through the seven year tribulation period which is going to be really terrible is not the word to use I mean it's it's more larger than that word terrible and will also be part of the millenium kingdom of God where we will live under his perfect reign and his perfect role okay there are no more questions no questions the end times okay if there's no questions then we'll just fix a date for our second assessment which will be chapters with the first assessment we did chapters one to four that is the pre-existence of Christ's equality with the father and the spirit will he split the role in his sorry Christ role in creation and his promise of his coming again so the second assessment will have chapters five six seven and eight which is understanding the incarnation the humanity of Christ the purpose of the incarnation and the virginal conception okay and then we will do uh nine ten eleven twelve thirteen and the third assessment so is that okay would you want to have these chapters five to eight is that fine yes ma'am so okay four chapters okay which is the date that we can have it would march 21st or 28th be fine for the second assessment march 28th is fine for me okay thank you paul uh thank you super she's 28 sounds good okay yeah then 28 sounds good we'll have it on uh the 28th okay on the 28th you'll have chapters five to eight okay next sorry success it's okay okay thank you uh so uh next class will be uh the last class which is chapter 13 the Son of God which is also very uh you know uh very short uh notes on that uh so if you have any questions or doubts even as you're going through uh these chapters that you went through for the test one chapters one to four or chapters five to eight you can raise any questions uh and then we can answer that otherwise uh next Monday will be our last class for this course okay uh do you think it was uh do you think you want me to redo any chapters re-explain any chapters you can tell me now we still have a couple more minutes before this class ends any chapter that you want me to you know uh teach again anyone i hope i was not too fast in going through the chapters was it okay was it fine can i have some feedback please it was okay man it was okay it's okay all right it was good paul sir thank you thank you thank you everyone for your feedback any chapters you want me to go through you can still let me know uh again post it on the stream page uh and we can do that again if you want a more personal study then that's also fine because all of you don't have to join class those of you want to join those classes we can still redo some of the chapters that some of you want uh uh an explanation are interested in knowing uh more you can still do that okay okay uh then we'll have our second assessment chapters five to chapter eight on uh the 28th of this month and then we'll have next week we might we can decide for the final assessment where we'll have chapters nine to thirteen nine to thirteen will be very short because only basically nine ten and eleven have content for it the twelve and thirteen very little content okay okay thank you all for joining class today have a good day and a blessed week ahead and i'll see you on uh when i stay for your doctrinal foundations i hope all of you were okay with the the doctrinal foundation assessment were able to access it had any issues i haven't assessed it okay uh today uh five o'clock ISD is the deadline uh you can it's accessible now you have any issues you can just uh uh you know post your message on the stream page and i'll help you okay i will do that yeah is where is this am here maybe before 10 am i'll finish off okay thank you success sorry for the inconvenience uh i don't know every when we check it and upload it it's all fine but once it's uploaded i don't know how uh you know the button for uh uh you know restricted users uh gets on which is quite strange that happens to your class but when i post it for the final year students for their assessment it's all works perfectly but so we just had to turn that off and i think all of you were able to access access the form after that okay thank you all for joining class uh have a good day and a good week ahead and i'll see you on uh venice day don't forget to you know submit your assessment uh the deadline is uh five o'clock today okay thank you all bye sorry five o'clock what's time on your your nation your country because uh it's like i said is this am so that i won't be late in submission no you won't be late because you're going to do it in uh within three to four hours you have more than that now we are uh 10 36 am for us yeah so you have more hours yeah all right thank you okay thank you everyone bye


The BSU women's hockey team also hits the road this weekend for another conference matchup. The Beavers continue their month-long road trip with a weekend series at MSU Mankato. The Mavericks currently sit in last place in the WCHA with only one win in the conference. But the Beavers know they can't take them lightly. We can't go down there just thinking we can show up and get points because that's not going to happen. We have to go down there. We have to be ready to play and we have to play. We have to bring our A-game like I would say. There's no way, I guess, anybody in this league that we can just think we can show up and be successful. But again, it's an opportunity. Starting on Friday there's three big points. Let's see if we can go get some. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


So, now it is 1 o'clock and with all that set up time, we're good? Yeah. Yeah, right? Right. We're good. So, it's my pleasure. Jay, you presented. Oh, wow. Actually, in this area, it seemed like yesterday, 2016. So, without much to do, it was my pleasure to introduce to you Jay DeMartino-Fidelis. Thank you, guys. Thank you. So, we've all kind of been there. Most of us who kind of work like either SOC work or malware analysis or, you know, where you end up writing rules, right? I'm just going to kind of give you a methodology or at least my methodology of how I write rules and how I go about things. You don't have to adopt it. I don't care if you do. Hopefully, it gets it better out there and we can all rise up and start crafting good detections and whatnot. So, my name is Jay DeMartino, head of detections and countermeasures for the Fidelis threat research. That's just some fancy title my boss gave me. Really, I'm just like the rule bitch, right? So, that's pretty much how it goes. There are some prerequisites to this talk. I do a lot with regular expressions and with YARA. So, that's all my examples are going to kind of center around those two. If you are unfamiliar with YARA, the talk that Ming just mentioned that I did back in 2016 was to catch an APT, YARA, and I go through more of the syntax and whatnot. So, if you want to learn that, I definitely suggest going back and watching that. Regular expressions, I don't know, I have good days and bad days either way. If you're not doing them every day, you're, yeah, either way. So, when you're writing detections, the real problem is that you and your coworkers, you know, you're kind of building this structure and it's very complicated, right? And sometimes, you know, like the guy in the picture, he may be looking down at what his coworkers doing. He's like, what are you doing? I'm up here or, hey, let's build this and it's all disjointed and whatnot. And there's a lot of complications. It's never really easy, right? Because malware will be at all different layers upon the stack and the attack surface is at all different layers. There's not one easy different thing over one protocol or, you know, whether it be the file or the network layer, or even metadata and whatnot. So, what happens when you two have been working alongside of each other and all of a sudden your colleague leaves the company, right? And everybody, you know, it's like, it's a normal thing. Everybody leaves and it's like, hey, cheers, we're going to throw a party for you. And he's like, yeah, man, sorry for everything. We're going to be friends.  It's like I kind of equate it to monopoly, right? And you get the chance. Everybody wants to go and collect $200, right? Everybody wants that. But it's like, in this case, no, you got to pay the other players. You're taking your lumps.  So I learned this the hard way. So that being said, how do we rise up to the occasion, right? So I'm going to throw another one. I probably should have said this earlier. The other prerequisite for this is a little bit of, you know, set theory and whatnot that most of us probably learned in computer science. So, yes, I'm going to give you some Venn diagrams. It was the only way or the best way I can kind of convey it to you and whatnot.  That's the set of everything. Everything that's going on, whether it be the network, the endpoint. And then you have your detection, your target, right? What are you trying to signature? I call it a target. And so it's, you know, you're trying to pick that needle out of the haystack. So when you finally go for it and you write your detection, you end up getting these other set of events. I really don't have a better name for them. They're just another set of events. We all know them as mostly false positives, though, right? But they're not exactly all the others. There's just some random others that some of which happen to overlap with our target.   Your red set on the left-hand side is the target. That's your detection. The blue set is your other. It may not always be large, you know, your other, your false positives. They could be a lot smaller. And then the purple areas in the middle, that's what you're trying to eliminate, right? You're trying to eliminate that purple area. So how do you do that? How do you do that? I call it shrinkage. So we want to shrink that other event set. If we could shrink that other event set, we can get the union of the two sets to be smaller, right? The typical way that people mostly do this is kind of with some sort of and not, you know, hey, I got this detection, oh, and not my domain controller. Oh, and not this file that passes, you know, from this person to this person every day via Chrome job or something like that.  And so you end up with these long kind of daisy chains of and not situations where you're just kind of filtering out. And, you know, those aren't, those are somewhat maintainable, but those aren't really maintainable either. At least they can get out of hand and whatnot if not done properly. So how do you do that?  There's, like I said, there's the and not method. But once you do that enough, your other set gets really, really small. And it just, like I said, it gets hard to maintain. But then your target set still stays large. So is there anything, and there's not so much of an overlap, but it's enough that it creates in your workflow where it takes time out of your workflow to be going through some of these false positives, and you just don't want to be dealing with them anymore. So we've manipulated the other set, right? So what about maybe taking a look at the targeting set, you know? And then so back to shrinkage. We're going to try and shrink that targeted set, your detection. How do we shrink that profile, right? That attack profile of that detection and whatnot. And yes, you can do it. One of the situations that the target set grows over time is because of false negative situations. You get, you find new activity all the time, and your target set just, you end up taking them on more of these sets. Your target one, and now you have another target two, some mutual exclusive set that has nothing, it's involved, but then it's kind of not involved with the other set. And then you have to merge those two together. And then, like I said, that's a growing, it's literally a growing problem. You have two sets converging together, and it's getting bigger in your other set, may or may not be getting smaller, but it just doesn't become maintainable. And what I like to call that is kind of the one rule to rule them all, mentality. Analysts like to write these catch-all rules, where, you know, the Lord of the Rings effect, I guess. And so, you know, we write these really large monolithic detections that just, like I said, they become un-maintainable, right? And so, you got to kind of know when to separate or chain your detections, and then you also, you kind of drop or ignore some of the true positives, and maybe then pick them up with another detection, either with a lesser confidence detection, or with a lesser severity detection. And so, you can kind of shrink that target set a little bit. Just to kind of give you an example, right? So, at one point in my career, I inherited this network, network, we are a rule for ghost rat. And it was literally, it was 100 different beacon strings that we were targeting in the one rule. And you look at the condition at the bottom, and then all the number of condition, all the number of beacon strings that we were looking at, notice the first for loop goes from A to Z, and then there's another, the second for loop from A star, and then a third for loop B star and a fourth for loop C star. So, we've enumerated the alphabet going on the fourth time. That's how many times we've enumerated those detections and whatnot. And so, what if one of them starts going crazy? How do you adjust this? How do you adjust something that's so monolithic? You literally have 100 indicators of compromise in your target set. And we all get defensive about our rules as analysts, you know, it's our babies. We curate these and whatnot. And so, there is a kind of effect that it's like, oh my precious, oh yeah. And so, like, we don't want nothing to happen to them, but the life cycle shows that we have to, we have to do something about it.  I mean, I'll talk a little bit, but I'll give you some more kind of examples. So, how do you do that? You separate multiple detections. You take the one, take target set, the full set. You separate it from target one and then target two, and then they have a couple of other sets in between there as well. And now your sets just got smaller, right? So, this one is a lot larger, and then we've separated it out. And now we have two smaller sets to kind of deal with. One set may not be giving you problems, but another set may be giving you problems. But at least when you do it, you've done your work up front, you've done all your analysis up front, that you don't necessarily have to manage the T1 set, or if the T1 set's giving you problems, you don't have to manage the T2 set when you go in and make your changes. And then to even further slice it, you can make it into even more, further slice it, and then the sets become even smaller, and then they have a lot less kind of management and whatnot with them.  If you do want to come back and watch the... There's a lot of good tidbits in some of these next few slides. I suggest coming back. You're not going to ingest all this stuff, and especially the syntax that I got going on with some of these. You're going to be like, whoa, so you're going to need to take a second to kind of parse through it and whatnot, though. But the main things that I want you to kind of focus for the next couple slides are the constructs and the naming and whatnot, and I'll kind of walk you through the rest and whatnot. So, one thing you can do with YARA, at least, is you can separate by condition. That ghost rule that I said earlier, notice that... I at least noticed that there was different lengths of our detection set, our indicators of compromise. And so I kind of separated them and kind of grouped them by conditions in that case. So I can group with the condition and it makes it easier to promote maintenance on your rules. In these three examples, I have... I just have three, actually, but I had like up to 10. I had up to 10 for all 100 different indicators. So I had 10 different rules that I was in managing. But it was a lot easier because if one was false positing, I had a different confidence value when I needed to make a change and whatnot about it. And so rather than I can then just focus on this one rule and all the other nine rules, I didn't even have to worry about. So the ghost beacons, I split them up. Length four just got like one little indicator. Length five had 85 different indicators and indicators of compromise. And then length six had... excuse me, had three of them. And so how would you kind of separate just for... because not everybody does YARA. So an example, how would you kind of separate that in regular expressions? I'll let you chew on this regular expression for a second while I take a sip and whatnot. So this guy's kind of looking for like landing pages like Man in the Middle attacks for PayPal, Yahoo, Hotmail. They got PowerPoint online, Word online. So like Office 365 and whatnot. These are all these kind of landing pages that they're trying to man in the middle and get your credentials. And with the regular expressions, you're just grouping the IOCs with the OR clause pretty much. And so that's how you would do the equivalent of this rule from YARA similar in a regular expression. It's a totally different detection, but it's the same idea, same concept and whatnot. So another thing is that you can separate your indicators by... so I talked about the condition statement in YARA, but you can also separate them towards the indicators of compromise as well. Grouping the indicators of compromise. So what I like to do... so these are four different rules for strings out of an APT3 binary. Notice the hash is all the same for all four rules. But I have four different rules for strings. What's the thing that I said earlier? The one rule to rule them all, that's what most analysts do. They all want to just jumble them up into one YARA rule and say, hey, give me this and gives you some kind of complex expression at the end of the condition and say, hey, this grouping or this grouping or this other grouping or this other grouping. Well, you can... if you break them out into different rules and then you be very selective with your rule names... excuse me... you can bring a lot of value to your analysis. When you start separating your detections like this, you start augmenting your analysis and you can say, hey, this... I got this one binary here. It hit on one of these four string rules for APT3. Maybe that's not an APT3 binary, but I got this other binary that hit on three of the four. And so when it hits on three of the four, you're like, okay, it's more than likely APT and then, oh, wait, so we didn't have the fourth rule? So maybe there's a shift in your detections. Maybe you're detecting the shift in targeting and whatnot. And so their binaries are kind of changing. They may have a different campaign going on. And so a different person on the team is compiling these or something or they fix their incorrect spellings and whatnot. And so if you look at some of these groupings, just I have some regular strings, just very unique strings. Then I have network GUID strings. And then notice that with the first rule there of strings that I say any of them, right? So that's basically the OR clause with any of them. And any one of those strings are unique enough that they could stand on their own. You don't need any other supporting strings to kind of make your detection and whatnot. Now there's two rules with any of them and there's two rules with all of them. And so the rules with all of them, where it says all of them in the condition, those are your lesser quality indicators. You can still group them, but you need the strength of all four indicators to compromise to say to give you that confidence layer on your hit and whatnot.  So when people make mistakes in spellings, now granted there's a lot of code reuse and whatnot. So when you have all these mistakes like this, especially grammar mistakes, you can generally kind of attribute it to one person or but if you start seeing more and more and there's a lot of different compilations flowing around, then there's probably some code reuse going on as well. And that's how you would detect that stuff. And then you have more output strings. So the output of this tool was our APT remote command tool. I can't remember if I wrote these rules. I probably did. I don't know. I didn't put my name. I guess I should have put my name on it whether I was the author or not, though. But it's a good grouping. It's a good representation of what I'm trying to convey to you guys on splitting up your detections to make them more manageable and whatnot. So let's see. One more wall of text and then we'll get back to some other stuff. So we talked about groupings by conditions. We talked about groupings by indicators of compromise or string sections.  The next one, you still want to try and create multiple detections, but you want to use multiple detection methods. So I have three rules up here that are all looking for the same technique. They're looking for a very simple embedded executable. That's it. Nothing fancy. Well, maybe the detections are a little fancy, but nothing fancy about what the technique that I'm trying to detect, right? And like I said, this is what I said earlier about how when you build enough of these rules, the more rules you have, the more you can augment your analysis. And so you can save this time up front by just by running YARA or your regular expressions and let those automated scans do your triage for you. And so when you can have a large enough rule set to scanning and do triage, and then you can have, without even throwing the binary in a hex editor or Ida Pro or even a text editor or something like that, you can run it against your rule set and you can get somewhat of a disposition, whether it be benign. You still may need to verify it if it's benign. You can get some sort of suspect disposition. It's doing all these techniques, but then there's nothing attributable that's going on, or you can get a malicious disposition right off the bat if you have an attributable signature. And so you can say, hey, this is definitely malicious. I can attribute it to this group. How much more do I need to spend on this? I can move on to the next binary. So like I said, these are three different rules targeting embedded executables. One of them looks for more than one DOS stub. So the 16-bit DOS stub that's in present in the 32-bit Windows PE header, or just a before it, I'm sorry, the MZ header, the 16-bit. So it looks for multiple DOS stubs. The other one, it looks for a possible PE structure in which the DOS stub may have been stripped. And then there's another one that looks for a DOS stub. It just looks for an additional DOS stub past the initial DOS header. And so what happens if the outer binary doesn't have a DOS stub and then the embedded binary does? And so these are three different techniques to kind of catch embedded executables using these rules. So next I want to talk to you about some detection targeting approaches and whatnot. But first let me take a step. So we're all in the hunt, right? We're all in the hunt. What was the black hat talk? 2015, big game hunting. We're all in the hunt for big game, big game malware and whatnot. The original big game was Jaws, right? So as I go through all my data, I realize some things. And that I'm hunting, but as a malware analyst, right? So I'm always on the hunt for that big game. So I can make an argument of this is bad, and it could be just some random file. This is bad any day of the week, blah, blah, because of the context you give it to me in. And I could do that a couple different ways. I can do that with kind of unique code DNA. You could either do it with the strings, with the very unique strings, or you can do it with unique byte sequences, right? So that unique DNA allows you to track the families and go hunt. But I noticed when hunting that the data that I was looking or the rules that I was producing, based on the data that I was looking at, I had a bias. Like I said, I can make an argument for anything to be malicious, right? And given a limited scope of the view. And so my, I didn't realize, but my detections also were becoming biased. And so, you know, we're hunting for that shark, we're hunting for jaws, right?  But then we look under the water, we look, we see the whole scope, and it's just some guy wearing a shark fin, right? It's like, you're, and you're confused. You're like, wait, I thought this guy was bad. You know, why is he not bad? But it's just some guy with a shark fin strapped to his back, right? Now, once you've seen the whole picture. And I got that way actually, or at least I noticed that, because just enough customers are like, no, this is good. I'm like, no, this is bad. And they're like, no, this is good. And so I would argue with people and whatnot. And so I noticed the bias in the detections. And so I noticed that a lot of my detections were as a malware analyst. And so I got to thinking, well, what would a network admin's detection be like?  And whatnot. With now our authors, we're looking in a sea of bad, or a sea of, let's see, what's, yeah, we're looking from a sea of bad that ignore the good. And then the network admins are writing their detections. They're writing detections from a sea of good to detect or highlight the anomalous bad. So they're almost seeing this kind of inverse view of what we're looking at as a malware author. So how do you write a malware analyst detection in Regex? I showed you the one prior with kind of the DNA, the unique sequences. But how do you write that in Regex? So I had a customer that was like, hey, I want to see these, they had these custom mail headers and they were getting mail from all over the world and they were like, look, I know this is bad, it's coming from this country or it's coming from that country and how do I detect this stuff? So I started writing these regular expressions and then it quickly got out of hand for him. He's like, look, now, you know, he's like, you showed me how to do this, but now look, we've got one, two, three, four, five, six, seven different countries and I'm getting new ones popping up every other day or so. And so we can't really take that approach in our detections, right? Or at least the network admins can't take that approach in our detections.  How would I do this?  And he's like, if you can write me a signature that, you know, if it's not these three countries, and I know like the DOD, they got Five Eyes and stuff like that, like people, and then they're smaller companies that, you know, they're only doing, they know they don't have an office in Madagascar or something like that or in Nigeria and I mean, they may have a Nigerian, maybe related to a Nigerian prince, but they don't have an office in Nigeria, right? And so, and then they had these other kind of headers that were coming in through one of their things upstream and they were marking all this mail stuff for us. And I'm like, man, this is a gold mine here, right? And he's like, look, I want to find all these different, these different detections based on these, or the non-presence of these strings and whatnot. So I kind of took the, I went to the regular expression route and when I inverse it, I came up with negative look-aheads, right? And so they're a little complex, like I said, if you want to read into them, go back to the talk afterwards and kind of see it. It's all about creating a set and then you have to match, to non-match on, and then another matching set. It gets a little hairy, but I definitely suggest going on like Regex 101 to help you build your regular expressions and whatnot, though. And I came up with these three detections for the three different ex-headers for the situations that he wanted me to do. And it worked out great. He's like, man, this is awesome. I don't have to do any maintenance anymore for these detections. And it did everything that he wanted to accomplish. So, you know, and that was kind of looking at that inverse view, right? So we talked about kind of the malware analysts, detections. We talked about the bias that it kind of creates and how a network admin has a different view to it and whatnot. But how do you get longevity out of your stuff? And I have a technique that I call, I don't know how else to describe them, just circular detections. I'll write a couple rules based on a few things. And those two target rule sets are actually exclusive, right? They share the sample, but they don't share any same indicators of compromise, right? And so I'll create these circular detections. I'll have rule one, and it detects a piece of malware. But then I have another rule that I built off of my original source. But rule one detected this malware, but rule two didn't trigger. Analyze it. We know it's malware. But when I analyze it, I get an update to rule two. So I got that rule... I got a new indicator of compromise for rule two that I didn't already have from my first original sample, right? And most people who do a lot of virus total or reversing labs hunting, do a lot of retro hunts, you guys are used to this stuff, kind of panning out and finding the broader campaign. This is a kind of common thing. But I want everybody else who's not a malware analyst or not a malware hunter to kind of, you know, learn this stuff. So that's why I'm telling you about it. And so how do you do these circular detections, right? So my first round, this is actually a throwback to my old talk. The payload names. I found these rear little payload names and these small DLLs that were getting loaded up. And they kind of had some of these unique names. Now it set up that MSI may not be unique, but it's kind of unique in the context of it's a DLL and it's only 11K, right? And then I came up with a string de-offuscation routine. And that routine, so I had the payload name that was embedded into the loader and I had a string de-offuscation routine that was also embedded in the loader, but it de-offuscated the payload, not the strings for the file. And so I run it, I do a retro hunt, find a bunch of other files, and then I go on a round two and I found some new payload names, so my set of indicators of compromise just got larger, right? And they all stand apart from each other, so they can all be a detection on their own. But I went from having two payload names to I now have eight payload names. And then instead of having just one byte sequence for the payload de-offuscation, I now have three. I only got two rules up there, plus the previous one. And so I ended up getting three. And I keep doing these iterations and I keep finding more rules and I mean more Intel and I keep finding more malware. And in the end, I end up with like 27 payload names, some of which may not have even been plug-axes for the payload. So they were using a similar delivery method, or at least I suspect they were using a similar delivery method for a couple different pieces of malware. And then for as far as the strings, and then the byte sequences, I came up with 11 different byte sequence rules. And so I would have a subset at any one time if a file was scanned, and I'd have a subset of maybe five out of ten of these byte sequence rules would trigger on one of those things. And so, but if it got like two out of ten, then maybe I'd take a look at it. But if I got a high number of matches, detections, then I would just kind of roll with it, right? And kind of update it as I go along. So I'm all about stories. My next one is a story, because we're all in the trenches, right? And so I had a buddy of mine, Fish, is his name.  I'm like, what? Like, yeah. And so I'm like, he's like, we got hacked by the Russians. I'm like, no, we didn't, dude. Like, all right, we'll take a look at it, right? And it's just this and this. And he's all excited. And it was a day before Thanksgiving, right? And I'm on vacation. It always happens on a Friday at four o'clock, right? It always happens on the weekend, right? Or it always happens when you're on vacation, right? And so we called it like Operation Turkey Eve, because it was a day before Thanksgiving. And he's calling me up. And we're getting on a phone. We're talking back and forth. And I'm like, walk me down the path that you arrive to however it is, right? And so he walks me down this path. And but I'm a guy that I got to look at the data, right? I can't just take somebody else's word off the phone. And so one of the big things that he pointed me out to was the file in question had a hit in virus total. And it was tagged by Thor APT scanner. And it was tagged Fancy Bear, which is supposedly Russia, right? Whether it is, whether it isn't, I don't know. But either way. So that's what he's in. We'll just say that it is just for a matter of fact, because he's like, yeah, we got to Russia. So it says it's tagged by Fancy Bear. And it says it's Mal. Mal Fancy Bear. And it says Compitrace Agent. Yeah, Compitrace Agent. And so I'm looking at these files, and they look like malware. They really look like malware. The loaders are like doing this crazy stuff. They're using like an undocumented API. It's an arbitrary binary loader. And it really looked like malware, just something that you wouldn't normally do, right? And some tearing through it, tearing through it. And for a good like three hours, I'm like, maybe we did get hacked, right? Maybe we did. But I was like, I got to see this through the end, right? And by this time, I think it was like 12 o'clock at night, day before Thanksgiving. Got to get the family up the next morning, right? I'm not giving up. And good thing that the person who wrote the rule, or at least I traced it back, to where the source came for the rule, good thing he actually uses a lot of things that I kind of preach, which is a good naming convention and also having good complete descriptions and whatnot, and then also sourcing where your information came from. So I noticed that this author, I'm not going to say his name because I actually do respect him a lot, but we're all human. We all make mistakes. And it came from a report from Arbor Networks. And so I was like, let me go back to this report that Arbor has, and let me read their report. And I probably read that report like four times, really like four times, I'm like, what is going on here? What is going on here? And at the end of the report, they give a YARA rule. And I'm looking and I'm looking and I'm like, this YARA rule looks similar to the YARA rule that authority PT scanner used to kind of make this attribution. And the name of the rule, and hats off to Arbor as well, they're doing good naming conventions. They're doing descriptions. Now, they didn't source anything, but that's fine though. And the name of the rule just says computer trace, a computer trace agent. And I'm like, well, wait a second. So I had to kind of dig more and dig more. And turns out that what was going on was fancy bear was taking this computer trace agent and they were patching the beacon, the domain beacon. That's all they were doing. A normal computer trace agent, DLL, different from a fancy bear, was only 28 bytes. And then it was x-award, so it was obfuscated. And so since it was obfuscated, you can't pre-predict what those domains are going to be. So how do you signature the unsignatureable, right? There is no real code in there that's attributable to fancy bear. So this was a computer trace binary. And so it took me a while to kind of tear it down and to kind of come to this discovery, did a byte-by-by comparison, and finally I was like, no, we didn't get hacked by the Russians. It's just whoever, we have like one box in the network that has this computer trace software running, let's go get the IT department, let's clean it up and whatnot. And to thaw APT scanners kind of credit, he, so this was day before Thanksgiving, so it's November 2018. And then on March 2019, he actually renamed the rule. He changed it instead of MAL for the first three. He changed it to PUP, which is potentially on one program. Thanks to a colleague of mine, I was like, what is PUP, right? And even I was like, I'm a seasoned guy, and I was like, what is PUP? And I was like, what does that make any difference? Well, it, but he still got the fancy bear attribution in there. And that rule, once you look at it, it's hitting on all these comp, compu trace binaries in virus total. Maybe it's running in reversing labs as well. So anybody who goes and looks up a compu trace binary in virus total, they're gonna get false attribution of fancy bear for this binary. And then they themselves will be think they get hacked by fancy bear. And so you see that domino effect of the just doing things kind of proper, taking your time, making multiple detections and doing proper naming conventions and whatnot, and just kind of slowing it up a bit and not having that one rule to kind of rule them all mentality. And so that's kind of my story. Does anybody kind of have any questions or anything or what? Mm-hmm. I would say, yeah, it's a little, it's maybe you can do some automation into it and look at ratios and whatnot. I kind of, when I do my circular detections, I do a lot of bytecode optimizations. And I'll look back at the assembly table, take a look back at my previous talk and I talk a little bit about it. But where do you stop?  We're doing things, we're hand jamming things. Most of us probably should be. You know, because we all, a lot of the SOC people, they're just getting things on a whim. And, you know, if they write a script, take an hour out of their time and write a script, they may never use that script again and do any kind of automation with it. But with the rules that you're doing, you can do some triage up front. But yeah, where do you kind of stop it? It is kind of up to the analysts. You just got to find that line within your workflow, I'd say. If you do have an malware shop and you got a much bigger automated workflow, then I'd say then you got to need to see, you know, give it some thresholds or something like that and say, hey, you know, I got some malware that in my eyes is pretty rare and whatever the source that may came from. And let's say if I get a hundred hits on it, I'll just stop right there, right?  Because probably more than, it's a high confidence, very targeted sample, why are there going to be a hundred hits out there? You know, or you get a thousand. You can bump that up to a thousand maybe. And so once you kind of get to that level, you can kind of say, okay, yeah, this is a lot of noise. But then once your rule set gets more mature, you can leverage more of your rule set to kind of give you that other feeling. So you're not really always relying on the numbers. Does that kind of make sense? So at least that's my point of view. So, yeah. Any other questions? I know it was a lot, guys. And I thank you. And thank you for all the people that stayed. A lot of technical stuff. Go back and watch it. A lot of text on there. Chew on some of those YARA rules and whatnot. If you haven't played with it, play with it. It's a great thing. Regular expressions too and whatnot. So, yeah. Thank you, guys.


All right, lady. What is this? Well, I'm building another Qt Pi RP2040 tester. This is the Qt Pi RP20. It is so cute It's so small. It's got all these pins on the back. Got that Raspberry Pi logo. It's an RP2040 with 8 megabytes of flash It's got a stomach Qt connector and two buttons in a neopixel and we have to test each board make sure it works So we've got this TNT 3.6 and it's using mass storage over USB To literally like load this as a little disk drive and then drag over the test you have to So I plug this into USB-C And then I've got this little cut out here, which because there's no mounting holes So to line it up perfectly I press the button and this runs the test and it takes about two seconds and then we know it's working So if you want a Qt Pi Sign up. It's part number 4900 easy to remember We're going to be making more of these as you see it's fast. I'm going to test these and put them in stock today You


We'll come all at today's DevCon presentation with the title, Building the Motor Control Platform with ST Spin32F0 Family Drivers. My name is Jiri Keperda, and I'm Product Marketing Engineer at ST Microelectronics. Let's warm up with a couple of poll questions. The first question is, do you have any experience with integrated architecture, meaning integrating microcontroller and gate driver? So there are two answers, yes and no, and I will come back with the results after a few slides. Let's start with a review of the motor control architecture. The brain of the system is a wide range of MCUs based on ST Spin32F0 Family. The gate driver provides the necessary strength and timing in order to drive the bridge inverter, either made of MOSFETs, typically for low voltage applications, or it is made of IGBTs, typically for high voltage applications. ST gate driver portfolio does include half bridge gate drivers represented by L6400 family and L6300 family with capability up to four amps. Recently, we developed also free-phase integrated gate drivers under ST drive family name for both high and low voltage applications. You can find low voltage, high voltage MOSFETs, IGBTs and also A-specs for inverter bridge in the ST portfolio. Now, there are two options, how we can integrate the motor control system. We can integrate the MCU together with gate driver and leaving the power stage discrete. Second option would be integrated gate driver with MOSFETs or IGBTs on one single package. Let's have a look on these two options from the application point of view. The first option in terms of integration is called ST Spin Family, and the typical use would be the application where we have portfolio of products with very similar requirements for MCU, but different requirements on the power stage, meaning the output power. The IPM slim modules and also PWD drivers represents the second option. The very similar output power is the common characteristic for this architecture and leaving the freedom on MCU selection based on the features of the system. Quick summary of the microcontrollers for motor control applications. ST is currently offering several lines of MCUs. The integrated solution is represented by ST Spin32 family. For more tailored application, the selection does include high performance MCUs, including the latest STM32 MP1. Next line includes mainstream MCUs, and the ultra low power line is dedicated for low IQ sensitive applications. The last line does include also the virus capable MCUs. Now, let's check the first question. I will repeat the question, do you have any experience with integrated architecture, microcontroller and gate driver? Oh, it's almost tight. 47.6 is the answer yes, and 52.4 answered no. So, I think that's a good starting point. So, now we will discuss system in package solutions for motor control. The PWD family together with ST Spin32 F0 represent the system in package technology. Currently, there are two devices from PWD family available on the market, and the third one is in development phase close to the launch for the mass market. The PWD family drivers are targeting industrial market, factory automation, fans, pumps, and blowers, home appliances, cooking hoods, and gas heaters, and also power supply units. The PWD 13F60 is a high density power driver integrating gate drivers and four-inchal power MOSFETs in dual half bridge configuration. The integrated power MOSFETs have a low RDS on of 320 mAh and 600 volt drain source breakdown voltage. The embedded gate drivers high side can be easily supplied by the integrated bootstrap diode. The input pins extended range allows an easy interfacing with microcontrollers, DSP units, or whole effect sensors. The device is available in compact QFN package. The PWD 5F60 is an advanced power and system package driver, which integrates gate driver and four-inchal power MOSFETs in a compact QFN package. The integrated power MOSFETs have RDS on of 1.38 ohm and a 600 volt drain source breakdown voltage. The embedded gate driver features two comparators that can be used for peak current control or overcurrent protection. Integrated bootstrap diodes, fast decay or slow decay, on-board constant off-time peak control, undervoltage protection, and low side and high side. 3.3 to 15 volt compatible inputs with hysteresis and pulldown. The evaluation board EVAL-PWD-5F60 demonstrates how to use the PWD-5F60 to drive a single phase load in full bridge topology. This allows a control of both directions and the amount of the current flowing into the load. The typical application that can benefit from the high integration of the PWD-5F60 are, for example, single-phase BLDC motors or fans. The board has a very small footprint and optimized layout thanks to the integrated features of the PWD-5F60, and it can be simply run by applying the supply voltage and a direction signal. Before we move to the next chapter, ST Spin32F0 family, we have here also second poll question. The question is, do you have experience with, first answer, low-voltage motor control design, second, high-voltage motor control design, third, both, and the four is obvious either. We started today's presentation with a motor control architecture. We will focus on the second option as highlighted in terms of integration. This option does integrate a microcontroller together with gate driver into single QFN seven-by-seven millimeter package compared to the first option combining power stage together with the gate driver as discussed on previous slides where we introduce PWD family drivers. Let's have a look what we have under hood. The integrated microcontroller is standard 32-bit STN32 ARM Cortex M0 from the ST standard STN32 portfolio. It is the same silicon as STN32F031C6. The analog and power conversion provides free phase gate driver with 600 milliamp sync source capability up to 45 volt for low-voltage family and one amp or 350 milliamp gate current capability for high-voltage family depending on subversion. The low-voltage version of STN32F0 includes also 3.3 volt bug converter which provides the supply for microcontroller and 12-volt LDO for the gate driver supply. As I mentioned on the previous slide, currently we have two main group of STN32F0. Low-voltage is rated up to 45 volt and the high-voltage group we decided to split the family into subfamilies. 250-volt subfamilies and 600-volt subfamilies. All drivers can be used in sensor or sensorless configuration and we are providing for each part number dedicated firmware for the evaluation. The microcontroller STN32F031 is used across all STN32F0 products. The 32-bit M0 ARM core-based architecture has clock frequency of 48 megahertz, four kilobyte of SRAM and 32-kilobyte flash for the program. The number of GPIOs depend on version and it could be up to 20. Five general purpose timers, including dedicated timers for motor control with complementary outputs ensures the best possible performance. The ATD converter has up to nine channels which are multiplex and they can be used externally or internally together with built-in op-amps for current sensing. The SPI, UART and I2C combustion protocols are available. The last feature is the serial wire debug. All products from STN32F0 family have an extended temperature range from minus 40 Celsius degree up to 125 Celsius degree. Now there is a time to share the second question from the poll, meaning the results. So actually it looks like I was not able to get any results compared to previous question. So there is a small hiccup here. Nevertheless, let's move to next chapter. Which is STN32F0 low voltage. Currently we have three options of low voltage STN32F0 drivers. The low voltage STN32F0 family has several common electrical parameters. Voltage range is up to 45 volt. On the lower side depends on the version but it can be as low as 6.6 volt. Built-in buck converter which provides 3.3 volt supply for the microcontroller. LDO which provides 12 volt supply for the gate driver. All drivers of STN32F0 family have a standard set of protections under voltage lockout, over current protection and thermal shutdown. There is also extended temperature range as I mentioned previously. We use 7x7 QFN compact package. Here we have a side-by-side parametric comparison of all STN32F0 drivers. The operating voltage range starts at 8.2 volt at STN32F0 and the under voltage lockout was lowered down to 6.6 volt for the A and B version. The MCU, LDO and buck converter are the same across all three drivers. The major difference among those three drivers is the number of available GPIOs and number of op-amps. Since we were pin limited there is a trade-off between those two features. The STN32F0 version provides four op-amps and 15 available GPIOs. The B version offers three op-amps and 16 GPIOs. And finally, the B version has the highest number of GPIOs, 20 and only one op-amp as a trade-off. Both A and B version have also bootloader. STN32F0 provides ecosystem for the development of motor control applications. The evaluation boards allows you rapid prototyping and quick setup to evaluate and demonstrate the proof of concept. The ST eval-spin3201 is based on STN32F0 this FOC in free shunt configuration. The firmware is available for sensor and also sensorless application. The ST eval-spin3202 provides FOC and a six step commutation algorithm in one shunt configuration. The firmware is again available for sensor and sensorless application. The ST Spin32F0B is on ST eval-spin3204 evaluation board in one shunt configuration with six step commutation firmware. I skipped the ST eval-ESC002V1 since it is reference design for ESC rather than generic evaluation board. This evaluation board has ST Spin32F0 on it and it goes with high speed six step commutation firmware. You may find this table helpful in case you are looking for a reference documentation and available firmware. The eval-kit-robot-1 is an evaluation kit offering a ready to use servo brushless solution. The Maxon motor, which is included in the kit offers a very high torque density and very low cogging torque. This motor together with an incremental encoder and ST Spin32F0A running field oriented control with closed loop positioning is an excellent choice for reliable and high precision position and speed control. The ST Spin32 motor control workbench is a graphical user interface software running on PC that reduces the design effort and time needed for the ST Spin32PM SM FOC firmware configuration. The user generates a project file through the graphical user interface and the same GUI allows you a real time monitoring of the system and changing the key variables. More details about software tools including the real application will be presented also in the second half of today's presentation by my colleague Rosario. I would like to share with you also an application which is slightly different than Free Face BLDC. The ST Val Spin3201 supports also the application with brush DC motors with an incremental decoder. The brush DC motor library with graphical user interface allows you speed and position control. The communication is performed through the UART. Now we are moving to the next chapter which covers high voltage ST Spin32F family. The next step in the evolution of the ST Spin32F0 family is a high voltage option. As you can see from the block diagram, the architecture is very similar. The high voltage drivers have the same M0 core based microcontroller. The gate drivers are made in the BCD6 offline technology which provides very good robustness and I'll share more details in a few minutes. From the development point of view, the key is that the entire development ecosystem is the same as for low voltage drivers. Currently, there are four options of high voltage drivers. Two versions of 150 volt subfamily and two drivers from the 600 volt family. They are pin to pin compatible. Also, high voltage options are offering FOC and a six step commutation algorithm and compatibility with ST Spin32 ecosystem. Both versions can save up to 60% of the space on the PCB due to the system in package solution, meaning integrating ST Spin32 Cortex M0 micro together with high voltage gate drivers. Few key parameters for the ST Spin32 F0 600 family. The 601 version can provide up to 350 milliamp gate current and the 602 version up to one amp for higher power applications. It has integrated bootstrap diode and it is offered in two package versions. The other parameters are the same as other ST Spin32 F0 family drivers. Similarly, the ST Spin32 F0 250 has two options in terms of gate current capability. The 251 provides up to 350 milliamp and 252 up to one amp gate current and also two package options are available. You may ask the question, why we develop 250 volt to land drivers? These drivers can be used in the high power tools, garden tools, industrial pumps and industrial automation. Electrical characteristics of the gate driver are the key parameters from the robustness point of view. The integrated bootstrap diode with zero static drop provides not only bill of material savings but also improvement in the electrical behavior. The gate drivers, both high side and low side are protected by undervoltage lockout. The drivers have interlocking cross conduction prevention which has a direct impact on the reliability and longevity of the system. The PCB layout especially the ground rounding for the high power application is critical. The gate drivers have separated GND pins for logic and low side power. The gate drivers of ST Spin32 F0 high voltage family were successfully tested with below ground spikes 100 volt and more. As I mentioned before, the high voltage version of ST Spin32 F0 family offers two package options. 72 leads QFN 10x10 package with pitch 0.5 and 1.8 millimeter Cripitch for the critical pins. The 64 leads to QFP 10x10 package with the pitch 0.5 and Cripitch 1.12 millimeter. The list of evaluation boards includes all versions of high voltage ST Spin32 and the firmware covers both FOC and six step commutation algorithm, one shunt and free shunt configuration and sensor and sensor less application. The summary table and tools overview should help you to figure out what do you need to get started. I would like to stress one key parameter, the ST longevity commitment. For the ST Spin32 F0 high voltage drivers it is 10 years longevity commitment. All evaluation boards have the same architecture. They included a stealing debugger, feedback network, power stage, power supply, and of course the high voltage ST Spin32 F0. In this case, ST Spin32 F0 601. This board is using single shunt sensing. The EV Spin32 F0 601 S3 has free shunt resistors and the power stage supply voltage can be within the range 50 volt and 280 volt AC. EV Spin32 F0 0602 S1 has a single shunt configuration and has dual footprint either for MOSFETs or IGBTs. The last evaluation board EV Spin32 F0 251 S1 is also single shunt configuration with dual footprint for IGBTs or MOSFETs. The board allow the load up to 16 amp and the ST link is detachable. My presentation is over. Thank you very much for your attention. And now it is Rosario's turn. After that, we will have a Q&A session, have a fun. Hello and welcome to this video presentation where we will show how to spin a permanent magnet synchronous motor using the motor control software development kit. My name is Rosario Tanasio and I'm an applications manager at ST Micro Electronics. So what is the motor control workbench and how does it benefit a designer of motor control applications? The motor control workbench is a GUI that is part of the motor control software development kit or SDK. This also includes the FOC library for permanent magnet synchronous motors. The ST motor control workbench provides an easy way to configure motor control application software and matching hardware setup. The project generated by the tool is compatible with the STM32 Cubemax for further extension or modification. The motor control workbench supports many of the boards of the motor control ecosystem or can also be used with the custom boards. It has a large number of example projects to start with. The user can create a new project input the motor parameters, set the signal conditioning current circuits for current and voltage sensing and also leverage on an embedded tool for the tuning of the API controller parameters. This is also an interface that allows it to monitor the application once the motor is spinning. The FOC library includes both the sensorless or censored control for speed and position control using all effect sensors or unencoder. The software reduces the design effort and time needed for application setup. Let's check software requirements. First of all, we need to have a laptop with the 64-bit Windows 7 or Windows 10. Then we need to have a development environment. We recommend the IAR embedded workbench for ARM or the STM32Q by D. We will have to download and install the X-Cube motor control software development kit full version. You can do that from st.com register and get approval which should take a few minutes. Then download and install the STM32Q by Macs as well as the ST-Link drivers. And finally download and install JavaJR8 for Windows. Okay, next is an overview of the hardware setup. We need our laptop with the software that we've just mentioned installed, motor control workbench and STM32Q by Macs. We need a USB cable. We need also a demo board for this specific test. We have selected the ST-Spin3201 which has the ST-Spin320F0 and six low voltage FETs that implement a three phase inverter. The topology is the three shunt one for this specific board. As you can see, the board is a general purpose one. It has a lot of test points, a potentiometer to close the speed feedback loop as well as the connector for the oil effect sensors or the encoder plus three push buttons that can be used to enable or disable the application or reset the microcontroller. The ST-Link is also present on this board so you don't need an external one. And we need to supply this board with power supply that is capable of delivering 12 volt and a minimum current of one amp. The motor that we have used for this demonstration is BLDC, low power 4.2 watts but capable of reaching 8,000 RPM. It has four power pairs. The oscilloscope is also necessary as well as a current probe that we will use down the road for tuning. For the wiring, you need to connect your power supply cables to J2. Be careful the admissible voltage range is 8 to 45 volts DC. The motor winding phases need to be connected to J3. And the USB cable to J5 on one end and on the other end, any of the available USB ports on your laptop. I have placed the current probe on phase V. The laptop is, as you can see on the right side, running the motor control workbench. And this is the basic setup. But the motor is shown here.  The board is already supplied as the red LED show. The motor I've used for this demonstration is available on Anheim Automation website. If you want to buy one for a few bucks and repeat the test. It has a rated voltage of 12 volts, rated speed of 8,000 RPM. The peak current is 2.2 amps, rated torque is 0.7 ounces per inch. The line-to-line resistance is 3.5 amps and the line-to-line inductance is 0.7 milliarys. The back EMF constant is 0.8 volts per kilo RPM. And this motor has four pole pairs. One thing to note is the back EMF constant very often is not available on the data sheet of the motor manufacturer. If this is the case, like for example, for the Anheim Automation motor, you can always measure it. The way to do that is spin the rotor at constant speed. We typically use a drill to do that and a digital oscilloscope to measure first two phase voltage and the electrical frequency. The other important thing to notice is this data sheet provides line-to-line resistance and inductance, but the motor control workbench uses a per-phase model. Therefore, you will need to divide these values by two in order to use them properly with our software tool. Now I want to go over the workflow and it's to be followed for successful spinning the motor. First of all, we need to create a new project with the motor control workbench and then we needed to set up the motor control workbench by inputting the motor parameters, setting the current sensing and the deprotection, then working on some driver management settings such as selecting a proper switching frequency for our application. We needed to set the type of speed sensing, startup parameters, and the serial communication. Once we have done this, we can generate the compile and download the code into the ST Spin32F0. If all of this is done correctly, we can connect the board to the motor control workbench. One thing I want to mention is that if for any reason the motor parameters are not available, you can use the ST motor provider. This is available for download on our website or you can proceed with the manual characterization and extraction of these parameters. IOC file that is generated by the motor control workbench can then be imported in the STM32QB-MX for code expansion, further code generation or tuning. The final code can then be compiled by using IR or Kyle or, for example, our STM32QB IDE and finally downloaded on the microcontroller. If everything is done correctly, as I have shown here, and you try to spin the motor and you get error from the motor control workbench monitor, don't get discouraged that this is quite normal. There are still a couple of steps that need to be done. First of all, we need that to perform the tuning of the current regulator. Then we need it to successfully switch from open loop to closed loop while using torque mode. And the final step is to tune the speed regulator. Now that we have talked about the tools, we can proceed with the generation of the code using the motor control workbench. We start from a new project and we can see from this window that we have the option of selecting either a custom board both for the control and the power or one of our, for example, nuclear boards or one of our expansion boards dedicated to motor control applications. The other option is to select a complete inverter board which features both the control and the power stage. Among the featured board, you will find the ST-SPIN32-1. We select it and we click on OK. The motor control main page will now load up and will allow us to change and configure the application parameters. We start from the motor ones. We set the number of pole pairs, the maximum speed, the peak current, the supply voltage, the phase resistance, the phase inductance, and finally the back emf constant according to what we have seen in one of the previous sections. When we are done, we click on OK. Here we can also select to use the bus voltage sensing to have overcurrent protection and eventually also temperature sensing for a protection. From the current sensing tab, we can define the current reading topology. We have three options, one shunt, three shunt, and the two insulated current sensor. The board is a three shunt topology, so we will keep this. We also keep the sensor resistor value, 10 milli ohm and the amplification and a torque gain of 7.7. It is provided by some external opamps mounted on the ST-SPIN32-1. In a general application, we will customize both the value of the shunt resistor, the amplification on board, in order to exploit as much as we can, the dynamic of the A2D converter. Once we are done, we click on the next tab, which is the speed sensing one. Here we can choose between sensorless or sensor diffusive, for example, using all sensor or quadrature encoder. We'll keep the sensorless observer plus the PLL and move on to the next settings. From the fever and drive management tab, we select the drive settings. Here we choose to go with a switching frequency of 15 kilohertz. We can also define the execution rate as we speed the regulator. We keep one. We can input, for example, the values of Kp and Ki for the speed regulator, as well as for the torque and the flux regulator. For now, we use some low values for Kp and especially Ki, so I modify Ki here. Also, here we start from low values in here as well. And we have also some divisors. I will use the bigger number for all the integral terms of the three PI regulators. On this part of this window, I can select the target speed. I will use 2000 RPM. And the cutoff frequency, I will start from 6,000 read-ins per second. Very important that the execution rate, if I keep it one, the control will be executed once every PWM period. Otherwise, if I choose two or three, it will be executed once every two PWM periods or three PWM periods. At this point, we are done with this. Next, we want to define the startup parameters. So here we have the advanced customized table, which allows us to define five different steps. Here I have already defined the table. In this column, you define the duration of each step. Here you define the speed and here the current. The first step is very important because it allows the alignment of the rotor. It needs to have a longer duration, the final speed of zero and a current that is 50, 60% of the nominal current of the motor. Then in step number two, you start ramping up the speed to 5,500 RPM in this case with a final current of 1.3. Then we keep increasing the speed to 1,000 RPM, keeping the same current. And we do that for step number three and four. And finally, we approach our final speed by using a final speed of 1,800 RPM with a final current of 1.2. We start executing the controller algorithm from step number three. And we define a minimum output speed that is slightly higher than the final speed of step number three, so 1,020 RPM. Last thing, we define the estimated speed and the tolerance in these two menus here. We want to have kind of wide tolerance at least in the initial phases. So I've used 150% and 50% as upper limit and lower limit. Once we are done with this section, we can close this window and move to the next. At this point, we have everything we need to generate the code. To do this, click on the blue arrow, which will start the generation of the code. At this point, you need to choose your debugger, IR in my case, and then click on generate. Okay, once the generation is completed, we can open, we click on open folder, click on eWorm and select the project. IR will open. The next thing we have to do is rebuild the whole project. This will take one minute or two. And after that, we have to compile and flash our STSPIN32 with the generated code. To flash the microcontroller, just click on this green arrow. Okay, once done with that, we can simply go back to the model control workbench and close the cube MX. And we can open the monitor by clicking on this icon. To connect the board, click on this icon. Okay, at this point, the board is connected. We can click on the advanced tab and try to spin our motor using the torque mode. Okay, so let's set the current reference. For example, 120, we hit set the reference and then start the motor. You will see that the motor will increase its speed. And then after a while, we will see this speed feedback error appearing on the left side of our monitor. This is normal with the model control workbench. And it's due to the fact that the PI parameters as well as the observer constant C1 and C2 are not yet tuned. So we need to do that next. Let's proceed with the tuning. In the configuration tab, you have also a tool to do the tuning of the PI loop parameters. In order to do this, we will use the five steps of the rev up table that will be configured with the final speed equal to zero for all the five steps. And the final torque value that can be defined using this formula that you can see here. So the final torque is equal to 32,535 divided by the max readable current, which in our case is 21.4 amps times the nominal motor current, which is 2.2 amps. Okay, at this point, we use a final torque for step one of 1200 with a duration of initial zero. For the second step, we define a duration of 50 millisecond. Then we decrease the torque to 600 and we select step number three duration equal to zero. And for step number four, same final torque value of step number three with a duration of 50 milliseconds. Now we have defined our step function. We can go back to the advanced tab, start with some low values for the KP and the KI of our PI controller, for example, 150 and put at zero, both the KP and the KI for the ID regulator. Once we have done this, we can hit the start motor tab and observe the response of the controller on the oscilloscope. Now you can see that this response is not ideal. It's a little bit slow. And when this happens, it means that you need to increase your KI. So next step will be to bring a KI up to 100. We clear the fault and we hit the start motor again. We now observe that the response has improved, but it's still not enough. So we will increase a little bit further, the value of KI to 200, clear the fault and start the motor again. Now we see that the response starts to have some oscillations. So at this point, I will not increase the KI anymore and I will start increasing the KP parameter until I find the response that is satisfactory. Okay, so at the end of this tuning procedure, I came up with the two values of a KP and KI. KP equal to 1500 and KI equal to 100. At this point, I am ready to test again in torque mode. I set the reference to 120, clear the fault and start the motor. I observed the behavior of the motor by looking at the measured speed. And I noticed that again, the speed feedback error is here. This is happening because we haven't tuned yet the value of C2 of the observer. This value is currently equal to 24,000. We can start by halving it, repeating the test by clearing the fault and starting the motor until we see that the speed feedback error is gone. At the end of this procedure, I have found that the value of 880 works well for this motor. So I cleared the fault, start the motor again and I can finally now observe that the motor speed is stable, the motor is able to hold the torque and if I change the torque reference, the motor follows the reference and the speed increases. So at this point, I have attuned current loop. My next step will be that of adding the speed controller to the system. Okay, so to add the speed controller, let's select the control mode speed and let's start with low values of Kp and Ki. We select the target speed of 3000 rpm, we clear the previous faults and we try now to start the motor and see what happens. We can monitor the speed of the motor using the plotter. So here you can see that there is a big overshoot with the current parameters and that the response is very slow. So definitely we need to work on the Kp and Ki parameters in order to improve this current behavior. To do that, we can, for example, start with higher values of Kp. Check again what the response of the motor is when we do a step from 3000 rpm to 1000 rpm and back to 3000 rpm. In this way, we can again monitor the speed. We see that now the speed is following the reference quite well and by iterating this kind of procedure, we can achieve a really well tuned motor. So this is it for this demonstration. I hope you have enjoyed it. The for more information about our demo boards, our tools and our ecosystem, visit www.st.com.