Hello, everyone. Welcome to our five o'clock session. It's going to be amazing. Who's pumped who is excited? Yeah, woo! We're going to be talking about the dissection of WebAssembly module, which if you've been following the WebDev world, WebAssembly is a huge topic. And I'm delighted to introduce Patrick Ventizolo, who will be giving the talk. So a warm round of welcome for Patrick. Thank you. Thank you, everyone. Do you hear me? Yeah, good. OK, so today I'm going to talk about WebAssembly. So I'm pretty sure you heard about that. And maybe you also heard about WebAssembly with the crypto jacking talk before, because actually, I've used WebAssembly if it's available directly on the browser. So I will speak about WebAssembly. And I will do two analysis of real-life WebAssembly module, one on Ethereum and one on, actually, the con-ive WebAssembly module. So I'm Patrick. I'm a securities researcher for a German company called Co-Scient. And typically what we do, we develop to produce that is like a decentralized analysis platform, like straight-intel analysis platform. And part of my research time was dedicated to WebAssembly analysis. So I will introduce what is WebAssembly, of course, the WebAssembly VM. And after that, all the WebAssembly module is composed. And all you can do some analysis on it, like program analysis, like CFG reconstruction, call graph, call flow analysis, et cetera. So WebAssembly is a binary instruction format for a stack-based virtual machine, so the WebAssembly VM. And typically, the most impressive stuff with WebAssembly is that have been created by the four major browser vendors. So actually, they are part of the 3W3C community. And typically, the guy behind that are the guy of Mozilla, Apple, actually WebKit, Chrome, and Microsoft with Edge. So it's well-supported, and it's really amazing for that. When I say it's well-supported, that means actually 75% of all the mobile on the world can support it, and 83% of desktop users. So that's mean I'm pretty sure all of you in the room are able to run WebAssembly module directly on your browser. It's already used. Actually, it's already used most of the time for video game. Actually, even the official WebAssembly demo is a video game. It's called Tank, it's this one. So it's like a two-player game. So if you want to give it a try, it's funny. And the other pretty amazing demo is this one that is called Seven-Temple, and it's based on Unreal Engine 4. So it's based on Unreal Engine 4. It's really impressive. So just give it a try, and you will see. Actually, Wazom is also used in business web app, or huge web app. The main one is AutoCAD. And also, for those who know Google Earth, actually Google Earth is only available on Chrome because they use native client. But in the future, like in the next few months, they will release the WebAssembly version of that. That means you will be able to go in Google Earth on every available WebAssembly compliant browser. So in the last month, we got some interesting, like, Portage and Project in WebAssembly. So we got, like, a Portage of Veeam directly on your browser.  And you have also, like, GS Linux that allow you to run Windows 2000 directly on your browser. So it's pretty nice for that. Also, for those who are more interested in kernel level, there is the Nebulae and Service project that will allow you to run a WebAssembly module directly at the kernel level. Sorry. For those who are more interested in, like, blockchain smart contract, there is actually two platforms that support WebAssembly. The main one is Ethereum. That is the second biggest cryptocurrency by market cap. So it's not, like, officially support WebAssembly. I mean, they plan in the next version of Ethereum that will be the Ethereum 2.0 to use WebAssembly, like, in the main network. But you already have WebAssembly support in the test network called Covan. But I will talk about it later. Also, there is EOS that use directly WebAssembly. So you compile your, like, C++ smart contract into a WebAssembly module. And this WebAssembly module will be stored directly on the blockchain. So if you want to learn a bit more about reverse engineering of blockchain smart contract, I have do a talk at recon this year about that, so if you want. So as I say, I think it's too tall earlier. We, someone spoke in this room about the crypto jacking stuff. And actually, yeah, ConIve use WebAssembly if your browser is compliant. And as I say, 83% of desktop users can use WebAssembly directly on their browser. So most of the time, it's a WebAssembly module that's going to be used.  And it will work. But that's the reason I put illegitimate in parenthesis. We also see that in the last couple of months, a lot of, like, crypto jacking attack have occurred. So that's also the reason the ConIve services is not considered as fully transparent or fully good for usage. So let's talk about WebAssembly basics. So typically, you have a C or C++ code or even a REST piece of code. And you want to, you will compile it into a WebAssembly, a wasm file. So the wasm file will be the binary version. And you can convert it easily to a text representation. So that's the YST representation. It's the one on the middle. So actually, it's really simple as a representation. You have the, like, I will say, the definition of the module. That will be the first part. It uses S expression, so, like, leaps. And after that, you will get the function bodies for every function that you have. And you can find an X expression or you can find, like, a linear representation of low-level instruction. So it will be really easier to read in that case. If you want to switch from, like, the text format and the binary format, the easiest way is to use, like, a translator. And there is two translators that are available for the moment. Just to give you an idea, the instruction set of the WebAssembly VM is really short. It's well-defined in the paper. It's a totally complete instruction set. And there is only 172 instructions. So it's really reduced. And there is, like, a lot of duplicate instructions in terms of, if you want to do an addition between an Integror32 and another Integror32, you will get almost the same instruction with Integror64 and Integror64. So that's why I call that, like, duplicate instruction. The most interesting one for me is all the instruction about control flow, because, typically, that will allow you to create some block. You will be able to do some branch and call some function that means call, like, in-bed function by directly saying, OK, I want to call the function number two. Or you can do some indirect call saying, OK, I want to call the function that is, like, in an index function. And you will call the index two. And inside, you will get the number of the function. So also, in terms of, like, operators, you have everything related to arithmetic, some constant operator, et cetera, et cetera. So the easiest way to start with WebAssembly is to use nscripten. So it's the tool developed by Modzia. And actually, the purpose of nscripten was to compile C and C++ code into asm.js. But they do the support of WebAssembly. And you can use that as an easiest way to compile. Typically, the line on the bottom will be the compilation line to create, to convert, like, a low-word into a low-word.html. So the reason for that is it will compile into a WebAssembly module. And after that, nscripten will directly create, like, a JS Glue code and the HTML. So just with one line, you are able to, after that, load a WebAssembly module into a white page. So it's a pretty straightforward. If you want to directly develop your own stuff, you can directly use, like, an online IDE. Typically, WebAssembly Studio is one of the most famous. You put your C code there, and it will create a WebAssembly module. So that is the, like, text format representation. But it will also generate directly the main HTML and main the JS. Actually, the fact is, behind this online IDE, it's nscripten. So it's just the same, but directly on your browser. Personally, I prefer wasn't fiddled. It's almost the same, like, same idea. But you can directly debug and get visibility about the output directly from the interface. So at the end, for example, I have done this with the Fibonacci function, and you will get something like that directly on your browser. So I have a basic HTML file just there. You can see that I fetched the wasn't module. And after that, I will instantiate the wasn't module with this API. And I just put the exported function, that is my Fibonacci function, and directly call it with some argument. The result is I will directly get everything in my console. And if I want even using, in that case, I use Chrome, if I remember, you can directly get a debug visibility, the function body takes view directly in your browser using that. So for example, there, we can directly see the code of my Fibonacci function from Google console, like developer console view. If you want to learn a bit more about the different JavaScript API, you have everything on the MDN of Maudia. It's really amazing the job that they do. And actually, you will get this browser-compatible table in order to know, OK, which solution should I use if I want to be fully compliant with every web browser. For those who prefer not to use Chrome or any web browser, you have directly a standalone VM. So it's WayVM. And you can directly provide the text format or the binary format directly as an input of the function. So there, I use my Fibonacci module. I put debug in order to get a feedback of the output. And I precise, OK, I want to use the exported function Fibonacci. And I put as arguments 6, 7, and 8. And I get the result. So I get directly a constant that is the value 8. What is really cool with this standard VM is that it's the VM used by EOS. So it starts to be used a lot. And you can get some pretty good feedback and developer feedback if you need. So let's talk about this VM, what is inside? What makes web assembly a game changer for the web? So actually, the execution model is really simple. The fact is you have the linear memory and the global variables that will be in your application, in your host. So typically, on a browser, it will be directly in the GSM giant. And it's considered as interest. So I will talk about that just after. And you have the wasm engine that is considered as trust, trusted. And typically, you will get the function body, the indirect function table, and the execution stack on it. So the linear memory is just like a continuous byte addressable range of memory. You can access to it from a web assembly module using load and store instruction. And you can even increase the memory size and get the current value, the current size of the memory from a web assembly module. So it's pretty good for that part. And in terms of security, they usually, and they should, but they do, put some bound check array at runtime directly on the memory. I say they should because we got, I think there is one CVE on V8 because they don't do the proper checking. So they got a use after free or memory leak. Don't remember exactly, but they got a CVE because of that. So on the entrusted part, you have also the global variable. So it can be mutable or immutable. And typically, you will create a variable. And this variable could be imported directly in your web assembly module. And you can use that. Typically, you can see that like, I don't know, like parameter for web assembly module. And the user will provide this parameter. And this parameter will be a global variable. And this variable will be imported at runtime. The same way, you have just two instructions to do that. Get global and set global. So really simple, really efficient. And for the trusted part, so we call that trusted because there is nothing that can be modified at runtime on this part. So that's the reason. So everything, once you instantiate a web assembly module, it will stay like that. And there is no way to do some modification on it. So typically, you instantiate a web assembly module, like the Fibonacci module. And you will hold the code in the Fibonacci function will be immutable, completely immutable at runtime. And for the code indirect, so as I say, you specify the indexed into this table. And the number will be the number of the callable function. For the stack, it's like a basic code stack. We call that a protected code stack. The reason for that is that the code space is limited. So it's defined during the instantiation of the module. And it's not executable. The reason for that is you only push pop value on it. You don't push instructions that will be executed because those instructions are actually present in the function body, not in the stack. So the main reason we got a lot of talk about the security of web assembly and also why is it really efficient, et cetera. It's because the guy who creates web assembly got the design web assembly with security in mind. So if you go to the web assembly website, you will see the specific web page for security. And as I say, two important goals, protect user and provide developer with useful primitive and mitigation. So the purpose is to make it easier for developer and for user and to provide high level security. So typically, what's happen if you do something bad or if your web assembly module don't have the behavior you plan to. But typically, you will trigger traps. So for the moment, you have only one type of trap, but they plan to have exception unlinked in the future. Typically, an exception could be a trigger with an integer division by zero. Or even funnier, you have a specific instruction in the instruction set that will say, OK, just trigger an exception. That is an unreachable operator. Also, they put CFI on the web assembly VM, so it's control flow integrity. That's mean there is some verification and validation at runtime about the target of the call. The branch, a branch in web assembly will be a branch to a specific block, like block ID, block label. So there is verification of that. And because of all this reason, that's prevent usage of Rob Gadget, because typically, everything is already defined at compilation. And during the instantiation of the web assembly module, all those verification will occur. So if something bad happens, the module will just not load. So let's talk about the inside of the binary format. So typically, to make it simple, there is one header in this module, and after that, you have 11 sections that are defined in the papers that I wrote, like already defined, 11 different sections, and you have one custom section that can occur whatever, how many times you want, like it's unlimited. In terms of compactness, to give you an idea, the Fibonacci module is this one. And you have only 1,021 bytes for this module. So to give you another idea, the Autodesk weather module, if I remember, is just like 39 kilobytes, megabytes. So it's pretty short for a big business application like Autodesk. So that's a good representation, and a good help if you want to do some analysis, recommend binary file. It's a binary file explorer called WasmCodeExplorer. And it gives you directly the matching between the text view and the value in the binary file. So there is one header. I think you cannot do as simple as that. You have a magic number that will be null byte ASM, and after that you have a version that will, for the moment, be only the value 1, because you are currently on the MVP one. But that's typically all. For the section, you have 11 different sections that are defined. So I will talk a bit more of the principal one, just to say that the custom section is a little bit more interesting, because it's the ID 0, and you will provide a specific name and the length of the name in this section. It's really interesting, because they put the name section, that is the custom section, as the standard. And typically, it's like the equivalent of the dash G flag on GCC. It means you have all the debug name of the variable and on the function, et cetera. So pretty useful for this one. So let's talk about the principal section. The first one is the type. So typically, in the WebAssembly module, you will define some signature. A signature is like a composition of the parameter type and the return type. And this signature will be used as a verification during the instantiation. So if you have a Fibonacci function that takes only one integer 32 as an argument, if inside the WebAssembly module there is more parameters than that and the signature is not the same, it will just trigger a trap. You have the function section that will declare the signature for every function. You have the input section. So typically, you're just going to say, OK, to run, I will need this function. And for example, from a GS point of view, you will need to say, OK, associate the, like you will provide the Gison and say, OK, the memory function or the return function, associate this return function to a console.log, for example. So you typically are going to do that. And the last one is the export function. So typically, you say, OK, I want this function call to be callable at runtime. So you instantiate your module and you will get like a list of exported functions and you can directly call a dos function. If you see, for example, there, it says the call function is the function two. So it will be this one. And you precise the type. So this one, for example, will take no parameter. So that's how it works. Of course, the code section is pretty interesting. It's like the function body. So you will get one body for every function. And the last one is the data section. So typically, it's like the equivalent of the data of a PE file. And it will be used to initialize the linear memory. So for example, there, you can see that the LORD will be put into the linear memory at the offset 1,024. And this chunk of data will be put at this offset. So when I was start looking at that, there is no like disassembly. Yes, but there is no like CFG. There is no way at the moment of my analysis to understand deeply all the weather module work. So I have developed a tool called Octopus. And typically, it's more like a tool for like block and smart contract analysis. But because some smart contract platform like EtherM and EOS use WebAssembly, I have developed some tool for WebAssembly. So I will show you some screen. And it helped me to analyze some real life cases. So the first one is to do the CFG reconstruction. So for that, you need to identify the block, the different basic block. So you have the block, loop, if, and else. And all of them will end with the end instruction. So just based on that, you are capable of creating the basic block. And for the branches, you will need to understand, like it's like a particular tip of branch for me, you will specify the relative depth as an argument. That means if you have a branch inside a block, and you have branch zero, that means, OK, I want to branch at the end of this block. But if you have multiple branch into the same one, like branch one or branch two, you will need to do like it will be the relative depth. And it will mean you will jump later on the code or not. To give you an idea, the Fibonacci function just there, you have a block. So it starts there and it ends there. And typically, when you have the branch if zero, that means you need to branch to the end of the current basic block, because it's relative depth and it's depth zero. So you branch at the end of this basic block, so you will branch there. And so that gives us the following result. It's like really simple as a way to do, and it works pretty well. Another type of program analysis that is really efficient for WebAssembly analysis module is the call graph analysis. Typically, you will get two different calls. You will get direct call. So it's like the black edges just there. And for indirect call, you are notable statically to know which function will call this other function in an indirect way. So the only thing that you can say is this function is present in the indirect call table. So it can be a target for a call. And so it gives us the final result. Typically, this one is the WebAssembly module for a Blake 2 cryptographic algorithm. So I think we can find it directly on the thing I extracted from Node directly, Node.js. So it's a Node.js module in that case. Sorry. Also, there is a decompiler for WebAssembly. Typically, what it does, you can translate the text view to the binary view, of course, as I told. And you can also directly convert the binary WebAssembly binary into a C representation. The fact is the result of the decompilation for the function will be cool. And it will work. The main issue is all the snippet of code that is embedded into it. And that will not only you to directly compile this C code and use it like a standalone binary. It's working for a basic example like this one. But it will not work with huge sample or huge library. So let's talk about real-life WebAssembly analysis. So the first one that I have analyzed is like the hello world of Ethereum. So as I told, the parity team, that is like a huge member of the Ethereum community, have put the support of WebAssembly into their specific testnet. So I will analyze this one. So just to give you a quick reminder, Ethereum is the centralized platform that runs smart contracts. And typically, the smart contracts are stored on the blockchain. And to store a smart contract in a blockchain, you need to do like a transaction. And it will create like a new address, dedicated smart contract. So a parity team, so it's the ones that put the WebAssembly support, it's the company created by Gavin Wood, that is one of the co-founder of Ethereum. And their client, the parity client, actually represents like 30% of the Ethereum network. So it's pretty huge. And actually, they put the support of WebAssembly directly on the client as well. So in March of this year, so parity, tweet about, OK, the first wasm contract have been deployed on the Covan network, that is the testnet of parity. And typically, what they show there is the transaction that will create the smart contract. So that's the input data. And if you take a look at that, you can see the null byte ASM that is put in hexadecimal. So we will first start with the analysis of this WebAssembly module. So usually, in Ethereum, for those types of transactions that is a smart contract creation transaction, you will get the loader code, the loader module, or like a loader code. And this code, the only function of this loader code, it's to put a chunk of data into the Ethereum blockchain. That's the only purpose of that. And this loader code will be executed only once. And that's the only reason it is executed just one. So typically, we should get the same behavior for WebAssembly because it's intended to work in the same way on typical existing Ethereum smart contract and the one with WebAssembly. So that's what I found. There is three functions, this loader. The call function is exported. So that means an Ethereum client will call this call function. It will need to import like a red function to the two parameters. And there is one function that is the function one that is only inside the module. What we can see is that the call function will call the function one and the function return. But if you take a look at the code inside the function one, it's just completely useless. It's just nothing. Actually, it's just an empty function. So there is no really reason to do that. But I don't know why it's implemented like that. And after that, so if you take a look at the call function, so the call one will be the function one. And after that, we take the constant. That is 1,036 and 232. And we call the return function. So the two value will be this one, the two parameter. So if we do a pseudo code of that, it will look like that, so call to function one and call to function return. The fact is to understand properly all related to constant in WebAssembly, you need to have the data section, because it's the data section that initializes the linear memory. So that's why we want to have a better understanding of that. So typically, in this case, you already saw this screen capture, actually. You will get the hello world string. And after that, you will get a piece of memory that is actually a WebAssembly module. And that's actually the runtime code, the runtime module. The only thing that I can say is the following, so the code is this one. And the questions that come in mind for me is why is there is a hello world string there? Because it's definitely not used in this one. And it don't make sense to have that in the loader code, so maybe like bad optimization from the parity team, I don't know. Maybe they change it, actually, but at least for their basic hello world example is still there. So let's take a look at this piece of code. You will get something like that. So same exported and imported name. So it looks more like a generic, important function that will, after that, call another function, depending if it's the loader code or the runtime code. And what you can see is the data section contain the hello world string that makes sense because it's a hello world module. So in these cases, the code is this one. You have the call function that will call the function two, and the function two will call the return imported function. So the question is why the call function is not directly calling the return function for the answer? I don't know, actually. There is also two system sections on it. There is a linking one. So actually, I don't know what is useful, but there is. I'm supposed it's to say, OK, there is also some other function on it. And there is the custom section name with some debug information. Why I told you that? The main reason for that is, at least in EVM, like in current smart contract, if you put some extra information that is not used, it will use computation power. And if you use computation power, you will need to pay in gas. So you will need to pay more because there is some extra stuff to do. So typically, a call two functions that does nothing, or stuff like that, that will cost you money when you will do the transaction. So this module is really simple. I think it's a good start, actually. And it's the first time for me that I saw the concept of loader and payload in WebAssembly. I mean, it's used like in real cases for Ethereum, et cetera, that is legit. But you can imagine that in the future, maybe they will do the same kind of stuff with some crypto miner, et cetera. Or you will only get one loader with a huge piece of data section that will contain the real crypto miner, and some JS scripts that will just call this function, get back, and put the crypto miner into memory, and after that load this memory into a real WebAssembly miner. So it's definitely possible. It's really easy to do. So I'm pretty sure we will start having some stuff like this one. Since my analysis, there is a tutorial. No, if you want to create a typical LOWardWasm module on the Ethereum network. So just give it a try if you want. And yeah, as I told, there is a lot of optimizations that can be done, but I don't know if they do some modification, and if it works better, no. So the final analysis for today is a crypto miner. So typically, the most common ones that you can find as a crypto mining WebAssembly is the Connaive one, because Connaive is the main services that is used for crypto jacking. And maybe some of you go into the San Diego website around May. So maybe your CPI have been used, not for what you think. So typically, this WebAssembly miner I've been found on this website. So it's a monorail crypto miner, and it's used the Connaive proof of fork hash algorithm. So this part is pretty interesting, and you will see why just after. If you want to take a look at this, you have everything directly on the GitHub, and that is the hash of the Wasm module. So that's the cool graph of this module. So it's pretty huge. The first thing that you can see is there is three interesting functions, the Kryptonite hash, Kryptonite create, and Kryptonite destroy. It's pretty interesting, because it contains this from Kryptonite, so that's the reason. And actually, those functions are exported. They are in gray on the screen, so they are exported. So if you do a basic Google research on this one, you will see that it's on three or four different GitHub projects, and you will directly find out the text view and some GS code in order to use this WebAssembly module. Actually, those strings are also used directly in VirusTotal and on other detection rules in order to detect WebAssembly crypto miner. So yeah, it works, definitely. But if you only change the exported name, you will get nothing totally clean on VirusTotal, typically. So that's the main issue with only matching on string, and like in that case, exported function name. You can just have a completely third crypto miner just by renaming with, for example, this one that is like a real one, a real case that I have so. Another thing really interesting is all those functions, it's all the exporting function in this case, and in this case, and in this one, you have exported function and some imported function, like enlarge memory, getTotalMemory, et cetera, et cetera. And actually, those functions come from nscripten. So that means the creator of Coneyev, or at least the creator of this WebAssembly module, have used nscripten. And he actually don't remove the unused function. Typically, if you, for all the exported function, if you don't use it, you don't need it, it's simple. And for this one, it will depend. In some cases, it will be useful only if you run the WebAssembly module locally using nscripten. And in some cases, because it's like in a web browser context, it will just use, it will be just not used, it will be completely useful. So that's the reason I have put some detection on my tool to detect this specific nscripten function. So it gives us this following call graph. So it's a little bit more clean. And the really interesting function are this one. So it's called memcopy. It's an exported function. So it's part of nscripten, actually. And what we can see is there is a lot of different cross reference to this function. I mean a lot of different from a lot of different function. And the other thing that you can see, it's the number of static calls on some specific function. For example, this one is the function 31. And you can see there is 16 static calls from the Kryptonite hash to this one. And in the same way with this one, 10, 10, 10. And this one, 9, 8, 9. So typically, because we are talking about like crypto algorithm, proof of work algorithm, and hashing function, for me it's clearly a means that it's like computation function. So we can potentially do some matching and rule detection based on this information. So if I put that in a graph, I have classified all the instructions in each function based on the function that is there. And the type of group, the instruction is like part of a group, like control, group, constant, et cetera, depending of the behavior of the instruction. So we get this following representation. And for me, the most important one are the ones that just not use any or maybe one or two control flow operators. That means there is almost no basic block. So at least one, but no basic block and maybe no branches. So clearly computation. Even more if you choose a lot some variable. And if there is some constant and arithmetic and bitwise operation, in that case for me, it's like complete jackpot. So in our cases, the function 31, 38, and 39 seems to be a good client, typically because the ratio of instruction per block are enormous. And you can see that the static cross-reference to this one are pretty cool. So in the same way, I have continued my analysis of this one, this function. And I found out that if we take a look at the text representation of this function, you can see a lot of usage of the local variable in this one, this one, and this one. I think this one is like more than 35 local variable. So pretty huge. And if you do some correlation of the occurrence of every instruction, you will see that with only nine different instructions, just there, nine instructions that represent 75% of all the instructions, we get 93% of the complete instruction in this function. So just based on that and based on the statistic and occurrence of each function, you should be able to create some rules, like detection rules of the kryptonite algorithm. So when I first discovered that, I do some research. And I found out that there is a project from a guy from Texas, Dallas, Dallas in Texas. And they use typically the same type of methodology. But they do that at runtime using a modified version of V8, if I'm not wrong. So it's pretty cool. And if I remember, they also use like they do that at a really low level point of view using Intel PT, if I remember. So it's even more efficient. And they do some really good statistic about occurrence of instruction, but also in video game. Like the tank was a module that I have shown you at the beginning of the talk and some other. So you can definitely create some rule based on that. Even better will be to create an antivirus that will, during the instantiation of a WebAssembly module, hook the content of this WebAssembly module and put that into like a rules-based detection. That will be the perfect way because in WebAssembly, you can directly provide a WebAssembly file from like GS, you say, OK, fetch this was a module. But you can also create a byte array in GS, put the code on it, and load it in WebAssembly. And in that case, you will not be able to do some analysis except if you hook the GS engine. So it could be a good solution in that case. Also, there is some other technique that I am actually working on and seems pretty promitious like the magic constant way. And for those who don't know the function divination, just take a look at CBL. It's really, really cool way to detect some like bad behavior. So a quick conclusion. I'm out of time. There is a lot of things to say in WebAssembly. They will do a lot of good stuff in the future. Actually, it's the four major buzzers that are behind. So you can be pretty sure you will get some better performance. For the language and platform, it's already the case. There is support for go, if I remember. And in post-MVP feature, you will get like thread, exception, SIMD, and like a garbage collector for WebAssembly. In my side, for Octopus, my tool, I'm currently working on the WebAssembly emulation directly in, I don't know if I told you, but it's in Python. So directly in Python. And I'm working on symbolic execution. And I think I will release something in the, I think before the end of the year. I put you some resources, if you want. For me, the best one are this one, as an introduction. And this one has a paper from the guy behind J-Dix. It's the guy behind J-Dix, so it's pretty cool. And you have some other one in terms of like vulnerability research, et cetera, like the two blackout talk that occur this year that are really good, it's really good resources. So thank you. And if you want to ping me, I'm completely available on Twitter.  Thank you.


Concerns about reproductive aging in men are often brushed aside, but there's no justification for that. There's good evidence that older men have more mutations in their sperm, which means their children could suffer from a range of genetic abnormalities. A 2003 study found that couples in which the man was over 45 took five times as long to get pregnant as when the man was under 30, regardless of the woman's age.


What is going on everybody 2019 20 revolution basketball four box one half intercase break Number one tiered random teams. Remember if you do want to trade your team got to trade the whole block of teams Just a reminder all cards shipping this four box break of 2019 20 Revo. It's gonna roll the dice. I'm gonna go Wow late night hard 12 6 into 6 There's one I would be wanting a roll of seven if I was playing the crabs because I bet and I don't I don't bet And I do not pass line, but I like to joke that I do five six seven eight Sometimes I'll do it on those ones that have Electronic boards. I like the Indian casinos 12 times on the list of tier teams. I Think Leif best of sports will be the next one buzzy. There's five left. I just dropped the link Here it is again No, I'll drop the link once I do this randoms five six. There's only five left Jasper's case breaks calm seven eight nine ten 11 and 12 unless we want to do another hit trap, but I haven't seen any spots sell Ted with the Lakers Rockets Pacers Matthew with the Grizzlies Nets Nuggets Brian with the Celtics T-Wolves Mavs Steam with the Knicks Spurs Clippers Matthew with the Heat Sons Bucks Nick with the Bulls Warriors Kings Jeff with the Pelicans Thunder Magic Rick with the Wizards Sixers Blazers Russell with the Hawks Hornets Raptors Zach with the Cavs Pistons and Jets Really, that's crazy Nick six spot and you get the Bulls again. I did go 12 times, right? You're not seeing things That's kind of crazy though Not the worst one to get to be honest All right, we're gonna pause it. No, we're not gonna pause We're gonna open the case see which four boxes we're doing so you can trade while I do this The Warriors are pretty good too. Yeah Okay with it. Yeah All right, so let's roll the dice one two three left side four five six right side to see which inner and Todd says He just picked up one in optic choice So we can do another one of those tonight, too Revvo Some revolution I Saw that I saw all the open boxes. I'm like, are you leaving this for tomorrow? All right, this is this break. This will be three four So let's open this We're gonna be needing like a couch and stuff if we're all staying late, you know me a little lounge area All right We'll go top one two three bottom four five six and then if there's no trades by then we'll probably break it and Last call Zack is saying cast pissing jazz anybody Maybe some say coups sextant or not sextant. There's Garland Dylan Windler who's the other rookie? Kevin Porter, Jr. The calves are actually pretty good Russell has the hawks hornets Raptors Up for trade maybe a swap for those two, baby Russell and Zach if not, we might rip because I think you guys are the only ones with With trades so there you go, Buzzy. There's the link for that Joe JL popped in the chat Five left in the two boxer and then I left the optic choice. Those are the two closest other than the cup hockey Yeah, it's free shipping to the United States and then free shipping to Canada if you order above $50, I believe All right training window closed. Good luck.  I see someone like emailing us 1003 I think they might be in a different time zone, but maybe a different country. It's like a They think we're this person things like a private breaker only only have one customer Try our best, but not always You know males definitely gonna be delayed Not just on our end, but on, you know post office and to So if you have you know high-value packages, it might be worth Upgrading just sending us an email and trying to upgrade a priority shipment that is still not guaranteed But it'll probably be a little quicker than what you know first-class or priority mail would be Want to upgrade it to like three day or something like that UPS. We also do that so I guess I did email back just now So now I kind of think we do email back at this time the Andre Hunter There's a Astro of Campbell Walker, and I believe all cards shipped in this So in case I miss anything it will be shipping out No matter what lift off Brandon Clark. There's a say clue rookie. It's weird. Oh, this is nice That's the Astro parallels I am Williamson. That's a party card Pelican spot goes to Jeff tea Congrats Jeff Nice one and a little foreshadowing because I might or might not have seen this guy's name on the bottom of the stack, too There's a clay fractal base, there's a Devon Booker Ruihachi more a rookie revolution There's a Jeremon green Astro Supernova James Hart nice fractal parallel. It's a really sharp There's a Luca second year There's an Admiral Schofield number 31 out of 149 There's the Neil Galanari groove There's a Luca shockwave and a Zion base, which I think is around like 40 50 bucks for the base alone I don't know anybody know what a Zion Astro goes for pretty solid box In my opinion Let's leave all this up And yeah, I do see already a few people emailing about priorities So yeah, if you want to definitely send that ASAP because we want to make sure your package You know if you want it that way want to make sure it goes out that way About a hundred dollars nice. So already around a hundred forty hundred fifty dollars. I guess right I think the base is like 50 bucks, right? Maybe I'm high on that But already triple your money from box one Imagine some ink now Next revolution is in the store. That's these case breaks calm. Got Jimmy Butler vortex There's John Collins fractal. Yeah, I think so too Lucas Amonich. I Remember revolution especially I always say this about prison, but revolution especially we couldn't sell For what's worth? I mean people said no autos. It's junk But now now it's gained a little steam Rick with the wizards gets the Astro of Rui Hachimora Chris Paul remember all cards do ship There's Dennis Smith june. It's gonna be numbered to 100 New York Knicks One no Carter jr. Joe Kitch not see her little rookie revolution Astro of Al Horford and a Rui liftoff box three Yeah, so $40 dollars around the right area $40 to $50 I guess probably depending on you know, maybe condition or centering PSA 10 is probably a couple hundred so Yeah, definitely a lot of value in these these basketball breaks LeBron lift off die cut for the Lake show Ted Howard Ben Simmons groove There's a goga to 75 Sunburst. There's a LeBron base Mitchell there's a Tatum Astro Kobe white rookie revolution There's a fractal of Kelton Johnson Eric Bledsoe a lot of parallels in this fractal D Russ. There's a RJ Barrett base Yana shockwave There's Kevin Durant and Astro Admiral Schofield Right so last box. Yeah, I can't complain about pretty much any of the Panini products Nor what I want to would it be in my best interest to the only thing I have to say is they don't do it for basketball, but Yeah, I think only football is unparalleled football Maybe a little too much. It always hurts my eyes sorting that or shipping it or breaking it. I Don't know why maybe it's just I'm a little baby But it always like actually physically hurts my eyes Not that I think they're ugly. It's just like they're so shiny Gotta like turn the lights off and sort them Good luck everybody find a box. You got an autograph. I believe only one auto in this So maybe a couple more in the next half in The store now we can run it back tonight if we want to it is auto of Jalen Rose Pacers That is in the Lakers combo that is Ted Howard Tybal. Oh Fractal LeBron That Lakers spot doing well not numbered but definitely a nice one What's a the fractals a little more common so might not be crazy money I don't know what a fractal LeBron is going for 1920 Revvo Can't remember if he was a cav in last year's Revolution or not. This might be his first Lakers Maybe not though. It might be where he's in a Kaz uniform and then Lakers team name. So technically PJ Washington Bruno Fernando Fractal There's another LeBron LeBron James. That's a base and Brandon Ingram 123 out of 149 impact So there you go, that is for the Lakers that's Ted No, not for the Lakers. Sorry Lakers uniform Pelicans team actually threw me off there Pelicans That is Jeff 123 out of 149. So there you go. Thanks everybody for getting in. Let me actually write that on this Thanks everybody appreciate Everyone getting in on that Revvo number two might have a couple more autos since we only hit one auto in this one in the store now Jasper's case breaks.com


What's up everybody, Jason here for jaspyskatesprac.com. This actually finally sells out the break, guys. I know people have been waiting, put up a filler today and boom, sells out finally speaking to number 14, where we're giving away 12 teams in that break with this 2021 Prism MBA, that MBA. MLB's sell-o-packed, one-pack break number 13. So first we're gonna do the break, we'll randomize the names of the teams to the pack, see what pops out of there. Then at the end, we'll randomize the names and the top 12 names each win a team and the finest baseball picture number 14 in the following order. So Dodgers, down to the Giants. So, just realized that right now, so we're gonna put a team sheet here for the pack filler and then we're gonna put giveaway, of course for the giveaway. So there you go, top 12, get a team. Now in the meantime, let's just do the break first, quick little pack filler. It is a one to six, seven times, one, two, three, four, five, six, seven. Chris, I want it to six, seven, seven, one, two, three, four, five, six, and seven. Braves down to the Cincinnati Reds. All right, so again, stick to what you got, of course. Here we go, quick little pack, let's check it out, see what's in here.  So we got Nolan Aronato, is he on the move guys? Potentially, right? George Bratt, Sammy Sosa, Evan White for Seattle rookie, Paul Goldschmidt, and then a little Trey Turner. So nothing too fancy here, but little something there for you guys. But the main reason why you're in here is for these teams giveaway. So of course, top 12, get in guys, let's roll it. And it is A, two and a one three times, good luck. Let's actually get the original list, the list here. And of course it is three times, one, two, and three. Boom, so from Chris Butler down to Allen, not in unfortunately, but the top 12 are Allen, Allen, Chun, Hope Chun, sorry. Chris Allen, Chris Butler, Chris A, and then Sean sneaking in right at the top, how about that? So there you go, so these customers are in here. And we'll make this a little bit better.  Chris A with the White Sox, Chris Butler with the Phillies, Allen with the Blue Jays, Astros, Pirates, Rays, Chris Butler with the Nationals, Hope Chun with the, or Hope Chun, sorry, with the Royals, and then Allen, Marlins, Twins, and Giants.  So if you guys wanna stick around for another video, you guys will see the break happening soon. Thank you.


Hey you guys, how are you guys doing? So girl today we are going to be pre-pooling with Jess coconut oil Now I purchased this coconut oil girl I was at Ross looking for some stuff that I possibly didn't need and this is This is refined organic coconut oil It's a big pretty sized store Smells really good too. So you guys like most of you I have had mixed fillings when it comes to coconut oil and for me personally what it boils down to is that I Cannot or prefer not to use coconut oil as a leaving oil now I do use an oil mixture Every other day, and there's quite a bit of different oils in there for a while there I was in a finny greek oil kick I don't use that as much now as I leave in but I do use it as a treatment Hot hot oil rinses and stuff like that. My hair doesn't respond as well using it as a leave-in. So It's been a while since I've used it to pre-poo my hair and again when I would pre-poo or do like a DIY Pre-poo recipe if I use coconut oil, it wouldn't be by itself It would be with several other ingredients, but I Suck up the video, you know, I don't know about y'all But when I it's time for me to wash my hair I start to go to YouTube and you know, I'm telling myself that oh, there's some video out there That's gonna miraculously give me give me some advice on how to detangle my hair in like 30 minutes or something girl Please know it's not happening So since it is cooler right now And I believe it's it's cooler and in a lot of states here in the U.S. It's in a solid form However, this is what it looks like have everyone I rub it together It will start to melt due to the heat from my hands now when I would use coconut oil as a pre-poo Which again, I haven't used coconut oil solely by itself Honestly, I haven't even used coconut oil in a treatment in a very long time I can't even tell you the last time but I by itself has been years Years so what was I saying? I'm I do apologize you guys Coconut oil when I did use it in a pre-poo.  I'm excited y'all And I'm nervous um This see this is what the back is looking like you see that girl. Can y'all see that? Yeah, you're gonna get it together. All right, let's just do this section right here girl Now I've been using the african pride pre-poo And um I know a lot of people do not pre-poo their hair You know, you may feel like it's an unnecessary extra step But I find for me personally and pre-pooing again, it's just a pre-treatment before the shampoo process Uh, it basically helps with Um, preparing your hair for the shampooing process for me I like to detangle while I'm pre-pooing and it does make my overall wash day go quicker So my hair has been sectioned off. This is a fairly large section, but we're gonna we're gonna work with this Okay, now I'm gonna go ahead and mist my girl Mist my hair with warm water I'm gonna smooth that through See how my hair is Yeah, I'm gonna really take my time Now my ends are very dry I can feel it they are very very dry now. I do have a wooden comb here um I probably won't use that. Let me zoom in y'all. I just in the midst of that I went ahead and did like a couple of sections in the back I'm I'm I'm okay. No, that's not complaining. I'm a little disappointed though my my hopes and dreams Again misting with water Let's put this section away Um and while we're at it, we're gonna take take down a little section in the back And see what it looks like Now I remember why I didn't didn't use coconut oil by itself now, you know, so anyway y'all Taking some coconut oil I'm going to rub it together and the palms of my hands to allow it to slightly milked Some yeah, it's it's looking like an oil. Okay Couldn't run it through my hair I don't like the way my hair feels with Yeah, um So let's just finish this section up put it up and let's just take down Um a section that I did about five minutes ago Now that the coconut oil has had a chance to sit in it a bit Okay, let me take this section down now this this better This better raise my credit score or something. So let's see My hair feels heavy with this and it feels heavy. It feels I don't know gummy. Is that possible? We're going to cease and desist I'm not going to do this Um and again, it's it's been a while like I said a couple of years that I've solely used only coconut oil in my hair Typically, I do use it with other ingredients or other products So yeah, I'm not going to do that anymore.  Yeah That's it for me for trying to pre-pool. I tried I tried to give it a you know give it a go But it's not working for me and I'm not going to continue to put it on my hair if it's not working So that is it everyone. Thank you so much for watching. Take care. Bye


Progressive web apps are now supported on Windows. The Credential Management API adds support for public key credentials, and you can now name workers. I'm Pete LaPage. Let's dive in and see what's new for developers in Chrome 70. Users can now install desktop Progressive web apps on Windows. Once installed, they're launched from the start menu and run like all other installed apps without an address bar or tabs. Service workers ensure that they're fast and reliable. The app window experience makes them feel like any other installed app. Getting started isn't any different than what you're already doing today. All of the work that you've already done for your existing Progressive web app still applies. If your app meets the standard PWA criteria, Chrome will fire the before install prompt event. Save the event, then add some UI like an install app button to your app to tell the user that your app can be installed. Then, when the user clicks the button called prompt on the saved event, Chrome will then show the prompt to the user. If they click add, Chrome will add your PWA to their start menu and desktop. We're currently working on Mac and Linux support, so check out my post on desktop PWA's linked in the description for complete details. The Credential Management API makes sign-in super simple for users. It allows your site to interact with the browser's credential manager or federated account services like Google or Facebook to sign in. Chrome 70 adds a third type of credential, public key credential, which allows web apps to create and use strong, cryptographically attested and application-scoped credentials to strongly authenticate users. I'm pretty excited about it because it allows sites to use my fingerprint for two-factor authentication, but it also adds support for additional types of security keys and better security on the web. Check out the web auth docs linked in the description for more details and how you can get started. Workers are an easy way to move JavaScript off the main thread and into the background. This is critical to keeping your site interactive because it means that the main thread won't lock up when it's running expensive or complex JavaScript computations. In Chrome 70, workers now have a name attribute which is specified by an optional argument on the constructor. This lets you distinguish dedicated workers by name when you have multiple workers with the same URL. You can also print the name in the DevTools console making it much easier to know which worker you're debugging. Naming workers is already available in Firefox, Edge, and Safari. These are just a few of the changes in Chrome 70 for developers. Of course, there's plenty more. Web Bluetooth is now available in Windows 10 and allows your site to communicate with nearby user-selected Bluetooth devices in a secure and privacy-preserving way. Chrome can now send intervention and deprecation messages to your servers using the Report to HTTP Response header or surface them in the Reporting Observer interface. And there are a number of important deprecations that you should know about. Check the deprecations post for more details. All the details, including docs and specs, are in the updates post linked from the description. Be sure to check out the latest new in Chrome DevTools video to learn what's new in DevTools. Then click the Subscribe button and you'll get an email notification whenever we launch a new video. I'm Pete LaPage and as soon as Chrome 71 is released, I'll be right here to tell you what's new in Chrome.


This is stock number 9324X. We are here at Summit Automotive in Fond du Lac, Wisconsin, your new and used Dodge headquarters. Today we are checking out this super clean 2016 Dodge Journey SXT. From this HD video you will be able to tell that this journey is extremely clean all the way around. Factory fog lights, no dents, stings, scuffs or cracks in the front bumper. You can see just how clear and nice those headlights are. This one has factory painted alloy rims. No scuffs or scrapes on this rim and it does have 225 65R17 tires and they have probably about I'd say 70 to 80 percent of the tread left. Black clear coat is the color. We shoot all of our videos in 1080p so if you have HD capabilities on your computer tablet or smartphone device turn them on now because it's like you're right here looking at the vehicle with me. Passengers side rim, no scuffs or scrapes on that. Very nice condition and as you go down this side of the vehicle you can see just how clean the body is, how glass like and mirror like and reflective that paint is. We take these HD videos so if you are far away or even if you're close by and you just cannot make the trip down you can still see the car, hear the car and have confidence in the vehicle that you're looking at before even get here. Very, very clean down this side. I didn't see any dents or dings. Back rim is an excellent condition as well and these back tires have just as much tread as the front tires. As we go around to the back you can see just how clean the rear bumper is. This one does have the dual rear exhaust which means that it has a 3.6 liter Pentastar V6. This is an all-wheel drive. You can see the rear gate is nice and clean. I didn't see any dents or dings on that and the rear bumper is in nice condition as well. No dents, dings or cracks on that. Take a quick look at the back storage area. You can see it is very clean as well. Underneath here you have another storage area and then your jack tools are underneath there. These seats do go down for extra storage. Nice and flat both sides do that and then they have a strap to get the back seat up again. You can see that the shocks hold up real nice and as we go around to this side of the vehicle just as clean as the passenger side, once again take note on how clean that body is, how reflective and glass-like and mirror-like that paint is. We want to make sure you get the most accurate representation of the vehicle without even coming here so that when you do get here you'll know exactly what you're getting and have confidence in the vehicle and the people you're working with.  There are no rips or tears in these seats. Power driver's seat with factory lumbar, factory floor mats throughout. Power windows, power locks, and power mirrors. This one has auto headlamps and you have an information center right here where you can get your digital speedometer as well as your compass or I'm sorry your temperature and your miles display. You can see that this one has 30,775 miles. This one has the touchscreen radio with AM FM and Sirius XM capabilities. Excuse me. Dual climate control, CD player, passenger seat is very clean as well. No rips or tears on that seat. Side current airbags. This one I don't believe was ever smoked in, smells very clean, has an in-seat storage area which is really nice to keep your valuables out of sight, out of mind. Factory floor mats back here as well or on the passenger side as well and the carpeting is very very clean. Push button start and we'll take a quick look at the back seats and check out under the hood. Second row seats are very clean as well. No rips or tears back here. This does have the latch child safety system for car seats. Down here you have the in-floor storage which is kind of nice. You got these little containers. You can put ice and drinks and stuff in there and then you can take it out for easy cleaning. It comes with floor mats as well. So this button or this latch right here can move the seat forward and back. This one will put that backrest down and then if you do this one it moves the whole seat up like so for easy access to the third row. Third row seats are very clean as well. No rips or tears back there and to get the seat back you just push back and down. You're all set to go. Heated power mirrors. Under the hood we have the 3.6 liter Pentastar V6 motor. It's been on Ward's top 10 engine list four different times now for just reliability, horsepower and fuel economy. Engine bay is very clean runs very smooth. This vehicle has been fully safe and inspected by our Chrysler Dodge certified technicians. Has a fresh oil and filter change. All the fluids have been checked and tapped off and this vehicle is 100% ready to go. And to see more pictures of this journey or one of our other 400 new and used cars, trucks, SUVs, minivans, Wranglers, you name it we got it go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle on our lot. Videos of every single used vehicle that we have all at summitauto.com. Thank you so much for checking out the video. If you want to make this one yours give us a call right now<PHONE_NUMBER> ask for one of our sales associates to make this Dodge journey years today. Once again that number is<PHONE_NUMBER>. Thanks again for checking out the video. If you like it want to check out more videos go to youtube.com slash summit auto remember to like subscribe and share on all those videos and this one in fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more used inventory videos like this one on your right. If you have not been to our website on the bottom a link to this vehicle on our website click those check us out and we really look forward to helping with this super clean 2016 Dodge journey. SXT once again that number to call is<PHONE_NUMBER>. Thanks again.