Well, good afternoon ladies and gentlemen. Thank you very much for joining us here today for this first press conference of today, Saturday 25th of January. Thank you also to our audience who are watching us live on our webcasting platform. Now it's a great delight to have to say that it's been a real stand out year for environmental initiatives here at the annual meeting. We started our environmental agenda on Thursday with UN Secretary General, Banky Moon and Dr Kim from World Bank and President Barroso of the European Union, making some very, very determined announcements and pledges to tackle climate change and work with the forum amongst others, other stakeholders to really drive momentum going forward to the UN climate talks in 2016. Following that, we've had our own World Economic Forum report which was launched yesterday on the circular economy with some analysis that suggests that we could unlock a trillion dollars of extra value for the global economy every year by 2025. Now it's a turn of a very long running initiative and a very long running collaboration with the forum. I'm very delighted to be here with my colleagues to announce the launch of the Environmental Performance Index. I'm going to keep my talking to a minimum so the experts can do their bit. I will just first introduce them and invite them to make some remarks. First of all, I have Kim Samuel Johnson, director of the Samuel Group of Companies in Canada to my left and we have Angel Sue, PhD director and lead author of the 2014 Environmental Performance Index at the Yale Centre for Environmental Law and Policy and we have Mark Levy, deputy director of the Centre for International Earth Science Information Network, Columbia University in the USA and also a member of the Global Agenda Council on Measuring Sustainability. Kim. Thank you very much. The 2014 Environmental Performance Index is designed to help governments gauge their success in addressing a range of environmental challenges that every government faces including environmental public health, air and water pollution and the vibrancy of ecosystems upon which all life depends. We have produced this index for 15 years and the 2014 EPI marks the 10th iteration. I worked with Dan Estee starting 15 years ago to launch the original index in Davos. So it is especially exciting to be here again with the 2014 EPI. We know you are all anxious to hear about the 2014 EPI rankings. So before I go any further, let me tell you that Switzerland is again in the top spot followed by Luxembourg, Australia, Singapore and the Czech Republic. Somalia performed worst in 2014 preceded by Mali, Haiti, Risotto and Afghanistan. Other than Haiti, we did not have enough data to rank any of the bottom five performers in our last EPI release. We know that a country cannot manage what is not measured. So although Somalia, Mali, Risotto and Afghanistan are not performing well, there is a silver lining in simply having the data to include them in the 2014 EPI. One of the most important innovations of the 2014 EPI is that it ranks many more countries than past iterations. When we began this project, we only ranked 23 countries. In 2012, we ranked 132. This year, we ranked 178 countries. This broad coverage allows us to draw more conclusions about global environmental trends because the 2014 EPI ranks countries representing 99% of the world's population, 98% of the globe's total land area and 97% of global GDP. Angel and Mark will mention more about this global scorecard in a few moments. Thank you all for joining us today. In addition to this briefing, please do not forget to visit the 2014 EPI website at epi.yale.edu for more information and a full 2014 EPI report. I am pleased now to turn it over to Angel Chu, the director of the environmental measurement program at the Yale Center for Environmental Law and Policy and Lead Investigator on the 2014 EPI. Thank you so much, Kim. I just want to first thank everyone for being here today. We are so excited to be presenting to you the results of our 2014 EPI index. So, I'm just really excited on behalf of all of the researchers and the collaborators at Yale and Columbia universities and around the world who helped us in this effort. As Kim mentioned, our 2014 EPI results show that leading countries have relatively strong performance across the spectrum of environmental issues, which include air quality, water quality, climate change and energy, et cetera, and also measures of environmental health. And as a major theme of this forum has been economic development, employment, growth, what this result shows is that countries don't have to necessarily sacrifice the environment for economic growth and development. But at the same time, even these performers aren't best in everything and there are some areas, most notably fisheries and forests, where countries could also improve. So, among the world's largest and established economies, Germany performs very well at number six, the United Kingdom is at number 12, Japan is at number 26, France 27th and the United States is 33rd. In terms of some of the fastest growing economies, so these are the so-called BRIC economies, Brazil comes in at 77th, Russia is 73rd, India is 155th, China is 118th, and South Africa is 72nd. This entire group performs relatively worse than average on air quality, biodiversity and habitat protection, but India and China in particular stand out as overall laggards. But despite this gloom and doom for these emerging economies, some of these BRIC countries actually are performing better on issues than they have in the past. So China, for example, even with dismal declines on air quality over the past 10 years, has received continuous media attention over the last year for air quality. And so they've taken a number of measures to implement policies to improve the quality of their air. And they've also realized the value of better measurement and indicators towards this progress. Our website, as Kim mentioned, epi.yale.edu features a profile for every single country so you can dig deeper into the data indicators to understand how each country performs. Kim also mentioned some of the innovations that we've made for this year. We're constantly striving to refine how environmental data are used to shape policymaking, and as a result we have some important methodological advances for this year. For example, we're featuring for the first time a global indicator that assesses fine particulate matter or air pollution. These are harmful particulates that have human health consequences. We also feature a satellite derived indicator to assess deforestation and how countries are performing on improving the rates of forest loss. And finally, we have in our policymaker summary a global scorecard to show how the world is doing on these critical environmental issues. So for example, we now know that the world has made significant advances in terms of waste and sanitation, child mortality, and also the protection of both terrestrial and marine habitats. Epi indicators demonstrate both high scores and solid trends in these issues. But then at the same time, we see again a notable decline on the state of the world's fisheries and also air quality, which Mark will dive further into. So we'll hope that you'll take a copy of the summary if you're here in Davos or download the report or materials from our website. Mark. Thank you, Angel. I want to take a look at the bigger context and the implications for how we're going to promote more effective management of environmental problems globally that we can derive from our experience with the EPI. I think it's fair to say that internationally we're living through a period of dramatically rising interest in trying to tackle the big environmental problems that we face. We see this in anxiety over climate change and water scarcity and other issues. We see it in the rapid proliferation of sustainability strategies among corporations. And we see it in the dramatic rise in the seriousness of the environmental issues in the debate over the sustainable development goals. These will not be easy problems to solve. I think I can make our main point by contrasting two indicators. I can give you a tale of two indicators. If you look at the issue of access to clean water, you find an experience of great success. In the last 20 years you've had 2 billion people elevate from a position of not having access to clean water to having that access. Today there's only about 750 million people that are forced to live in conditions where they lack such access. This is within our indicator set, the indicator that has shown the greatest performance. If you are grading indicators instead of countries, this one would get the highest grade. But if you look at the air quality indicator, which is just as important substantively, it's a major source of premature death and illness. And the air quality indicator, things are getting worse at a faster rate than the water quality indicator is getting better. Instead of having fewer people exposed to bad air, we're having much more. In the last 10 years, 660 million additional people are forced to live under conditions of unsafe air. 1.8 billion people totally at present worldwide live under such conditions. Why the big difference? Well, I think what the water indicator has, the air quality indicator lacks. And there's three critical things that we think are elements of success. The first is a clear policy target which is measurable. The water indicator has that. It was embedded in the Millennium Development Goals. In the case of international air quality, the world community has not set a target for improving air quality. The second is a system of measuring objectively and regularly the rates of improvement on the indicator. The water system has that, the air system does not. And then the third is a set of policy and management mechanisms which are closely tied to the target and the measurements. So if you set policies so you're evaluating performance against these indicators, you can make great progress. If you don't, you're going to languish. So these lessons are important because, as I said, the world is trying much harder to solve these problems. But I've been part of many international environmental assessments where the conclusions are depressingly similar. The problems are getting worse at a faster rate than our solutions are getting better. So in general, you tend to see situations that are much more like the air quality story than the water quality story. And fundamental to all of this is the quality of the data. So one of our conclusions from the very beginning of this experience 15 years ago is that the data quality and availability are distressingly weak in a number of very high importance areas. So it's not just air, it's also in water quality, it's also in waste, toxins, across many, many very important indicators. This is very, very bad news for the international community that's trying to frame ambitious sustainable development goals. For example, there's a lot of creative work that's gone into framing watershed management goals, sustainable agriculture goals. These processes will fail if we don't live up to the challenge of figuring out a way to measure progress on those goals. So I want to conclude by pointing out that our experience has shown that when you get these things right, targets, measurements and management, you can make dramatic progress. So it is possible, but we have a lot of room to make up. I'll take questions. Oh, I can just have one more. Please. Thank you. Thank you. Just before we turn back to Oliver for questions, I would also like to mention my own country of Canada. It is notable that Canada, which has a reputation for being an environmental leader, is not in the top 20 performers this year, coming in at number 24. There are already discussions in Canada about the role of tar sands, pipelines and fossil fuels. Canada's ranking in the 2014 EPI should add more substance to this ongoing debate. I'll turn it back to you Oliver. Thank you. Thank you. Well, being a former journalist, maybe I could start with asking a question myself. I can't resist myself sometimes. The problems are getting worse faster than the solutions are getting better, which is a bleak picture you paint, Mark. But we're also talking about almost defining period in terms of momentum being generated at this meeting. How do you reconcile these two forces? Do you think we now have enough momentum to turn us around and actually start building solutions quicker and faster than problems are getting worse? I think we clearly have that potential. I think the optimism is born of experience in small scale experiences and in corporate level innovation where you've had corporations make decisions to reduce pollution, reduce environmental footprints and make dramatic improvements. So in individual firms, specific projects, we've shown the possibility of great progress. What we have not yet done is scale those things up at a fast enough pace. So the challenge before us is to take what we know from these individual experiences and scale them up at speed. Any further questions? Sir, there's a microphone just coming. How would the index help investors look at investment and make judgment? Thank you very much for the question. We've seen over now the past 15 years a very strong link between the investment climate within a country and the environmental performance. They tend to rise together. They tend to stagnate together and they tend to fall together. It's especially true when we look at emerging economies where especially you can see long, what I'm calling long haul implications for countries that are addressing their environmental problems. An example of this would be Brazil, which came in at 77 this year. And an example at the other end would be India that came in at 155 using the index as a tool we would state and show that Brazil long term is going to augment its investment climate to foreign investors because of sound environmental performance. I would also add that business can be a very powerful change agent for reform in terms of promoting transparency, insisting on very good data and making sure that nobody is allowed to be complacent. And looking very closely and making investment decisions at the environmental performance and policies within that country and we see that again and again. Thank you for the question. Lady at the front. I'm interested to find out where China ranks in the index and also if other any sort of over the period there are countries where they have improved the ranking through maybe alternative renewable energy or other sources. Thank you. I'd like to take that question. So China is a very interesting country because they've rapidly developed over the last two decades and have suffered severe consequences as a result. But at the same time, I think that top leadership in particular the last five year plan, which was called the greenest five year plan to date, they've made an enormous investment and commitment to try to reverse its pattern of developing very quickly and polluting at the same time. So the unfortunate part is that they're not quite there yet. So in terms of air pollution, China performs the worst out of all countries in terms of outdoor air pollution. And so they have more people living in cities with worse air than any other country in the world. But then there are some notes of optimism, for example in terms of climate change and energy. The way that we've structured the indicators this year, we rate how well countries are performing on their ability to reduce emissions over time and also the rate at which carbon intensity grows. So compared to other BRIC countries, India, Brazil, Russia, for example, China is the only one that has been able to reverse that trend of growing the economy and also growing emissions. So they've actually been able to reduce emissions. So I think there's a lot of optimism and you're absolutely right that the renewables piece has a lot to do with it. They've made huge investments to try to increase the share of renewable electricity within their energy mix. They have a thriving R&D industry for improving these technologies and for exporting them. So I think they're really doing a lot, despite their lower performance, I should add. Any further questions? Perhaps one for me just to close things off. One of the top trends we identify in our global agenda councils here at the Forum of 2014 is rapid urbanisation. In fact, we talked about it here with China. And this is a potential positive movement in terms of air quality. It's obviously the concentration is a great challenge, but could this be a more efficient way of improving air quality? What impact does this huge mega trend have for future air quality? Just quickly. I would say that I think urbanisation presents opportunities and then challenges at the same time. So with the air quality issue, if you have a mega city and you have urbanisation increasing the amount of infrastructure development, etc., then you will have potentially higher air pollution. But the emergence of Singapore, for example, as number four in our index shows that also you can be more efficient with delivering better infrastructure for clean water and also for treating wastewater. And so I don't know, Mark, if you have anything to add. Well, I would just say that historically cities go through an inverted U curve where they start out relatively clean. They get very, very dirty and then they get better. And so what Beijing is going through now, other global cities have gone through in the past. London experienced the same thing about 100 years ago. The challenge today is as new cities, the Beijing of the future comes online that they shrink the amount of time it takes to clean up. And they lower the cap so that they don't force their citizens to suffer in that way. Thank you. Well, there are no further questions, so I'd like to close this conference. I'd like to thank my panel for joining me here today. Thank you all for joining us here and also thank you to our audience watching on our live webcast platform. Thank you. Thank you. Thanks.


Income tax 2021-2022. Filing status, part two. Get ready to get refunds to the max, diving into income tax 2021-2022. Most of this information can be found in the form 1040 Instructions Tax Year 2021 found on the IRS website, irs.gov, irs.gov. Also remember that when we're thinking about filing statuses, you wanna think about what the impacts or have a general idea of what they will be on the tax return. Easiest to do that, visualizing the tax formula. Different filing statuses such as single, head of household, married filing joint will have major impacts on the standard deduction as well as the tax rates will be the progressive tax tables will be dependent upon the filing statuses. There also could be many other areas that would be impacted, including the phasing out of credits, for example, will have different phase out limits depending on the filing statuses and just the ability to be taking certain credits, especially the ones you wanna be considering are going to be those low income or refundable credits, things like the child tax credits, the earned income tax credit, what are they gonna be the implications if you have someone going say from single to married or married to say divorced or something like that. So we've got the 1040 up top is where the filing status will be checked off, single, married filing jointly, married filing separately, often referred to as MFS, married filing or, I'm sorry, head of household, often referred to as HOH and then we've got the qualifying widow, widower, QW. Remember the strategy will be you wanna have the general rules that will be in place and the general rules will include who qualifies for what usually fairly straightforward between the different filing statuses but then there could be a gray area such as is someone married at the end of the year, is someone divorced or separated, then of course you could start the more research for those areas. Also custody issues could be issues with regards to whether someone qualifies for head of household, for example, you could start your research on those areas by going to the IRS.gov, looking at the form 1040 instructions and go from there to pick up more information. They'll refer you to other areas such as publications that could help you in some of those gray areas. You also wanna know the general idea for with regards to the hierarchy of which filing statuses would be better so that when you're talking to clients about them, you can talk intelligently about it just in general and if they're asking you a question about what if I got married or didn't get married if there's a divorce, you can give some answers to that as well. There is an impact on the standard deduction. You can kinda get an idea of the standard deductions fairly easily in your mind by just remembering the main principal number of the single or married filing separate, which is the 12,550 and then double it for married, that would give you the 25,100. The head of household will typically be in between that at the 18,800 and then you could also have differences on age based on age and based on whether they're blind which could modify those items as well. Remember that the different tax brackets will be dependent upon, this is the tables here for your progressive tax brackets so you got the single filers versus the married filers and the married separately filers and the head of households. These are probably items that you may not be given or given this detail, you're not gonna memorize these tables in your head but you can get an idea of the percentages and you can give an idea of what would be happening to these brackets as you go from say single to married for example and then when you process returns in the software you can then talk about the average tax rate and the marginal tax rate and so on. So here are the statuses, last time we took a look at the married filing separately, the singled and the married filing joint, you can kinda, I think it's easiest to visualize these in two separate buckets and then branching out into those buckets. One, either single or non-married, let's say non-married versus married. If they're not married then they usually have the option of either being single or head of household, not so much the option where they would fall into one of those categories under the bucket of non-married and it would typically be dependent upon whether they have like a qualifying dependent, usually head of household would be the better filing status if qualified for. If married then they would usually be married filing joint but they might then file married filing separately in certain conditions, they can't generally jump back to single, that's the general idea. Then there could be gray areas in terms of was someone married at the end of the year? Were they legally married? If they lived together for long, on state laws those kinda questions were they separated or divorced? According to state law custody issues with regards to a child especially oftentimes in a head of household type of situation and then you've got the qualifying widow, widow were which is somewhat self-explanatory although it's a little bit more complex when you put it into practice because that would be the year of death of someone for example a spouse would typically still be married filing joint and then you've got the question of whether they would qualify for qualifying widow, widow or whether they would go back to single being dependent in part on whether there's gonna be a dependent again. So we're looking here at the head of household, we're looking this time at the head of household. Last time we look at single married filing joint, married filing separate. So head of household, you could check the head of household box at the top of form 1040 or 1040 SR if you are unmarried and provide a home for certain other persons. You are considered unmarried for this purpose if any of the following applies. You were legally separated according to your state law under a decree of divorce or separate maintenance at the end of 2021. So usually if they were never married then it's fairly straightforward. If they were married then they were divorced. That's fairly straightforward. If they were separated and there's not like a divorce per se but like a separation of some kind then it gets gray and you gotta go into the state law and see what not if it qualifies for separation and so on and so forth. You also might wanna consider and make sure that you're in alignment with the two spouses. If one spouse for example, files married filing joint or married filing separate even and the other spouse files as single or something like that or a head of household then that could be incongruous on the tax return side. You might get a letter about that or something like that. So in any case, but if at the end of 2021 your divorce wasn't final and an interlocktery decree, you are considered married. You are married but lived apart from your spouse for the last six months of 2021 and you meet the other rules under married persons who live apart later. So then you got again that kind of gray area you're married but you're living apart. You are married to a non-resident alien at any time during the year and the election to treat the alien spouse as a resident alien is not made. Check the quote head of household and quote Fox only if you are unmarried or considered unmarried and either test one or test two applies. Head of household test number one. So remember you only need to meet one of the tests it was an either or thing. And when you're looking at the tax law or instructions you wanna keep aware of when you're looking at different tests for example, does it say or or does it say and with regards to the test this is an or test. So one of the two needs to be applying test number one you paid over half the cost of keeping up a home that was the main home for all of 2021 of your parent whom you can claim as a dependent except under multiple support agreement. And so you got this kind of exception situation which is another kind of gray area. See who qualifies as your dependent later so we can expand on that if that gray area applies your parent didn't have to live with you. So we've got this kind of dependent test if you're qualifying for head of household and remember we're in the bucket of non married at this point in time with regards to filing status question then being do I have to file single or head of household head of household will typically be beneficial. Normally you need a dependent in that case and when you're talking about a dependent that's a parent it's a little bit kind of looser in terms of the conditions including this item down here which says your parent didn't have to live with you in order to qualify. So let's take a look at it one more time. You paid over half the cost of keeping up a home that was the main home for all of 2021 of your parent whom you can claim as a dependent. So typically they're gonna claim as a dependent but this is your parent rather than say a child except under a multiple support agreement. So then you've got that exception with the multiple support agreement in that instance gray area. You can see who qualifies as your dependent and you can get into that more detail. Your parent don't have to live with you. So you don't have the added requirement which is often in the case of having them to live with you. So now we have head of household test number two. Remember that this is an or type of thing not an and type of thing. So one of the two tests would need to be met possibly to be moving up from in a non married status from single to the head of household. So test number two, you paid over half the cost of keeping up a home in which you lived and in which one of the following also lived for more than half of the year. So you've got that second component that's going into place someone else lived for more than a half of the year. If half or less see exceptions to the time lived with you later. So you're gonna say, okay, what if I had someone that lived with me less than half of the year? Is there an exception in certain instances? That's gonna be a gray area where you could then go into the more detail and see if there's gonna be an exception in those cases. So one, any person who you can claim as a dependent. So they're gonna be someone you can claim as a dependent. That's gonna be the general rule, but don't include. So these are gonna be exceptions to the rule. Again, kind of like gray areas on here. So one or a your child whom you claim as a dependent because of the rule for children of divorced or separate parents under who qualifies as your dependent. You can see more on that exception later if you qualify in that or if that's one of the exception or B, any person who is your dependent only because he or she lived with you for all of 2021 or C, any person you claim as dependent under a multiple support agreement, see who qualifies as your dependent later. So that's gonna be another kind of gray area especially when you've got these kind of support agreements. You've got two people that have the support. Typically you would think that common ruling would be like a 50-50 support test. So then you've got the question of 50-50 support. What if there's a 50-50 living type of arrangement with the two parents, for example, then who would claim them as a dependent for tax purposes? These become gray areas that you gotta dig into. And you also wanna be in alignment. You wanna get these kind of straight in like the negotiations with regards to custody agreements and divorces and so on because that'll make it easier for the taxes. And if one person, for example, or if two people claim the same dependent on the tax return, then the IRS is gonna be able to catch that automatically because they're gonna see the same social security number or it might even bounce back the second tax return that is filed. And then you go through a whole rigmarole, a whole hassle that you would like to avoid by basically getting these arrangements down as best you can upfront. So ahead of Household Test 2, your unmarried qualifying child who isn't your dependent. So if it's an unmarried qualifying child that's not your dependent, then you may still be qualifying in that case to qualify for head of Household in the event that they're not the dependent. Again, a bit more of an unusual situation. Three, your married qualifying child who isn't your dependent only because you can be claimed as a dependent on someone else's 2021 return. That's an unusual type of situation. But you have a situation in that case where you have a qualifying child, but the only reason they're not dependent is because they're not meeting this one particular test, which is your married qualifying child who isn't your dependent, but only because you can be claimed as a dependent on someone else's 2021 return. And four, your qualifying child who even though you are the custodial parent, isn't your dependent because of the rule for children who divorced or separate parents under who qualifies as your dependent. You could take a look at more detail on that later. And again, another kind of gray area. So the general rule that you wanna have in mind once again, for head of Household is you paid over half the cost of keeping up a home in which you lived and in which one of the following also lived for more than half of the year. And then you've got basically your exceptions and that would typically be a dependent that's test number two. And test number one is specific to like a parent where you have basically that different kind of living conditions. Then you've got all of the basically exceptions. Well, what if they're not a dependent, but they lived with me and so on or I can be claimed as a dependent then you get into the more detail. You can go to the form 1040 instructions to start looking into those items in more detail. If the child isn't claimed as your dependent, enter the child's name in the entry space below the filing status checkboxes. If you don't enter the name, it will take us longer to process your return. So if for example, you're filing head of Household and you fall into the situation where you could still qualify for head of Household but you have someone that's not a dependent that's gonna be a requirement to help you to qualify then it's not gonna be on the first page of the tax return where the dependent usually goes. So then you still wanna put that information in place so that they can check that box off or they can see that that qualification is met to meet for the head of Household. If you don't do that, it could cause some problems. So qualifying child to find out if someone is your qualifying child, you can see step one under who qualifies as your dependent and then we have the dependent to find out if someone is your dependent, see who qualifies as your dependent later. So clearly we've got this whole other topic in terms of well, who is a qualifying child and then who is a dependent. We'll talk about more of that in more detail later. Head of Household exception to time lived with you. So now we're looking into that exception where you're saying usually they have to basically live with you, we said for like half the year but what if they didn't? Are there any exceptions to that rule? So here we can go and dig into that. So temporary absences by you or the other persons for special circumstances such as school, vacation, business, medical care, military service or detention in juvenile facility count as time lived in the home. So these are kind of items where you can imagine well, they're not living with me here but it's not like they're living on their own and possibly like, you know, their own place or something like that. They're specifically going to school or they're having medical care or so on and so forth. Then you might still be able to qualify even though they didn't technically live in your home for that half of the year requirement. Also see kidnap child later under who qualifies as your dependent if applicable. If the person for whom you kept up a home was born or died in 2021, you still may be able to file as head of household. So what happens in the event that someone died in 2021? Well, they might not have lived with you for half the year but that's because they died in that so they were living, they could have lived with you the whole time of that year that they were there. So if the person is your qualifying child the child must have lived with you for more than half the part of the year he or she was alive. If the person is as anyone else you can see publication 501 on the IRS website you could find that. Similarly, if you adopted the person for whom you kept up a home in 2021 the person was lawfully placed with you for legal adoption by you in 2021 or the person was an eligible foster child placed with you during 2021. The person is considered to have lived with you for more than half of 2021 if your main home was the person's main home for more than half the time since he or she was adopted or placed with you in 2021. Head of household keeping up a home. So what does that mean? To find out what is included in the cost of keeping up a home you could see publication 501. So when you're saying, okay, well, what does it mean to be keeping up a home that seems kind of vague? In general, you can see, well, obviously and if it was a dependent child you would think it would be pretty straightforwardly met but you can imagine a lot of gray area there as well in that test. So you could take a look at that publication and find out on the IRS website for more information. Similarly, if you adopted the person for whom you kept up a home in 2021 the person was lawfully placed with you for legal adoption by you in 2021 or the person was an eligible foster child placed with you during 2021. The person is considered to have lived with you for more than half of 2021. If your main home was this person's main home for more than half the time since he or she was adopted or placed in custody. So now we've got head of household married persons who lived apart. Even if you weren't divorced or legally separated at the end of 2021 you are considered unmarried if all of the following apply. So now we've got the gray area of what does it mean for someone to basically be unmarried which could divorce would be a fairly straightforward condition of going back to unmarried which you would then go from married filing joint or married filing separate to the single filing or head of household. But you can imagine gray area in terms of what does separation mean which you might rely on state law to some degree to help you out with. You lived apart from your spouse for the last six months of 2021 temporary absence for special circumstances such as for business, medical care school or military service count as time lived in the home you file a separate return from your spouse you paid over half the cost of keeping your home for 2021. Head of household married persons lived apart your home was the main home of your child step child or foster child for more than half of 2021 if half or less see exception to time lived with you earlier. You can claim this child as your dependent or child or could claim the child except that the child's other parent can claim him or her under the rule for children of divorced or separated parents under who qualifies as your dependent and you can see more detail on that later.


Russians tried to surround Avdivka this time. The Russian occupiers have been trying to surround Avdivka in Donetsk Oblast since May, last deadline when they tried to do so was March the 1st. But the city is still under the control of the armed forces of Ukraine. Vitaly Barabash, head of the Avdivka Civilian Military Administration, said it. The situation regarding the threat of encirclement is not new. They have been using this tactic in Avdivka since May. There were many different dates that they set for the encirclement of Avdivka. The extreme date for encircling the city was the 1st of March. But there's a Ukrainian flag over the city till now. Now they entered the lowlands from the north. Our soldiers are located on the key heights. This is what gives the enemy such crazy losses in this direction in the north. They are less active in the south of the city. But they do not stop trying to perform a pincer movement surround. The guys are in positions holding on. Everything that occupiers have at their disposal works. Air strikes, missile strikes, multiple launch missile systems, cannon artillery, mortars, cluster munitions, magnesium incendiaries. Everything flies towards the city and positions around the city. Barabash said. Barabash stated that there was more shelling, including of the city itself. According to him, three weeks ago there were more assaults on the Bakhmut Front than in Avdivka. And now the frequencies of attacks in both areas are the same. Both in the Bakhmut Front and in the Avdivka Front, 250 to 300 shelling and 30 to 40 assault actions are recorded per day. The only difference is the number of anti-aircraft strikes. In Bakhmut, three to four strikes are observed daily. And in Avdivka, sometimes it's up to 30 per day. In addition, Barabash reported that currently approximately 1,900 people remain in Avdivka. At the beginning of the invasion, there were 26,000 inhabitants. By 2014, there were about 40,000 people living in the city.


The microphone is not on. Awesome. It is on. That's weird. Okay. I'm sure there is some, so I'll take questions on Assignment 3. No questions? Maybe I'll pull up the... What was the bug? No. What was the bug with Level 2? There was no bug. Yeah, I thought you said something else. I said it's working as intended. I made no changes. We asked, but there was no bug. Yes, exactly. We're not quite sure how we did something, and there's no way to replay it, because you have to log off to know that you made it to the next group. Right? How do you want us to handle that in the reading? Yes. Yes, that's what you did. We'll figure something out. There's a way I can set it up where you're a member of all the other groups. I'll look at it some more, but yeah, you should know how you broke something, right? I mean, you did it, so how did you do it? Well, the problem might have been related to that not getting feedback on the input necessarily, so I wasn't getting feedback on it, so when it happened, I had no idea that it happened. I had no feedback to know that it happened, I think because of the piping and stuff. Should at least have it be man-history? Should at least have it be man-history? Oh, that's true. I remember what I did. All the different steps, sure, but I had no idea which one was actually successful because I got no feedback when it happened. And so I kept going and then happened to run and score and see that I was... I bet you already broke it. Interesting.  That'll tell you. Yeah, maybe I can give you access to the levels or back levels or something at some point, so that should be fine. Cool, okay. Any other questions? GDB shows us a mutation point for everyone. GDB shows us a mutation point for level one. That's weird. Actually, you said the same thing, right? That is strange. Okay, so because you can't GDB instead to ID program, it should drop, regardless of what it is. One thing you can do, if you have access to the binary, you can copy it from there to your local home directory, so you should be able to run GDB on it then, unless there's something wrong with the server. It could be because I changed the file system so that you only have access to your programs. Actually, if I could move it, if you GDB part two, that's weird. Okay, yeah, I would say copy it, you can copy it either to your local folder, it should definitely work then, if it doesn't, then send me an email, because I don't know, I don't have any reason why it shouldn't work, but it's not like extra hard in that sense. It's not intended to be like that. Okay, so in case you didn't see it, I wrote out these are some tools you should use, if you find other tools helpful, send them to me and I will add them to this list. So basically, the main idea is you need to first do some, you need to understand how the application works. So a very highly unaffected strategy will just be throwing all the techniques we talked about at trying, but for overflows and train injections, all that stuff, because you don't know how the application actually works. So you need to understand how does this application work and then understand what could be the possible attacks to get it to do what you want to do based on the attacks that we talked about in class. So there's pretty much two ways to go about doing this. So the first way is statically looking at the binary to see what it does. So that would be using ObjectDump or using one of the other disassemblers that we talked about in class in order to look at the binary, understand from the code what is it doing. Has anybody tried that yet? How was it? Difficult? Because of the x86 code? Yeah, so it takes a little while to get kind of used to that. So that's definitely one thing to do. I think it's good just to look at it and kind of see what's going on. You can also see, usually from ObjectDump, depending on how the application is compiled, you can see what library functions it holds so that can help tell you maybe what's vulnerable. So what about, so why do you use GDB? So what's the other strategy? Why do you use GDB? Instead of just looking at the program as instructions as itself, you want to actually understand how is this program executed. So with GDB, you can debug the program and then you can set breakpoints, you can see what it's doing, you can output the value of registers, you can do all sorts of stuff. So can you just use GDB to break the program? No? Yes? Why? I think you can because you can save the values. Yes, you can arbitrate it. Once you're GDBing a program, you can arbitrate it to change the values. So let's say you change the memory that you want to do, is it going to work for this thing? That would be a huge security vulnerability if you could just debug a setUID program and then automatically get root privileges. So part of what, when you can GDB a program, maybe that's why it crashes. Yeah, I don't know. I've got to think about that. To debug a process, you're using the Ptrace interface and so the operating system, if it sees that you're trying to debug a setUID program, which in this case you are, so it's executing a few. So in that way, even if you break it, you have full control over it, but at that point it doesn't have the privileges that it normally had. So GDB is definitely important. What are some other, any other tools that we use so far? Strings? Actually that's a great tool. What do strings do? Neatly print all the strings. Yeah, so actually what it does, it's actually an incredibly simple tool. It just looks through, not even a binary, just any data or any bytes. And it looks for ASCII sequences of at least, it's configurable, but it's at least four. And it will output all of those that it finds. So if you run the strings command on a program, let's have no idea it was going to work. So I'm at level three on this thing. So if I run, well, let's say if I, what's some program, let's say Python. So if I run strings on user, then Python, it's going to output all of the ASCII characters. So you can see some of them are garbage, right, DKB, AppSign, right? This is probably just randomly some characters happen to be ASCII strings. But it does show me interesting things like all these .so, so I can see what libraries this program is using. It shows me the actual string names of some of the functions that it's using. The libc functions, memcopy, malloc, all kinds of stuff. And we can maybe even see, and then it has all of these Python symbols in there, which could be interesting. So yeah, it's usually very nice. I mean, obviously Python is a huge program, right? So, but this is nice to see. You can see what strings are in the program, right? So I know if you're interacting with it, have you seen all of the programs? Are there some error codes that you're not seeing that could be interesting? Right, so this is part of kind of doing the static analysis to see, hey, can I actually can I understand what this program is doing? So strings is incredibly useful and really simple. What else? Any other tools? Object up. Object up? Yeah. So what you may want to do, I'm going to keep using Python just so that there's no spoilers. Right? So as we saw, we can use object dump to oops, that's because I don't know. Oops. Yeah, so I can look at the code here, right? See, it doesn't have a main function. It's really interesting. I've never looked at it. Yeah, so see, even Python has a main function, right? So you can see that it's doing stuff. So yeah, we can look at actually the Python interpreters code, so that can help to understand the control flow. See what else? What are some other things? Hex dump, ooh, hex dump. What do you use hex dump for? It's just easier to look for the file in front of the strings. What do I do? We'll just go with this. So you can use hex dump and this will output the actual ASCII, like the hex of the file in ASCII which could be useful. ASCII will output on the right the strings in there so you can see where exactly those strings are so you can kind of look through it. Python is a bit... strings is actually a little bit better for this. Yeah, you can see all the things in here. Anything else? S-trace. S-trace, so what's S-trace? This is the... I guess it's kind of big picture of library calls and stuff. Almost, almost. So it's not... It is library calls in the sense that it's the system calls so the S-trace stands for system so this will trace all of the... all of the system calls that this program is making to the kernel so it essentially puts some hooks in there and shows you exactly what it's doing and this can be incredibly useful to understand what the programs are doing. So for instance, if I wanted to say what is Python actually doing and there'll be a lot of output so... Okay, cool. Do you want to set a reset to an enter to if your terminal ever gets messed up? It's a good handy trick. Okay, so... I think I can do... So I'm going to give it a file or I'm going to give it just a lot so it'll pull the mess up. So you can see through here, these are all remember the system calls at the kernel level so these are all the calls into the kernel that this code is making and so... let's... actually you can see really interesting thing it must output it to... okay, yes but it outputs it to standard error so piping it to a mess doesn't really help I guess I could have done it to Python but... So we're saying that Bash actually has an exec Python and if we look at the exec ve function we see that it passes the list of arguments and then the environment so we see that it's actually calling it invoking it with user bin Python and then the parameter lop and so this shows us actually all the system calls is making and so to do this we can actually see that the OS is even it's loading all this stuff it's actually reading in the Python file like this l file so this is kind of normal stuff that should be happening and then and it's reading some files so we can see that it's trying to... yeah, so it's reading all these things in it's registering a bunch of signals so we can see that these are the signals of the Python program I'm just going to kind of go through this if I look for the lop so this could be a lot of information and not all of it's actually important but it's kind of useful to go through because I can see that it's calling read link on the lop right, the lop is the parameter that I typed into the program it's getting the current working directory it's trying to lstat the lop and it's trying to open the lop and we can see that the result from the program from Python is that there's no such file directory and then it's writing out to the console so what does this tell me about the program what is it doing with my input the first argument yeah, not even a binary it's just trying to open this file that I gave on the parameter so now I know that this program is going to open whatever parameter I pass in so I can see here that the case that I tried is a file that doesn't exist so what case should I try next a file that doesn't exist exactly, yeah, that's what I was trying to do to try to see more behavior of this program cool so strace is very awesome strace s for system calls what's the other tracing program ltrace so what does the ltrace do so ltrace is library calls so ltrace will trace all the libc calls that your program makes so these aren't the calls that go into the kernel necessarily these are at a higher level so we can see, run it with ltrace to see what happens see sometimes they can be more or less or alright, cool okay, that was fun right, so as we'll see every library call that it's making is being logged I guess I can just kill it and see so we see that it's actually an environment variable so it's actually kind of cool we can already see that we can maybe alter the behavior of this program by changing these environment variables which is something we couldn't see from strace but we can see it here in ltrace because getenv is a libc call and we can see that in malloc stuff it uses semaphores it's calculating string lengths and it's copying strings around and we can see it's copying a lot of strings around I think that's mostly what it's doing I guess you can use ltrace to filter out certain things about what it's going to trace or not trace wow, this is like a lot of it's trying to parse the file it's trying to run it at the same time but I gave it a file that doesn't exist so this is I don't even know what it's doing it must be creating some yeah, something or maybe it's reading something or something anybody do research on the python interpreter? not yet cool, interesting oh it is, I was reading all the library files like all of the python library files interesting alright, so with these tools you can get very far because these let you see what the program is doing right, and so from there that can help you try to understand what's going on but using these you should also try to understand and know what you're what you're doing so keep track of the things that you're trying to read okay so we saw how we saw how the stack works and we saw how the stack changes when we make function calls and so stack overflows can occur when we're copying data when data is copied without checking the boundaries of that data because the programmer has to specify exactly how big chunks of memory are, arrays are so when we declare an array in C you have to specify exactly how many bytes or the size of that array and when we malloc data we also have to specify exactly the size and so the attacker can overflow what we're copying from or controls the length or size of what we're copying then they can force more data into, they can force larger data into a buffer that's a smaller size so normally so has anybody ever gotten a stack fault because they did something like this and they had a small buffer nobody can actually raise their hand okay cool so normally this causes a stack fault so kind of as a security person a stack fault should very highly focus your attention because usually depending on how the segmentation call is happening you can actually turn it into something, an attack or it's usually indication of vulnerability that you can use to exploit the program so if you usually if you carefully craft the buffer that you're overflowing it can as we'll see in this example you can try to overwrite that return value on the stack to save VIP so that way instead of that program going to where it was originally going to go to the function that called it it's actually going to go to somewhere you control where the control flow of the application goes you can make it execute your own code and so that's really this is more exploitation you can put this code that you're going to execute can be either part of the thing that you're overflowing or not it can be somewhere else as long as you can get the control to that program and this is why this is so important is this control now you're inside this process you are executing your code of your choosing in this process and so that code has the same privileges of that process so it's a setUID program you're going to have the privileges of that setUID so let's look at an example so because of the Cdeco calling convention the save base pointer and the save VIP are both stored on the stack so before we call the function we save the VIP with the call instruction and then the first thing that function does is save the base pointer and then set up a new base pointer so those are both on the stack so there's nothing in a program or a function so VIP and the VIP are saved on the stack so can the program read and write to the stack this is where it puts in its local variables it has to read and write to the stack if it didn't read and write to the stack then you could never use it so there's nothing that prevents a program from changing those values so we'll see what happens if those values are changed so let's look at an example so we have our C program we have a function called myCopy that takes in a character pointer this function has a buffer foo and we do a string copy from string to foo so what's this today it takes on a string copy to stir into the first argument we mean all the bytes from stir stir is a character pointer it actually goes character by character until it encounters the delimited character which is large 0 so it takes the first character that string points to right copy that byte copy that byte to the first byte of foo and then increment both by 1 and then keep doing that until foo points to an old byte so do we tell a string copy the size of the buffer foo no so if the attacker controls string controls the size of string can they make it this copy to be more than 4 bytes yeah right they can make it be however large they actually want to be and this is actually a key problem so string copy is inherently dangerous because we don't tell it the size of foo inside string copy because in C strings or buffers are just pointers to chunks of memory that have no length associated with them so string copy has absolutely no way to tell what the size of this character pointer that gets passed in is so it just stupidly copies from the source to the destination now the other important thing about string copy is it puts an old byte at the end may or may not be interesting so then we look at a main function that calls this so we're going to copy so you can see I used this for my class last year note to self never put in hard coded class information into strings in case you want to use this for other classes and then we're going to print something else and we're going to return 0 so pretty simple right let's see what happens when this program executes and how the stack looks based on this so when we do object down we can see the code of this application the x86 instructions and main in its apple prolog is going to first push evp then move the stack pointer to the base pointer so it's going to save the caller's base pointer it's going to create its own base pointer it's going to subtract ESP minus 10 or minus 16 then it's going to move this 8048504 onto ESP so where ESP currently is and it's going to call my copy so what do we know about this 8048504 what is this so is that that's not the string it's uh are these ascii values 04 is an ascii value 048504 08 the address exactly yes this is the address of the constant bytes string ASU space right so the compiler when it sees this constant string it creates an elf section for the I think it actually uses read-only memory for these constant strings so it creates a read-only memory segment and then it says in the elf header we looked at hey this constant string is at this specific address so I know in the code I can reference this address with this hard coded memory address and it knows because it created the elf file like this that it can use that exact memory location and the string will always be loaded there by the operating system cool then it's going to call my copy then it's going to move 8048517 to EAX it's going to move EAX into the stack pointer and it's going to call printf so what's the second address put the after yes the string after or the address of the string after and then we're going to move 0 into EAX call leave and then call return so what's this 0 into EAX doing the return value at setting the return value of main alright so then let's look at my copy so my copy what's the first thing the program has to do as to save the base pointer it's going to move the stack pointer to the base pointer it's going to subtract x28 from the stack pointer it's then going to move evp plus 8 into EAX then move EAX onto the stack plus 4 and then it's going to take evp minus c move that into EAX move EAX onto the stack so what's the stack layout going to look like this is what you should be thinking about is when we call a string copy what's the stack going to look like from these instructions so what's the thing that's currently on the stack at the stack pointer EAX and then what was in EAX going to trace it back so EAX is moving on the stack pointer then what's from EAX so remember the important thing about load effective address is even though as the parentheses there's no dereference here so it takes the value of evp it subtracts hex c from it so evp minus c then moves that into EAX so from evp what do we know about this thing that is currently on the stack before we call a string copy it's what it's it's the address of it's the address of it's the address of what my copy the address of my copy is going to be actually here where these bytes are stored right the call is actually going to be the one that pushes an obstruction pointer what was that what was that what was that right but we got just a second so there's a thing about it like this so the app ESP is here it's going to be plus four exactly so remember the calling convention says when we want to call something we push from right to left so the topmost thing on the stack is going to be the rightmost so we're going to push first the rightmost thing which is string and then we're going to push foo and then call and so for reading from the bottom up we go left to right so we know that foo right the address of foo and so what is foo where is foo located on the stack minus right to me the x28 bytes below the stack pointer that will be the that will be where that will be where the address of foo is but where is foo on the stack where is that value 0.2 0.2 0.2 minus 4 minus 12 minus 12 yeah so EVP minus 4 so this also helps this check so at EVP so we go down from EVP what are those variables those are parameters so let's think about before a function call in general from the CDEPL calling convention so we push arguments push push push then we call which pushes the instruction pointer and then the first thing we do is save the base pointer and then why do we do that subtraction we're making space for what for the local variables local variables so EVP is here I see so below EVP is what local variables so local variables exactly every time we see EVP minus something we know that that's a local variable and so when we see EVP plus something what's that? a parameter exactly and that's how you can read this so you can know so there's two tips that tell you that this is foo that foo is located at EVP minus C the first one is that it's being used here as the first parameter to string copy so you can trace it back and say okay this must be foo because it's the first parameter to string copy the other way is to say I know this is EVP minus something and there's only one local variable in the function my copy so this must be foo and then by the similar reason what's EVP plus 8 string str and then we leave and return after we call string copy it should be easy so you actually already got where everything is without even drawing the diagrams and stepping through it one by one to see how everything goes cool but let's do it so we can see how it goes okay so we have the only we have a bunch of registers right so the only registers used here are EAS stack pointer, base pointer, and instruction point we have all of our code here so the program is going to compile this and then we have our stack and so let's say our stack we start at FD2D4 and so that's what's in the stack pointer and the base pointer somewhere above that at FD2E0 and instruction pointer is currently at 804 4840E which is the start of the main function that's my clicker let's set through this right so let's say we're going to simulate the execution here and we're going to save the caller of main's base pointer so we're going to push EDP onto the stack and move the stack down so we have the save base pointer what's above that same base pointer? the parameter is past the main there will be the parameter past the main it's going to be above it what's directly above this EID or this starting this base pointer a number of arguments higher what was it? other programs other programs yes the return to save EIP the return address into the program that's called main so that's main is not any different just like every other program so there's the main we know that when we get called the thing on the stack right at that moment so right at that memory address I can't read it out FD24 what's at that location and that box that I didn't specify is the address of the next instruction that we need to return to from whoever called main so at the end of this main function when we call return that's where we're going to jump to and that's where execution is going to go to and then so we know so that's the save EIP from the last function our job is to save the base pointer the last function which we do then we set up our new base pointer for our frame so we say the current stack pointer is now the base pointer is currently our stack pointer where we are now that sets up the base pointer and then we make room for our local variable so we're going to move the stack pointer down and from this way from the base pointer which points here that's how we can get to argc and all the argv by going up so those will be evp plus at least 8 because we need 4 up there so the evp is here so 4 above that will get us to the save instruction pointer and 4 above that will get us to the first parameter which will be argc in main and then 4 above that is going to be argv so we subtracted we moved down the stack pointer is going down here at fb2 c0 now we're going to set up the stack for the function call to mycopy so we're going to move that hex 804 8504 into the stack pointer and then we're going to call mycopy so what does the call mycopy exactly like I'm going to do put this return address the address of the next line into the base pointer the base pointer is pointed up at the top stack pointer yes so it's going to push 80423 that's the next instruction we want to execute onto the stack and then what's going to happen this call instruction so it's going to save the evp and then it's going to change the evp to mycopy and actually I actually cheated a little bit here when you look at the assembly it's not going to say mycopy it doesn't have any labels it's actually going to say call 804 83 f4 so it's going to call that and so we'll have pushed 804 8423 so this is the address of the instruction directly after the call so remember maybe let's say right so these are the breadcrumbs so this breadcrumb here says okay when you're done executing go back to this address and start executing there so this is how the program can go make function calls and then you can come back picking up that bread to get to the correct functions cool now we need to do our so now mycopy is being called so it needs to save the base pointer because the current base pointer points up here to main's base pointer so we're going to save main's base pointer right now we're going to set up our own base pointer to set the new base pointer into right here of our frame and now I have to make more room so everything changes so now we're going to subtract 28 hex 28 from the stack pointer which I'm going to put it all the way down there and I also have a diagram here for the base pointer because it's currently at v8 so now we're going to move evp plus 8 into eax so what's evp plus 8 str right the parameter to mycopy and we know that A because it's offsetting a positive offset from evp and we know it's the first parameter because we know that 4 bytes above evp is the saved instruction pointer and 4 bytes above that is the first parameter to mycopy so we're going to move that into eax so that's going to move 804 80 8048504 hey that's not like 4 okay so then we're going to move that value onto esp plus 4 so that's going to be the current stack pointer plus 4 so that's going to be up here and then we're going to do this load effective address so we're going to calculate remember load effective address does not dereference anything where this dereference evp plus 8 well that's memory location fd2c0 we didn't move fd2c0 into eax we dereference that and we got whatever was at that value at that memory location which was 8048504 now we're going to calculate take the address whatever is in base pointer it doesn't matter that it's an address addresses are just values take fd2 wait sorry fd2b8 subtract c from it subtract 12 and move that into eax so now eax has the value fd2ac which is there so at runtime this address is going to change different runs of this program depending on the environment structure that can change the address of that constant string 8048504 is never going to change it's hard to put it into the program the stack can change this is why it's essentially calculating the address of foo at runtime so that buffer foo is located here and it's only 4 bytes the way I draw it it's just these 4 here so now we're going to move that value onto the stack pointer right to where the stack pointer currently is and now we've set up our function frame so that we can call string happy so then what is string happy going to do we take the return address put it in the stack pointer and then call the location where strs is located yes okay so actually because of dynamic loading it gets a little more complicated it has to look up and see do I have a string copy function have I loaded it yet if not able to dynamically load it and then put it in an address in the correct place so we won't go into that at all but if we just treat the function string copy as a black box what's it essentially going to do what was that right copy the byte at 804.8504 copy that byte to fd2ac and then increment both by one and so copy the byte at 804.8505 copy that to fd2ad d right copy those bytes into there and so then so we know that at 804.8504 are the continuous bytes exactly at this memory address is the byte A which is actually as the A which is what 61 65 okay 41 takes 41 no 41 is capital X oh yeah capital X doesn't matter but the point is that is what's actually that byte that is there is that represent that integer which when we interpret it as a character we interpret it as the character A and then one byte above that at 05 is going to be S and then one byte above that is going to be U and one byte above that is going to be space all the way to the end we'll get to the exclamation point and then a zero null light and so when we do this copy right this is exactly what's going to happen it's going to say take that A copy it as at fd2ac fd2ad take the U copy it all the way up so what's actually going to happen is ASU is going to be copied here into foo ASU space and so this is where we get into endian weirdness so you see we copy 61 73 75 20 but when we interpret fd2ac as an integer right so we copied it this way but when we interpret it as an integer we interpret it the most of the bytes as the highest one right exactly so when we interpret this as a number it's going to be hex 20 75 73 61 so definitely have to keep that in mind we're going to do a buffer overflow and then we're going to copy CSE space which is going to be the same thing 63 73 65 20 and then we're going to copy 340 space which is 33 34 30 20 just keep doing this there's nothing to stop the program from doing this because string copy doesn't know the length of foo it has absolutely no idea that it's copying over what was originally allocated to foo because it's just a pointer to some chunk of memory and we can increment pointers to get to the next element of that array so what's going to happen next without this piece without this piece without no space so it's going to be these ones and then it's going to overwrite this right space 201 and then it's going to write 5 space RO and then CKS and then what then the null byte right so does everything just crash and then this happens and then we get immediately a site fault after it copies this no why not because it doesn't know what was the return address it's just a set of data on the stack right remember we called it when our stack was located here right we called string copy here so string copy made its own stack space where it does all its own stuff and once it returns it's going to put the stack back here but we didn't mess with anything on here right we messed with essentially names saved things so string copy just returns and then now we get into we could do anything else right we still have our base pointer points to where it should be we still have our stack pointer points to where it should be right but now we have the leave instruction so what does the leave instruction do yeah so move ebp into the stack pointer and then pop ebp so it does the opposite of these two instructions so it's going to move the stack pointer the stack pointer to the base pointer so the base pointer is at b8 so it's going to change the stack to be at b8 and it's going to then so the base pointer we can see is the stack pointer is up there yeah bc oh oh oh because then we pop so it moves it here so what was here at fall the return value the base pointer the same base pointer this is this base pointer our base pointer currently points to the same base pointer at b8 so it moves the stack pointer to the base pointer which is at b8 and it pops that value it needs to pop that into ebp to restore the base pointer of main so it so now the base pointer is c6 c6 c6 c6 c6 1 6 6 so this is crash not yet right we're just copying one value from memory to a register right nothing back there now we return so what's going to happen what does return do now the previous value over the it's going to yeah so right here at the stack pointer right it's going to say return means essentially pop into eip so take the value that's currently at the stack pointer move that into the instruction pointer and start executing from there it's going to set the instruction pointer to be 31 30 32 20 and then the program is going to go fetch and start executing from 31 30 32 20 and that's where we get a segmentation fault and everything finally crashes because there is no memory mapped at 32 30 32 20 what if there was memory mapped there just just interpret fetch execute right just executing memory so we can actually if we compile this we can run it and we'll see that it outputs a segmentation fault now you will need more flies if you want to try this on a newer gcc this is on an older gcc so this doesn't have any of the stackenaries or any of the other detection things but you could do this and it works and this is a really key thing if you're trying to do these exploitations to verify that you've done it so getting a segment fault is one thing but you want to know why did it segment fault got you to control PIP got you to control something else it was another point of dereference so what you really want to do is load the program in gdb run the program and see where it crashes and why it crashes so it's going to tell you to start the program and then this is the key it says segmentation fault 31 30 32 20 where do these bytes come from well they're in the program that would be us so that means we can control the instruction pointer 100% so we can force this program to go wherever we want to go and execute whatever we want to execute and so if we look at the registers we can actually see that they're exactly what we calculated by hand running through it so we can see that the base pointer was 60 60 60 166 as we saw so we were completely controlling the base pointer and we're completely controlling the instruction pointer you'll have to disable the stackard and address randomization for this tool stackard you can still do this randomization doesn't matter we can do any hard coding anything we're still causing it to crash okay so these are the vulnerable functions that you should look at these are the functions that by themselves are inherently vulnerable because there's no way for the programmer to specify only copy this many bytes they're judged entirely on the size of the input so if the attacker can control the size of input they can always make it larger even the so on that previous example foo was only 4 bytes large but even if foo was 1000 bytes large or 10,000 bytes large if we control what's being copied there we can always make it bigger because at 10,000 is constant it doesn't depend on our input and string copy has no way of knowing that it should only fill 10,000 bytes in there so gets is one of the functions if you see this function you should immediately be thinking buffer and workflow but you've got to think how can I control the input to this but it has a caveat always look at the documentation for these functions so you know exactly the semantics for instance, forget you can't have any new lines or end of files so that's actually really important when you're trying to create an exploit to know what characters can I use and what characters can't I use as we saw string copy the same with string cap concatenate strings together sprintf so printf into a string and there's no way to specify the exact size there same with vsprintf scanf, sscanf and fscanf if you use the %s these are also wonderful and any custom input routines as well so you can have a program that calls getCar to get a character if it keeps doing that and puts it into a buffer with no bounds checking then you can control that so as long as you can control the input to these functions 9 times out of 10 can cause some kind of overflow that was awesome, cool so we'll stop here and we're going to get into on Monday how to actually exploit a stack overflow vulnerability