and good morning everyone from Amsterdam oh good news the vlog the vlog uploaded last night it uploaded no issues as I was resting I slept so well this is good news ah just you know not having to worry at all about that getting it up for you and okay just making my bed here and yes the more global running uniting in Amsterdam today you better believe it but real quick just want to give you a quick update on the weather some people are asking about that what's going to be happening here on Sunday so we just pull up the app let's see so Friday showers and wind that's today when you're watching this Saturday showers light rain early then remaining cloudy with showers in the afternoon high of 58 degrees Fahrenheit and then let me just make sure here Sunday it's lucky it says chance of afternoon showers highs in the upper 50s and lows in the upper 40s perfect so it looks like Sunday there might be rain in the evening but the race will be over by then so actually everyone I'll just pull it out here yes we're gonna we're gonna start honing in on the shoes today but you know my thesis on the four percent and the next percent and whether to wear which which one to wear given the weather so anyway okay let me just get this and then we're gonna start rolling here I always do I always destroy my bed when I'm sleeping in it just totally annihilated the comforter I don't know about you but I always sleep better if I make my bed life it's all made I always sleep better it's just I don't know it's always been that way let's go ladies and ladies and gentlemen let's go meet everyone did I already say this in the room I can't remember my legs are starting to feel real good I woke up this morning and they just feel great so they're starting to come around really react to that taper okay we're almost there I see him I see him this is amazing oh my goodness look at you guys how you doing good to see everyone Paul Paul good to meet you this is awesome thanks for coming how's it going Camille good to meet you Zotan good where are you both from oh that side is amazing pretty cool just to get something special I love it this is great okay oh my goodness so you are you are you're fit you're in shape good yeah it's a rarely am I am I not on time right usually it publishes on time almost done thank goodness absolutely brilliant everyone just brilliant thank you shout out to everyone who came out for another demore global running run in Amsterdam today oh my goodness so first of all Paul coming through with some ribbon for my bottles appreciate that that's gonna help and then yes you better believe where this is gonna hang up once I get back home in the studio so cool so amazing I think we're starting a little bit of a new tradition here and I'm gonna have to start thinking about maybe a group run in Argentina for the world mountain running championships in November whatever I don't know let's do it like whatever city I'm able to travel to for these races let's keep meeting up like we did one last week in Vienna thanks for taking the time out of your day to come say hello get four easy miles in it was perfect through Vondelpark just cruising along and now I am I'm on a mission for lunch and then I have a little more thinking to do for the bottles so I'll keep you posted on what my plan is for that because it's Friday now I know you're watching this on Saturday but I need to deliver these bottles to the to the tent the place where I pick up my bib numbers by no later than 3 p.m. on Saturday and then what happens is they have the bottles overnight and then they take the bottles and distribute them's whatever their system is they distribute them around the course to all the tables along the way so my task today because I don't want to have to think about this tomorrow my task is to get all of these ready for the distribution on Saturday all right everyone ah so cool true love true love is gonna love this by the way ah nailed it just nailed it all right maybe I should hang it on the wall while we're here in the hotel hey all right I'm off to the grocery store a little known fact I don't know if I've ever shared this before but I actually really love and it connects to seeking beauty sorry if it's a little windy is that I really love classical art and just like looking at beautiful pieces of artwork and so it pains me that in that museum right down there the ricks I'm not saying it right but the ricks museum houses quite a few pieces of Rembrandt's art so I'm not I'm resisting going into the museum I should not be walking around for hours looking at artwork so guess what that means I'm just gonna have to come back to look at Rembrandt right down there it's gonna be epic someday but not on this trip I just gotta rest and go get food right now at a grocery store and this is gonna be the food that I'm gonna eat on the morning of the race which is tomorrow when you're watching this so I don't want to have to think about it on Saturday a real supermarket it's huge I've been looking for a big supermarket this entire trip like a big one this is awesome we don't have mist in the United States that is cool there's a lot going on in this store and I can't read the labels but we're making do we're making do feel good about that shopping situation oh man what a great grocery store all right on to the expo we're gonna run for it USA there we go thank you oh okay yeah yeah yeah yeah filming perfect four one gonna be good thank you putting putting you to work awesome looks good look okay where do I pick that up down there okay perfect yes I know looks good I'm a Rembrandt fan yeah yeah well uh he was he was excited for me that is awesome that's what I'm talking about thank you for volunteering shout out to all the volunteers fun just met Chico exactly where are you where are you from from Brazil from Brazil yeah he watches the vlog in Brazil and you just just landed yeah he was unable to come to the morning run uh in Bondo Park this morning but which I regretted so much but we meet here exactly amazing it's a great coincidence buying some clothes right and you're uh you're racing yeah yeah okay looking to to maybe cross the finish line in 255 wow yeah so break the break this re-hour mark good for you good for you well shout out to Chico thanks for watching the vlog appreciate it yeah yeah this is actually really smart I would not have thought of this you can check your bib so that it uh is so that the number you're assigned is connected to the correct uh your name so here we go let's scan it here okay there it is perfect that's good good good good by the way I just talked to the people at the information desk I can drop off the bottles tomorrow it's uh I thought it was 10 but it's eight bottles so it's which is it's fine so it's 5k 10k 15 20 25 30 all the way up to 40k and I drop them off tomorrow it was easy they were very helpful there at the front at the information desk so that is good news we will I will bring them back uh tomorrow on Saturday so all right let's keep rolling it's uh tempting to pull out the debit card and just start buying everything but I'm gonna resist I'm gonna resist all right I need to head back to the hotel I could stay in that expo all day and uh good to meet you Adrian right there at the end as well so that was fun I was actually my first uh big major marathon expo uh that I've ever been to so oh man it's like Disneyland in there but we will see you back at the hotel oh yeah there we go back at the hotel we are loaded up now loading up this mini fridge all right right Dio right Dio time for some afternoon tea don't mind if I do and yes it is time for the all important gear check you better believe it it's time to make sure everything made it over on the airplane I've already seen it here and there but I just now that I have the the bib number no messing around so there is that let me just pull out the singlet here the headband the shorts the socks and uh I'll double check the weather but again as I said this morning the weather is looking up for Sunday morning okay there it is and I know a lot of people want to buy this singlet not quite ready yet but uh yes we will be placing the seek beauty work card and love each other on a singlet uh what do you what do you say maybe by Christmas so it could be a little Christmas uh Christmas gift and then yes of course my racing sunglasses the Smith sunglasses that I love they made it over as well we'll put those there and that there and then oh my goodness oh my goodness so the rain appears not to be in the forecast but I'm still not counting out the next percent we shall see so here are the four percent right there I'm going to set that down there and then grab the socks over here uh-huh the racing socks right there and bada bing a bada boom now this is the fair weather kit okay genre shorts spelled j a n j i my Solomon socks Nike vapor fly four percent flyknits my rabbit singlet my halo headband uh I sweat and so I do not like sweat running into my eyes and therefore that is why I wear this and then my Smith sunglasses I already mentioned and of course I will be pinning my bid number on after I fill it out so I'm going to put my name date of birth on my emergency contact hopefully we don't need that and then I already double checked that this is going to work for the this is how you will track me through the app is by using that and let's just make sure I forgot to double check but sure enough they are on top of it four pins just like that so and with that okay got the four percent's on just feeling them out a little bit and it's getting very real here there it is there's the bib uh basically oh yeah and I'm going to start working on the bottles right now but uh because I got the bottles got the tape got the ribbon got the blue marker for marking 5k 10k 15k etc but I'm going to call it there uh no question of the day uh okay quick quick uh note tomorrow's vlog is actually going to publish early because I'm going to talk about my race day strategy for the Amsterdam marathon but I wanted to publish before the marathon actually happened so it's going to publish um let's say like I'm going to leave for the starting line a little before 8 a.m so it'll publish between like 6 30 a.m and 8 a.m local time here in and uh Amsterdam uh so that'll be for tomorrow's vlog and I'm going to talk about the strategy uh so anyway take note of that and then what else was I going to say um I think that's it okay question of the day no question of the day rather a thank you to all of you for coming on this journey really since the beginning of 2019 when I had this dream I've actually had this dream for a long time but to try and qualify for the Olympic trials and was cut cut short in the Cleveland marathon training block because of that uh stress reaction in my left foot so I was unable to race Cleveland was kind of dancing around trying to figure out okay what will be my next chance to race a marathon sure enough ended up in Amsterdam and uh we made it we made it together thanks for holding me accountable to the training thanks for inspiring me to train hard during these last really these last two months especially uh since pikes peak and uh so just want to say thank you onward and upward it's inspiring to continue to read your comments and to meet many of you here at meetups around the world and uh demore global running is going strong so I love you thank you and um yeah you'll see tomorrow's vlog publish early with a race day strategy and then once the race is over of course I will update you you're you're frankly going to know before I even know what my time is that's just how modern uh modern racing works at this point in the game all right tossing it back to a couple Amsterdam actually you know what we'll toss it back to an old Cleveland marathon vlog on the right uh training for the Cleveland marathon just to show you how long we've been on this journey and then on the left talking about Amsterdam training there on the left all right I love you guys see beauty work hard and love each other see you tomorrow


Genotype networks are sets of genotypes connected by small mutational changes that share the same phenotype. These networks enable evolutionary innovation by allowing the exploration of different neighborhoods in genotype space. Empirical confirmation has been found for proteins and RNA, as well as comparative studies for gene regulatory networks. Three interconnected genotype networks were constructed from synthetic gene regulatory networks which produced three distinct phenotypes in E. coli. The networks contained over 20 different synthetic GINs, providing robustness in the face of mutations while enabling transitions to innovative phenotypes. Mathematical modeling was used to quantify robustness and evolvability for the complete genotype phenotype map, linking these features mechanistically to GIN motifs. This study demonstrates how GIN evolution along genotype networks may drive evolutionary innovation. This article was authored by Javier Santos-Marino, Yves Tassoudi, Hadi Astri, Kasuma Hordani, and others.


Bailey and her desperate need for a liver transplant I expressed the hope that someone listening might know of a possible donor Who could assure a 11-month-old Ashley of a chance to live? I listed several others who like Ashley are waiting for transplants if donors can only be found I Gave a phone number where possible donors could respond. Well, God bless you all the response was overwhelming Over 5,000 calls were received from people in 47 states Many callers asked for donor cards so they could help others even after they're gone Six liver transplants have already taken place six children including candy Thomas one of the little girls I mentioned last week have been given a new lease on life and Two people have received cornea transplants. They were given the gift of sight by one of our neighbors who heard about a chance to help I'm sorry to say Ashley's situation remains the same. None of the available livers was suitable She still needs a transplant soon in order to live time is short, but your response has been so generous I have to believe there will be a donor found. I'm going to keep on praying one thing I know we live in a country where people truly care for one another Today, I'd like to take you behind the headlines and talk about an issue that affects every US taxpayer Efficient management of the federal government Government has grown like a patchwork quilt whenever a new need was identified a new program was patched on regardless of what it cost The door was wide open for fraud waste and abuse Is it any wonder that we hear so many infuriating stories about government throwing money away? about food stamp rings that illegally obtain aid meant for the poor and needy or about Illegal aliens receiving government loans Already we've cut the volume of new federal regulations by one quarter reducing paperwork on the American people by 300 million hours a year We've reduced the rapid rate of growth in government spending and the inspector general program has helped save or put to better use Over 22 billion dollars that was being improperly spent in the Defense Department alone Our efforts have saved or put to better use 16.1 billion dollars and the department's 18,000 auditors and investigators have my full backing in their continuing fight Against the fraud and waste typified by the recent $916 plastic cap purchase Would you pay that much for a plastic cap? Well the government shouldn't either and secretary Weinberger is cracking down Seeing to it that negligent employees will be fired and irresponsible government contractors take it to court Those horror stories you've been seeing and hearing about scandalous Prices that we're paying for spare parts are the result of our own investigations and Represent the findings of more than a score of Defense Department inspector generals We've saved 50 million dollars in government-wide travel costs by using airline discount fares We've also discontinued one out of every five government publications eliminating 73 million copies of such vital reports as a moment in the life of a lizard and growing ornamental bamboo and we're ahead of schedule in our efforts to reduce federal civilian employment by the equivalent of 75,000 full-time workers This coming week, I'll bring my senior appointees together at the White House to continue an ambitious program to upgrade management of the federal government Our long-range goal is to overhaul the entire administrative system.  Our government has over 2.8 million civilian and 2 million active military personnel in over 22,000 buildings using 19,000 computers 330 differing financial systems and 200 payroll systems and there's never been an effective effort to manage this growing administrative monster Each year we've fallen behind the private sector in management techniques. Well, we're bringing this to an end now Reform 88 is geared to get results over a six-year period It'll save the taxpayers or result in the better use of tens of billions of dollars that could mean as much as the equivalent of Nearly $2,000 for the average American family and these savings won't be obtained by cutting help to the deserving But by eliminating waste and inefficiency for example in debt collection where the government is owed over $280 billion will be using modern methods to ensure that federal loans are paid back You may have heard about the individual who obtained 10 housing and urban development loans and defaulted on all 10 Well in the future Dead beats like that will be headed off at the pass We'll do it by using credit bureaus and pre-screening to determine the credit worthiness of applicants for loans and grants and to help Reduce the $40 billion in delinquent debt. We'll be automating our collection techniques just like private industry It's about time the notion that government is the servant not the master came back into fashion one of our highest priorities is to restore to the American people a Government well managed and responsive to your needs and respectful of your tax dollars The greatest nation in the world deserves the best government and with your support We'll have it until next week. Thanks for listening and God bless you


What's up everyone? It's your girl Kenzie here from Layton Sports Cards, and I'm ripping a personal here for Isaac K We've got a 2022 tops chrome formula one racing hobby. All right best of luck Isaac. Let's see. We getcha See, let's see Uh, who was the one-on-one again? It was an F1 racer It starts with like a T I think Blake's gonna look Who was it was F1 he pulled a yuki auto and the one-on-one printing plate auto out of the same box Who's bearer was backwards the names of turn it around? Logan Sargent Logan Sargent, that's right. That's the one-on-one printing plate She's good drew. Thank you for asking Yeah, she's awesome Ferrari refractor Um, I think that was the last box Pep of absolute baseball. That's the only box I saw in the back when I went to get it. So I don't think we have anymore Uh, we've got Ricardo uh refractor from the planer Yeah, Kyle What team is he gonna be on next year? We've got checkered flag alexander obon and speed demon george russell Yeah, professor. We just saw that Blake is a patch fan And so he wasn't too happy to turn the game on and saw they already scored in the first minute Sergio Perez refractor Williams racing So he has a chance, you know, at least he's not going to like red bull or Mercedes that have like star racers You know really already louis hamilton refractor. You might have a chance Got refractor alfattari Kind of crazy the first play that the bills have since Yeah, that injury is a touchdown. That's crazy Uh, golden purple yuki sonota a nice one there for alfattari a gold yellow Or gold purple for gold yellow schumacher and magnificent Got hots refractor I would absolutely love to watch that man play football I I love watching him play I haven't won a fancy team every year just because I love watching him play Mini diamond sebastian vettel aston martin that is four out of two ninety nine Oh, awesome speed demon refractor of trawler's leclerc We've got future stars liam lawson for carlin and we've got a gold checkered flag of lance straw Aston martin five out of fifty Nice hit there for you isik On the gold checkered flag Yeah, that's right. Kyle. Yeah the first american in f1 I think lane was calling me that It's hamilton refractor uh mercedes Wow, that's so cool. I actually had no idea that he was american Thank you for that Kyle. We're stopping in perez. Yeah for sure. I had no idea We've got refractor mercedes latifi and albon refractor alpine refractor Is it alpine or alpine? You know, um, I was told alpine and what I've watched from breaks. It was alpine people were saying alpine Because I I thought it was alpine too, but I I don't know. I'm curious Oh, uh rookie refractor of joe guanyu Nice one there and purple checkered flag rookie joe guanyu There you go. Nice pack there For some joe 65 of 199 Alpine That's what I thought Last pack here for you isik very nice box overall And refractor speed demons of yuki sonoda All right, that'll do it for your box isik. Thanks as always for hopping in we'll get these right out to you


Welcome to George H. Smith's Excursions into Libertarian Thought, a production of Libertarianism.org and the Cato Institute, narrated by Daniel Highland. Self-interest and social order in classical liberalism. Thomas Hobbes. In the first part of this series, I wrote the following about Shaftesbury. He was especially critical of a doctrine known as psychological egoism, which insisted that all human actions are necessarily self-interested. In one respect, Shaftesbury did not object to this primitive hedonistic analysis, since all human action is motivated by the desire to attain happiness, or satisfaction of the self, in some sense. Nevertheless, it is a serious error to suppose that all human actions are motivated by self-interest, as that term is commonly understood. Psychological egoism is a modern label. During the 18th century, the same idea was frequently called, by David Hume and others, the selfish system. This is the doctrine that all human actions, however other regarding or disinterested they may seem, are in fact motivated by considerations of self-interest. There is also a theory known as psychological hedonism, according to which all actions are motivated by the desire for pleasure or personal satisfaction. But I shall ignore that approach for now.  Hobbes, according to his liberal critics, had parlayed psychological egoism into a defense of absolute sovereignty, along with the corollary doctrine that individuals must surrender their rights and obey an absolute government unconditionally in order to maintain social order. Thus, by attacking psychological egoism, Hobbes' critics hoped to undermine his defense of absolutism at its root. So what is the relationship between psychological egoism and political absolutism? I shall consider this issue presently, but first I should call attention to a possible glitch. According to some modern Hobbesian scholars, Hobbes was not a psychological egoist at all. Contrary to the many critics who linked him to the selfish system, Hobbes did not in fact believe that every motive can ultimately be reduced to self-interest. An able defender of this interpretation was the moral philosopher Bernard Gert. In his introduction to man and citizen, translations of two early works by Hobbes, De Hominé and De Sive, published in 1972 by Anchor Books, Gert argued that the Hobbesian approach is not psychological egoism. Rather, Hobbes merely argued that other regarding motives, such as benevolence, play a minor role in human affairs. Their influence is limited and cannot be used as a foundation upon which to build a state. This is not the place for me to debate this issue, even if I were inclined to do so. Except to note that many passages by Hobbes definitely point in the direction of psychological egoism, whereas others seem to support Gert's interpretation. Suffice it to say that Hobbes, who was a bear for consistency in psychological reasoning, did not always practice what he preached. In the final analysis it doesn't matter much if Hobbes was a strict psychological egoist, for the essential points made by his liberal critics would still apply either way. His psychological theories were quite crude in any case, even by 17th century standards, and they sometimes give the appearance of having been concocted ad hoc as a rationale for vesting absolute power in a state. Now, let's take a look at some of the ideas defended by Hobbes that so alarmed his liberal critics and caused them to criticize psychological egoism, sometimes in considerable detail. In De Sive, The Citizen, Hobbes denied the common maxim that man is naturally a social animal. Man does not desire social interaction for its own sake, i.e., because such interaction is inherently desirable or pleasurable, but because of the personal advantages he hopes to acquire. These gains are both material and psychological. In addition to the desire to profit from commerce and the like, which is motivated largely by our jealousy toward those who possess more than we do, social interaction also caters to our vanity, as we revel in the attention, praise and esteem we receive from others. Hobbes' cynical view of human nature is painfully evident throughout his writings, and to reinforce and illustrate this cynicism, Hobbes sometimes invited readers to imagine themselves in certain situations. Suppose you are at a social gathering. Your primary reason for participating in a conversation will be to get something from others or to puff yourself up. You will hope to receive some honor or profit from it. You may, for example, attempt to stand out by telling a funny story, often at the expense of someone else. Friends who are not present may have their whole life sayings and actions examined, judged, condemned. Even participants who leave the gathering early may be the butt of sarcasm and ridicule, and all this for no reason other than to amuse their supposed friends. And these are, indeed, the true delights of society, according to Hobbes. Hobbes was a witty fellow. But however humorous these and similar observations may be, it would be a mistake to dismiss them as mere witticisms. When Hobbes talked about the vanity inherent in human nature, he was making a serious point with serious implications. As he put it, all society, i.e. all social interaction, therefore is either for gain or for glory. That is not so much for love of our fellows as for the love of ourselves. But no society can subsist if these selfish motives are permitted to operate unchecked. In a state of nature, a society without government, people would exploit others mercilessly, even to the point of murdering innocent people for their property. And the only remedy for this war of all against all is fear. People will naturally pursue any goals that they regard as conducive to their own good. However much their selfish actions may harm others, only fear, a counteracting self-interested motive, can persuade people to change the direction of their normal self-interested actions. Only the self-interested incentive of fear, especially the fear of death, can overpower our desire to exploit others by violent means, since we value our own lives more than we value the goodies that violence may yield. This is the basic rationale for a government with absolute power. Only such a government can instill the continuous fear, including the fear of death, necessary to maintain social order. There are no other sentiments or dispositions, such as benevolence, sympathy, or a regard for justice, that can possibly override our selfish proclivities and sustain a voluntary social order. Thus an absolute government, one that enforces unwavering obedience by instilling perpetual fear among its citizens, is a necessary precondition of social order and internal peace. Hobbes expanded on this theme in Leviathan. The following passage from chapter 13 is typical. After asserting that men are roughly equal in their physical and mental abilities, such that a single person, no matter how strong or smart, always has something to fear from others. Hobbes continued, From this equality of ability arises equality of hope in the attaining of our ends, and therefore if any two men desire the same thing, which nevertheless they cannot both enjoy, they become enemies. And in the way to their end, which is principally their own conservation, and sometimes their delectation only, endeavor to destroy or subdue one another. And from hence it comes to pass that we're an invader hath no more to fear than an other man's single power. If one plant, so, build or possess a convenient seat, others may probably be expected to come prepared with forces united to dispossess and deprive him, not only of the fruit of his labor, but also of his life or liberty. And the invader, again, is in the like danger of another. A little later in the same chapter, Hobbes identified a psychological factor that supposedly will cause conflict with our fellows unless we are all rendered afraid by a supervening power. We want others to value us as much as we value ourselves, and when they don't, we get offended and angry, emotions that will lead to violent conflict and even to murder. This argument, though full of obvious holes, was presented by Hobbes with his typical self-assurance as if he were making a profound and airtight point. If, contrary to many modern philosophers, I appear to have a low opinion of Hobbes's philosophical arguments and his supposed rigor, rest assured that I do. Again, men have no pleasure, but on the contrary, a great deal of grief in keeping company where there is no power able to overhaul them all. For every man looketh that his companion should value him at the same rate he sets upon himself. And upon all signs of contempt or undervaluing, naturally endeavors as far as he dares, which amongst them that have no common power to keep them quiet, is far enough to make them destroy each other, to extort a greater value from his contaminers by damage, i.e. injury, and from others by the example. Given the innate dispositions of human nature that will supposedly generate a perpetual war of every man against every man in a state of nature, we might wonder if Hobbes was aware of how rational human beings can resolve their conflicts and agree to cooperate for the benefit of everyone concerned. Well, Hobbes was well aware of this possibility, and he discussed the fundamental principles of social order in chapters 14 and 15 of Leviathan, his second fundamental law of nature, by laws of nature, Hobbes meant normative principles that will further peace and social order, reads as follows. From this first fundamental law of nature, by which man are commanded to endeavor peace, is derived this second law, that a man be willing, when others are so too, as far forth as for peace and defense of himself he shall think it necessary to lay down the right to all things in a state of nature and be contented with so much liberty against other men as he would allow other men against himself. If other men will not lay down their right as well as he, then there is no reason for anyone to divest himself of his, for that would be to expose himself to prey. This brings us to the Hobbesian version of the social contract. I cannot adequately cover this complicated notion here, but I will mention a few points that relate to Hobbes' defense of absolutism. The first point may seem to split hairs, but it is important to an understanding of Hobbes' theory. To refer to a social contract may be a bit misleading when speaking of Hobbes. More precise is the term social covenant. A covenant, for Hobbes, is a type of contract, one that involves future performance. A contract is the mutual transferring of right. For example, if I sell you my car for $5,000, I agree to transfer the legal right or title to my car in exchange for the legal right to your money. This exchange of rights is the essence of contract. But there are different kinds of contract. Suppose I deliver my car with the understanding you will pay $5,000 after three months. Here, I execute my part of the bargain immediately, while trusting you to fulfill your part of the bargain in the future. Hobbes called this kind of contract, a contract that involves a future performance by at least one of the parties, a covenant or pact. According to Hobbes, the reciprocal agreements by citizens to deal with one another by peaceful means is a social covenant. It is a covenant wherein citizens rely on the future performance of other citizens. Such covenants involve serious and ultimately fatal problems if made in a state of nature. Since motivated by self-interest, the person who has not yet fulfilled his side of the agreement will almost always renege on his promise. Hobbes seemed blissfully unaware of the power of unwritten customs and social sanctions that do not involve a government. Without a government to compel the future performance of other parties, it would be irrational for a person to enter into covenants at all because his trust in the other party is bound to prove unwarranted. Indeed, according to Hobbes, covenants made in a state of nature are not even morally binding. Only the fear of governmental punishment for violating a covenant can make covenants rational and therefore morally binding. This is the basic reasoning behind the Hobbesian defense of absolute government. Unless self-interested individuals fear being punished for their violations of agreements, such agreements will be impossible and there will exist no foundation for social order. No allowance is made by Hobbes for the possibility that contracting parties will fulfill their agreements as a matter of honor or from a sense of justice. Indeed, these options would not even be rational in a state of nature because the naive party would leave himself open to being exploited by others and this would not be in his self-interest. The reciprocal agreement in the Hobbesian social covenant consists of everyone, except the sovereign, renouncing their right to pursue self-interested actions as they deem fit. But there is no contract or agreement of any kind between the sovereign and the citizens in this tortuous hypothetical scheme. Citizens do not transfer or delegate any rights to the sovereign. Rather, they agree to renounce their rights, provided others agree, and this social covenant is then enforced by the sovereign who retains the same fundamental right to do whatever he likes in effect that he possessed in the state of nature. In other words, after the social covenant occurs, the sovereign is left with complete discretion in deciding what to do with the citizens. The citizens, in contrast, having renounced all their rights, with the sole exception of the right of self-preservation which is inalienable, even for Hobbes, have no right to disobey or even to question the sovereign, who remains in a state of nature vis-a-vis the citizens. And those virtually rightless beings certainly don't possess the rights of resistance and revolution, regardless of how unjust or tyrannical the sovereign may be. On the contrary, justice itself has no meaning apart from the will of the sovereign. Whatever the sovereign decrees is just, by definition. We can now understand why Hobbes painted a terrifying picture of a society without government. If people are to submit unconditionally to an absolute ruler, their only alternative, a state of nature, must be sufficiently horrible to justify this drastic measure. Hobbes admitted that men will agree with a social covenant from fear alone, specifically the fear of death in a war of all against all. But covenants motivated by fear, he insisted, are still binding. I have presented this summary so that readers unfamiliar with Hobbes will appreciate why so many liberal philosophers targeted him for attack. Although Hobbes did not spawn many disciples, per se, parts of his analysis found their way into the writings of their important philosophers, as we see in Samuel Pufendorf's writings on international law. We even find some aspects of the Hobbesian approach to self-interest in the libertarian classic Cato's Letters by Trencher and Gordon. Some key Hobbesian ideas influenced later sociological thinking, as we see in the work of Ferdinand Tonnes. And Hobbesian elements are evident in some modern economic theories. Many economists who invoke Hobbes frequently show little understanding of his ideas. As I noted at the beginning of this essay, liberal philosophers thought it necessary to attack not only Hobbes's political conclusions, but also the premises on which he built those conclusions. Chief among those premises was the Hobbesian notion of self-interest, and how that supposedly ubiquitous motive renders social order impossible, unless it is severely restrained by the fear of an absolute government. I shall discuss some of those criticisms, especially as they pertain to psychological egoism, in my next essay.


So, our next speaker is going to be talking about modern Windows user space exploitation. He is a security researcher at MSRC Israel. Please give a big round of applause to Sa'aul Amal. Okay. Hi. So, first of all, thanks a lot for all of you to come up here. I know that there is a great competition, so I really, really appreciate it. So my name is Sa'aul Amal. I am at the MSRC, like, based in Israel. And so, actually, I'm here to talk with you today, like, about how we can execute arbitrary code on the latest Windows system.  My whole point in life is about reversing and exploiting vulnerabilities. I'm also highly addicted to CTFs. I'm in the CTF team, which I hope that you, like, probably heard of us by now. And I actually want to, like, kick off the talk with a very important, like, question. So, like, what do you think the point in life is? So, of course, the point in life is to execute arbitrary code, yeah? And there is actually a very simple and trivial process for that, right? I mean, all you need to do is to find some really awesome KCAS zero-day vulnerability, and you will have something in the middle and then profit. And back then, about 200 years ago, it was really, really easy. I do hope that you all do recall the times that the stack in the heap were executable, and everything is fixed, and you have no SLR whatsoever, and you can corrupt function pointers and jump to them, and basically nothing stops you. Well, those times were fun, easy, but also really, really dangerous. Well, we don't have that anymore, right? Since we have mitigations. We have mitigations everywhere.  And the thing that I really want to do today is to talk about the internals of the mitigations, understand them. And most importantly, see all of the primitives that you need to gain in order to bypass them, since it's really known a trivial process. And I feel, personally, that the best way in order to achieve that is to find one single vulnerability and to exploit it on many different operating systems with increasing and increasing amounts of different mitigations. So that's exactly what we are going to do right now. So actually, my intentions were to take a real Windows vulnerability and to exploit it, because it's fun. But sadly, I saw that if I would, the talk will probably last three hours, and we don't have time because there is a great, like, a CTF that is going right now, and I have to go. But instead, we will take a really, really awesome Windows CTF challenge from the Insomniac CTF teaser from 2017. And on the way, we will send the message that I personally really want to see more Windows CTF challenges, since it's awesome, so please do that. And we are going to achieve code execution on many different operating systems and take together the journey to bypass many, many mitigations. Okay, so what we are dealing here with, the Windworld challenge. It was a great challenge based on the Westworld PV series. Sadly, I didn't watch it, since I was extremely busy in the last two years just, like, reversing Hyper-V. But the challenge is really cool. It basically tried to implement some kind of neurato, which basically, like, lets you create both robots and humans, and you can move them, like, on some map, and you can make them talk to each other and interact to each other and fight and do, like, awesome stuff. And the important note here is that both robots and humans have, like, a best-class shared, which is person. And the interface simply, like, lets you do those actions, those operations on any person's instance. Each time that I will state person's instance, I mean, of course, like, robots are human. They are simply inheritance from person. Now, this is not how to find vulnerabilities talk. This is an exploitation talk, so let's cut to the chase and dump all of the vulnerabilities. So vulnerability number one. We have an uninitialized attribute in the person instance. Each person has, like, a member of his conscience that tells you if the person is conscious or it isn't. So the person constructor keeps in mind to initialize that value to false, but the person copy constructor forgets it. So if you can trigger the person copy constructor, and of course you can, you have an uninitialized value which takes whatever was on the heap before, which is cool, and we have also a use-after-free bug. In the challenge, we need to share pointers to person instance and between many, many different objects and components, but it's kind of like a problem since you have to know when you can free the chunk. So the challenge is to use shared pointers, which is kind of some wrapper for pointer which has the ref count, which simply counts the amount of objects that took a reference to you. So each time some other object took a reference to you, it incremented the pointer by one. Each time it leave you, it's like that pointer by one. And when the ref count reaches zero, the object can be freed. The problem is that there is some flow in the challenge that you can take a robot and to transform it to a human. And now, this is really cool, but the problem is that the code that does that use std move which actually duplicates the object and those duplicate the shared pointer. Now, this is really, really wrong because this actually break the whole point of shared pointers. The right thing to do here is to increment the ref count and that's it. And instead, you duplicate the shared pointer and you have two different shared pointers which points to the same chunk in memory. And of course, this is really, really wrong since when one of those shared pointers will reach zero, the person chunk in memory will be freed and you have a dangling pointer from the other shared pointer to a freed chunk. And then the fun begins. So cool, awesome. So yeah, the problem is that you can say that you have a vulnerability if you don't have a flow, right? You have to trigger the flow. So we actually can do it by taking a robot and to transform it to a human just like I told you. And this happens when you have both robots and human in the center of the maze, okay? And you have those preconditions to be met. And you see that one of the preconditions is that the person's conscience will be set, meaning not false. And we can do that by the first vulnerability of the initialized value. So combine those two vulnerabilities together. We can make the flow of transform a robot to human and we have dangling pointer from the other shared pointer to a freed chunk in memory. Okay, and now after that we armed with use after free vulnerability, let the actual fun begin. Okay, so let's start to work. We start with execute code on Windows 7. The first thing that we need to do is to understand the allocator, right? Because we have like use after free bug and like trivially the thing that we need to do first is to trigger some allocation, some other object allocation to fall in the exact same spot on the heap that the last person chunk got freed, okay? This is usually how we exploit use after free bugs. And the problem is that we have many, many different allocators and each allocator has its own logic and the way tracks free chunks and you have to understand the allocator that you are dealing with if you want to exploit the vulnerability. So of course we are in Windows, so we work with the LFH, the low fragmentation heap. This is the font and allocator in like use of space since Windows Vista. Now, I don't want to talk about LFH internals since highly documented all, like basically all over the internet. I will simply say that it's really like JMLock if you are familiar. And you have this track which called user blocks which is a pool of same sized chunks in the heap and every time you do a malock, you get a chunk from there and like every time you free, the chunk like goes back and you have no coalescing, no consolidate, no fragmentation like whatsoever. Cool, the problem is that in back then, in Windows 7, we have like a metadata which called free entry offset which sets in the first two bytes inside the free chunk after the header which means that it has no encoding and no soar and no protection whatsoever. And this metadata indicates to the allocator which chunk needs to be returned to the user in the next allocation and simply like corrupting this field is like give you extremely strong primitive. The second problem is that the LFH in Windows 7, it allocates chunks continuously in memory. So shipping LFH in like Windows 7 is basically not really a problem.  So you can see on the left side that I simply spray some size on the heap and on the right side, you can see that all of the chunks, all of the allocations for one after the other very, very nicely, everything is like predictable. And the most fun point here is that thanks to the free entry offset, the LFH keeps free chunk in last in first out fashion. So this tab, like malloc, free malloc, will actually for sure return the same chunk so we can exploit the use after free bug here very, very easily. Okay, now that we can allocate some other objects on the same freed person address in memory, we can start like any primitives because if we want, and of course you want because it's the goal in life to get arbitrary execution, we need to gain probably like relative or arbitrary read-write. So each person has a name, a SDD string name, and the interface simply like let you dump the name. It's printed over the socket with the info command, but the name is like simply SDD string. It's a pointer in the person instance, but I can allocate whatever I want there, like string event, which I basically can control every single byte there. So I can fake the name pointer and set it to fixed address in memory, arbitrary address for my choice, and then I can dump it. The great thing here is that the length of the name is also a field in the SDD string, which sits in the person instance. So we basically have arbitrary read with arbitrary length and it's cool. In the very same way and in the very same fashion, we have arbitrary write with arbitrary relent, right? Because the interface basically let you to update the name as well. So yeah, it's cool. And now that's not enough because we want to execute code. So we can corrupt some pointers, but it's actually way, way easier. We have a function, a virtual function in the class. It's not even in the VTable, you don't need to deal with double the references. It's function pointer inside the class called on and counter, which gets triggered each time two different persons meet on the map. So by basically spray string set in the relevant offset, fixed address, and then move two different persons to the same spot, we have the ability to jump to arbitrary address and execute code. Okay, cool. But I know that I will probably need to read more than one address, right? You will probably need to read more than once. So we can make a really, really elegant trick. I really like this stuff in exploits. It's like really, really cool. You can corrupt the on and counter function to points to actually get S and then move persons on the map and each time they meet, the getS function will be triggered as the on and counter function. But it's really cool since the getS gets the first argument that on and counter would get which is a person address in memory. So I can send data over the socket which will write all the fields, all the attributes of the person instance. And I do that without trigger any other vulnerability whatsoever, okay? I simply trigger the vulnerability once and then I can write on all of the fields of the structure over the socket, which is really cool. Tricks like that is the exact stuff that make exploits reliable. And it's really, really important to make sure that we trigger the vulnerability as few times as possible. Okay, fantastic. Let's keep going. So we have arbitrary read, write, jump primitives. It's cool, yeah. Basically, life is easy. But we have SLR. Everything is under SLR. The DLLs, the main binary, the heap, the stack. We don't know where everything is. So we need to start like licking pointers. The problem is that I don't have the primitive to read something relative to me. I read absolute addresses and I don't know which address to put there. So I really need to trigger some allocation of some other object, which is the same offset as the SD name in the person class. It has some other pointer to heap, to stack, to library, to function pointer, whatever you want. Well, SDVector actually meets those demands. So by basically trigger SDVector, we can do this trick. And now apparently, person in reality have friends, okay? And like person in the challenge also have friends. And each person has a vector of all of its friends. So by simply taking single person and like add seven different friends to it, the SDVector containing all of its friends will be the exact same size as the person instance. And it's really, really important because we are in the LFH and the chunks are like organized together when they are in the same size. So we can trigger the location of some SDVector, dump the name of the person and we get the Vtable of the SDVector which is in the R data section of the main binary. Well, that's easy but the problem is that from obvious reasons I can control on the fields, on the attributes of the SDVector. So the length, the fake length of the name will be huge number and I don't have any control over that. So I do leak the pointer, but the process dies during the copy. Now, this is fine because we are in a CTF and the process basically relaunches and takes to the fact that in like user space all of the DLLs and all of the binaries get randomized in boot that's correct but they still where they are in virtual memory for the entire system lifetime. So the process dies, it relaunched and every pointer that you leak stay where it was except of course for the stack and the heap that gets like randomized in the process creation. But all of the DLLs in the main binary will stay where they were. Okay, now we need to choose the course to execute our real code, right? Well, we can call out function pointers, Vtables, we can call the stack into Rope, we can basically even load some DLL, some unsigned DLL with our code and it will be executed. We can to allocate a read write execute chunk, we can do basically whatever we want and nothing stops us. So let's do the Rope, okay? Let's create some chunk, read and execute, write shell code and jump to it and now it's time for demo. I do hope that on stage the demo behave just like they did downstairs. If not, I will publish all of the code and you can execute it at home, please do so. So let's go to the Windows 7 exploit. I have the IP right here, somewhere. Okay, awesome and let's launch the VM. Since we are in a CTF, I simply decided that the arbitrary code that we will execute will be to read the flag and the flag is iLavida since we all Lavida and let's execute the challenge just to make sure. What's happened? Okay, yeah, 84. Let's hope that again the physics on stage is just like downstairs. So we leak the address of the main binary, we leak the address of the user database since I have some people there, kernel 32, the heap, the stack and if we do Rope, we have the flag. Okay, so the first demo works, thank you. Awesome, yeah, the process of course, it's like a CTF, it's cool and we go to the journey to the next operating system. Windows 10, pressure one. So we take the very simple C that we executed just now and if you try to execute it, trust me, it will fail and it will fail since the shape fails and the shape fails since we have a lot of change, a massive change like between the allocator, the LFH between Windows 7 and in Windows 8. And seriously, like a lot of really cool and awesome engineers, like they invested like a lot of time in that and the LFH looks extremely different. First of all, we don't have this free entry offset field which is really, really good. Instead, we have a bitmap which simply indicates or we chunk in the user blocks if it's allocated or if it's freed. And moreover, all of the allocations are randomized. The order of the allocations cannot be predicted so easily as it was before and if you take the very same tester that you had in Windows 7 and execute it on like Windows 10, pressure one or eight, yeah, it's like basically the same, you can see on the right side that all of the addresses are in complete chaos. You can't know what comes after what and the state is really not predictable as it was before. Now, since we don't have the free entry offset field, the start like malloc free malloc won't return the same chunk, right? Because the allocation are randomized. So it's not that trivial anymore to call malloc and to get the last free chunk. Actually, with extremely high probability, you won't get this chunk, okay? Cool. Now, I want to bypass it, right? Because we agree together that the point in life is to execute arbitrary code. So we need to bypass the mitigation. Like otherwise, we don't have a reason to live. So in order to bypass the mitigation, we have to understand the implementation and to see where the random comes from. Okay, so it's really, really interesting and from now on, we have the beat map which indicates for each chunk if it's freed or if it's allocated. So the allocator choose a random position on the beat map, it scans from there in a linear fashion until it sees beats that indicates free chunk. It simply flips the beats and returns this chunk to the user and there you go. And of course, since the position in the beat map is random, the allocation order will be random. But the question remains how the random position is chosen. So we have like any symbol in NTDLL which called RTLP low-frag heap random data which is a fixed address of 100 hex values which are random, truly random. Seriously, guys, this is not the issue here, okay? All those values are simply created from kreibgen32 random in kreib32.dll. And that's fine, they are cryptographic random. And each time we hold a pointer to this random data array and every time you do a maloc, I take the current random value from the array and this random value is used as the index for scan in the beat map. So of course, you can see from here that the allocation like order will be random. Let's see this happens. So, sorry.  Now let's call maloc, okay? So we choose some random position in the beat map and we start to scan from there. Now we happen to choose zero which indicates free chunk. We simply flip the beat and return the chunk to the user. Now we call another maloc and we take another random value. This random value, like it happens to be allocated chunk right there. So we start to scan from there in a linear fashion until we see free chunk and there we flip the beat and return the chunk to the user. Now of course, there is a serious, very serious issue here because all of the random values are in static array which size of 100 hex. So what's happen if we try to allocate more than like 100 hex allocations which basically happen really, really fast. Like even if you don't do it, your process will probably does allocations all the time. So the pointer will wrap around the array but the values were random before but they stay intact and they're the exact same values. So if you try to execute this POC which like simply does allocation, free the chunk and then for FF times do like alloc free, alloc free, alloc free and do the allocation again. The second allocation after the loop will use the exact same random value from the array in the beat map and does for sure by definition it will return to you the exact same chunk that got like returned in the first allocation. The whole point of the loop is just to increment the pointer on the random data array and to make it overlap. That's it. And this is really, really deterministic, okay? This kind of like my passes is like really, really cool. It's extremely like makes me happy to see tricks like that. And of course, that's exactly solve my problem since I can execute this POC and see that it works perfectly with probability one. We get the same chunk. Okay, awesome. So we solve the shape issue and now we can continue with exploit because this is the point of the talk, right? So yeah, now we need to like execute code. So I probably want to call to some function which will make me the address of the stack since it is easy to leak all of the DLLs and the main binary just like I did, but in the heap of course it's again, it's pretty easy to leak. The stack is like a little more complicated in this challenge. So let's call to RTLP get stack limits in like any DLL, it should leak me the stack. Crash in 29. And in 29 is the fast fail feature. We have it since Windows 8 and basically if your process does that, it means, hey dude, I detected some really inappropriate behavior or something really, really bad happened. I don't know like what to do, game over, I'm out, bye. And yeah, if your process does that, something bad happened, okay? And okay, let's go simple bits up in the stack and see like where it comes from and it comes from guard check, I call FPTR. And it's kind of interesting since the first argument to this function was the address that I tried to jump to. You see that is actual byte code in NTDLL. So we have save G which is control flow guard. The job of save G is to basically make sure that every indirect branch is okay in the sense that every time that you try to jump or call to some address, two function pointer, again indirect branch, call rdx, call rbx, symbols in your binary, you have a white list of function that the address that you try to jump to has to be in this white list. If it doesn't, abort. And this is exactly what happened here. There are many known like bypasses and rocker runs for it. Joe Bialik gave a great and awesome talk about it in the last offensive con, about CFG, CFI internals, issues, we have there how to fix them. If you are into it, please check it out. It's really, really awesome talk. Okay, but again, the point in life, execute arbitrary code and like all of this stuff, we need to bypass CFG. And it's not that bad because CFG does make the life way, way harder because we don't have any pivots, right? I can't jump to the middle of function because for sure it's not in the white list. I can't jump to RTL restore context and all of the functions that give me controlling of the RSP or that leak it to me and all of the problematic functions are like forbidden now. Okay, but we don't have yet something that checks the integrity of the return addresses on the stack. So if we leak the stack and use the arbitrary write primitive that we have already and write Rop, it's fine because we don't have yet something that validate the integrity of the return addresses. Okay, so let's do it. Again, it's really, really important to see a demo. I had some random going on with like threshold one VM here. Something happened there. I hope that on stage it will be fine. If not, again, the code will be published. You can execute it at home and see that it is cool. So let's go to threshold one. Again, we are in like a CTF. So we should have a flag and of course, post 10, because post 10. Yeah, I love IDA, blah, blah, blah. Okay, so we do have a flag. Let's try to execute the POC. This is the right IP, yeah? And again, let's hope that everything will be fine. Okay, so we leak the address of the main binary and we leak the address of the UCRT, NDDL, Rop, oh man, okay. Interesting, yeah. Sometimes the VM does some problems, let's try it again. Yeah, okay. Yeah, the VM does like some problems. Okay, sorry about you can execute it at home and check it out there. Let's see if now it will work. Yeah, code has run down. So this is why we have vulnerabilities, right? Again, the leaks work fine. We have the flag. Honestly, I think that I'm about to have heart attacks of sorry for that, but it works eventually. So cool, okay. Fantastic, I love IDA so much and Hyper-V is the best thing ever, is a great flag indeed. Okay, so let's keep going. Windows 10, Redstone 5, the last test, kind of. If we try again to execute this POC on Redstone 5, you see that it will fail, it will fail deterministically. And this is because the shape fails again. We fixed the issue in the random, in the LFH, it's got service of course, because it is a very serious issue. And since build 16.179, we don't have this issue anymore and the random got fixed. If you want to check it out, all of the internal spin different stuff you can see in this tweet link. I like what about it, you have everything there. Please check it out. But again, we need to bypass the random. Now, please keep in mind that the demand that I have here is not really to... It's not to restrict, right? I don't have to take two different chunks and they need to be continuously one after the other. All I need is to spray some allocations and I just want one of them to fall in the person-free chunk, that's it. So even if you have random, I can try to spray and see if it will succeed, right? Now, of course that one allocation won't do it. Then, 10 allocations probably not. A million allocations will definitely work. So the question is where is the threshold? And for that, I simply wrote some tests there, okay? Those are the numbers of the allocations that I had to spray in order to catch the last free chunk. And you see that the numbers aren't so bad, right? Okay, so let's simply try. Sorry for that. Let's try to spray not FF double than that. Works great. I really like the times when theory and practice meet and it's basically work with... Multiply the account of the spray in the code and like that's it. So the shape works. And now we try to execute arbitrary code just like we did before and everything should be fine. Well, not. We have in 29 again and we crash and, like we said, because we have ACG, which stands for arbitrary code guard. This mitigation does exactly what its name suggests, okay? It's basically forbids you to execute arbitrary code by like introduces two new restrictions. The first is, sorry, the first one is that you can't allocate and you can M up plus X pages at all. It will simply fail. VirtualAlockEX will fail if you try to give it the flag of page execute. This is exactly what would happen if you try to like execute this. This is like POC, okay? I don't have time for that, but I will publish it. The second restriction is that you can edit the permissions of existing code. So those new restrictions combined, you can't execute arbitrary code unless you bypass the mitigations. And now there were some like knowing cool bypasses for that in other versions. They of course got service and fixed, but keep in mind that again, there is nothing that makes share the integrity of the return addresses on the stack. So Rope on the stack works 2000 years ago. It works today and it's still cool. Now, it's not really a problem, right? Because I can call load library EX and try to load some unsigned DLL. So I have CIG, which is code integrity guard, which basically forbids you to load unsigned DLL, okay? We make sure that the digital signature is fine, and if not, abort. So load unsigned DLL wants to do the trick. Now, I really wanted to talk about Edge since Edge is a really, really cool use case for that. Edge has CIG, ACG, CFG, and many, many XYGs in it, many, many guards, but I don't have the time. Great shout out for Patrick from Google Project Zero. He found many bypasses, really, really cool. And he like wrote a really cool PDF about it. And please check it out. I don't have time for that. It will be here. I published the slides and all of the links so you can see it at home. Alex and Esco, my best buddy, found a really cool core bypass for ACG, not just for Edge. Okay? He found a really cool bypass for ACG inside the operating system. And he had a great talk about it. Every talk of Alex is awesome. So check it out. Alex, I love you. And now we have to go back to the point in life, up with record and stuff. So let's bypass ACG and CIG. So just to make sure that we can do something, let's do rope on the stack, but I don't want to do a very long rope chain because it's hard to maintain and offset change and it's cool like in CTF when you have a very short rope chain, but in real world scenario, probably you want to do some complex stuff and try to implement a long logic in rope. It's not like... It's not like pretty fun. It's very dirty work. We do it in iOS Explorer all the time, but if I can avoid it, I want. So let's try to call create process, shell execute EX system or something like that just to make sure that we still can control what's going on here. So we have the Redstone 5VM. Let's kick it off and go to Redstone 5. And let's try to call system. I have the IPM? Yeah, something. Okay. And we have the exploit for system. Again, I will publish the POC. You can actually see that the POC is really, really, really elegant and you can see that the rope... Sorry for that. The rope is simply called system. Okay, system with the command type flag. Okay? So let's do it. This is the VM. Yeah, of course, we don't have memory. Cool. Good point. Are we ready? Sorry for the delay. Come on, come on. It was faster before. Yeah. Okay. So, yeah, so the flag right now will be AAA. Okay, because we don't have time for that. Fantastic type flag. Okay. I'm sure that you will see the AAA like once it leaked. We have the challenge and we try the POC out. Yeah, the IP is 93, not 83. Okay. Let's hope again that the physics is like still fine. The base of the main binary, the base of the UCRT command. Fantastic. And I also need NTDLL. And now before we execute the ROP, please just let me execute WendyBug and to like attach the process, because I have a feeling that we will need it. And let's breakpoint on system. Okay? We have a breakpoint on system. I'm so sorry for the team. It's like inside the VM called ROP. And we have a hit on system. And of course, I do expect that the first argument will be type flag. Now, if we do go, we need to see the flag, right? Access violation and the process dies. And we are inside system.  Okay. Yeah. Yeah. So what's the heck is going on here? So of course, we have another mitigation. If the slide will work, yeah, it works. Fantastic. Yeah. Child process restriction. This exact behavior that I expect to see, because you really don't be allowed to call system in like many processes. You don't have a very good reason to do it. I mean, I have because I exploit vulnerabilities, but you at home don't really want that Alsace will be able to call system. It is really non-point in order to do that. So child process restriction is really, really cool mitigation because it's very, very simple. It's one bit in the process that forbids the process to create children as sub-processes. That's it. It's really, really cool because it kills a lot of different exploits and make, of course, the life way, way, way difficult.  So let's make sure that we still have the AAA we do, and we have an exploit that leaked the flag. Ah, sorry. Thank you. Now you should see it. Okay, awesome. Yeah, the laptop doesn't respond. Sorry. Is everything fine? Okay. So we have the VM and we have the exploit. Now, you kind of already know how I like about to leak the flag, right? We saw all of the mitigations. We see how much harder it gets, but I always get to the same technique, right? Do rope on the stack. So instead of the very simple rope that I just showed you, it's very, very short. It's very elegant. Like, one of the shortest rope I ever did, just called system. Instead of that, I have a different rope. Again, the main looks the same. Just leak the, like, address and, like, the rope. But the rope now do open, read, put S, flash all in order to leak the flag. So the rope is, like, way, way longer and still it's fine because it's a CTF in real world. This kind of, like, approach to implement everything like in rope works, but it's really, really kind of last resort, right? I really want to do more, like, elegant stuff. Okay. Again, physics on stage, like a lot of random, should be fine. And let's leak the address of the main binary. Done. UCRT base. Command. Stastic. NTDLL. Rope. A.A.A. Thank you. Thank you so much. Again, everything will be published. It's a CTF challenge, but of course the point is to learn how to do it and to do it, like, in a good way. So this is for the demo. Okay. So what's going on right now before we go back to the CTF? There is much more than I could have told you in this 45, 60-minute talk. I really wanted to talk about Edge and about, like, a lot of stuff, but I didn't have the time. You can always, like, DM me on Twitter, come and talk to me, come to Tel Aviv, we have great food, and we can talk. Yeah, we have containers and, like, sandboxing. We are actually, like, working right now on some really serious, like, improvements for CFG. It should be awesome. We will keep you posted. I kept telling you that, yet, we have nothing that checks the integrity of the return addresses on the stack. Yet. We tried RFG, which is return flow guard. Just like wrap in Linux, okay? But we had to pull it off, actually, since we had a very reliable built-in rest condition in that feature. It was really, really reliable to exploit it, basically, trivial. Joe Bialik gave a great talk about it with the POC, with the example, internal details. Again, check his talk. It's really awesome. So we are, like, waiting for sets by Intel. Basically, RFG did a very, very simple trick. It implemented Shadow Stack, which is a separate stack for only the return addresses in software. And then, when you do rats in your code, you will compare the return address for the main stack, and the return address saved on the Shadow Stack. So we don't know where the Shadow Stack is, and if the, like others, are different, abort. Again, we had some trivial rest condition there, so we pulled it off, but set by Intel is a Shadow Stack in the processor, in the processor itself. So it should, like, mitigate ropes, like, all together. Actually, I really, really like Kernel and, like, below kernels and, like, hypervisors, and we have awesome stuff going in Ring Zero. We actually introduced LFH in, like, kernel space, which is a life changer for kernel corruptions, really, seriously. A life changer, since the LFH is way more secure than the way the, like, Windows pools worked before. We have VBS and VSM, which is crazy. We actually have SMAP only for plus-up dispatch flows, because it's kind of, like, limited, like, right now, it is a start, and it works great. There is great documentation about it all over the place, all over the Internet. Check it out. But more importantly is that we want your help. So I don't know. I just love to wake up in the morning and talk to awesome people about awesome stuff that I reverse. So if you find some cool bypass, talk to us. It's, like, really cool. You can always DM me and Twitter, mail, come to me right now. I really, really, like, open to stuff, and I, like, love to talk to, like, cool people about, like, cool exploits. So do that. There is something else that we are trying to do, and it actually works great. There is the approach of trying to kill a bar class all together, okay? If you saw Joe Bialik tweeted about his init all mitigation, which basically do, like, memset zero for all of the structures, it should kill a lot of information disclosure. It, like, works great. And the guy, AWE, which is awesome, great challenge. So in his write-up, he actually wrote that in the first space, the challenge, like, did at work because Visual Studio 2015, by default, has the slash SDL combination flag, which memset zero all of the structure. So the first vulnerability of the uninitialized value of the is-conscience in the person didn't work. It simply didn't happen. You have the vulnerability, but it's basically have zeroes. So we had to disable the flag. So it's really cool to see that we don't intend and cool stuff like that happen. So, yeah. And it's time for shutouts. Again, so AWE is the guy who wrote the challenge and the write-up. Again, like, great work. And please do more, like, Windows CTF challenges. Tomasz, my best friend for exploits, Whiskey, and Burgers, thank you for all of your help. And thank you for all of the brilliant engineers that actually keep track of Twitter, see all of the stuff that we wrote, and keep fixing that. It's really cool. And we have many, many examples that I simply tweet something, and, like, three months later, I've been defined and I see it fixed. It's, like, wasn't even some kind of serious, like, vulnerability, but they do also awesome stuff. So keep do that. You have some reference for all of the stuff that we did here. I think that the last link got down, like, a week before, I sent a message to the Insomniac. I hope that it will be up. If not, we will ask them. They are really, really nice guys. And thanks.


Prayer is affecting something. Prayer is making the difference. Prayer is establishing the will of the Father in the earth. Prayer is transforming you into someone who can handle what you're praying for. Prayer is shifting things in the spiritual realm, whether you see it or not, whether you believe it or not. When you pray, something is happening. It is impossible to accomplish nothing in prayer.


Remember that life-saving allergy med EpiPen? The one that went from $100 to a whopping $600? Turns out, something dark might have been going on behind the scenes. We found this information online. Let me know if you think this is true after watching this video. So buckle up, because Big Pharma just got hit with a $50 million lawsuit settlement. Apparently, Pfizer and another company called Mylan were working together to keep a cheaper version of EpiPen off the market.  But before you get upset, it's not about devaluing the importance of EpiPen as a medication. It's about making sure everyone who needs it can afford it. And let's be real, $600 is a lot of money. This isn't just some random accusation.  And guess what? They won. This $50 million settlement is on top of another $345 million they already had to pay out for overcharging. So, what's the takeaway? Big Pharma needs to be held accountable. People deserve access to life-saving meds without getting ripped off. Here's another truth that Pharma companies are keeping from you. The Chi-Coil PEMF therapy system. This non-intrusive contactless system emerges as the ultimate wellness solution you've been looking for. DM us to explore further into this revolutionary approach and follow us for more eye-opening revelations. Share this video, spread the word, and let's make sure everyone can breathe easy.