Good evening, everyone. In a few minutes to Nintendo hacking 2016, talk will start. This talk will be translated into German, and there are English subtitles available. Anyway, without much further ado, these are Derek, Nierwirt, and Netwheel. The three students have been working on hacking the Nintendo platform for a while now. And please give them a warm applause. Hi, guys. So we'll come to talk about Nintendo hacking 2016. Let me quickly introduce the other guys. This is Derek, and that's Ned. And I think I can speak for all the three of us to say that I'm really happy that you guys are here today, and we are happy that we can be here today to tell you everything about what we did in the past one and a half years, I guess. So I will start with the state of the Wii U. I hope a lot of you guys have seen the fail-of-flow talk in 2013 about hacking the Wii U. Not much happened afterwards. Until 2015, there is a public web kit exploit released. And about this time, we started looking into the Wii U, and we wanted more access than just user mode. Because there is also the kernel running on the PowerPC, and then there is this other ARM processor that runs IOSU, also user mode and kernel mode. I am not going to consider the user mode today, because I think the kernel exploit is just way more fun. So let's start with PowerPC kernel real quick. It has all standard basic security measures, though it doesn't have any ASLR, which makes our life easier. It has about 146 calls. And we don't really, we can't really name them from start, right? Kind of need to reverse it, but there's a nice thing. So the Wii U uses this RPL mechanism for dynamic libraries. And there's this really nice library. It's called corinnet.rpl. And it contains a lot of syscalls, shims, and symbol names. So we can name all the syscalls straight away without much hassle. And it's important to note that all the syscalls use a save copy and copy out mechanism to get data from the user space into the kernel space. So you start reversing each syscall, and you start looking for bugs. And what we came up with at first is what we call iocontrol-vhacks, or by indirections are hard. It's actually a bug in the IPCK driver submit request syscall. So what this syscall is used for is you want to submit requests from user mode to this other processor running, which I'm going to talk about later. And so you submit these kind of request structures. And the kernel uses copy-in to fetch the request structure from user mode into kernel mode. But there is a certain type of request structure which contains an indirection, like a second layer, right? And well, they just ignored it for the second level and hoped for the best. So let's look at the relevant part. I'm really sorry I'm showing you this code here, but it's not much more than that. So there is something that's called iOS packet in the second line, which is kind of this request that we submit from user mode into kernel mode. And in the top line, there is this special request entry. So it contains a physical address, a buffer size, and a virtual address. And what we do from user mode is we submit, it filled out with the virtual address and the size. And the kernel does this convenient thing for us to kind of change the virtual address to the physical address. So we can see it copies in this packet from user mode into kernel mode using the save mechanism. And then it goes through all the entries and fixes up the physical addresses for us. But we can see in this line that it doesn't use the save mechanism at all. It doesn't care about whatever address we put in there. So this gives us some kind of right primitive to wherever we want, basically. This looks hard to exploit, right? Because the right kind is going through this conversation. But we actually only need one byte to exploit the kernel. And we do this by noting that this Ki effective to physical conversion function actually returns zero for any garbage input we get. And there's a pretty high chance of the input to the function to be in garbage if we point it to any part inside kernel data. So the strategy here is that we go into the syscall hand address table and we overwrite the last byte for one particular syscall handler. And we hope that the new address actually points to some usable gadget. So we hope for the best, basically. And the other important thing to note here is that our user mode code is running from what we call the jid area.  So that's nice too. Okay, let's look at the relevant structures. So this is the kernel. And we should read this from the bottom to the top. Okay, like in the last line in the bottom, we see this entry to ke loader call. And then we can look at the last byte there. It's hex f zero. And what we will do now is overwrite this last byte with zero. And what happens is that now the syscall will actually point to this very usable gadget up there where it loads this register R28 into the link register and just branches there. And the nice thing is that we control R28 from user mode. So this gives us a way to just jump anywhere, basically. So how do we exploit this? Well, we have our K mode function there. And then we just call iocontrol v to this shifted address. And from this point on, we have this nice syscall that just jumps to anywhere we want. And then we call it basically and this calls our K mode function. So the vue starts out with full four hearts. And this gives us PowerPC-con mode code execution. So we subtract one heart. And it's quite nice, but we can and need to go deeper. And for that, let's look at the iosu architecture. So iosu is present as one big L file. And this includes the kernel and all the services. And it's running on the Starbucks. It has a hardware way to enforce no execute. And again, no ASLR, making our lives easier. And it's a micro kernel design and it has about 146 calls. So another thing to notice is that the kernel spawns all the services as user mode processes. So before we can exploit the kernel, we actually have to exploit one of these user mode processes, which we did, but I'm not going to talk about. And to look into the kernel, we again reverse all of these syscalls in search for bugs. And what we came up with is called mqhacks or message qhacks. It contains another nice bug class that apparently never dies in the turbo flows. And let's look at the code again. So there's the syscalls, it's called create message queue. You pass it a buffer and the number of buffer entries. And what they assumed was that each buffer entry is four bytes. So when they check the address range, they just multiply the number of entries with four bytes. So does anyone see the integer overflow here? And the other nice thing is that they just use the number of entries for the maximum number of entries for the message queue. And our write primitive again is a descent message syscall. So I told you about this hardware NX, right? So iOS should be enforcing that no executable memory is writable. And if you look at the kernel section flex, we actually see that kernel text is read execute and kernel data is read write. But these permissions are all lies, okay? So our exploit strategy. Well, let's look at the relevant part of the ISO kernel. So we see that kernel text starts at this lower address at hex 812. And conveniently for us, there is a syscall there. And the addresses before that are all valid. So we create a message queue starting at minus eight bytes and this magic hex 400 whatever, two number. And from this point on, we just push two messages and then our instruction to branch R3. And what this does is it actually causes the start of the text section to be overwritten, branch R3. And let's just look at the integer overflow, right? Four times this value, truncated to four bytes, gives eight bytes. So what the kernel thinks is that the message queue is only eight bytes, but we can just push any messages we want, okay? So this gives us IRS kernel mode execution. And the nice thing about this is that we actually have full control over the console now, right? So we can dump the console as OTP, which contains all the keys except for boot one, which we will coming back to later because unfortunately the keys for boot one are locked out as we've already seen. And now we wanna make everything persistent. So how do we do that? We find that title content is only verified at title install time, but never at boot time. Because at boot time, they only verify the title binary. So what you can do is you can actually start to mess with the metadata of titles and overwrite it. And what we did was to overwrite the ROM for a DS game, exploited the emulator and got user mode code execution again. And another thing is the console contains this config file, which tells it to boot into which title to boot. So what you can do is you overwrite the title ID with your modified DS emulator title. And the next time you start at the console, it actually boots into the exploited game and yeah. So this gives us persistent code execution and cold boot with full control over the console, whatsoever, so game over. So as we just saw, the kernels are like pretty broken, right? So what is missing? And I just copied this slide from failoverflows talk. As you can see, we are using the same default theme for our slides. And basically the boot one key, which is the second stage boot logger on Wii U, this key is still unknown. And they tried to get it somehow with some side channel attack thing, but I think it never worked. So it would be nice to get this key. And the first thing we did was to make a NAND tracer. So we can basically sniff all the traffic from between NAND and would want to see what boot one reads from flash. And so we get some nice addresses and we could compare this with the file system on this flash to see what file it is reading. And we also kind of messed around with some files on this file system. And we found out that boot one actually parses a file that is called system XML. And I don't know, it doesn't really feel safe to parse an XML file in such a really early boot process. I mean, there's a lot of stuff that could go wrong. So we tried to attack this. We tried some blind exploitation stuff, but yeah, unfortunately it didn't really work. So let's try something else. So there's boot one, which of course boots this, sorry, we've got boot zero and this boots boot one and fail overflow found out that this boot zero, which is the boot room of the security processor can be re-enabled again in virtual remote and you can just dump it. So let's look at boot one, boot serial, sorry. And we can see that it reads the boot one key from OTP and then it locks out boot one key forever. And this happens really early. But it's basically kept in memory all the time until it's done, until it has launched a boot one or just panicked. So this means that we have to exploit boot zero to get the boot one key. And unfortunately, boot zero is pretty safe. It's kind of surprising because this is a Wii U and basically this gives us this question, how can you exploit something that has no bugs? So the answer is we have to introduce our own bugs and we're doing this by using fault injection and maybe you have heard of it already. It's basically you introduce an error into the device by clicking the clock or voltage in the reset line. You can also do electromagnetic fault injections there in many ways. But basically what you want to get is a mutated instruction or an instruction skip or some corrupted registers.  Yeah, that's really useful. So we want to click boot zero. And to do this, we have to find a nice target like the weak spot of boot zero. So let's take a look what boot zero does. The first thing it does is it copies itself to RAM for some unknown reason. I mean, there's no good reason to do this, but it's nice for us because it copies itself to RAM and just executes from there. And then it copies the boot one key to memory. It locks out the OTP slot, initializes some other stuff and flash controller. And then it starts reading the boot one image. And it does that by just reading its header to this address. And then they read the size from the header field and they also do some max size check on this. And please note, the header itself is not encrypted and they also don't do any signature verification here at this step. So they use the size and reach the whole boot one image using the size and then they do a real signature verification and make sure that the image is not corrupted. It then decrypts the boot one code using the key from RAM. And then it clears the key and jumps to boot one entry point. Okay, so what is weak spot here? And I mean, if you look at this, you can pretty much already tell what it is. And of course it's this size check. So what we can do is we can write our own modified version of boot one to flash with some really, really large size in the header. So it reads the header and then it's supposed to do the size check and this is exactly where we want to glitch it and eventually it will just skip the instruction or something else happens and then basically the size check is bypassed. So when it's reading the boot one image using this size, it will actually overflow the buffer and we have some jump instructions at the end. So when it returns from the flash read function, it will eventually jump to our code and this is actually boot zero code execution. Okay, so we have boot zero code execution and we can just dump the boot one key from RAM and we didn't even need an exploit for this, right? So it's just, boot zero is actually pretty safe, right? But when it comes to glitching it's kind of fragile because boot zero code is writable and also boot one image buffer is in front of boot zero buffer so we can just overflow it. And also the setup that I had is surprisingly stable so it works like 50% of the entire time. So let's finally look at boot one and boot one is able to understand the VU file system. It uses real file path strings to load a firmware image and of course the first thing we did was to look at the XML parser and well, unfortunately, it seems pretty safe. But maybe we found a bug, we are not really sure and we haven't really tried to exploit it, interest kind of faded out because you know it's, after all, it's just the VU. So that's it for VU and now I will hand over to Ned Will, he's talking about 3DS. Hi everyone, I'm Ned, I started 3DS this year and I'm basically a software person so I'm gonna be showing some of the homebrew side of 3DS where that's at right now. So just to reiterate from last year, these guys broke user land, kernel and security processor. They also broke the secret hardware key scrambler and since then, Nintendo's been kind of mad about this. They released a lot of system updates and they started a bug bounty program. So there's a lot of bugs getting patched but because of the amount of the level of exploitation we got last year, it's actually really easy to find new bugs and new exploits. So what I wanna emphasize here is that even though it's like a cat and mouse game because we have so much control, we can exploit more difficult bugs on the latest firmware. So starting with user space, this is where all homebrew comes from. So already it's pretty good, like this has always been a huge focus for the homebrew community because it's kind of where user space is where you want to be running your own custom games, modifying stuff. So we have a bunch of game entry points and a bunch of browser exploits but there's a couple of limitations to these and that's that game carts cost money and they frequently like the games that are exploited are usually somewhat rare and unusual and so the price goes way up as demand soars and for the browser every time we release a new browser exploit, Nintendo can actually enforce that you're in the latest firmware because before we fetch any web page, it'll check that the system's on the latest version so they can kind of remotely cut off web browser exploits. So looking at this, I thought it might be fun to look at if any of the system titles could be exploitable as primary entry points and I found something called Sound Hacks. So just the basic, like the two probably most obvious things to look at are the image loader because it's got JPEG parsing and also the music player. But when I looked at the music player, I saw that they're parsing actually a lot of formats and they even have their own custom playlist format and if they make a single mistake anywhere, it's over so then I was trying to compare with like open source implementations. I didn't find any overlap. It seemed like everything was custom so that was pretty promising. So over the course of about a month, I found a bunch of bugs and I was trying to like chain together little like logical bugs and it wasn't really working and then I just found one that was really critical so I'm gonna demonstrate that here. So I actually studied MP3 for like the whole month and PEG was like the last day. So I looked at it and they actually malloc 256-byte buffer for the song name and then when they go to load it, if they see a Unicode bomb marker, they just mem copy the thing and that tag size is totally controlled so you know, that's it. So this is like, this is pretty great but it's a heap exploit so it's a little tricky but this is what it looks like. So we have our name chunk that we're about to overflow and then like I'm a CTF player so I just put A's there and then the next thing that happens is this gets freed and so this victim chunk that we've overridden it's actually the way the 3DS keep works they actually track, they have a linked list of what things are currently allocated so this gives us the classical heap on link arbitrary right and so at this point we have a 4-byte right and we want to get it raw out of it so we'll probably do a stack pivot. So I looked at the binary and there's only one pivot gadget and then I looked at the thumb pivots there's actually a lot but because this CPU was too old didn't support the wide instructions that where all the pivots come up so unfortunately that one pivot instruction has some like arithmetic conditions on it specifically it was that in order to load all your registers from memory the condition flags had to satisfy less than and everywhere where we returned from the function it had just checked that like if this pointer is not null free and so the comparisons wouldn't ever be satisfied because nothing's mapped up in the negative area so of course CTF workarounds we can still do this so I'll overwrite the heap free list head with a stack address and so on the next malloc we just return that stack address and read into it so there's a couple of constraints on this and the first one's really normal like this is every pivot to stack heap thing you have to make sure that you have a heap chunk on the stack luckily this is actually pretty easy because all you need is a size followed by two null pointers representing next and previous so when malloc goes to look there it sees like the size is big enough and then nothing else is in the queue so we'll just return this and then this worked so we mem copy the next tag to the stack and like we just specify that size and malloc's and reads it in for us and then from there we're done because we can just do a little a little rock chain where we mem copy the shell code to the heap and then use an existing exploit GSPone which has been around for a long time to overwrite the text section and jump there so there's the first heart so you can't really talk about homebrew without also talking about kernel because we want to get access to more syscalls like the 3DS actually sandboxes a lot of the syscalls away from you and so as an attacker, well your goal is to call some syscalls that are restricted a really nice example would be you'd want to map some executable memory for like a jit emulator so it's kind of a tricky situation because you're inside the sandbox you want to break out, you have to find bugs in like pretty restricted syscalls so I looked at last year's talk here and like what had been done so far and it seemed like there were a lot of attacks on that memory mapping but I didn't see much about the sync primitives or anything related to use after free and I had just got a pretty bad grade on my OS project because I had a lot of those so I knew this is a good place to look so I noticed the design flaw when I was reversing the ref counting so it's not so much that they couldn't possibly get this right but generally when you're designing an API you want to make it really hard to abuse and this is just not really true for how they do ref counting so I'll go ahead and bring all these up yeah so basically whenever the user fetches a kernel object to perform some operation on it meaning you call a syscall that does something using a kernel object it does the correct in-graph and then decref for you but I was looking at it and I was thinking well like a lot of times the kernel actually is using these objects internally to do stuff so I mean I spoiled it I mean it was like a week I found three user for free and they're all following the same pattern the kernel is using an object internally without maintaining the reference count correctly and then some people ask me advice on kernel hacking maybe at home I definitely recommend looking here I'm sure that there's plenty more so the one I'm gonna talk about today is the timer object so this is a pretty simple API with the kernel you can have it create a timer for you and you can set the timer you can wait on it it's like a normal synchronization primitive so like I said I was looking for these user after freeze I saw this and I thought it's kind of interesting that this one called pulse is here because what's happening with this one is when you set the timer to pulse like every period it's signaling everything that's waiting on it and then it like resets itself and then if you wait on it the next period comes around you signal again and so I was thinking like it's definitely doing some stuff with this object internally that's like a bit more complicated than some of the other modes and the other kernel objects so I looked at how they did the pulse like every second when it pulses like what's actually getting executed and if you look here they do some pretty good locking and then they signal and then what happens here is basically when they signal they go through and everyone that was waiting gets rescheduled made runnable and then at the end they reset the timer state and just say like okay everyone that waits on this again has to wait for the next cycle so and then this also looks pretty good like they're locking the scheduler here and this would work but nothing's preventing you from just closing this from another core so I have fast hacks which is just three syscalls is that that's it that's the entire exploit and there's a lot of setup which we'll get to but you just create the timer set it to run really fast and then close the handle and then if it was pulsing and you closed it it'll use after free so what's nice about this is if you lose the race it just the timer is just unscheduled you're fine and then it actually happens quite often and I didn't even really specifically try to win this too well like I just once it was within a second I didn't worry but those parameters are probably not optimal so we should look at how do we exploit this basically this is a little bit more complicated view of it I'll show a diagram in a second but this is like where the use after free actually happens so like R7's pointing to my timer object and then it was freed before we reached this trunk here and then it's loading R7 to R0 loading something from that and then branching to it so that's like calling a use after free object so this is pretty exploitable on the 3ds kernel because they use a slab heap to deal with allocating the objects so this is the normal situation when that first timer is allocated the vtable is pointing to the real k timer vtable and then it wants to call that timer reset function it's totally fine but when we free it actually the vtable pointer goes to the next freed timer object in the kernel so it's actually interpreting that struct as a vtable and what's nice is it actually overlaps with the initial timer value that we totally control so it looks like okay we could just set the initial timer value you know do this use after free and we're just calling user space that's what I thought and then it realized it wasn't that easy so because of what's actually calling this is in a kernel thread we actually can't guarantee that our user process is actually mapped in memory and in fact it's on a different core so even if you open a process on the other core like ran a thread there you can't get more than 25% of the time I think so that's just super unstable also because it's a kernel thread we don't necessarily want to crash it we don't like crashes in general but this will just totally break everything if the timer like sync thread dies so as long as we return to a function do something cleanly in return it'll be fine so it sounds like okay all we have to do is find some kernel function we can call and we're done but there's actually another issue and that's that kernel code is mapped at high addresses and these are actually negative and the set timer syscall actually checks if your timer is negative so there's a pretty funny trick I found and it's that when you set the timer you're saying like start like one second from now start pulsing obviously it's adding like the current time to the one second to know like when do I trigger this timer so set timer is the one that does that add for you they don't check for overflow when installing it and timer schedule values are signed which is also a bit weird so we can overflow and schedule into the past so how this looks is that's my like disgusting setup call so what's happening is like in the middle that's the start of the 3DS boot and then that range on the right is what the 3DS will allow you to pass for your values for the initial and like pulse period time and so what I do is I just put it right there at the end and then it overflows and then on the next pulse I also control that and that's also less than that range so then we can get it to line up on the kernel address that we want and so that's pretty good unfortunately we're at the end like at this point it's pretty solid but there isn't like an obvious single thing we can call and it seems like well maybe you could race a bunch of times and call a bunch of different things in the kernel and like you know that's a decent amount of control but because of all this weird negative scheduling stuff it's actually pretty hard to do multiple calls so I was trying to look for one thing that I can call that will give me control and this is where it gets really tricky so if we look at how the memory mapping on 3DS works in user space you can access the FC RAM which is that first range up there that's just where your heap goes there and then the kernel also has a view of this heap it's a shared mapping so if we can write one of those something in that range into the free pointer and allocate it it actually ends up in something we can see as the user so then I noticed this this is actually a common instruction prefix in ARM so I jumped here and at this point like we just did a C++ view table call on the use after free thing with one argument so this means that R0 contains the address of the object and R1 contains the address of where we just jumped to so that B65C is where R1's pointing so this is actually some random linked list lookup function but it's actually looking down to the add instruction and loading it to R1 and then we write that to the object and so at this point it looks like this it's pointing to something in user space and then we just alloc two times we can look in user space oh they put the object there you control the V table and from there it's pretty much standard straightforward thing so there we go got full R11 user space in kernel and this is almost game over one more time so we have broken several parts of the 3DS firmware including the 3DS kernel and all software that's running on the security processor what we haven't looked at yet are the 3DS boot ROMs and basically there's one boot ROM for each processor for the R11 and for the R9 and I think there's probably more boot ROMs in the 3DS system on a chip used to old Nintendo DS mode but we will focus on the 3DS boot ROMs here and what we know is they are somehow loading the firmware image from NAND flash and we also know that the R9 boot ROM has all the interesting stuff because only the R9 has access to the whole crypto hardware like AES engine, RSA engine we also know that the boot ROM will initialize the secret keys for the AES key slots and yes we would like to get those keys but unfortunately the boot ROM is disabled it disables itself before it's launching the firmware and 3DS boot ROMs also print nice error screens like when the NAND is corrupted or something it shows an error screen so let's look how the boot ROMs are protected in detail basically there are two registers that we call configs sysprot9 and sysprot11 and the boot ROM writes to those registers and of course they are one shot you cannot re-enable the boot ROMs again because this is not the review and basically when it disables the boot ROM it only disables one half of it so what you get are two parts of boot ROM there's the unprotected part and the protected part you can just dump the unprotected part by taking over a line from firmware but you can never see the protected part and they were really clever and basically they put all the interesting code in the protected part and if you look at the reset vector it just jumps directly to the protected part of the boot ROM so you can't really figure out what is going on when the 3DS is starting up but what you can do is you can look at the code from the unprotected boot ROM and who knows maybe we can find a bug so let's do this first of all of course there are no keys in the unprotected boot ROM they put all the keys in the protected part it's also mainly, it's a lot of driver code it talks to some hardware like NAND flash, MSE, the AS engine and also to a spy flash which is kind of interesting because the spy flash is some really tiny chip that is soldered on the Wi-Fi socket and it's actually used for some Wi-Fi settings and other user settings used by all Nintendo DS mode and that's kind of interesting it uses the spy flash and it also includes the ARM exception vector table and this is actually a design that they have adopted from previous generations of the Nintendo DS such as the DSi if you don't know ARM basically you have something that is called an exception vector table and this is located at this hard-coded address in boot ROM and basically every time when something weird happens or something special on the CPU it will jump to those exception vectors like the reset vector that we just saw or when you're trying to read from an invalid address it will jump to the prefix abort or data abort vector and also when you receive and interrupt it will jump to the interrupt request vector so those are the exception vectors and they are hard-coded in the boot ROM and there's kind of a problem with that because as a developer you don't want to put the exception and the routines in the boot ROM you want to be able to change the code so what they do is they just redirect all the exception execution flow from boot ROM to another jump table that is located in ARM-line memory so it looks like this what you can see here the boot ROM vectors it's basically just a jump instruction to the RAM vectors and the RAM vectors are also just another jump instruction to the actual firmware handler and this is how things look like when the firmware is running but what about cold boot? well, on cold boot you get this and this looks kind of interesting because you have the boot ROM vectors that still point to ARM-line memory but since this is cold boot the RAM is not initialized so this is interesting but it's not really a buck because at some point the boot ROM will initialize those RAM vectors but let's cheat a little bit here and say let's just assume we could somehow trigger a really early exception even before the boot ROM is able to initialize the RAM vectors well, probably it would just crash because on an exception it would just jump to an initialized memory and there's probably no valid instruction there so this is not very useful but there's a really nice hardware flaw we found this by just writing to some memory reboot see what happened and basically we found out that some RAM is actually not cleared on reboot and this also includes ARM-line so the basic idea is we can set up some custom exception vectors in RAM that redirect execution flow to some dumper code so when we reboot we get this and this is really interesting because if you look at this this means all we need to do now is trigger a really early exception and then the boot ROM will jump to our dumper code so how can we trigger an exception? well, if you look at the exception vector table again there are some exceptions that we can trigger because they are hardcoded like reset and they won't jump to online memory and you also can use the interrupt vector because interrupts are disabled on reset and this won't work so what is left is these three interesting exceptions and if you look at those they normally don't happen undefined instruction is very rare it shouldn't happen so I don't know but this reminds me it's a really nice use case for doing fault injection again because you can corrupt register and get mutated instruction so it's really likely that it will trigger an exception so this is the vector glitch hack basically we set up some vectors in RAM trigger reboot then do some glitching magic and then we reset again and let it boot up normally and hopefully the dumper code got executed and then just wrote a copy of the boot ROM in memory so we can just dump it all this stuff is not very stable but it works for me so okay, we got the boot ROM and Nintendo is losing a life there so before we look at the boot ROM I have a little prologue for you and basically in early 2014 an FCC document became public there it is and basically it says that Nintendo has changed the CPU of the Nintendo 2DS and there's one really interesting sentence that basically says they have changed the security function of the initial program loader that is installed in each model so the initial program loader is probably the boot ROM so obviously there must be some really huge bug in the boot ROM, right? So let's look at the boot ROM basically there are some boot methods you can boot from then that's what it normally does but alternatively you can also boot from spy flash which is a Wi-Fi flash and it will only boot firmware images that are signed and encrypted there's no freaky development backdoor that we can exploit it also uses two different set of keys for NAND and non-NAND boot methods and also for retail in dev mode so even when stuff gets leaked you cannot use it on your retail console so let's do a small boot walkthrough it's pretty straightforward actually so the first thing it does is it selects a boot device then it loads the firmware header and the RSA signature from it it's just one block and then it hashes the header and extracts the hash from the signature and compares it so basically basic signature verification header verification and then it assumes the header is safe and then it starts loading the firmware sections and the firmware images are pretty simple to format you have some entries in the header that tells you to take the data from this offset and there's a section with the size loaded to that address it's pretty simple so we know from Nintendo's past that they like to mess up RSA signature checks so let's look at how RSA is done in three years so for the three years firmware they are using RSA signatures in the PKCS standard PKCS is basically a bunch of standards that tell you how your signatures have to look like and they are using the 2048 bit version of RSA which is safe and in the signature you have the SHA2 hash and this is encoded using ASN1 and ASN1 is some really complex structure it's basically similar to the MP3 structure so you have little chunks of data and those chunks have little headers and the headers have tag bytes and length bytes and basically this ASN1 stuff is used to tell the parser which hashing algorithm is used and well since SHA2 hash is only 20 hex bytes in size you have some remaining space in the signature that you have to fill and PKCS says you need padding and this padding should be deterministic it should only contain FF bytes so when you're trying to forge signatures it's really difficult because of this padding that is really long and when you compare signatures of different firmware images you will actually notice that only the hash will change and the rest of the data is always the same for all signatures but well for some reason they decided to write a signature parser for the stuff so what you get now is RSA the Nintendo way again so the first thing it does is it tries to parse the padding and this parser is totally messed up like there's a flag byte that tells you if the padding should be checked and if it's one then it is checked it should be all FF bytes but if it's two then it will just skip the padding and it also has some really weak bounds checking it makes sure that it will not when it's parsing the padding it makes sure that it will not go out of bounds but they forget to verify that the hash will actually fit in there as well so the next thing they do is parsing this really complicated as in one structure and this parser is also really simplified so we know as in one has some length fields and there's no bounds checking so eventually it will add the length to the current pointer in the signature and then they stop parsing and say okay we parsed all the data and now there should be the hash and they are not checking this length and this point is used to do the hash comparison so in all you can say it only checks a few bytes in the signature because the padding parser is messed up and also the as in one parser is really simplified so what we can do is we can prove for us a perfect signature where the final pointer when it's done parsing the padding and the as in one data that this final pointer matches the pointer of the calculated hash of the boot room so what it does then is it does a mem-compare with the calculated hash and the calculated hash like in this never fails right so it will always succeed and this is six hacks so six hacks is a boot room exploit for 3ds and basically we can sign our own firmware and there are over 60 million vulnerable devices and basically in new 3ds and 2ds basically all models are affected and of course since this is the boot room Nintendo can't fix it so that's really nice but there's one hard remaining so something is missing what we haven't done yet is we haven't dumped the ARM 11 boot room it's probably not really interesting but for a sake of completeness you would like to get it and in theory we can just do a vector-clitch hack again because it has the same floor but now that we can sign our own firmware let's try something else so if you look at the unprotected part of the ARM 11 boot room you can see there are a lot of references to ARM 11 memory so maybe now that we can sign our own firmware and we can set up our own firmware sections maybe we can all write some boot room data but the boot room developers were kind of clever and the ARM 9 boot room checks the firmware sections and they have some kind of blacklist and unfortunately you can't just overwrite boot 9 data sections but for some reason they forgot to blacklist all the boot 11 data regions so you can just overwrite boot 11 stack or the exception vectors and well, you can dump the ARM 11 boot room yeah, that was pretty easy and now I get to tell you something all the stuff about the boot room we did this in summer 2015 so we could have talked about this already last year but since we are kind of friendly hackers we hold this bug so long so yeah, Nintendo should be thankful and okay, so that's it three years free game over and here's a picture of Nintendo Switch and our buddy is already thank you very much there's about five minutes left for questions are there any questions from the internet? yes, there's actually one question from the internet and that is the internet wants to know if we can get DSP code execution maybe sometime soon can you repeat the question? it's very hard to understand here okay, the internet wants to know if we can get DSP code execution well, the DSP of the 3DS runs its own firmware and that is included in some kernel module and basically when you can sign your own firmware you can also make it load another DSP firmware so yes, you can do this okay, people who are leaving please do so quietly and people entering also do please do so quietly this was a question on microphone 3 I think but no longer okay does the internet have more questions? yes it does the internet wants to know if you or how you glitch the Wii U to get execution well, I don't want to read how I did it in detail but there are some basic fault injection attacks and my setup was I think kind of complicated you had to modify a lot of stuff on the Wii U main board to get it work so I guess you have to figure out yourself, sorry okay, there's a question upstairs microphone 5 I think 7 but it's okay well, you said that you broke all the 2DS but actually you showed that the 2DS changed in the boot process so did you verify that that worked for the first version as well? yes, so the new 3DS was released after the 2DS and the new 3DS is also vulnerable and basically all the Nintendo 2DS consoles are also vulnerable as well yes, we did verify this and we don't really know what this FCC document is about we got some really new 2DS from the store and basically there's no difference for the boot room at all so yes, everything is vulnerable nice to know, thanks final question for microphone 3 yeah, just a fun question out of interest when you're going to buy such a device do you also plan to play a game on it or is it just going to check how the kernel works? personally, for the Wii U I own zero games great, thanks I also didn't pirate any so I never played a game on my Wii U


This is the animation minute Let's start with jobs as always hot job animation director is needed here Epi games is hiring animation programmers Blender animators are wanted here Silver and games is looking for experienced animators to join their team And I saw this on my LinkedIn timeline with the emails listed to apply and another one looking for a senior anime and CBA Studios is looking for 2D character animators and then effects animator Switching to the 2021 anim state of the industry survey go check it out Always good to have pixel art and this time it's also for a job. They're looking for freelance pixel artists Speaking of pixels look at that goodness, come on Adam challenge has posted the next theme and it stopped motion also Kevin Perry is going to do the winner critique That's super cool Speaking of super cool. I thought this was really really cute. Look at that. So cute Switching gears look at this calm on a little Speaking of loving this is a fake trailer for a potentially full movie But I would love that because it's so cool.  It's really really neat Not pixels, but voxels I would play something like this Check out the YouTube clip here for the proof of concept of key mesh That is also very nicely done. Love all the shapes and angles here. That's very nice Speak of nice. Oh, I love that that fall. Ah, she's so good. I love this Chester has finished his animated rap segments. It's really nice to come to new poster for the next Disney movie coming up very soon Will cool game reel as always make sure to check out the full thing There I self promote. I had a really fun podcast with Ross. So go check it out and let me know what you thought about it Then I post about a tip for students that I can only 200% agree with you should always do a little exercise I don't always focus on big shots do a little things in practice Let's finish this with key mesh again Look at that. So cute with the loops and that is it for the animation minute You can find it every Monday on this channel at 10 a.m


I don't even play 18, and I thought that was sick. How's it going, everybody? Dato, do I hear back with some more Dragon Ball Fighters rank matches? This time we are doing a heavily suggested idea, and that is playing a team of my least used characters. These characters have been all been used less than 20 times around there. Yeah, so I'm not expecting this game to go exceptionally well, but I did want to see just how much we'd be able to account. Can I get anything off this? No, that's not, well, not that. I wanted to see how much we'd be able to get done with a team like this. And I think we've done this once before, and it went about how you'd expect, but I think we had... All right, I'm guard canceling. I'm guard canceling.  Oh, no, Vegeta assist. And it was a blue combo? I guess I must have missed the tech window. I am genuinely curious, though. Is there anybody watching this video that plays? That was scary. Is there anybody watching this video that plays this exact team? Let's go. DP, OK. I... A lot of people don't actually use that DP other than TUDs. I've tried to incorporate a bit more into when I play UI Goku, but yeah, it's a it's a pretty good move. It is a projectile, though, so Broly Barrier... What are you doing? Let's go. First decent damage of the entire game for us. But 21 does not get sliding, or at least maybe the medium version does. I don't know. 21 ain't my kind of character, to be honest. Are we going to live? No, we're definitely dead if he wants us to be. Two bars, even from UI Goku himself, but he should, yeah, tag out. Tag out for the blue life. I can respect it, even though I am going to bring UI Goku back in. That's a promise. He's not getting away. Here comes the big fist. Oh, no, the buff. I forgot they actually did buff that for this character, which, by the way, not a huge casual. It was, I think it was a buff for, you know, obviously, Majin Buu players can get a lot out of that. But I think it genuinely was for just in case you're a casual fan of Majin Buu, it used to just not even work. I don't think it I don't think it ended up being the best casual friendly bow. I still think if you're if you're new to the game and just don't want to spend a lot of time practicing, Majin Buu is probably still the worst character for that. This man requires diligent training. Fataws, let's go. Do I still have my? No, I didn't. OK, well, I'm just going to settle for a dragon rush. I thought I had my smash problem.  You wanted to go, you wanted to go around again. I don't know why I did the backflip. I don't know why I did kickflip. Structurists, this is pretty nice. Oh, I just, you know what? I did jump at him six times. It does make sense to get punished eventually. Again, this is another one bar situation. He's going to keep you. I go go in. All right, all right. Eighteen was sparking. I'm actually glad 18 is last. Probably the character I could do the most with. Not saying it's guaranteed. Hold up, I shouldn't have said that. I shouldn't have said that. You like, please stop. Stop. All right, well, time to bust out the old sparking. I really want this. Oh, my God. OK, why am I not being able to punish that, dude? I am just not good. Oh, no, is this going to take three bars? I think it is. We're going to do it even though we have sparking because it's the only way to guarantee the kill at this point. Android rush combination. Yes, it did kill. Oh, that was close to a view. I go to die there. This game was going straight in the trash for me. All right, he's buying that sparking time off. No, our sparking literally died right there. Oh, no, it's bad. It's all bad. It's all bad. Can he kill from here with Vegeta? Since I think he can. Oh, he has an interesting route. I don't know if I agree, but maybe it's still enough. Yeah, I didn't agree. He just I should have taken my turn with more assertiveness, with more assertiveness. I definitely was trying to stagger, see what he was going for. But I actually hit him and then waited too long and got Galeclaw. Oh, rough match. OK, we can bring it back. It wasn't to be honest, it wasn't hopeless. We did see we had glimmers of hope. We can push through. We got to rely on good old fundamentals. If you don't have fundamentals, what do you have? Oh, my God, I don't have fundamentals. Fundamentals are out the window. Oh, the biggest jab in the game. Man, just punched. Oh, my goodness, the punch was crazy. I'm getting drag and rush like a feeling in my book. And while it was a grab, I was I wasn't entirely incorrect. As a good comp, as a good combo. Off the command grab. I am I'm feeling. No, Vegeta says you always want cursed.  How did I get corner from that? You know what, I'm not going to look a not going to look a gift to us in the mouse here. I'm just God, like let's just call it with it. What the? Oh, how do you confirm off that? Twenty one players. Tell me what to do. Twenty one players help. What do I do from that rage? I knew to stick out the tail. I just didn't know what to what I'd get off of it. All right, we out. The PSS. I really wanted to call out 17 right there. Maybe we'll get another chance. All right, he is just going for it. He's just trying to do the OK. All right, not bad. Not bad. We're going to get him in the corner for that.  I'm going to go for a bit of a reset here, actually.   This guy is insane.  OK, OK, hold on. Yo, come on. Oh, I don't think that's going to work. No, no, I'm I'm I'm a great a I'm a great a fool. Can I can I switch out? That's a lot of blue life right there, honestly. And I didn't think you'd go around that time. I tried to I tried to jab because I thought he'd stagger. The amount of guard cancel I went for in this game alone, I thought he was like I thought he was going to make the read. I'm going for the tail. OK, oh, I've seen people do that off the tail, I think. Maybe that's more of a block string thing. No text. OK, fundamentals. Remember how I said fundamentals? Everybody text a dragon rush the same. You would think that was the one thing I have going for me right now to H. OK, how do you what what do you do with this character? Is there something I do? Oh, my goodness. Ha, ha, ha. OK, back at the quarter. I think this is a three bar kill. Yeah, that's three bar kill. He didn't go for it. Oh, he saw the vanishing reacted. But we still do escape. That shouldn't have happened. But oh, I just can't. I can't I can't hit him. This should kill. I mean, he let the last one get away. This one, he should not let it get away. He's doing a lot of saucing for no. He's just trying to sauce. Oh, I forgot he could do that. I was like, OK, I'm going to make him block this one and then I'm going to go for the dragon rush. OK, watch me bring it back right now. Confidence is through the roof again. So that was that was about that was about what I deserved to be honest. That was it was petty. It was petty. Yes. Um, not entirely. I'm depressed, I think. Oh, get that out. Get out of here with that, Vegeta. We don't want to see that going. That move is cheap. Big face. OK. OK, switch out. Oh, wait, you can beam off that. That's crazy. All right, not bad.  You know, get the pace of the game back in hand. The punch we're doing wake up punches. Yeah, yeah, keep walking. Keep walking. We got that. OK, I am committed right now. It's cheap as well. What? Oh, my cheapness. That was cheap. I'm sorry. But that I did not know there was a sale going on right now. That's blocked. OK, not blocked. Didn't expect that, honestly. That was that was good. I don't know why he ran up at 2H. That was godlike. Are we out? No, dude, it's a blow up.   I can't get this team to move. All right, hold on, hold on. I'm going to try to bring back in 18. Actually, I'm a spark here. I probably should have 2H. That's fine. Gale claws was smart. I'm a big believer in Gale claw and my spark. He's at a time. Oh, if that commingue would have hit, I would have. I would have been so happy. Blocked. Yeah, we. Oh, he tried to sweep with Yamcha. All right, Majin Buu has to come out now. Gale claws again. OK, got to stop jumping. Going for midis. Behind the back. OK, hold it together. This is this entire video has been hold it together. We just keep guard canceling. We got to stop. Guard canceling is the only defense I know. How did. OK, I thought I could punch there. That's fine. That's fine. We might get level three. That's the worst that could happen, but. Why did I just? Oh, I don't have spark. I was like, why didn't Super Dash come out? But I do not have spark. That makes sense. I click the shortcut buttons and I deserve that. OK, Yamcha is slow. We could take him out of one good combo if we can get it. That's that's a big gift, though. That tail length is pretty good. Oh, that's another thing I should have. Please don't think that I'm saying these characters are bad. I literally think Majin Buu is pretty top tier when you know what you're doing. I think Adroid 18 is good. And I think 21 is pretty decent as well. I just these are not my kind of characters. And that's why we get what you're seeing right now. He teched that one. Damn, that was. Dragon Rush was about the only thing I had going for me. I'm just going to level three here for the knockdown. If Majin Buu is the one that turns this around, I'm shocked. He punched again. I'm going in. Oh, no. Why did he punch again? Dude, it was my one chance. I almost want to go again. Do I do that to myself, though? Do I do it to myself? Going back in all aboard the hype train. I'm winning this one. This is pure confidence. Blocked it. OK, I missed. I missed. OK, good. OK, good. Not bad. Not bad. What do I do? What do I do for a slot? I didn't even get the move to go out. Humbos, too? OK, I mean, I guess you don't get much off of that. But that is interesting. Oh, my goodness. I am going to take quarter, though. He's going to punch. And I know it. OK, or DP. Boom! Don't ever DP in my face again. Pure confidence, baby. That's all you need. All you need in life is a little bit of confidence. Punch again. Try me. Try to me. Let's go. Confidence is up. Fundamentals are back. It's fundamental season. OK, not bad. Not bad. We even got a spark, dude. Couple of correct reads. But if I win, I can't leave. Oh, my goodness. We are moving. Yo, some people don't believe it be like it is.  And I know people are like, why? Why do you care about that? You don't know how to use them. And while true and as hurtful as that is, sometimes you've got to get the OK as well. OK, I'm going to fire a beam at the round start. Let's see how that goes. No, should we save 17, 18 for last? That makes a lot of sense in my head because then, I don't know, we get the. We get the. Who cares? Who cares who were saving for last as a beatdown? Oh, that was a bit of lag. So I'm not even going to count that in the hype catalog. But wow. OK, well, I can't leave now, especially with that little bit of lag. We have to let him beat up on us again. But if I get two wins in a row, that officially nullin voids the contract. OK, a win. We had to fight tooth and nail for it. And it came after the set at ended. But hey, you know what it is sometimes. Sometimes you got to take a win where you can get them. Big starts. Oh, we could have had so much going for us right there, too. We're going to have to take this now, huh? Dang, we literally had that. Clicking buttons for right there. Hold it. Hold back to block, dude. That's all I need to do. OK, hold back to block. Keep that in our mind. We know the block command. This is like cheating. I'm not really smart. Honestly, apparently my defense today is even worse than usual. That jab is boom. That was sick. Second jab is pretty good, too. Teleporter said, hey, boo, what's up? OK, I don't know what I'm doing, to be honest. Give me that. Give me that sparking timer. No, no, no, no, no. Yeah, yeah, yeah, yeah. It makes sense, makes sense, makes sense. He can't kill me here, though. Actually, that was raw damage. No, no, no, we're so good. We're so good. Whoa, y'all just turning around on a dime? My man had those new brakes installed. What? OK, now you know what? Getting hit by a genesis wasn't too terrible for us there. I just didn't respond to it appropriately. I got blown back. I was like, oh, that was so bad. Oh, I got hit again. What the? What is the move, dude? What is the? I found a move. That was the move I was looking for. And that keep blast is pretty good. There, too. OK, we still got it. Hey, wow, we actually have a chance to win this one, too. Because of those god-like zoning skills.  I'm feeling good about this one. Nah, you can't get it off that. OK, I wanted to test that. I did want to test that. No blocks. That's crazy. Oh, blocks were definitely, that was so important to block. Not getting hit there was a huge factor. Oh, Wolfgang Fisk caught back up with me. That wasn't sliding. OK, I was like, oh, he should have gone for level three there. Dude, I'm so worried about surviving this. I'm blocking that. I'm blocking that. Let's go. 21, that was, that had to be like the most important drop of the whole set. Oh, I couldn't, I was too committed. I wanted to do one more wave before I even thought about him super dashing. Let's go home, but he's still super dashing, huh? You don't get sliding off that.  I can't keep dropping. Oh, that sucked. I'm sorry, he got outplayed. That was a big brain fanatic.  I don't even play 18, and I thought that was safe. Try something. OK, he didn't try something. Not everybody's born a cheat. You had so much for watching this video. Hopefully you guys enjoyed it. Yeah, sometimes I guess this video, if nothing else proves, you can have fun with characters you don't know how to play. That barrier was so good. That barrier was so good. Oh my goodness. But thank you guys for watching this video. If you enjoyed it, let me know your favorite moment down below. And let me know your least played characters down below in the comment section as well while you're down there. Hit the like button and subscribe to the channel if you want to keep up to date on all things Dragon Ball fighters and fighting games. And there's some other videos you can check out that should be on your screen right now. Other than that, I have been Dr. Doe. Thank you so much for watching this video all the way to the end, and I will see you in the next one.


Welcome to the 35th session in the first module of the course Signals and Systems where we continue our discussion on convolution. In the previous lecture we had looked at discrete convolution and we had used a very simple and yet effective analogy called the train platform analogy. So we thought of convolution as a point by point or step by step interaction between the passengers sitting in a train and the passengers standing on the platform where corresponding passengers shake hands and the combined effect of the handshake is what we record as the value of the convolution at every step. And then you had this train move by one step and there was a new effective handshake and there you are. Now we go on to continuous independent variable convolution and we would like to build the same idea and to evolve a methodology for calculating the convolution of two continuous time functions. In fact, here let us begin with an example again. And we will begin with a very simple example of convolving two rectangular pulses and for variety we will take those rectangular pulses to be of different lengths or different sizes so to speak. Let us put down the question that we want to address. So what we are trying to do is to create a continuous independent variable convolution. We have two continuous independent variable functions, let us call them x1 t and x2 t. And we wish to calculate the convolution which we will of course represent as usual by a star and that is calculated to be x1 lambda x2 t minus lambda d lambda integrated overall lambda. This is done for each t and now as I said we will take the example of two rectangular pulse. x1 t is a rectangular pulse, let us be relatively general now instead of trying to restrict it to 0 or anything of that kind. Let this rectangular pulse go from t1 to t1 plus capital T1 on the axis of t and of course let the rectangular pulse have a height of A. Let x2 t be the rectangular pulse beginning at t2 and going up to t2 plus capital T2 with a height of B. Now without loss of generality let t2 be greater than t1. So you know here there is a choice to be made. We can convolve x1 with x2 or we can notionally convolve x2 with x1. However, we must now review the idea that we had established earlier. We had asked this question before specifically when we talked about how we would process an input going through a linear shift invariant system, we had talked about the commutativity of convolution. Let us just review that idea once again. So I had asked you to prove at that time I had left as an exercise for you to prove that convolution is commutative. I am sure many of you must have attempted that exercise by now. But let me now carry out the proof because it is a very important idea. So let me prove that convolution is commutative. What I mean by that is it does not matter whether you are talking about convolving x1 with x2 or x2 with x1 they are the same thing. We prove this indeed x1 convolved with x2 evaluated at t is integral x1 lambda x2 t minus lambda d lambda integrated over all minus to plus infinity. Put t minus lambda is another variable alpha for every specific t. Now notice that when you do this let us identify what happens to the limits. Of course lambda is t minus alpha and lambda equal to minus infinity gives alpha equal to plus infinity lambda equal to plus infinity gives alpha equal to minus infinity moreover d lambda is minus d alpha so we have all these little changes to be made. So if we make these replacements you notice that you can replace d lambda by minus d alpha t minus lambda is just alpha so I will write that down t minus lambda is alpha lambda is t minus alpha and then you have a minus sign and these limits also reverse. So the minus sign together with the reversal of limits cancels one another out. So this is cancelled by reversal of limits so what I am saying is that we could rewrite this as minus infinity to plus infinity x1 t minus alpha x2 alpha d alpha and that is the same as x2 convolved with x1 evaluated at t. And since this is true for every t it is quite clear that convolution is commutative. So you know for every t we have established for every individual let us write that down we have established this for every individual hence established x1 convolved with x2 is the same as x2 convolved with x1 for all proved. Now a very similar proof can be given for discrete time convolution for the sake of completeness let us complete that proof also. So what we would have there x1n and x2n being convolved. So x1 convolved with x2 evaluated at n is just summation on all k x1k x2n minus now again for a fixed n put n minus k equal to l which means k is n minus l and of course summation k going from minus to plus infinity is equivalent to summation l going from minus to plus infinity for a fixed n and for every fixed n therefore what we have is x1 convolved with x2 evaluated at n is also summation l going from minus to plus infinity x1n minus l x2 l and that is the same thing as x2 convolved with x1 evaluated at n this is true for every n hence proved. So we have completed the proof for the discrete case as well. Now we go back to the continuous example that we had begun with I would like to calculate that convolution. So you know your you notice I said without loss of generality you know. So let me draw the two pulses again and then it will be clear what I am trying to say. I have these two pulses which I want to convolve a pulse of length t1 and height a to be convolved with the pulse of length capital t2 and height b and I said it is without loss of generality that we said that one of them is greater than the other. We could take as we said b to be greater than a as we did there is no problem with that or I mean the longer pulse is the second b to be greater than a and t2 to be greater than t1 actually well that is not without loss of generality. I mean which pulse is higher or lower in height is not without loss of generality I must correct myself there. In fact it does not matter what the height is convolution is actually a consequence of essentially linear operations being done on the system. So when I scale up one of the inputs the output is scaled by the same amount. So in fact I can say a stronger thing without loss of generality. If I take pulses of unit height albeit of different widths so capital t1 and capital t2 need to be different for the general case and I need of course to evaluate it for the general case where t2 is different from t1 but I do not need to evaluate differently for different a and b. I could without loss of generality take a to be equal to b equal to 1 and then if I want the answer for any other a or b I could simply multiply the output by a b. So let me without loss of generality take a equal to 1 b equal to 1 and t2 greater than t1 as I did let me write that down without loss of generality we will take a equal to b equal to 1 and t2 greater than t1 here. This t2 greater than t1 is without loss of generality because of the commutativity of convolution it does not matter which one is longer the convolution would not change if we interchange that is why I am saying t2 greater than t1 without loss of generality. I am saying a equal to b equal to 1 without loss of generality because if you have any other non unity a or b you simply multiply by that a and then by that b alright anyway let us now calculate this convolution so we will set up the process we will have to have a train and platform here too the only change is that the train and platform are now very dense in passengers occupancy by passengers passengers are as close together as they can get tending to touch one another tending to become a continuum. So you know unlike the discrete case where you could identify this passenger and the next passenger the notion of next is there in the discrete case the notion of next is absent in the continuous case. Take any two passengers no matter how close there is another passenger which is between them and distinct from them these passengers are indexed by the continuous independent variable. So are now the question since we know the convolution process is commutative let me choose the more convenient of the two x1 convolve with x2 or x2 convolve with x1 one of them is likely to be more convenient and naturally if we have assumed capital T2 is greater than t1 it will be convenient to fix the one which is longer onto the platform and then move the train which is shorter. So we will move x1 we will make x1 the train and we will put x2 onto the platform and we shall work this out in the following session we shall work out the convolution entirely in the session that will soon come. Thank you.


Hi there lovers and friends! I'm with my lover and my friend Rick Shucks who has not been loved on in so long! So long. So long. I miss you. He had the nerve to tell me he's been in a relationship now for two years. Almost two years. Okay I feel like you're boosting because like I definitely have talked to you. October will be two years. So I did one of these videos with Tim DeLaGhetto which is like your sidekick and so I got the real deal this time around. I got Rick on this. Basically what we're going to do today is call some of you. I asked you to submit questions that you had about relationship sex or dating but this time I'm going to give you the straight up advice. I do a counseling service and during that service I don't necessarily have to say all the things that are on my mind because I want to give you advice that's going to inspire you not you know necessarily put you in your place. So I asked him when he was here I'm like do you have a friend who gives you that kind of advice? You want to know what he said? Yes. Rick. All right let's call the first person. All right. All right. You better keep that. That's pretty embarrassing. This is Shan. And Rick. Hi. Yay that was like a nice rehearsed TV show. I know. Shan and Rick. And Rick. Okay so explain your situation. Okay so Instagram pdm'd me and I had no idea who he was so I double checked with Tinder because I have a Tinder and we matched fair on April. I was in like a weird phase with like dudes at the time so I was like not giving him play the first couple messages he was sending me and then I realized that he was fine as hell so I was like oh I'm tripping so I tried to get on that and he wasn't like really giving me play back but then eventually we ended up hanging out. It was very much more of like a physical situation. It didn't go very far because I don't do that but it was just it was um it was an interesting setup interesting scenario and we didn't really talk after that but then I started going to the church that he serves in. He's actually in the worship team at this church and so basically we ended up talking later and he made it pretty clear that he's open to something a little bit more sexual but not something serious which I'm okay with the not serious part so right now I'm in this phase where I'm kind of entertaining the idea of having a physical relationship that doesn't go as far as like oral and like intercourse. Wait you say you're entertaining a possible sexual relationship that doesn't involve sex? Is that what I'm gathering? A physical relationship. Oh physical that doesn't involve sex. Okay that we're not serious we're not like dating for emotional purposes.  What would you say it like that? I am at a place where I'm like open to most just new experiences and I have no expectations for many ones if that makes sense. But you do have boundaries. I do have physical boundaries yeah okay okay. Yeah but you gotta know what you want like if you were right now hiring someone to come work for your company who are you hiring? You hiring a boyfriend or you hiring a make-up buddy like what like legitimately forget that the players involved what do you want? I know what I want right now. It sounds like she wants a good time. What everybody wants she wants a good time. The only difference with her and most people is her good time stops at 10 p.m. After that she gotta go home she's not trying to get into this. It's probably more like seven. No no no she's down with a little bit you know she should do some heavy padding. It wouldn't like to go out but she's not trying to go all the way there.  That's something you really have to say like vocally verbally I'm only going to do x y or z and nothing with d. You have to say that. If you're super honest with yourself what's your motivation for even considering this person your life like what value are they adding? You know what's interesting is that um and I just think that he looks so beautiful. I can't get this gorgeous. Hotness. I was right. Well you sound horny to me just being completely honest but you don't you don't want to want to be and that's that's tough. That's a tough thing to deal with um from what it sounds like you might be setting yourself up to crash your beliefs though. Yeah I would definitely say that this sounds like a situation where from the jump this dude has made it clear for you that he's not an ideal partner whether it took him 10 months to message you in the first place and then it feels like I could be wrong that you're making all the sacrifices so you're going to his church like you're the one who's like hounding him to meet up and then now you're at this place where he's made it clear to you what he doesn't want and you are trying to consider whether he he can fit inside of your world so it's not you who's like this is all that's going to happen and he's you know calling us right now and being like well this is all that she can offer how do I at least keep around in my life like you're still trying to make an accommodation for someone who has made zero accommodation for you and it's a recipe for disaster because essentially what this hot person is doing is they're making you question yourself worth so you get wrapped up and do you actually like this person or do you just want to prove that you're good enough for this person and that's a tricky place to be because one the answer is yes but if he's good at what he's doing which it sounds like he is he's going to keep you guessing that the answer might be no and that's not a thing that you can control I mean you might think that oh I'll just control it past kissing but that kind of personality type you'll find yourself it's like a casino investing more and more trying to get a payout that was never going to be there from the jump unless you're on the opposite side of that and you're just trying to use him for whatever it is you want physically but she don't know what she want no physically I mean she knows he's hot she knows she wants to go to her threshold with him but it's like that it are you just like hey give me that happiness in those lips and then leave me alone is that kind of your goal that you don't want to say I think that it's a combination of both of those things I definitely think there's a component of affirmation there because I can definitely admit that I've elevated him in my head because he's so beautiful and because I'll say that he's a highly visible person he has a decent following he's popping yeah and he has access to a lot of very beautiful women because he models so I think that affirmation that he's at all interested in me to begin with is an ego stroke okay so I do like that but also he's an amazing kisser so that's that's also yeah I'ma lean more towards Shannon's advice on this one then because I think that side will outweigh the other side yeah totally no I mean I had this situation this dude I met on tinder and he was so damn hot and I don't know what happened but like it's almost as if like a shadow came across the moon he just turned super sexual all of a sudden and he started make it out with me super heavy he was pushing so hard for sex like borderline begging like it was weird but he was so fine and such a great kisser and I definitely went back to my car and had to alleviate myself because the sexual tension was so hot you know what I did I blocked and deleted him that day I was like I know what this is I know this is trouble I know this guy's hot and fun fact later on I cast him in one of my videos so I feel like you got to be honest with yourself and be like this is fun and I already did the fun thing I already proved I could get this dude you guys already made out you've already gotten the affirmation so like take your winnings and leave the casino now while you still have your house and your deed intact yeah and I'ma give you some insight on the male mind now I'm not a hot dude but we all think the same no not like not like what she's telling me listen let me let me give it a good advice well thank you I appreciate that but let me give you this good advice there's no correlation with what kind of man chooses you and your value hot ass dudes don't only fuck hot ass girls you know yeah so the fact that he could have all of these women and he's messing with you there's nothing that's of actual value there so don't waste time with that thought that does nothing it means nothing for you but for some reason it's still just like I don't know addiction that's the reason not some reason it's just it's it's all he's got you hooked and he has you hooked on a psychological game there was this thing that I read this book called bad boyfriends I'm gonna recommend that you and everyone read this book it's like a lifesaver especially in your mid 20s but it was saying that like an inconsistent reward nothing makes a lab rat push harder at a button than an inconsistent reward so if they know whatever they push a button the food will come out they'll go about their business running their wheel chill a bit like they'll be living their life and push that button when they want food but if it sometimes gives food and sometimes doesn't the rat will become obsessed with it and that's the same thing with people as well too this dude is giving you inconsistent rewards and he's like giving you a little and taking away a lot and that in itself is gonna it's a mind game that you're going to lose and you're already losing it right now so you got to cut your losses I honestly this is a block delete and ghost situation I say get one more freak adventure out of him and then no because it's fun I mean with all the advice we just gave her she knows now that she shouldn't if she's going to not continue she's going to not continue but at least have a little fun before you do this that's my this is the horror movie where the person just like stays back for a second longer and loses their leg like if you just left when you knew it was shady you would have survived nah I mean because she already doesn't have an emotional attachment so he does though she doesn't it's emotional what you do no I don't yeah see but it is it's still her emotions are tied up in this I feel it in her but it's not emotional attachment to him it's all it's all about her it's all about her it's her pride I got that right you know I'm saying like what you said with the inconsistency he's not giving her that you got that feeling so it's making a try hard so get that and then leave if you leave now you leave with regret you leave feeling like damn I wonder what if get it again and then get out now my expert advice this is leave now I think that you just make the memories big those up in your mind and let them be a legend for you but then you get to leave being like on the high horse the high horse is a beautiful place to sit when you paint the picture down the line so advice battle okay advice battle but maybe let us know what you end up doing just text me but I think for sure this is a one and done situation I don't have time for dudes like that okay well thank you so much for for being here let me play along with us okay thank you for taking the time to tell me about myself okay DM me DM me let us know what you do I will okay all right bye bye bye she definitely texts him right now all right yeah thanks rick she's at his house


Hello. We are going to show you how to calculate a sum and a mean using Excel. I'm going to be inputting data. Again, my data consists of 12 numbers, and I'm going to insert it right here starting in D2. Notice how spreadsheet works. We're in the D column and I'm in the second row. I'm going to input 12 numbers. 69, 168. We're going to show you how to get a sum and a mean. Not going to be doing very much in this tutorial. We're still getting our feet wet in Screencast-O-Matic. Where was I? 68, 55, 99, 72, 59, 44, 88, 80, 74, and 71. That should be 12 numbers. It goes from D2 down the column to D13. It's always important to know where your data is located. Write it on your hands. D2, colon, D13. That's where your input data is located. The first thing I'm going to do is get a sum. Always write down what you're getting. So that you don't have to go look at the formula later. Yes. Also, when you show it to a boss, the boss will say, what is this? You'll say, well, it says sum. In column C14, I have the word sum. Now I want this sum to appear in column D14. So now I'm going to use what's called a function wizard.  It says insert function, a little f, a little x. That's called a function wizard. I clicked on it and I look for actually showing sum in average. But I can use this. That's one way to do it. Just use the sum feature or I'll show you another way to do it. Let's do it for the sum feature. OK, so I want the sum, say OK. OK, it's actually saying D2 to D13. Perfect. D2 to D13 and I say that's where my data is. I make sure that's where the data is located. I say OK. And there's the sum. There we go. 879. You can take a minute and check to make sure it's correct. Yes, but it's the sum of these 12 numbers. Now the summation symbol, you'll see it on the menu. If you go back up to the ribbon and you got this is a space saving ribbon. If you go to home and over to the summation symbol, that's a sum. And it would have done it too. That's the same thing. That's a Greek symbol, that symbol up there. That's called sigma and it's a summation symbol.  Yes, so you could have done it with that. I want to get the average, sometimes called the mean. OK, the average or the mean. I write the word average so I know what I'm doing. OK, and again, I want this where D15. OK, so D15 will be the average. What are the function wizard? Well, average is there. But if it wasn't there, I'd look under statistical look for the word average. Anyway, I got average. In the function wizard, click OK. Now, this is wrong. It says D2 to D14, as I told you, your data is D2 to D13, right? You automatically assumed if there was a number there that that's what you wanted. So you have to be careful.  D2 to D13, that's what your data is. I have no idea why Excel uses calls this number one. It should be called an array or input data. This number one is strange. I have no idea. But you'll get used to it. Yeah, you'll get used to it because you know what the computer needs. It needs to know where the data is located. Click OK. And there's your average, 73.25, you can tell your boss. Can't be easier than this. Can't be easier than this, exactly. OK, that's it for our first lecture on how to begin to use Excel for statistics.