All right, Defcon. So you're at the last talk of the evening. Please welcome Chris Eagle. Thanks very much. Can anybody hear me? Can't hear you? I'm Chris Eagle. Thanks for coming. We've got the Mr. Robot panel next door.  I don't know. I'm about tired of them. Oh, where'd my sheep go? She wandered off. Okay. Wrong angle. Not her best side. Okay, I'm here to talk about a project that I've been working on for lack of a better name called School Debug. And it's about emulating various processors using the Unicorn framework for emulation that was released at Black Hat last year. And because it's kind of what I do, it's all baked into IDA. And we'll see if it's interesting and go through a couple of examples and watch things crash. And hopefully have some fun. I've got to say this. Everything I say today is my own opinion. Not that of my employer and certainly not that of DARPA. They don't let me talk on their behalf. A little bit about me if you don't know. These folks down here in the front row are filling seats to make the room look full. I'm a senior lecturer of computer science out at a place called the Naval Postgraduate School in Monterey, California. Doing security related stuff for a long time now. Do a lot of reverse engineering of various sorts. Play a lot of capture the flag. I'll be racing back over there right after this talk is over.  Proving that just because it can be done doesn't mean it should be done. But that's what you're here to watch I guess. So this is really about CPU emulators. And they're useful in a lot of cases where you may not have a hardware to run a particular set of code on whether it's a well structured binary or just a small snippet of something like say a shell code. And you don't happen to have an ARM device or a MIPS device or a Spark device sitting around and you want to know how this thing behaves. So you're either going to become the world's best human MIPS engine. And you can interpret this stuff in your head and process it and figure out what's going on. Or you might want some help. And that's what I was looking for when I started thinking about baking emulators into things like IDA. Because in my particular use case IDA is virtually my desktop. I'm in it all the time. And I often have the desire to step out and execute something. Because perhaps my comprehension of the instruction set is not sufficient enough for me to understand what I'm reading. Or I just want to verify my suspicions about the behavior of a section of code. Like to run through it. Perhaps not an entire executable. Maybe I don't want to have to load up the elf and deal with the kernel loader and the operating system etc. And libraries and it's just a full blown execution environment just to run through five or ten lines of code. So I thought about this and decided if I could just run these lines of code anytime I wanted in some very stripped down environment wouldn't that be nice. We'll talk about how I got to that. I got there from here. You also may want to run code on obsolete platforms. Because you don't have real hardware to do it on. There's plenty of software emulators out there these days that do these kinds of things. But another use case for emulation. And there's another one I missed that I'm not going to go back. So emulators run the gamut from the simplest emulators that there are unicorns. In fact a fairly simple emulator. In fact it's not itself an emulator. It's not a standalone thing. It is an API that lets you point at instructions and execute instructions one or more at a time. Okay receiving some signals along the way. You can you can hook into it and get call backs and so on. And I'm really not going to talk about the inner workings of unicorn but I would encourage you to go out and try to find some of the slide decks that they've posted following Black Hat last year. There's some other presentations they've given at a variety of conferences. And dig into the project if you think you have a use for baking an emulator into anything. It is sort of to execution of instruction sets. What capstone was to disassembly of instruction sets. A fairly general purpose framework across many architectures that lets you script up things very quickly. And in this case we're going to execute things in just a few lines of code. That's the basics of unicorn. All I'm going to get into. But there are some fairly sophisticated emulators out there. I will refer to those later on. But unicorn is literally pointing at an instruction and update the internal state of unicorn and that is it. If that instruction manipulates hardware you're not going to get anything like that. Okay so the notion of a full blown emulator like a QEMU isn't what you're going to get out of unicorn. So the idea with this project was to build a lightweight CPU emulator available in a static reverse engineering context. I didn't want to have to go full on dynamic analysis with debuggers and processes and hardware operating system. Any of that stuff. I just wanted a very lightweight emulator that would let me step through code. And we can expand on it from there and I'll go into a little bit about the history and what led me here again in a couple slides. The idea is you're looking at some code. We step out of that static context. We go execute through some instructions in this emulated manner and then we take the knowledge that we gained by observing the execution state either to enhance our understanding of the binary or maybe incorporate some of that information back into our static picture to perhaps improve a disassembly, make some annotations, what have you. Maybe something as simple as utilizing a simple loop that you see in some code to decrypt, decode, deoptescape, whatever it might be. Whether that itself is code, self-modifying code or whether it's some data, some strings, anything like that and then bring that data or that information back into our static analysis without having to continue execution. Okay. And so the end result is what I'm going to talk about today. It's this lightweight emulator that I baked into IDA because if it's not in IDA I'm probably not going to use it. And that provides my static analysis side, my disassembly side and then the emulator as I mentioned previously is going to be based on this unicorn framework. I imagine if you're sitting in this room today you're probably familiar with IDA. So if you're not, okay, it's a commercial disassembler. There are some other disassemblers out there. We're seeing new ones every day. Binary Ninjas is a new one that was just released and maybe we can take this project and integrate it with that someday. But for now I'm primarily working in IDA. Supports a lot of different processor families and so that to me made it attractive to marry up with unicorn which also supports a lot of different processor families. Not as many processor families as IDA does. But more than one, more than two, more than three, I don't know, six or so. I'll list them out here in a minute. But it meant that IDA could understand all the code that I would ever want to emulate in unicorn. Okay. Because the processors that IDA supports are a superset of the processor architectures that are supported by unicorn. It's got IDA itself has integrated debugging support. So actual dynamic analysis let's fire up a process attached to it and pull in state. For x86 and ARM targets and it can do some remote debugging on some other targets. It also has a decompiler for 32 and 64 bit x86 along with 32 and 64 bit ARM. That's not entirely relevant to our talk today. Unicorn as I mentioned was introduced at Black Hat last year. Comes again out of the same group that did Capstone, the disassembly framework and now they have a tool called Keystone. In fact they may have talked about it at Black Hat. Anybody at Black Hat did they do Keystone this year? Yep. So they talked about their new project Keystone. I hope these guys keep coming back. That's like three years in a row. Capstone, unicorn, Keystone. They're all pretty useful projects. And Keystone is their assembly framework. So now we have a disassembly framework and assembly framework and an emulation framework. And you start to roll in these things together and you get a pretty powerful reverse engineering capabilities. There's the link out that their site is up there on the slide. It as an emulation framework is actually based on QEMU. So if you've ever used QEMU you know that it also supports a large number of architectures. And you might say well why do we have unicorn if QEMU supports a large number of architectures and in fact unicorn is based on QEMU. Isn't this just the same thing all over again? The answer is not quite. QEMU has a lot of support all the way down into hardware shims that lets you do full blown system emulation. We can boot Linux, we can boot Windows in the QEMU environment because it has that support for hardware interfaces and virtual devices and so on. The unicorn folks were not interested in any of that. All they wanted to do was be able to emulate processor instructions. They don't want the hardware interface. They're not trying to provide you network and video drivers or any of that stuff. They just wanted to help you emulate instructions. What does it do? Let's see. We run it in the emulator. What they did was they tore into QEMU, they ripped out all of that hardware abstraction layer and were left only with effectively the processors, right? The software CPUs that they then layered on top of. We instantiate a processor, we give it some state that it can manipulate and they give you access to that processor state and nothing more. Expose some of that up to a couple of different types of APIs and there you have it, right? A scriptable emulator. Supports the process of families that you've seen here, X86, about 32 and 64 bits, same for ARM, Spark, MIPS, and Motorola 68000. That's not all of the processor families that are supported by QEMU. But it's a start. It does take a fair amount of work to provide the interface to a given processor architecture. But I don't think it would be a stretch to add in some of the other processor families that are supported by QEMU if you wanted to enhance the capabilities of Unicorn. A number of projects, this is just one of them, have come along which make use of Unicorn. Some of them are pretty amazing and baked into a lot of very interesting analysis frameworks. I'll post a link at the bottom because you may be more interested in those than Unicorn itself because they provide somewhat more finished products. These are things that you'd make use of right out of the box if you did not intend to bake, if you didn't have a need to script an emulator of your own. So you can go find those out there and play around and so on.  There are some other emulators, as I mentioned, I talked about QEMU already, I talked about, I haven't talked about box. Box is another one. It is a pure x86 emulator. These are blurbs off of each of their project pages. Box is a highly portable open source 32-bit x86 emulator. While QEMU is more general, a generic, more processors open source machine emulator and virtualizer. It's a little bit more sophisticated than box. But it's also, there's a lot more to it than box. So could have gone with either of these, I suppose, but they really weren't geared to script around and just access just the processor bits. So this is sort of where I've been with this project. It's been kind of a long road. Unicorn came along and filled the need that I had and actually fulfilled a vision that I had back in 2003 when I built a tool called Ida x86 emulator. Where I wanted to do exactly what I described. I wanted to sit in Ida and I just wanted to emulate things. And use that to either transform my static analysis picture or enhance my understanding of the behavior of something. So I did that and at the time that I did that, I looked at those emulators, primarily box and QEMU back then, and thought, can I rip into this, strip out the bits I don't need and take just the emulator.  So 13 years later, 12 years later, somebody did it for me. And so then I revisited this project and retooled and that's again why I'm here talking today. Somebody did all the heavy lifting by stripping out all the unnecessary stuff out of QEMU and dropping it in my lap. Along the way, the HexRays folks did an integration between HexRays and Box. They did it in a slightly different way. I'll do two quick demos later on of what these things look like and the different approaches that you might take as you think about doing emulation in combination with a static analysis. And so they released a box debugger module that Ida could communicate with. And if you're familiar with Ida, you understand what the debugging views look like in contrast to the pure static analysis views. And we'll see that here in a few minutes. I did a similar thing for the MSP430 processor, which was the processor that got used for the micro corruption challenges. If any folks have seen that, they're a lot of fun. And they were, that was a pure MSP430 implementation and I didn't want to deal with their clunky user interface through a browser. So did this emulator. It was in a style very similar to Ida x86 MU. And then along came Unicorn. And it took me a while, but I finally decided to integrate it into Ida to see if I liked it better or provided, proved more useful than some of these other combinations of tools. As I mentioned, I looked at QAMU in box briefly, but there was going to be a lot of work. I didn't have the time to do it all. And again, somebody else came along and did it. And their approach, because we finally get QAMU involved in this whole thing, it gives us a lot more processors, right, than my particular approach, which was specifically an x86 emulator. And so I got that one narrow architecture and I've never had another architecture. And I've never wanted to do another architecture because doing an architecture from scratch was just more work than I wanted to get involved with. So this was a nice marriage for me. Now, to the implementation. In implementing this, I had to make a couple of choices. Again, hopefully people are somewhat familiar with Ida and what it looks like. Okay. With Ida, you get your standard disassembly view. And then there's this debugging view. But you have to do a little bit of work to integrate what you learned from the debugger back into the disassembly view. And oftentimes it involves overriding a lot of information in your disassembly view. So you might go into the debugger and learn something, but it's fairly transient in nature because you're starting a process and eventually that process is going to terminate. And the information that you learn vanishes with that process. There are ways to migrate some of that information back into Ida, overriding your original data in Ida. But you'd have to automate some of that and it's not necessarily a very clean approach. So the alternative approach is you don't jump out into a debugger and you find some way to incorporate emulation right there alongside your static analysis view. In order to do that, your emulation has to be able to maintain state. So you're either maintaining state entirely separately from what you're looking at in Ida. In Ida, you get to see an entire disassembly through the various portions of a program, your code, your data, etc.  But you need that in the emulation. So you either start modifying your database and adding all of that, those bits and pieces in there so that you expose them and make them available to view and navigate through. Or all of that information remains buried in the emulation and you have to come up with some way to propagate just what you want up into the static analysis view when you're ready to consume it. When you decided that you've learned what you wanted to learn and you're ready to annotate that static analysis. When I did x86 MU, I took the first approach and you're literally emulating on top of an existing Ida database. So as you do the emulation, your database gets modified. And there are some advantages and disadvantages to that approach. The disadvantages is obviously that it's destructive. So once you've modified something, if you're an Ida user, you know there's no undo in Ida. So once you've modified it, there's no going back. So if you want to see what it used to look like, you're either maintaining a separate database, a lot of snapshots, and it becomes a headache. But there, I have found it to be useful in many cases. The alternative approach is to take a debugging sort of approach. And generally speaking in Ida, that means you're launching a process and you're attaching to it in the way that a standard debugger would attach to that process, controlling the process, viewing the state of the process using Ida as a viewer. So you see what the running process state is. It gives you access to all the things you'd have in a typical debugger. And in this case, you're not manipulating your static view at all. That Ida database doesn't get changed at all unless you absolutely want it to. Your view is strictly into that transit process. And again, when it's done, you're done. Perhaps you learn something, perhaps you use it to update your state. The way you use that is entirely up to you. This is the approach that the HexRace folks took when they integrated box into Ida. Ida shells out the box. They created some IPC links between Ida and box. Ida pushes the state into box, including the code, the data that are being represented in that Ida database, and then tells box to go. It gives it an initial register state and then single steps or allows it to run freely as you see fit. Then pulls the data back out of box and shows it to you in Ida's debugger view. But again, once you're done, you're done and none of that updates your static analysis state. As I mentioned, there are some ways to pull state back into Ida, but it's entirely up to you how you're going to do it. I'll show you some demonstrations. I'll show you the two approaches and you can use that to understand what I did with Unicorn. In the case of Unicorn, the approach I ended up taking was the debugging approach because it just felt a little bit cleaner. I didn't want to get into updating databases and wanted to leave things flexible for the future. Might come along and implement it differently, but in order to implement it outside of a debugger, Ida doesn't provide you any tools to display something like registers, for example. Any of that execution state, while you're in a static analysis state, registers have no values, so you have to invent that user interface yourself. So that's one of the hard parts about doing it outside of the debugger state. My wife's probably sitting up here and not liking the slide, I don't know, or agreeing with her. In any case, I took on this task, trying to integrate Ida with Unicorn. A lot of unhappy development time. A supportive wife. A lot of time dealing with a mostly undocumented Ida interface. Dealing with a particular style of plug-in known as a debugger plug-in. Again, for those of you who know Ida, you know the state of its documentation. So I spent a lot of time reverse engineering Ida to try to learn how their debuggers actually work. Because there isn't much to go on there. At the same time, I was trying to integrate a piece of software that was really, I say, beta, that's kind of generous. At the time I was doing this, it was more like pre-alpha. So you never know where the problems lie. Is it Unicorn? Is it Ida? Is it me? And that's what led to bullet number one. But in the end, I was able to subclass Ida's debugger type to provide debuggers for all of the supported Unicorn processor families and end up with a debugger style interface for any one of these architectures that you could use to emulate code wherever you are. So if you're using Ida on Windows and you're running Unicorn and you open up a MIPS binary, you don't have to go find a MIPS platform anywhere. You can just pop out into the debugger and emulate through your MIPS code. And if you want to, you can utilize Ida's features for pulling some of that information back. Same is true for Spark or ARM, what did I say, 68k, x86, 64-bit x86 on the 32-bit platform or vice versa. So I got exactly what I wanted 12 years ago with a lot more flexibility. As it's doing this, you can go anywhere from basic, I've got five lines of code I want to emulate to trying to emulate through an actual process. If a code is formatted in the form of an executable like an L for a PE, the debugger plug-in tries to load that up and map that into an address space that is roughly what you get if you were to run it on the actual architecture the binary was intended for. There's a lot of challenges with doing that. Don't get to emulate through the kernel. We don't have a system call interface although I'll talk about later, one of my goals is to add the capability of hooking system calls so you can stub out some of the more common ones perhaps and provide some fake results back up into your emulation. So the debugger includes very basic loaders for PEs and ELFs that load those two file formats into Unicorn's state into the Unicorn emulation before you start up your emulation. It gives you stacks and so on. If you don't have a format that Unicorn recognizes or the school debug recognizes then all it does is takes the entire content of your Ida database and just copies it out into map sections in the Unicorn emulator. So however it's mapped in Ida, that's what you get out of Unicorn. It usually throws in a stack because that's something that you're going to need that you don't ever see in Ida but stacks are pretty useful and a lot of instructions make it useful. Some of the issues with doing all of this, if anybody's used Unicorn you might have some familiarity with building that. Ida is a 32-bit executable. Even though you may see well there's this 64-bit version of Ida out there, all that means is that it can understand 64-bit binaries. It is still a 32-bit native executable when you go to run it. That means that if you want to integrate with it you've got to build 32-bit libraries. So when you build Unicorn you've got to build it in the 32-bit library of Unicorn for the platform you're running Ida on. Whether that's Windows, Linux, or Mac. Unicorn unfortunately doesn't have very good support for building 32-bit libraries. They sort of assume that everybody's doing 64-bit stuff these days. Why would you want to build 32-bit binaries anymore? So we had to fix that up a little bit and they're getting better at being able to build 32-bit binaries. Doesn't also have, also does not have very good support for building on Windows. And that's primarily related to QEM use dependence on G-Lib. Which is not found on Windows platforms unless you reach out and you get things like SigWin, right, or Ming and install the requisite libraries out of those particular utilities. So this complicates Windows builds. In fact they don't have Windows built into their continuous integration. When you go observe how the project is, the state of the project out on their GitHub site. So it makes building on Windows a little bit tough. But it can be overcome. And in the end you're able to integrate Unicorn into Ida on all the platforms for which Ida is available. It's about all I'm going to talk about at a high level. It's pretty straightforward. Here's a disassembler. Here's an emulator. And it either works or it doesn't. So we'll see. I'm going to go through some demos and show you what it looks like. I'm going to start off with some simple de-opfuscation stuff. I'm going to show it to you in a couple different ways. I'm going to go through it fairly quickly. I'm not going to try not to get bogged down into the details of Ida isms or how to use Ida or things like that. I'm just going to show you what each of these things do, what they look like, and let you form your own opinions as to the utility of each and perhaps whether you prefer one approach to another. So if this all works out I'm going to use this old style emulator. Let's see. I've got to pick the right version of Ida. And we'll do this one. So you may recognize the section name. This is just a UPXPAC binary. And if all goes well here, I'm going to bring up this old emulator. Please work. It's coming. My machine's slow. This is an example of the original X86 emulator that I did in Ida. Good jokes. And what you're going to see here, assuming this works, is a crude like debugger console that's going to come up. We're not going to leave Ida's static user interface. I'm not happy with this. And we're going to be able to emulate through Ida without leaving its common interface here unless it never comes up. While that's going on, we may as well start the other one. Behind this door, we're going to try and do this with box. Ida's integrated box plugin. So in order to do that, we've got to switch our debugger over and you see Ida offers a number of debuggers. It's context aware, what platform you're running Ida on, and the nature of the binary that you're loading up. So you can see one of these is a local box debugger. And assuming I haven't messed this up either and still have box installed properly. If I choose box as a debugger, that doesn't do anything, we got to actually run it. So I'll set a break point at the beginning of the code here. I'll set a break point down towards the end over here. We're not going to jump out and execute any of these function calls because they jump out into Windows libraries. We'll just set a break point down here at the end. Maybe bring up a strings view. Try to convince you that it's actually doing work. All these strings, I don't know if that shows up at all. But these are the obfuscated strings that are part of the binary. You can see bits and pieces of strings but it's not fully de-obfuscated. And if box lets me do this, then we can start debugging. And this is going to toggle into maybe a segue back to the other demo. No, there's box starting up. I got too much going on in this machine. And so I just started off box. It's got this IPC channel between the two. And now Ida gives us a debugger view. We're not really running the process. All the emulation data has been stuffed into box. And box is going to do its thing. But this is a standard Ida debugger view. If you were running a process and actually attached to it, this is what you'd see. It's not the best user interface in the world. It's probably the number one knock against using Ida as a debugger. It's user interface is not great. But we can step through it. And the register state updates up here and so on. And we can let it run. And we should hit our second break point at some point down there. And we can go back and look at the strings on the binary. And maybe if I did this right, you're just going to have to trust me. I need one of those things. Yeah. Wow. It's got to pull these strings out of box memory. All right. Let's see how our other thing is doing. Look at that. It's like a cooking show. We've got a couple of things in the oven at a time. So this is back to the emulated view, right? Ida x86. You totally different view. We never leave the normal Ida interface.  It's very specific to x86. So taking this approach with other architectures, you would have to come up with your own interface, right? And replace all the x86 registers with whatever registers you have for that particular architecture.  Memory is really just the database. Everything you're manipulating is just a change to the database, right? And you're just, that's your memory store. You fetch bytes out of the database. You emulate them. You modify the database if that's what it says to do. But again, it's destructive, right?  And it's hard to see, but if you watch the blue here and it doesn't really highlight, that blue is stepping through various instructions and we'll jump down and it follows through and so on. And I can reach down to the same part of the binary, which is down here before these function calls. Set a break point and say run. And this is much slower than box because actually it's, all of the interactions with the Ida database are pretty slow. But we hit our break point and we can go back to our strings window and set this thing back up again. And we should have lots of interesting strings, right? Like this. And this is just an old IRC bot, but we got all these strings out of it because it's mostly de-obfuscated. And then you say you're done, right? We close this up and you go back here and in fact what was formerly empty space is now code that we can go and disassemble, right? We didn't hop into a debugger. We've destroyed our database, right? It doesn't look like it used to look, okay? But we've got de-obfuscated code and we just continue at this point doing static analysis, okay? So it's a quick in and out. And I consider that approach but for the user interface aspect of it, hey, I might have gone that way. Now let's see if box is behaving for us. And over on the box side, hey, we got hopefully the same strings somewhere. Yeah, we got all this library code. I have no idea where that's even coming. Oh yeah, here we go, right? And so here are the, again, it's an IRC bot and you can see registry keys in there that it's going to reference and so on. So we get the same result but we haven't modified the Ida database at all, okay? So it's like a running process, okay? And I would have to then extract this from box back into Ida if I wanted to make this data permanent, okay? So this is again the approach that I took and now we'll go do this a different way. This is where we thought those demos were bad. See how we do here. Set a break point up here. Try to set a break point same place down here. And this time I'm going to switch my debugger over and if it's installed appropriately it'll show up as school debug. So we do this and we go back up here to the beginning and we try to kick this off. Hopefully I hit my first break point, okay? And then the plugin looks a lot like box, right? So, but this is Unicorn handling this particular emulation, okay? So you get register state over here, right? Just like you do in box, okay? And any other debugger and so on. And at this point, all right, we can just step through and it tracks along and I can let it run and we'll do the whole strings trick. See if we get anything interesting, okay? Right now there's not much but names of the couple libraries that get imported and we go back over here and we let it run. Just hit go here, hit our break point, come back, rerun strings, okay? And like the other two emulators, now we've got all of these, right? Strings extracted from memory and if we go down to the bottom of the self-decoding loop, we can jump up and very much like box, right? This is the extracted code which we can then turn into code up here in our emulator or in the debugging session. But again, I don't have that back in my database and when I go to quit this, okay? I'm right back where I started from, okay? And I don't have any strings and if I follow the jump, right? Up here, you can see it's empty, right? Because this is the region in the binary that it unpacks itself into, right? So it's very much like a debugger and not a static, you know, overwrite or whatever you might want to call it. So that's it emulating on 32-bit x86 code on 64-bit Windows. Let's see what else I think I'm going to do, okay? Local ARM emulation, so Windows platform, no network connections, no ARM hardware. Somewhere I've got an ARM binary open. Let's see where this one comes from. There we go. Okay. It's an ARM binary from an old DEF CON capture the flag. Shout out to legit BS, right? Okay. One of their first CTFs. But ARM, ARM binary on Windows, okay? And actually it's not going to offer me any debuggers because IDA has no clue what to do with this, right? ELF binary, ARM, Windows, right? Don't do ELF, don't do ARM, okay? But the debugger recognizes the architecture at least so it says I'm available and it's the only debugger that says it's available. So IDA has already selected it up there and we can kick this off and now we're debugging ARM more or less, emulation. Don't worry about that. Awesome. We'll see what goes on. So there's some memory mapping problems there. Let's see if, yeah, not going to work. Clapping for my crash. We'll just pass all these exceptions down and it looks like it's advancing and maybe it's even updating registers. Okay. R2 is actually equal to one at this point. Okay. I left this open and it had some stale state and I think it's not happy with me. Okay. But that's the idea, right? We're in a debugging session and we can jump in and out of this without having to fire up an ARM environment, okay? Do any remote communications to a remote ARM device and then when we're done we step out and we're back in our IDA disassembly session. Okay. What else? Oh, now MIPS. Let's see. MIPS, I don't even have any idea how to read. So somebody out there probably says that's MIPS. I don't know. IDA thinks it's MIPS. Again, no MIPS debugger on IDA. I can't switch my debuggers. There's no other debugger option but you can see that. No, don't do that. School debug is selected. Okay. So we try to hit go here and hopefully we hit our break point from which maybe we can step. Okay. Although I don't have a stack. This is probably a bad choice. Let's see. Step, step, step, step. Right. And we're emulating our way through MIPS code. Okay. Yes. Five minutes. Great. Because I am tired. Okay. So we hop out of that and we're again back to our disassembly view. Okay. And I'm not going to go into the ways you integrate, you know, what you have available in your disassembly view and what you have available in your static view but suffice it to say there's ways to pull information back across if you decide that it's useful for augmenting what you have on the static side. And last thing I'm going to do is take a look at one of the challenges from DEF CON qualifiers this year. Okay. And what this was was a binary that they gave you a thousand of them. Okay. And when you went to interact with the competition, they asked you had one minute, right, to craft an exploit for one of these thousand binaries that they gave you the file name for. So you downloaded a thousand binaries and you had a minute to craft the exploit. So it's going to take a long time to do all that by hand. Okay. So you want to automate this and you want to have an answer in your hip pocket when they say give me your exploit for binary number one. Okay. So how do you automate? Well, it turns out that all of these binaries have roughly the same pattern. And I'll describe it not by looking at the code but by looking at the stack and there's two buffers in here. Okay. And all of the binaries differ in the location of that user input buffer in the stack relative to the save return address, the size of that user input buffer in the stack, and then the content that gets placed into what I've called a canary string right there. So they gave you a free overwrite out of that user input buffer but you have to figure out how much do I have to overwrite to clobber EIP. Okay. And after you've done that, right, which is not a problem, there's nothing hindering the overwrite, but they come back and verify that the canary string matches the original canary that they placed in there. So as you do your overwrite, you've got to rewrite the canary in there and it better match their original string. But all thousand binaries have a different canary and it's not always obvious exactly the way they set it. They compute it, they copy it in one byte at a time, they do a string copy, they do it a lot of different ways. Okay. But they always end up doing a string compare at the end. So if you can put a break point at the string compare, right, and hit it, it doesn't matter what you filled the buffer with, you can do some other computations to figure out the distance from the start of your buffer to save the EIP, set a break point on the string compare, right, look at the required argument that's sitting on the stack and pick that out and these become your parameters. What's my canary got to be, right, how long is it from EIP all the way down to the buffer and there's a couple of other constants that you needed to pick out. But I didn't want to do this a thousand times by hand, nobody did. And there's some good write ups about using some other automated systems to solve this. But what I did was I scripted up this emulator and the emulator, let's see, somewhere the script exists down here. You see things, because this is implemented as an IDA emulator, right, you get all of IDA's debugger scripting, I'm sorry IDA debugger, all of IDA's debugger scripting can be used to drive this thing. Right, so we write the script, we load the debugger, we set some debugger options to break on start, we run to the start address, right, we do some things, okay, we get the value of EIP and I'm picking out all of the arguments, all of the bits and pieces from a dynamic environment, although I'm not actually running a process, I'm just emulating through it.  And what that looks like is this, okay, we run IDA in batch mode and then I'll be done, I promise. We got this one and we've got which one? This one. Okay, so I got two windows right here, I'm tailing an output file on the bottom, okay, I'm going to use IDA in batch mode, you can see the long command line there and what I'm going to do is I'm going to run that script that I wrote and I'm going to run it against one of these thousand binaries, well in this directory there's 300 of them and they all scroll up like that and we'll see if this will work and make sure I clear out some stale files. Namely I got to kill that IDA session because it's going to get in the way of the batch run and we'll try this out. Now you'll see IDA flash, you have to look in the background if everything works, so IDA is coming up in batch mode, we're in debugger mode, it's done, you can see the output down on the bottom, right, that quickly it got into an emulation on that elf binary, okay, ran through main, picked off the parameters that needed and dumped them out to me, now I wrap that in a loop, do it for every file in the current directory and I've got my thousand exploit parameters and I'm ready to connect to the remote side. Okay, so for the future and very quickly, a better user interface when launching the emulator would be nice to be able to specify some register state, right now I just take a guess, right, where do you want to start your emulation, do you want any registers to have particular values, so I'd like to have that done up, some options for mapping into particular memory regions or loading other regions, if you're familiar with IDA and debuggers there's a very useful interface called app call that just, that actually lets you incorporate functions or call them almost natively from IDA Python, right, call out and have your function run and then spit the value back to you in your scripts, I'd like to have a hooking library to be able to hook various functions and do things maybe other than what the emulator's doing or provide shims for library calls or system calls, things like that and I'll also perhaps add the option to go ahead and pull in all of the shared libraries that a dynamically linked binary might link to so you can follow the library calls down into a shared library function and emulate your way through those if you wanted to do so rather than writing all the shims for them. It's out there on GitHub, it's out there today, I will push all the latest changes shortly after the con but if you're interested, I'm always interested in feedback, if you want to collaborate I'd love to hear from you, if you have ideas on features that might make it more useful and you don't want to implement them, at least share them with me and maybe I'll get around to them or find somebody who might like to implement any of your ideas and that's it and I'm happy to take questions and if not, if no questions please enjoy the rest of your con. Thank you. Do we have microphones somewhere for questions? Yeah, I'm supposed to direct you to a microphone so it gets picked up, you can come up here. Microphone is, oh it's right here, it's right over here. Drink, don't forget your drink, that's right. Hello. A couple slides back, you mentioned the two console output windows, that's the wrong way. How do you recognize what magic 4 bytes over IEIP and how do you deal with bad characters? When I was doing the scripted demo, so what I did was in the scripted demo, what I had to do was I had to study a couple of the binaries manually, right, not a thousand of them but I looked at two or three of them, looked at the first one I said, well this is clearly an easy stack overflow, I understand if it was just this one exactly how I would exploit it, then I looked at another one I said, oh this one is subtly different, what's different about it, and can I develop an analysis that walks through the program and at certain key points in the program picks off certain things for me, okay. So what are the parameters, where is that buffer getting copied really, the string or the string compare gives it all away, it tells me the start of the user buffer and the start of the canary buffer and from there what I can do is do some math to figure out where saved EIP was, okay. Third binary, all of these things again looking similar and so I took what I learned from looking at three binaries, developed an automated process that I would apply to the three binaries and then it extended nice and neatly to the thousand binaries which was roughly what they intended and what they wanted to do was force you to do it quickly, right, so you weren't gonna be able to, if you tried to reverse engineer all thousand to develop these answers you wouldn't have finished in the weekend. So I don't, does that answer your question? Yeah, yeah, now I'm assuming that's the logic you have to hard code into the program or does it auto detect that? That's the logic that you have to bake into the script that you write. So through here, right, are some various things that I was looking for, right, extracting some register values, I'm stepping one instruction at a time, I'm asking, you know, am I at certain types of instructions, I'm counting the number of calls that I've encountered because the third call down, the chain was gonna be the stir copy and when I got to the stir copy or the string compare, you can see what I'm doing is I'm picking some arguments off the stack, right, that have been placed here that are passing to the string compare and then I'm using that to derive all the information I need to craft the exploit parameters. Okay, awesome, thank you. Sure, any other questions? You trying to get me out of here? I think we're done, thanks very much. I'd be happy to talk to you off to the side of the stage, thank you.


When Spanish invaders eventually settled down in Mexico, they reached Cholula and built a symbol of their conquest there known as Iglesia de Nuestra Señora de los Ramidosa. The Spanish built this atop of what they thought was a large hill with the best vantage point. They hadn't realized that the hill on which they built this church atop was in fact the Olmali Cholula Pyramid. How this never dawned on the Spanish is just astonishing. Standing 450 meters wide and 66 meters tall from end to end, the Great Pyramid of Cholula is equivalent to nine Olympic-sized swimming pools. For an obscure temple no one's heard of, Cholula holds an impressive array of records. It's the largest pyramid on the planet with a base four times larger than the Great Pyramid of Giza and nearly twice the volume. Never mind the largest pyramid, it's the largest monument ever constructed anywhere by any civilization to this day. To locals it's aptly known as Tila Chilopetit, man-made mountain. Thanks to the church on top, it's also the oldest continuously occupied building on the continent. The story goes that until the locals began construction of an insane asylum in 1910, nobody knew it was a pyramid. Despite its enormous size, very little is known about the pyramid's early history. Its thought construction began around 300 BC by who exactly remains a mystery. According to myth it was built by a giant. Most likely the city's inhabitants known as the Chuloteka were a cosmopolitan mix. The pyramid is described as the Russian doll of a construction, consisting of no less than six pyramids, one atop the other and it just so happens that it's conveniently located in the Mexican highlands and was an important trading post for thousands of years, linking the Chuloteka Chichimeca Kingdom in the north with the Mayan in the south. The huge construction is still covered with soil and vegetation today and nobody really knows why it fell so far out of favor with people and even with the memories of people. But it can be hypothesized that this was due to an ancient cataclysmic event that affected the entire planet's cultures, causing floods, earthquakes and scenes of utter devastation across the globe. To understand what was going on in ancient times, why pyramids? Why everywhere? A new study of pyramids and their relationship with volcanoes has been proposed by our friend in academia, Stingen Vandenhoven and we will of course link his paper below so please check that out after the video. With this idea Mr. Vandenhoven tries to understand why a whole world started building similar structures, ignoring the obvious most given answers and looking for a possible deeper meaning behind this worldwide phenomena. It starts with a first clue, Pira Mid, which translates as fire in the middle. Ben Ben was symbolic for primeval mound. The author struck on the idea while looking at a photo of the Chulula pyramid in Mexico known as the largest Mesoamerican pyramid with the volcano in the backdrop. This sparked a quest to find out if that might have been of significance and it has proven to be so. Even though earlier researchers have suspected the pyramid to be related to the primordial mountain, as far as the author knows, no specific correlations have been put in paper in relation to volcanoes. According to Steven Meller, the word pyramid is derived from the Greek words Pyramus and Pyramidus. The meaning of the word Pyramus is obscure and may relate to the shape of a pyramid. The word Pyramidus has been translated as fire in the middle. In alignment with the indigenous tradition, we use the interpretation house of nature, house of energy, per netter. We know the ancients revered the primordial mountain as per Egyptian religion. The mountain reoccurs in many religions worldwide, often depicted with the pole star on top or a bird on top like the Ben Ben bird or the winged sun disk seen on top of a tree. According to the Thunderbolts project, it was given different names in different cultures. The Egyptians knew it as the primordial mound, the Israelites as Sinai and Zion, and the Greeks as Olympus and Parnassus. Further afield the Indians call the divine peak Meru or Su Meru. Mr. Vandenhoeven states that there is one very important link researchers and academics worldwide might have missed, which is the relation to the volcano. The pyramid, temples, temple mounds and platforms that are linked and aligned to volcanoes across the globe. Why volcanoes? Well, this is the primordial mount, the joining of alchemyl fire and water to create new land or a possible destruction and deluge by volcanoes. Could it be that the deluge or destruction is commemorated with pyramids as centiphas and monuments such as a possible deluge or destruction of homeland or did the ancients see the phenomenon of death and destruction as the most powerful of nature's forces? Not only is the pyramid a representation of that primordial mount that rises from the sea water and fire combined, it is also directly related to some of the world's largest pyramids so obvious in plain sight as a background to the building but not explicitly mentioned as related to it by any researcher. Not in relation to this subject in Mesoamerica and also not in a global relation in different countries worldwide like Bali, that was the volcano that caused the temple or pyramid to be built. Some pyramids and temples are directly positioned on or near such volcanoes making it a small copy of the large mountain behind it as seen in Mexico and Bali an ocean apart with no cultural links whatsoever according to conventional academic research. It definitely cannot be brushed aside and merely sneered to as just a coincidence. The Aztecs gave the name Mikokoti Street of the Dead or Calzada de los Muertes in Spanish to the broad street-like series of connected plazas in Teotihuacan. It points directly at the nearby sacred peak of Sierra Gordo, not any mountain, again a volcano. The street of the dead was once erroneously thought to have been lined with tombs but the low buildings that flank it probably were palace residents and the author of this particular research does not believe the pyramids are the pyramids of the sun and moon. He suspects they represent the two large volcanoes southwest of Mexico City and that the reason that the street of the dead connects to one pyramid is exactly that because the volcanoes potentially could have caused massive death to a pre-civilization. The old Toltec city of Tula was on the other side of Mexico City much closer to the volcanoes and that the newer cities are deliberately further on the other side. Could Teotihuacan and Chalula be cities that came from Tula that was abandoned and destroyed by volcanic eruptions during a cataclysm? Could it be asserted that the true meaning of the pyramid shape is the volcanic mountain? Could that be the reason why they mimicked the two mountains as pyramids in Teotihuacan and linked the street of the dead directly to one pyramid? That thesis would require more proof to be validated and hold any academic grounds and we're going to go into Mr. Vanden Hoven's theory in part two on the subject. What's the thinking on the matter? Comments below and as always guys, thank you for watching.


Marcia Joyner and are you counted? Today we are with our great great people that are out trying to make all this happen just for you and this is the census, census 2020 and they will tell us what the census is about why the census and how it impacts you and we need to know that you are counted. So Annie Mae? Hi Marcia, how are you? That is such a lovely name. Thank you. And we have a new guest, Jesus. Annie, would you introduce Jesus and tell us since he's the newbie on this? Sure, yes. Jesus is our new partnership specialist but I have him talk more about himself. Yes, my name is Jesus Arriola and I am a Hispanic Latino partnership specialist so I help the Spanish speaking community members complete their census. Wonderful. Now so let's tell us because Oahu is that, I hate to say this, the Hispanic people or Latinos or both, is it just for you, is it just on Oahu or is it for the state? For the state. For the state.  Yes ma'am. Yes, we'll be in Maui the first week of September and we're hoping to go to Hawaii and Big Island as well just to help and just let everyone know about getting counted. So how are we doing with the count? Yes, we're very excited to share with you all how we are doing here nationwide and at the same time for the state of Hawaii. Nationwide today we had a self-response rate of 64.6% and for Hawaii we had a self-response rate of 61.5%. So I'm gonna be mentioning a lot of numbers but just to clarify self-response rate or our score that's when people responded voluntarily and proactively responded to their census online over the phone or sending back their paper questionnaire but we also have what we call now the non-response follow-up and it's been going on since July 30. Our census takers are enumerating and visiting households who have not yet responded and now because of that effort we have a total enumeration count here in the state of Hawaii of 85.3%. So that's very good. 0.3% of us are already counted. That's great. Yes, so thank you for everyone who's been helping us making it happen and if you are one of those who enumerated yourself and you know self-responded thank you so much. Well, well for our audience that may not know that we're partners with the census and we have been here once a month for what since January? Actually since September of last year. Thank you so much. Yes, you're one of our longest standing partners since we started Miss Marsha so thank you for having us. It's great. We did respond and like I told you early that if everybody responds and I do mean if and I push and push and push that if everybody responds we would have enough for a third congressional district for three CD and I want that because now we are only four people in the Congress in the two senators and two in the house so so we get out the cellar if we had one more congressional district. So that's my goal with the census is to get tell us how that's counted. How who makes the decision on whether we get another congressional district? I noticed that some states lost congressional districts. How's that determined? It really depends at the moment we cannot really say if how many we're gonna get or not. It really depends on how the final count in after this 2020 census data field collection is done and our headquarters are going to process it to make sure that we have you know a complete and accurate count and then we will have the apportionment count later on and we will know by December 31 if we gained or lose seats so that's for this you know if the state got more and apportionment seats I would just redistribute it but that's why it's the 2020 census this once a decade census is so important to make sure that we have the right representation in Congress who can be our voice in in the national government. So who makes that determination? How's that after all of this I know goes to the president on the final day but who makes what how is that determined? Our experts in the census headquarters are our statisticians and our data scientists will make that you know after everything is processed that determination will be done. Yeah and just so people understand what I just said it just doesn't matter whether the president wins or loses he will be in office on the last day of the year so the census is turned over to him so just just so people don't think I'm yeah it doesn't matter um yeah the statutory date our deadline is December 31 and so that's why it's so important to be counted to make sure that our state has you know the best chance you know to get our um the number of seats that we deserve as a state. Yes so now Jesus tell us about you. All right miss Marshall thank you for having us yes um so I've been working with the community members nonprofits and small businesses to try and partner to just get the word out let people know you know the census is here let's get counted and then the importance of it you know um I know over the last couple months we've gone over with everyone about how the federal funding comes to the communities through the census numbers how roads and schools are you know built determine on the data and and again it's once every 10 years so the data that we are able to get today will determine the next 10 years and it's really important for a lot of the community programs so I mean we see it firsthand and now we see it it's probably more important now than ever and and with that leading into reapportionment for our legislators and as well as you know the importance of voting it's the civic civil engagement is very important so that our voices are heard and so that we can actually get programs and get the need that we get the needs and resources that we need. Let me add one thing I just read last last month I guess in Arizona in the 10 10 census the natives the the tribal people uh were counted as other they were not listed as native americans or indigenous or whatever the tribe name is so they just were put other now when we had the pandemic and they got nothing no nothing because they were other so it was then that I understood that the real especially here where we have um what do you call it um Hawaiians that that said well they weren't americans so they weren't going to participate and we had the marshallese and the micronesians and they're all lumped in as Pacific Islanders so is there is it important other than we saw what happened to the native in Arizona the native americans got nothing from this money for the COVID-19 and there was you know no water no nothing so are we by not getting a real good count of the people that say they're not american and they don't just participate is that going to be a problem here like it is in Arizona and the impact for this you know discount definitely when we have an undercount and we missed out we missed some people in the count we don't get enough funding that goes into again what Jesus mentioned earlier schools um water systems health care you know hospitals it really matters that we are included you know um that you are counted and we you know you we know where you are because that's when oh this community needs this um this funding for example language access right Jesus and I we work with a language specific community and also with everyone but I'm a Filipino speaker so I work with a Filipino community and we want to know where the Filipinos live for example because maybe that community needs language access more language access so that there can be funding for language access later on for example so those things matter and we really have I think one thing that I have to applaud the census is that they really focus on um you know making sure that uh our field staff like people like me and Jesus and even our census takers in the field are from the community we speak the language of the community so that we can really reach out and communicate um to you know the people that we want to make sure are counted so that you know we're not missing anyone out Jesus you want to add to that I completely agree and it's very important now I'll remind everyone it is a self response so it's really you know when you're going through the questions you're self responding so when it comes to and I know we'll talk about this the the race or the Hispanic not Hispanic it's really up to the individual and the household to determine how they want to be represented and it does matter so when you mentioned the incident or the situation in Arizona it just goes to show how important this is and again I'll reiterate we see the need now and we see that you know we really need correct data in order to assess and then act upon what's to come and this is again for the next 10 years so there won't be another count until 2030 so between then and now and then it's very important to be able to know who's in our community and and have them be heard and I think this is a very good step to start this new decade you know we're off to a very challenging time where we have to be innovative and we have to think outside the box but again it's all going to all the data is going to relate to what decisions are made because the data and the numbers are the foundation of the decision making we have a question how do you get responses from people who haven't answered because of COVID so yeah we would really love to talk to our community about that currently we have our census takers doing the hard work in the field right now they are still doing door-to-door visiting households who have that yet responded however it's not too late um you can still go online um at my2020census.gov or you can call<PHONE_NUMBER> if you want to complete your census over the phone or you can mail back your paper questionnaire to us if you don't want a census taker to knock on your door and and get your answers however we want to assure our community that our census takers are trained to do this safely and we are following CDC and local guidelines to complete the interviews and enumeration in a safe manner they're going to be wearing a mask and they knock on the door conducting the interview in a social distance way um so we want to you know reassure our community that we are doing this in the safest way however if you you have um the option to really just go online and do it yourself do you have a number we can put up for the through contact yes um contact number yes<PHONE_NUMBER> um that will uh you can immediately talk to you know a census representative we also have 12 other non-English languages um that you know you can access um from our website census 2020census.gov and you can um look at the available languages there if you want to speak to um in you know your native language now what about the people who don't have internet connection how do you reach them so they can um if they don't have you know access to internet we have radio actually we have a lot of partners helping us right now reminding communities over the radio in the airwaves um if they have tv we have such a massive you know advertisements over in you know in cable tv uh you know reminding them to respond to the census we are we also sent paper questionnaires we also sent postcards um we are we actually have seven reminders uh to communities just so um they you know since march we've been doing this since march and you know just to remind everyone and make sure that we don't miss out anyone what about people that don't have street address but they have a post office box let's say they live on a farm um how do you reach those people that don't have street addresses we actually also sent um postcards to them miss marsha in the po boxes we actually yeah we actually change a little bit we have to be innovative as susan right so we adapted and sent reminders to them our local partners sent reminders as well with all the information and ways to do and to respond to the census we also have um we did the update enumeration or actually update leave enumeration where we actually census takers left the paper questionnaires on their back you know in in their front porch or whatnot so they can see it and they can just grab it and fill it out so we really are trying our very best to make sure that we don't miss um any household well what about um homeless people houseless people are they coming that's a big community are they counted of course is this you want to speak about that as well yes of course yes they are counted they are part of our community and there are different operations and groups that have different roles and there are people that went out and have already built a relationship with our our houseless communities and made sure that they had the opportunity to self respond and then if they didn't they have the the follow-up where you know i'd like to mention that we have enumerators we have people in the field and you know we just asked that you remember that these enumerators in the field are your community members they're our neighbors our nieces our nephews our you know aunties and uncles they've stepped up to the call to work for and support the census and we just want to remind the community to remember that when they come knocking at your door and you know know that it is a service they're they are there to help us get account for our communities so please you know remember that and be nice to them uh they're very why they're going to be nice yes yeah yeah also to add to hasu's um comment as well we actually are working with our local service providers who are servicing um we're providing services to our um you know our community members who are experiencing homelessness and we are going to be doing a massive effort this coming September 22 to 24 um we will be enumerating food kit of soup kitchens um and other areas for our um houses communities maybe during those dates so we are working closely with our state and local city governments and non-profit organizations who are working with homeless communities so that um you know so they know the people they know where they want yeah because yeah they know where to go and they already have again that established relationship with them and so we can have that um a better count and that's gonna be September 22 to 24 okay good next well what about the prisons that is under a group we call it a group quarter enumeration and our um operation side our aco is already work uh also is working with our um um correctional facilities on that so they will be counted um there wow this is a quite an operation yeah actually group quarters we're almost done hasu's right I want to say yeah yeah so we're at the end I mean we look to complete our our field work September 30 so right now you it's more of the the non-response follow-ups with our enumerators so that's really uh we're leaning towards the end of uh the census count now um what I've heard the Micronesian community was living in very close quarters and now they're talking about because of COVID to move them into a hotel so do you lose those people to get what happens in the count let's assume we've already done that neighborhood and now they're moved to a hotel do you lose track of them how what happens um that's a very interesting and you know very timely you know currently happening situation right um we have like this we actually have a not native Hawaiian and Pacific Islander partnership specialist and she just um talked to us about that um last Monday during our meeting so so glad she talked to us and you know shared um the current flight flight of you know our Pacific Islander community members um we are working closely with them um we have partnership specialists we're making sure that they are you know we have reached out to them and that you know they will be counted um yeah so one of our colleagues are already taking care of that situation but thank you for bringing that up we don't want to lose anybody definitely definitely yeah I'll add I mean um we are counted where we were April 1st so that's really the key date of where you where we were um and that's where when the questionnaire asks where were you uh living April 1st or where were you staying April 1st so that it doesn't get mixed up um so that's one of the key um points is to remember when you fill out the questionnaire if you have questions please you know feel free to call that number we have professionals available to assist you in many different languages but yes it is April 1st count but okay now assume that you are a barn student in dormitory I guess we didn't have people in dormitories April 1st did we everything was locked down but let's assume that you were in a dorm or you were still in school someplace and um that's where you were April 1st but now that you've gone back to where you were from let's say assume Australia what about that person are they still counted or or did we just lose them so actually um early on I think around May our um the census bureau um wrote to our um university leaderships across the country to make sure that we don't miss the counting our college students um during April 1st so we are working closely with universities as well um to make sure that um we don't miss that we didn't miss any of our students so there's a partnership there so even if they were foreign students they were still counted yes because we um yeah the university um is helping us make you know account for the students who are there now okay we everything is so screwy and they said they were going to stop the date early stop the counting early is that still or are we doing better now so in terms of um our end date September 30 yes so um we are doing really well um and we are trying to catch make sure that our we can be you know we are ready by our deadline of September 30 is Marsha okay yes and again want to post the contact number for anybody that didn't get it the first time the telephone number or web page or whatever so we can reach you yes just go to my 2020 census dot gov or call<PHONE_NUMBER> um and you can complete your uh census form as well now if i know somebody that didn't you know for some reason or other missed it as a just ordinary person can i somehow encourage them to to do this or doesn't as a just a neighbor or something you know let's assume that i have a neighbor that has dementia can i as a just ordinary person can i help can i do anything yes i we encourage everyone to share about filling out the census so we do encourage everyone to reach out to your friends your neighbors um the community and we have a lot of partners that are in our community nonprofits and for profits so for example the Hispanic Chamber of Commerce Hawaii has events that are being uh collaborated with the census just to remind people you know the census is very important it you know it affects everything from the community small businesses to the legislature um so yes please remind your friends and family neighbors and at the same time if you see some virtual events out there you might see the census is right there alongside of it and we're excited to be able to you know just connect with our community and especially this time where we're all in this season um and we're seeking community interaction and all we have accessible right now is this virtual option we want to encourage everyone to stay flexible and and to stay connected um and this is one way right um so again nonprofits and for profits they're teamed up with the census and we just encourage everyone to take part okay and we at think tech our partner and i must tell you that it's been a pleasure being with both of you as usual and we'll see you next month census will be back with us but in the meantime if you have a neighbor that hasn't registered if you know anybody call the number and we are delighted and hopefully we can reach 100 before it's over before september so thank you asos and anime thank you so much it's always a pleasure being with you thank you so much miss marsha we're very happy to be joining this with you with you thank you for being there thank you so much mr marsha aloha and we'll see you next time


Welcome to Senior Moments. This is an interesting program today. We're doing it with the veterans of foreign wars here in Mount Payer. This is a craft fair that is being handled by both the St. Augustine's Church and the Northfields Veterans Place where the vendors will be supporting these two causes today. And we have 25 vendors here and this is going to be a full day because all of these people here have some great crafts and we're really very excited about having this beautiful day to be here and I hope that all of the craftsmen will do very well at this particular point. We'll do a couple of interviews and as a matter of fact, we'll see what some of the crafters are doing these days and get their ideas and what the market is. And this is a panorama of the 25 that are here. We've got quite a few. Really, it's some excellent crafts here for today. I just hope that the people come out because these people put a lot of effort into doing what they do and their prices. It's almost all personal. And so it really is a great, great place to have.  Okay, but that's good. We're here today with this wonderful craft fair that was going on at the VFW and we'd like to talk with Michelle Smitty. And she has an interesting product here because the scents that are coming out of here, matter of fact, she did a couple of fairs with me before and she always hands behind this lantern and like that and I looked over there and I saw her and I said, whoa, boy, she looks like an angel. If he only knew. We'll let him think that. Michelle has another job too as well but she's been doing this for how long? This is almost my third year. I'm coming up on my third year with Sensi. It's a newer company to the DS market. We've been around for about 14 years now and it's all about home fragrance. So we have what we started with is our wax and our warmers. So you put a cube of wax into the warmers and the light bulb or an elements warmer heats up the wax. It's all made with paraffin wax and it has natural and essential oils in it to get the fragrance. We also now have a laundry line, a cleaning line. We have body wash, hand soaps, room sprays. We have scent circles to hang in your car. We have scent packs and these scent packs are great to put in hockey bags. Come on, this is like Barry Montpillier-Hermont. We're good with hockey, right? These go great in the hockey bags to get rid of some of that stink that your hockey players have. But what they were originally designed for is to go in a Sensi buddy. So we have buddies that we come out with and they have a pouch in the back and you stick the scent pouch back there and this is a great little cuddle buddy for any child. And you can even get a French lavender scent pack and give it to them at bedtime to help them fall asleep at night. So that's my favorite little trick for moms. But we have lots of great items to choose from. A little bit of something for everyone's household here. That really is working very well on it and that's just, you're doing it with electricity, huh? Yes, it's all like... You activate it with, and so it must be a very popular, that sets up everybody. It's like way over there. It's a... A couple of people are like that and they're selling, you know, big goods and like that and they see this sent over here. That one is our diffuser. So it takes water and natural or essential oils and then it does have 13 different LED lights so you can interchange the light if you watch it long enough. It should rotate through the colors for you. And you can actually set it on each one individually if you like a particular color more. So you can leave it on one color or let it rotate through. And it has two settings for the diffuser as well. It has a high setting or just a lower intermittent setting for the diffuser to put the fragrance out in the air for you. That sounds really great. Thank you, Michelle, for doing this for us.  You said... Finisher, is it Swedish? I have no idea. I married into it. Oh, you married into it. I know my first name is Greek because it's an odd spelling. Yeah, that's right. Cor. K-O-R-E-N. Yeah. But the last name, I don't know. And this is a national firm, isn't it? Yes. It's pretty new to the area. Agnes and Dora. It's women's clothing. I love it. Super soft, comfortable, made for everybody. And one of my favorite things is almost all of it has pockets. You're wearing one of them yourself, yeah? I am a big fan of pockets on clothing. Yeah, that's good. Why don't you pull out a couple of these and see what we can do here? Yeah, absolutely. We've got cute little tops with fun sleeves and gorgeous colors. We did have with fashion designer here not too long ago and like that. So it's kind of interesting what you're doing right now. Yeah, I mean, this is actually a top, but it's meant to be long so that people can wear it. Some people can wear it as a dress and how about the white and the dots and the nice cut. It's got a nice v-neck. It's gorgeous. And the softness, I don't know. What do you think? Super, super soft. That's a summer wear though, huh? It is, yeah, I would say it's a summer wear. Let me grab a sweater. Yeah. So, and then I have some gorgeous sweaters. You can't miss that color. Yeah. It's got pockets, nice and flowy and just soft and comfy. Yeah, it looks good. I love it. I love it. You said pockets, those are nice. Yeah. I'm a big fan of pockets. That's good. On pretty much everything. Good. Well, I hope that everything works well for you today because we hope that the few more, we got some great products here and like that. We need some people now. Yeah. Thank you very much. Thank you. This is a Jolaine. Gislaine. That's an interesting name, Gislaine. Yeah, Gislaine Baker. Yeah. The colors and stuff, the thing you're doing is they really look really nice. Thank you. As a matter of fact, they're on your card. Yeah. Amazing. That's it. That's that one right here. Yeah. That's on the card. That's all right. I'll pick them up. Tell us what you do. I make table runners, quilts, table tops, potholders, pillowcases, purses, whatever, wall hangings and then I have a friend that makes these. This is all hand done too, right? Well, machine done. It is machine done. Yeah. By sewing machine. Oh yeah. And I hem it by hand. I hem, do all the hem by hand and I quilt it. But you have some great colors here. Is it aniline dyes or is it natural dyes? I haven't got no idea. So you just buy the fabric. I go to quilt stores and I buy fabric. Yeah. Until you use the old the matter of fact, a lot of times that they use the old material and like that and make something new. No, I don't. Everything is new. Everything is new fabric. Exactly. New fabric. Wow, they all come tumbling down. I'm going to let you go. Okay, thank you. Grist in. Just slain. Just slain. See that? Matter of fact, that's good. Yeah, thank you. Good morning Gladys. Gladys has been around here for a long time and she does this. I've seen her have many, many fairs and like that. So tell us a little bit about your product. My products are runners, placemats.  A little tiny Easter baskets here that I've made. And I got potato bags that you put your potatoes inside the microwave in these bags they cook for about four or five minutes and they're all done and ready to go with the vegetables that you can put inside. I also have pot holders, baby booties and slippers. I mean, excuse me, slippers, mittens, scarfs. Thank you. Please, we're also enjoying to have you come and visit us. We have a lot of variety of things in here and it's really, really nice. Well, I hope that what we need now is some people. That's what I'm saying. Hope you all come. Matter of fact, it's such a nice day out there. I hope that people come out. We'll drop the window in this sun. Little white snow out there, but it's really, really nice. After all of the stuff that's been going on. Yeah, right. Thank you very much. Glad you enjoyed it. Okay, Linda, this is a jewelry. Tell us a little bit about this new line. This seems to be just Touchstones Crystal. By Saworsky. Okay, so this is a big line? Well, it is. We are actually a company and we've been in business about seven years. But we have the Saworsky heritage behind us. We have our own designers from Saworsky and of course, they've been in business for 120 years. So we have a lot of really great heritage behind us. So our goal is to have parties with individuals so that they can see our beautiful products and as a hostess, they get free merchandise. That's good. I'm going to do this on the side because I love people. I'm getting out and meeting different people. The jewelry here, it looks like is it silver? Well, we have many different kinds of metals. One of the great things about our products is that they are all nickel and lead free. So right there, that's good because a lot of people have sensitivity to jewelry. So we have silver, silver plating. We have gold. We have a lot of pieces that are which is a really good metal that prevents people from breaking out. That's interesting. As a matter of fact, you have to think about that. Everybody is a gesture and has different sensitivity. Absolutely. So this is a relatively new business for me. I've actually been in direct sales since I've been 25 and I won't tell you how long ago that was. With one company or another and I'm just doing this company, I'm really having fun with it and I love the products. Thank you very much. Thank you. This is the girl that did all of this. I mean, she really worked hard at putting this craft fair together. Bernadette is probably one of our best church goers and with all of the things that she's done, she's just come back from the Philippines. She has a lot of people in the Philippines now that are church members and she has her own business and she did all of this on top of that. She has a job of her own working for the state of Vermont. So Bernadette, you're going to tell me all the good things that you do. So tell me. Start talking. First time I organized this and thinking about the homeless people, this is a fundraising for the homeless people, soup and kitchen and for a better place in Northveld. So all the people came over and participated in this event. We do appreciate their participation and I'd like to thank Donald as Michael, organizer without him, this is not going to be possible. Well, I don't know. You could have done it without me. Yeah, that's it. That's the only thing I can say and inspire me to do this and organize this because of the homeless people. Yeah, now tell us about your product because you have a lot of good and interesting things and you do a lot of this yourself. I have a mittens, handmade You're talking into the camera. Okay. I have handmade mittens and manufactured jewelry from the Philippines and I have handbag that I made it myself and manufactured scarps and I think that's all good and my sign is there. Maybe you can get the sign over there by the wall. Matter of fact, we're going to shoot this here too. You're going to tell us about this too. And then you did this and we have this one bake sale fundraising for the St. Augustine soup kitchen and other things. And what else? The print. And you've got the readjusters. I have this fundraising for the soup and kitchen and St. Augustine. These are donated by the Catholic daughter, St. Augustine. Thank you. Where does the and then this is we just got a donation here for the painting. The painting somebody bought. The painting is donated by Rivas. Yeah. Painting is donated by Mr. Regis. Rivas who? Coming. And this is the sign for the painting. And he had a painting that was in the governor's quarters, wasn't it? Yeah, this one is displayed by the governor's quarters. And he donated it to us. Thank you. Sounds good. Thank you, Bernadette. This is a young lady that boy out there she's really energetic. Matter of fact, I did a show with her not too long ago. She completely developed out a show that she did in Barry at the old labor hall. The old labor hall, which is, you know, quite well. As a matter of fact, I think she did a better job than we have. But we learned an awful lot and we learned also that there's an awful lot of work that goes into building one. Certainly are. And Debbie has a lot of different nice items here and like that. So tell us a little bit more about what you do. Certainly. All of my jewelry is magnetic. You just change the look as an example. Here's a silver bracelet with a purple in it and then you put in a fuchsia and it totally 100% changes the look. Or a black and silver is gorgeous in it. We have necklaces, keychains, badge reels. We also do custom photos. You upload a photo from your phone, your tablet or your iPad and a week later you have a one inch custom photo in your mailbox. Fantastic. Very very fun. And the magnetic is automatic. And they don't fall out. They don't fall out. I work full-time for General Mills and with metal shelving day in, day out and don't lose magnets. They're very very strong. And they're very fashionable. Yes. You can change with them. You know, if you have something that's brown on and like that your jewelry can be coordinated with that. Absolutely. Just like that. That sounds good. All right. Thank you. Well, thank you. Deanna Dunston is she's got some fantastic stuff here. There's a lot of glass stuff that you got here today. And they are on a timer. Huh? We need a little better. Need a little better?  You can use them in your garden or you can use them in the house for night lights.  So it protects the full front of the baby. They're reversible and then they have a burp cloth that matches with them. We also have what we call angels kisses. They're dark chocolate fudge cake filled with peanut butter cream. Absolutely no calories. So you don't have to worry about it. It's almost Christmasy. Yes, they are. Towels. And they're called towel dresses. They velcro around the waist so they hang on the oven door and they won't fall off. And we also have the other bibs. Other aprons. And we have aprons for adults, aprons for children and have pockets to put crayons or markers in. We have beaded ornaments that are all hand done. And we have the dog's collars and the dog's frames. There's a lot of variety here. Anything you would like to have done, we're willing to try. That's great. Thank you very much. Watch this. She's using a drop spindle. This is kind of interesting because we just did it together and it's a singing spindle spinnery. That's three S's. As a matter of fact, it comes from South Ducksberry too. So this is quite interesting. You're going to have to tell us a little bit about Carol. This is Carol Johnson in Collins. Carol's going to tell us a little bit more about what her product is. Is this the mic? It's very powerful. He'll tell me if it's not coming. I've been in business for 35 years. I started my business in 1982 in South Ducksberry. I've been in business 35 years and I'm in South Ducksberry, Vermont and I teach spinning, knitting, crocheting, felting, dyeing, multi-color blending, circular weaving and more. You must teach too. Yes, I teach a lot. I travel to people's places if they can put together a group. A lot of people have been coming to me since 1982. So you do all kinds of different fibers? I work with lots of different fibers. Have you worked with Alpaca? I surely have. You know the Yaimara Indians of Peru. Oh yes, in fact you and I have met before at the International Festival in St. Mike's. You're really good at it. Anybody that works in Alpaca knows you're a good spinner. It is a lovely fiber. So I have seeds for 2018 from my own garden from my own plants and I make felta ball kits circular weaving kits drop spindle kits small felted balls This is soap from a friend of mine I make button necklaces similar to the one I'm wearing and I have gift packs of seeds and few hats some made from the actual weaving kit So this hat is actually made from the circular weaving kit So those are antelan dyes or are they natural dyes? These You're a dyer so you probably do a lot of different using a lot of different minerals and things. The wool dyes the wool yarns I've dyed with acid dyes but I don't do all the dyeing myself just some of it. This for example I've dyed some of these wools and some were dyed by one of my students but what I'm going to do right now is some drop spindle spinning if you'd like to see that So right now I'm wrapping the yarn that I just spun onto the shaft of the spindle So how do you get the nubs out of it? Well that's a long process depending upon the the actual fleece of the sheep It takes a lot of skill here Well it's not hard a six or seven year old can learn to spin I taught my daughter when she was six she's now 41 and she's been spinning for almost 35 years This is the oldest way of spinning in fact the machine wasn't even around and this was the way people actually created their garments They're right all over the world They're spinning using drop spindles Isn't that nice? Look at how she does it See how fine it is? She's got a gauge here I can spin much finer than I am right now This is a worsted weight but I can spin sport weight lace weight, I don't have an example of that She does this just with her fingers so that's how skilled she is Well now I need to wrap it on because I have enough that it's too long for the space I have So I'm wrapping keep in mind this is not a prize winning yarn that I'm spinning right now I'm just demonstrating quickly But usually I bring my spinning wheel but because I didn't know if I would have enough space I didn't today and I'm glad I didn't because I wouldn't be able to show my customers or the visitors to my booth, my spinning because I would be tucked back there but the spindle allows me mobility and I can actually I can walk around and just the way Shepherds did as they watched their sheep absolutely, they spun and watched their animals at the same time Well thank you for coming I'm happy to be here Karisa Doyle she is one of the sponsors of this program here and she's the junior vice president of the VFW auxiliary It used to be the ladies auxiliary a couple years back we changed our name to the VFW auxiliary took ladies out and allowed men to join under their parents or spouses or other VFW members if they didn't have the actual veteran experience because we're one of the principal charities that we're doing here is the Veterans Club place over in Northfield tell us a little bit more about how the VFW got involved in this and their charity program we'll always support several different charities but the veterans place is one we go over and share dinners with them we do Christmas party for them and many of our members donate to them on their own charitable wise and we became involved because after all is the veterans place you know as a matter of fact this is a wonderful place because I remember years ago I got going over there and this used to be an old hospital so it really was designed really for veterans who could have their own place yep, yep, that's good because they need their space but they also need to be able to network with their companions and people who have the similar experiences that they have had do any of them come over here and participate in any of the activities here in the Montpellier post well I'm not sure because I'm with the auxiliary and even though they're in the same building we don't attend their meetings because they happen at the same time as ours so I'm not sure members are from over there you know come over here I see your commander here is Pat Pat Kelty, yeah, he just had a little operation too bad that he can't be here today but we wish him well he goes to get services through the VA and then part of that is they ship them where they need to go so he was down in Boston so he got his work done down in Boston take good care of him for him, right? and his wife Sherry Kelty is our president for the auxiliary president so they've been working as a team this past year so they really work hard for the the organization well this matter of fact that I was talking to Norm the other day and he said this operation here is busy all the time they got all kinds of functions coming in here for the next two or three months we do a lot of things to get money in and earn money for our programs the Northeast Fetalers come in we have several different groups that play cribbages different things and this area is a great place for an event like this because you got the space, you got the tables you got us to cook you some great food that's what you're doing out back thank you very much Trisha and thank you for coming and using it because it's important thank you Father Julian thank you for coming today this is one of the thank you your country is doing a wonderful job here at this craft fair to support the church so the better place in the north field and the soup kitchen is really where we were concentrating on and as you can see we got 25 vendors and like that so that is a lot 50% of this money from the vendors and like that is going to go to your church so tell us a little bit about the program first of all I would like to thank all the vendors who are participating this craft fair today and thank you for choosing Saint Augustine as one of your recipient of the proceeds for this fair we have a regular schedule for soup kitchen we provide coffee and brands and meals for those who would like to join our brothers and sisters who are in the city of Montpelier and they can stop in or those who are in need they can stop in any time during that day on Fridays and we really are happy to accommodate them for that we have a good people working for the soup kitchen I am very much grateful to be here in this area, in this Paris at Saint Augustine I am blessed with so many people who are active in the church and even the community outside the church at Saint Augustine they are also very much helpful to our faith community here have you seen any the soup kitchen for quite a long time have you seen the audience change or are they pretty much the same people that are there each time? Yes, thank you well I really don't know how many people who will be coming every week but I always do stop in I have mass in the morning and then holy hour because that is Friday and after sitting down for a few minutes in the confessional I go down to have some coffee some people there in the morning but usually the bigger crowd will be coming a little later, like 11.30 or 11 o'clock that is the time when they serve the lunch there are a few people who come earlier to have coffee and they sit down there to read and cheat chat with other people it is social time too it is, it is it is good to see other people and to have a break In the churches community like that do they still have them on Fridays or do you have the one on Friday and another church has it on Monday or Tuesday? Yes I'm not sure what days they have in some other churches around but it seems like we have multiple locations but it just happened that at St. Augustine we have the soup kitchen for Fridays Fridays yes, Fridays so thank you and thank you for the organizers of this craft fair and thank you again for choosing St. Augustine as one of your recipient we appreciate it and enjoy the rest of the day and hope you have a chance to stop in or stop by at the craft fair here at VFW in Montpelier it's still open until 3 o'clock this afternoon okay, thank you bye this is the swinging over 60s jazz band they are very popular at the senior center here in Montpelier and thank you for coming they are really wonderful people Amy Hand