Thanks for sticking with us today. Sunday is a bit more chill. Some of us are already flying go. Some of us are recovering from Engover and the last of us are here. Thanks for sticking with us. There's also some zombies there. Okay, so today we are presenting the results of our research which is and we will present a new approach for stack spoofing targeting Windows on like specifically 64-bit architecture of Windows. Who we are? We are three friends. I'm Alessandro Maglinozzi, principal security consultant in BSI where I do mostly red teaming, offensive tool development and white box assessments. So source code review, fuzzing and stuff like that. In my free time I work for, I maintain some tools, some offensive tools in project industry which is initiative by Marcello Salvarri to support open source developers and in the rest of my time I'm a bug hunter for Cinecretin. Then there is my colleague. Hey, my name is Arash. I work at cyber arc. I have kind of a dual role there. I'm very fortunate. I get to do a lot of threat hunting, detection engineering and I also get to do red teaming when time allows for it. And our friend Thanos unfortunately can be here today. He also contributed to this work. He's a red teamer at Netitude. He was also great and he contributed a lot here. So we want to make sure he's mentioned. So here we are. So a bit of story about this. All of this started back in 2022 when Namazzo, a security researcher and developer, released a pop on Twitter like an image where it was showing like a technique which then we popularized them. Fixed also a bit. And this actually, like we were very interested in this research, in his research and his work. So we reached down to it. We started developing this in-house. Of course we didn't know a lot about what was involved with the technique. So we started this research and development project. We developed our own version of the technique showed by Namazzo. And after that we continue researching on this technique. We will also present, indeed we will also present the detection part for this technique and other additional research avenues that we researched. So just to give you a bit of background, let's define what stack spoofing is. What we mean with stack spoofing. So of course you know that when you start to process on Windows, when you execute a binary, you create a process in Windows which is a container and then one or more threads are tasked with executing the real code of the program. Every thread maintains a cold stack which is an area of memory organized as a stack that maintains the information about all active subroutines in a given time for a given thread. And what we do with spoofing is that we want to create, to substitute the frames with fake ones. And this is usually never done for non-malicious activity. This is always done for malware to hide the execution flow or similar stuff. So you will see here four different frames and why I put this here is just to let you know what, like to let you see what a cold stack is. And you will see that there are certain things that are like, that appears, that are common to a cold stack. For example, we define this first two threads for this talk. We will just talk about these two frames as thread initialization frames which are usually at the bottom of the cold stack, like at the top actually of the cold stack. Then you have internal frames of a specific programs that we will refer to this during the talk as main modules frames. And then you have the frames related to a call API, an API call. So why this is, how this is calculated by Windows. So the stack is evaluated by Windows using an unwinding algorithm. And this uses the information contained in the pdata section of a binary or related DLL. And in this pdata section you usually have an exception directory. We contain all the information about the functions, specifically information about the, like every entry, runtime function entry in this table contains the information about the begin address of a function, the end address, and a pointer to a structure which is the unwinding infrastructure that contains information about the size of the prologue, the count of codes, and all the operations that were performed in a prologue of a specific function. Now, why this is important? I mean, this is used by Windows to manage exceptions. But what we are interested in is the usage that this is done to calculate the cold stack at runtime. And to calculate that, what happens is that Windows evaluate the frame, a cold frame size dynamically using collecting the information, collecting the codes, so the operation in the prologue that actually affected the, that impacted the frame size. And the operation are usually push, of course. If you push a register, you are subbing eight on the stack. And if you allocate memory, you're subbing from the, from RSP. So you allocate stake on the stack. So these two main operations are what modify the frame size. And then there is the push Mac frame, which is really not interesting for our talk. But yeah, it's another, it's another, it's another operation that impact the frame size. And this is important, this is needed in Windows, because if you remember 32-bit architecture, in the prologue, you always have like a push EBP, and then you save the base pointer. So you have the base pointer pointed to the, to the, to the top of the, to the top of the frame. And then you have the RSP pointing to the, to the, to the bottom of the stack. And this is useful. And like the contrary. But yeah, this is used to, this is used for, this is very useful to evaluate the cold stack, because you can just navigate back the chain of EBP that are pushed on the stack. But in 64-bit, this is not possible, because RSP is used both as a base pointer and a stack pointer. So to evaluate the cold stack, we need to recursively get the size of, of a stack frame, and then recover the return address. And then evaluate again the cold stack frame, and then the return address and traverse it back like this. So why we are interested in the cold stack? We are interested in the cold stack, because when you execute malware on Windows, you can generate some anomalies that can help with detection. So we have in-memory execution can be detected, because when you inject code in memory, if you're using especially to, to, to run a malware, you do process injection, for example, or code injection, and you're using an executable section on the heap, what happens is that, that section will not have a module associated. So that, that executable library is not backed by a file on disk. If there is no file, there is no pdata section. If there is no pdata section, there is no exception directory. If there is no exception directory, there are no, like, there is no way, there is no information that the unwinding algorithm, unwinding algorithm can use to dynamically get the size of that specific code. So what you happen, what will happen is that, oh, too much, sorry. What will happen is that you will have something like this. So you will have a frame at a certain point that is not resolvable, and this is associated with, with an back memory region. Uh, the other thing you can, uh, you can, the other anomaly that you can detect from the code stack is when you use, uh, directory in direct syscalls, and we are referring to direct system calls, actually direct anti-function execution, like get proc address, NTDLL, anti-function, and then execute the function pointer is calling directly the anti-function, and this will generate a code stack that misses the, um, uh, that misses the, um, why? Sorry for that. Uh, that misses the, um, what we, the, the frames associated with i-level API call. This stack frame is, is also generated if you're using an indirect system call, so if you're just locating the syscall instruction in NTDLL, and then you jump to it. So the frame, the stack, the stack is pretty much the, the same, and it misses the i-level, uh, API frames of course. But these are the anomalies. When you want to detect this, well, you can do a periodic scan. So you have a tool that stops the frames, uh, that stops the threads, uh, system-wide, get the context and unlike the stack frame. You can have a conditional scan which is a periodic scan with another filter to filter for specific kind of threads that are in specific weight states, for example. Or you can use hooking or kernel tracing which is instead, uh, done dynamically. When a system call is involved, you can use something like EWTI or another, uh, kind of, uh, driver to get the, uh, to get the user mode, uh, cold stack and hunt for detections. So, two, like, as stack spoofing, uh, preview research on the topic, uh, lead to the development of techniques to defend from specific scan, periodic scan, like stack location, stack cloning and stack hiding or, uh, to defend against specific, um, specific, specific, specific rule-based detection on the cold stack when executing a specific API. So stack location was probably the first one used and it's an evolution. It's a variation of, uh, normal return address spoofing where the, where we replace the malicious frame with, uh, with a trampoline, uh, usually in a DLL or an executable. And then we nullify the return, uh, the return address prior to the, um, to the trampoline. This way we have a cut cold stack like this, which is surely better than having garbage in the cold stack, but it's still, uh, it still has a defect which is this, this stack is not unwindable. So we still can have a detection for this reason. Uh, then we have stack crafting. Stack crafting instead is a technique that is usually asynchronous, like we have a system, uh, there is a specific function that gets cold, uh, and there are specific processes using that function in a legitimate way. So what we do is that we record that execution that cold stack at that point and when we need to call our target function, we just craft the same kind of, uh, of cold stack so that we can, in this way we can bypass detection like sysmon antin for specific cold stack trace or, uh, similar, similar detection. Then we have stack cloning. This as well has been developed to defend from conditional scanning and the idea is simple. Usually our implants go to sleep for most of, like usually sleep most of the time. So when I want to sleep using, uh, uh, delay execution, like rate delay execution using a sleep or using a weight, user requested weight state using, uh, wait for single object. What, what I need to do is just hunt for a thread that is already with that state that is sleeping with that state and then clone is cold stack. This will make the cold stack perfect, perfectly legitimate, uh, or appear apparently legitimate. So, uh, we will be defended by conditional scan that hunt for sleeping begins. Stack idling is similar but it uses another, another kind of, uh, approach. So the approach is that I will transform my thread in, uh, I have a malicious code executing in memory. Uh, I transform my thread in a fiber. So I have a fiber thread now and then I create another fiber with a legitimate cold stack that I use just for sleeping. So when I need to sleep, I just switch to the fiber thread to the other fiber that I created for sleeping. And then this process gets repeated when I need to go back from sleep. And this is what you have, like this is the, uh, this is the fiber with a legitimate cold stack and this is the cold, uh, in, in memory. So they, you can see that there are two different area, two different memory area for the stacks. Uh, and just one is active at a time. So what is our contribution? Today we want to present two techniques, uh, full moon and half moon that are designed to, uh, obfuscate the stack at runtime, uh, to avoid detection, kind of base detection, uh, mostly, uh, or hooking detection. So stack moving as some properties, like it hides the color from memory. It obfuscates the stack so it's difficult to understand which kind of, uh, cold stack was actually taken, was actually generated when executing a specific AVI system call. And then it has an outer, an outer restore, an outer restore technique. So usually, uh, we use ROP to restore the stack. We will see this is not always possible, but yeah, uh, most, most of them uses like most, for most, for the most part is use ROP to restore the stack. So full moon is the first technique and it operates like that. We have a function that we want to spoof, API or whatever. And what we do, of course, we are executing this from our main module that can be in memory or can be like in this case, it seems like it, it's a program, but it can be even injected in memory. There is no, there is no problem. Uh, this is for main module. If you remember, I'm, I'm referring to all the frames generated by the main module. So it's the, like I just packed all the, uh, all the internal frames for the main module. And what I do is I select three frames, well, actually four, to be a bit more stealthy in our intentions, but the needed are three. And, um, these are as an SF, a set, a set of FPRAG frame, a push rack frame, other thing frame. And then, yeah, we added a concealed frame just to be a bit more stealthy. And what they do is just at a certain point in the set FPRAG frame, what we are doing is that we are restoring the base pointer again. And so this happens through this kind of call, which is MOV RBP RSP, where we save our current RSP, which contains the, uh, address on the stack that can save the return address of this frame. And then with the second frame, the push FPRAG frame, the push rack frame, we push RBP on the stack. Now what happens? This creates an opportunity for us to modify the address that was pushed in memory, because that RBP now is on the stack. If you modify it, this will be evaluated by the unwinding algorithm as the address that should be used to restore RSP. And this gives us an opportunity to tamper with this so that if these RSP points back to our thread initialization frame, practically what happens is that the main module will completely disappear from the call stack. Okay, this doesn't solve the memory problem. So if you have, you know, unbacked memory section, this will not resolve that, okay? But from the call stack is not visible anymore. Because doing just this will of course corrupt the execute, the return flow of the program, we use a the sync gadget, which is a job gadget here, a jump RBX to hijack the return flow so that we can execute a restore function, which is under our control. And this restore function will reset the main module to what it was and just remove the fake frames. So this is the, the, the, the technique in a nutshell. And this is how the call stack is set up. And as you can see, there are the thread initialization frames and then there is no executable. There is just kernel base and these frames are all generated by our algorithm. Now these frames have some logical inconsistencies that can be used for detection. And Michael. Sure. So I'll talk to you guys a little bit about the IOC's and why this doesn't necessarily create a perfect stack, but does create a good looking stack. So if we look at the slide we have currently, you can see the spoofed frame, the kernel base.dll open state explicit, and you actually see a location that plus 0x390, that's an offset. So what's going to happen is that's the return address we would return to in order to continue execution within the stack. Now, why is this relevant and why is this in IOC? Because technically if we, well let's talk about what a call stack is. Based on the name, a call stack is of course a series of calls. So you will see an API call, making another API call, making another API call, and this is often so you can debug and you can see at what API you may have crashed, at what section you may have issues, etc. So it is supposed to show a series of calls to other functions. Now if we look at that spoofed frame, the kernel base.dll open state explicit, we go to the return address, but the return address isn't going to have a call because the return address is going to be after the call. That's where we continue execution or we return. So what we do is we actually go before the return address, and we try to look at that little move byte pointer that we see there for the open state explicit function. We can see that that is not a call. And not only is that not a call to another function, it is certainly not a call to create private object security with multiple inheritance. So immediately this becomes suspicious. And this isn't something a legitimate dev would ever do because it would just hinder their debugging process. It would impact them negatively. So this is something we would only see an attacker wanting to perform. Now, while I say this is an IOC, it's really kind of a difficult IOC. You know, it's hard to deploy at scale. It's not really something you can hunt in your EDRs. And if you observe this on every single function, there would be very massive performance hits. So while this is an IOC, we're not necessarily sure there's a realistic detection method yet outside of the possibility of a utility such as Intel Pin Tracer, which does it a little lower level than the operating system itself. So if we look here, we can tell you what we're looking for. These are the call op codes. This is basically the assembly that we're looking for in our eclipse detector to observe full moonwalk. So we're looking for specific types of calls. That mod Rex W basically determines if it's like a long call or a short call, for example. And then we can see relative 32 call. The call or 64 calls a register. And then of course, the system call, the NTDLL lowest level call that you will often see because NTDLL often makes the syscall for you. But if we were to observe there, we would see a syscall instruction. So this is the algorithm for all you PhD people out there. Basically, the idea is we're looking for very specific things in our algorithm, not just for stack spoofing, but the detector is looking for an invalid stack period. And not just by unwinding, because as we know, we can actually fool the unwinder as previously shown. So what do we look for? We're looking for unbacked memory regions. That's the reflective injection detected. Unbacked memory means some injection was performed, a private RX commit memory region was created. This isn't backed to any files on disk, no DLLs, no EXCs. So we consider this malicious often. We consider some injection of some sort. There can be false positives with this to be clear. Jits, browsers, you know, C sharp, you'll see these private commit memory regions getting created and executing code. So while this does help, it's not foolproof to be clear. The next is we actually look for the desync gadget, because what full moonwalk actually does is it desyncs the stack with basically a rock gadget in order to be able to effectively craft its own stack for restoration as well. So we can just look for that gadget, and often that can be an IOC as well. Additionally, the call mismatch detected as previously stated. Message box A is going to make a very specific call to the next function. If we look at message box A, we look at the previous instruction and it's not the right call to the next function. That's an IOC. And the wrong address detected as well. If the address is just not a call, if it's not strict, if it's not correct, you know, it has to be a call and it has to be a call in the correct order. I actually think I mixed up the mismatch and the wrong address, but the idea is the same. And when we're basically looking for a call that's not a call, or we're basically looking, is it actually calling the next function, because that's what a call stack is supposed to do. This function calls that function calls that function for investigation. So this is full moonwalk running. We have a successfully spoofed message box A. We're even telling you we're spoofing this message box A. Now we run our detector. On the left, you can see our four spoofed frames, frames eight, nine, ten, and eleven. Our detector first catches create file internal as a spoofed call because the previous address does not, the previous instruction is not a call. And here's what's interesting. We also get PSS query snapshot. Now if you look at the addresses, as I said before, this does unwind. If you look at the PC address for PSS query snapshot, it matches the return address for the create file function. So an unwinder is going to think this is legitimate. This is in fact what was called. This is in fact where it needs to return. But our detector knows better. Our detector goes there and says not only is there no call, there's absolutely no call to create file W. All we've done is fooled the Microsoft unwinder into thinking this looks legitimate. So if you actually use Microsoft's built-in unwinding, this is what we did here, it looks legitimate. We only caught this because our detector is looking for more. Now there are a few false positives as mentioned before. We see this a lot with JITS specifically. We saw this in WindDBG. It seemed to have a lot of JITing going on. We can see right here one of the processes for WindDBG has just these two entirely unbacked memory regions. For reasons unknown to us, it appears JITs don't always fully unwind and that these memory regions just always exist. And so there will be false positives with JIT processes as usual. So we did testing to see what the false positive rate actually was. We wanted to determine is this feasible? Is this something we can actually do without overloading a team? And we determined kind of, it's not too bad. So we'll see, we tested this on five different machines. Standard just means it was a standard Windows user machine. This is not a developer. This is just a person who logs on, watches video, does work on Word documents and that's it. Dev is actually a developer. Somebody who installs Visual Studio, sets up Postman and installs WindDBG preview. And again, you know it makes sense. The developer is going to have a higher false positive rate. They have more JITs. They're developing more tools that are going to have weird, unbacked memory regions. You know, no programming isn't really perfect and there's really no catch all for this. We can see on Win 10, the false positive rate is actually a little lower than Win 11 Enterprise. But you know, we do see that for the Dev machines it actually decreased a bit. As far as Windows server goes, we see a pretty high false positive rate. That's likely associated with, you know, you're deploying your web servers on this, you're deploying your .NET applications, you're deploying all sorts of stuff that's going to sort of increase that rate of false positives. And you know, just to end this, as far as detecting all this goes, it's like I said, for a hunter behind an EDR, this isn't really telemetry we get. Some EDR provide call stacks for very specific functions so as to not be too intensive. And we can sort of hunt on that and look for unbacked memory regions. But as far as it goes for full moonwalk, we just don't really have an effective way to check every single function call and ensure that this call is actually a valid call. So in a way this unwind ability is pretty effective in today's age. So after developing the detection, we actually talked about other kind of avenues that we could, where we could actually make use of this kind of knowledge. And so as we've seen, except for the execute, like in memory execution, there was another problem which was the correct stack frames allocated when we execute an iLevel API instead of going with the indirect Cisco. So we developed this additional technique which is an extension and it's half moonwalk. Half moonwalk is because we're just doing half of the technique. We are just considering what is like what is what we are calling and not really the caller. And so what half moonwalk does is that we can always go to like we can always match an iLevel API to a Cisco. So half moonwalk takes as input an iLevel API name and its relevant Cisco instruction and it will trace all, like it will trace the execution flow from the iLevel API until we find the relevant anti-function. And what we're doing is that doing this tracing we also collect all the information, all the exception information, so all the information in the P data section related to the prologue. And what we do is that we recreate the frames of the iLevel APIs before executing an indirect system call. So how we do that we just need to literally emulate the prologue of the iLevel API. And what happens doing this is that we can recreate the same kind of call stack perfectly, perfectly legit this time. So we also respect the location of the return address which is placed after the call. And the call is actually matching what it's been called. But we never call the iLevel API. So this is literally a CisWhisper type of indirect system call just with added spoofed frame for the iLevel API. So now we have a little problem that we will solve afterward for the emulate system call which of course is a function that will do this spoofing and it's visible as for now. So we will solve this later. So we are concerned about the return flow though. If we add these frames they will return back to where they are supposed to return. But we didn't actually execute the iLevel API we just emulated the prologue. Would that be enough to actually ensure that the return flow is correct? Well yes and no. So there are three strategies we can use. One is the return, place the return on a winding. So this is terribly worded. What I mean is that we place the return address on the epilogue which of course is just deallocating the prologue. It's just like literally rolling by the prologue so that will work. But we will be detected by eclipse again then because we need to move the return address not after the call but on the epilogue itself. The other and this is what it happens. Instead we have the call to anti-protect return memory in this case instead of placing the return here where it's supposed to do because there are all these tests we just move it to the epilogue. And this works of course but as I said we can be detected again by eclipse with this because if we analyze the instruction before this return address it won't be a call anymore. So we have a second strategy which is the targeted setup that works even better but it doesn't scale and the targeted setup is just like I can analyze what are the post-call checks what I call post-call checks are literally all these checks all these ifs that are executed after the call. And to avoid them from you know branching to avoid the branching I just save what I need to patch I just see what I need to patch and then I patch it before actually executing the call. Now this is this is pretty much it works but you can't do it anytime and honestly it doesn't scale at all because you would need to know what thing to patch every time you execute an arbitrary function this doesn't scale at all. So the lattice thing we can do is I don't know what is happening I'm sorry. Another thing I can do is using other breakpoints. So what it happens is that I place a breakpoint on return and we actually say sliding other breakpoints because we don't know how many frames we need to emulate so if they are more than four of course I need a strategy to out-update the other breakpoints otherwise I will miss some frame. Anyway what happens is that I place another breakpoint at the return address when the function returns back I just execute an exception handler that just execute the epilogue emulate the epilogue and then force the instruction pointers to return. And that this way this scales well but I need always executable I always need executable memory because I always need to make the exception handler like somewhere I need to store the exception handler somewhere so I always need some executable memory around floating around. So as I said before we also had a sort of a problem with the emulate system call because we said well there is no function if you remember before there is no like this thing is actually pushing this frame and then jumping to the syscall instruction here so if someone is looking at this emulate system call it can be problematic so what we can create is an opaque architecture that as this is a if but you can place a switch case for example that just will when this is executed it will execute so now we are stepping through here okay to emulate system call w this is a frameless function it will execute something on the stack it will corrupt the stack doing this but it will grab the position of this frame function and it will just swap itself swap the frame of the framer function with the frame function this way it will restore the stack the call stack that will appear legit legitimate and here we have what legitimates this like sequence of call is that we have a jump here to the restore proc of course this is opaque it's not that great but what we want what is really important about this is that even if we have something with no frame information associated as long as the stack size so the modification on the stack are equal to something that we are creating and this framed we can always replace it and fix the call stack why this is important because there are ways we can do that using standard Windows DLLs so we selected this in particular because it's very it was already abused in exploit development to bypass exploit mitigation it's part of the exploit mitigation developed by Windows and it's the call it's the call to MDR server call to so we can use this kind of architecture here to completely hide our caller again so how this may work so if we can enforce in our implant maybe a stage zero if we can enforce in our implant this constraint so we want the our implant at any time the internal the sides of the frames of the internal frames of our implant they should always match the sides of the MDR stop call to stock as you can see here you have a lot of space allocated on the spy on the on the stock for this function if we can enforce this this constraint we can start a thread pointing to our shackling memory which is our implant we can force this first two frames in the thread itself then we can start our implant and when the implant needs to spoof a function what we can do is call the call out moon execute out moon where whereby the first frame spoofed is the invoke function which is an arbitrary call to anything and then execute out moon with the rest of the AI level API frame and eventually call the spoof function so what this creates is a completely legitimate call stock where we have the frame in the thread frame they the thread initialization frames then we have the first two call to MDR stop call and they are cervical two and MDR stop call two then we have the execution of our implant we have the return address spoofed with NDR stop call to stock which completely hides our implant frames and then we have out moon executed with invoke and with and all the I level all the all the remaining I level API frames and then we have the system call again executed this will hide completely the caller as well so we are just we're just going back and try to you know complete what month was not doing so hiding the caller now the only drawback of this is that you always in order to restore the functionality of the program on return you always need an algebra big point placed on invoke so you can handle these two frames as much as as as you want as we shown before so target that set up or or return on epilogue or or exception or exception and there's but this invoke function you always need an exception under to actually restore the return address of the under stop stop call to stock and return to our implant just a word about chat we are studying a lot into chat with shadow stock mitigation and in direct branching tracing in direct branch tracing and so far we didn't find a way around chat it's not surprising so what happens with chat is that there is a shadow stock of course the clone like he maintains a list of all the return address that are placed just after a call and when on return it will check if these return addresses matches the user mode like the user mode the right of all the normal call stock and if they don't match there will be a CP fold that will crush the problem that will exit exit the problem. There is another another thing that is concerning about Intel chat is that within direct branch tracing there is no easy way to modify the instruction pointer as well we can just use exception handler as as much as we do now but the good thing is that even in machine support in chat so far there will there are always processes that are not yet enabled like browsers and stuff like that that we can still abuse for executing this technique. So key takeaways you will you always have the public pocket valuable here this will be enhanced with additional box after this talk so in the coming days this book of courses like both of the techniques are usually like have been developed and designed to obfuscate the stock at runtime so if you're planning of obfuscate the stock when you're going on sleep probably I'd rather use the stock cloning of the stock hiding and the reason is well as you see there are certain logical inconsistency in this the stock so if you leave it there for a long period of time you're increasing the chance of being detected by eclipse etc. that an enter is just just go there and see it and do a bit more analysis manual analysis on on the thread call stack of course another another another point is that this technique can be used wherever you use return address poofing as an arrangement you can use sleep encryption and release the pocket not long ago about how to you can integrate sleep encryption technique to this to this to this technique to this tax poofing technique but it adds a layer of complexity which is not always easy to manage so a word of caution if you are trying to integrate this in your own implant and yeah I think pretty much it's everything thanks a lot for joining us and if you have any questions if you want we are at the start so if there's time we're happy to take questions but I think he's also saying if you want to meet up with this after the talk we'll be happy to talk to anyone who wants to ask any questions thanks a lot


For an Indigenous person like myself, it's profound because after 471 years or what have you since the first papal bull was issued, I didn't think to see it even though it may not have great material influence over my relationship with the colonial state. I do know that it's very difficult to get the church to change positions on things because, well, I mean you had to twist their arm to, for a long time to get them to see that, well, the sun was at the center of the solar system and not the earth.


All right, let's start the meeting of the 15th, Christine Deschler, Chair of the Office of Finance Committee. I first will confirm attendance of members of the committee and make sure everyone can hear me when I call out your name, answer me affirmative. And if you are joining remotely, just indicate that for the record. Jordan, Shane. Here remote. Jennifer's not here. Sophie's not here, Brian's not here. Caroline, Rebecca. Here. Josh, Grant, Charlie. Here. John. Here, remote. Daryl. Here, remote. Yanny. Here. Al Jones. Here. Topher. Here. Say he's not here. Al Tosti. Here. And James not here. Dave. Here. And Tara Bradley. Here. All right. Let me do the script. On March 29, 2023, Governor Hurley signed to a law, a supplemental budget bill, which among other things extends the temporary provisions of the overmeaning law to March 31, 2025. This further extension allows public bodies to continue holding meetings remotely without a quorum of the body physically present at a meeting location so long as adequate alternative access to the deliberations of the meetings provided to the public. Adequate alternative access includes providing public access to the Zoom video conferencing, which we are doing tonight, ensuring public access does not ensure public comment or public participation. This meeting will not feature public comment. Those wishing to provide comments may be sent by emailing our executive secretary, Tara Bradley, and T. Bradley at town.arlington.ma.us. This meeting is being recorded and some attendees are participating by video conference. Accordingly, be aware that other folks may be able to see you and take care enough to screen share your computer. Anything that you broadcast may be captured by the recording. All supporting materials that have been provided members of this body are available on the town's website unless otherwise noted. The public is encouraged to follow along using the posted agenda unless the chair knows otherwise. I will introduce each speaker and then we'll recognize members wishing to provide any comment, questions, emotions. Please hold until your name is called. For those attending remotely, please remember to mute your phone or computer when you are not speaking. Everyone please remember to speak clearly and in a way that helps generate accurate minutes. Each vote taken in this meeting will be conducted by a roll call vote. First order of business are the minutes of May 10th. I move the minutes. Second. Let's see one thing that's first. What's that? Oh, please. No indicates and then there's no. Okay. Any other corrections to the minutes of May 10th? The motion has been made and seconded. Let's take a vote. Joining me just in time. Yes. Shane. Yes. There's not here. Sophie's not here. Brian's not here. Can't always not hear Rebecca. Yes. Josh. Yes. Grant's not here. Charlie. Here. Yes. John. Yes. Daryl. Yes. Annie. I'm staying, I wasn't here. Al Jones. Yes. Tofer. Yes. He's not here. Al Tosti. Yes. Dave. Yes. 11 affirmative. Zero negative and one extension. So we're going to tell me he's going to pick up on article 56, right? Yep. Composting. Then we will go back to I think it's 41 left off. And then we should be able to finish everything tonight. God willing. So Annie, are your students ready? My students are meeting me at 7.45. I had an email from their teacher this morning saying she was going to forward the presentation to the Tom Clark and Tom moderator. I will make sure that that has happened. I will teach them how to properly use the mic from and prepare them for the general insanity of Tom meeting. Okay, thank you. This is a couple of notes. Like, you know, if they don't, if they talk too softly, people are going to yell, I can't hear you. They shouldn't get rattled, you know, that kind of thing. I don't think he's going to be rude to them.  And tell them the finance committee is behind them. Absolutely. And so you'll introduce them. I will introduce them. I'm probably going to. I'll check with them about whether they think they need more time. I might ask for an additional three minutes or something just to make sure they're relaxed. I think that's a good idea. Give additional five. What? Give additional five. I can ask for an additional five. Let me see. I mean, I think they did the presentation to us in less than 10 minutes. We're trying to finish tonight. Yeah, I know. But you know, there's, you've got multiple speakers and your kids, and they're doing it for the first time. Yeah, all right. Let me see where I can pull off. You could say that you expect it to be much less. But yeah, just can't have it just in case when they're not free. Yeah, nice. So thank you, Annie. Carolyn and Jennifer also working with this group for a good chunk of time. And we tagged team. I think Jennifer and Carolyn carried the ball most of the time. So all right. So I had some communication with Kersi today and what we have decided is that the joint meeting between the Fincom and the School Committee to discuss the superintendent's strategic strategic plan, which they hope would be the basis, the override. They will. We will have that meeting on Wednesday, March 31st, May 31st. Wednesday, May 31st. Where? 730, and we'll work on the police station. Yeah, yeah. So that's the 31st. I'm going to talk to Eric tonight to see when the select board will take their vote on the override. If the select board vote on the 5th of June, I would like us to meet on the 7th of June. What time will we meet with the school committee? 730. And if we do meet on the 7th of June to discuss and take a vote on the override, I think I would, because of terror's unavailability for the next week, I'd like to have that as our election of officers night as well. This is the 7th? The 7th. All of that will be contingent on the select board meeting on the 5th. So I will let everyone know what Eric says is possible or likely for the select board. If not, then for the time being, try to keep the 12th and the 14th open. That's when we have to have our discussion over and take a vote. And then at some point before the end of the month, at some point at the end of the month, we'll have to do reserve transfers. And I'll have to talk to Sandy and Eda about that date. But I'm hoping if that's at the end of the month, I'm hoping and if that's the only thing we do, I'm hoping that will be entirely hybrid. I mean, entirely remote meeting. What was that last date? I haven't been at the end of the month. Okay, so we're going to say the 31st, the 7th, the 12th, and the 14th. Right. So the 31st looks like when we're going to meet with the school committee. Hopefully the select board will have their vote on the 5th, in which case we'll have it on our vote on the 7th. We'll have it on the 7th, if not, then we'll keep the 12th and the June 12th and 14th open. We're still looking at wrap up dinner on the 21st? Wrap up dinner is still scheduled for the 21st. Anybody have any questions about the timing? Anybody have anything else to talk about? So I'll toss these birthday things. Happy birthday. You know, another town, another town, birthday, a town meeting. How many is that? Like forever, right? My age or the number of town meetings. I think I'll hand it in. Yeah, just about. Yeah, 77. Well, congratulations. Thank you. Thank you. I remember the time that I was having this was 20 years ago. And so I can't remember whether it was you Charlie or maybe my wife mentioned it to Charlie lions.  There was a whole cake there for John. It was quite something. I miss the bakery, big shop snacks in the hallway. Yeah. Thank you. Sure. Is there a motion to adjourn? All right, all in favor. If we, if we end town meeting, we won't be meeting. Again, until the 31st, just to let everyone know that. But if we do have town meeting. We meet again. But anyway, we're not going to meet a memorial day, right? Right. Right. That's one hope we have. One thing to look forward to. Move the question everybody. Right. Bye.


Raditz has always been one of my favorite Dragon Ball Z characters, which sucks because he dies on Episode 6, so there's not really a lot of content around the guy. That's why I was so shocked when I found out that in Budokai Tenkai G2, beating Raditz with Piccolo actually unlocks a secret what-if mission storyline completely revolving around Raditz. And it's really hard, so this video is only going to cover the portion of what if Piccolo beat Raditz? Oh, also, I didn't know it was gonna be hard before this intro, so I might sound overly enthusiastic. Be prepared to watch my soul get crushed. I'm excited, dude! Faithful Br- uh, what if all about Raditz? I don't even know what it's about, but let's go ahead and just- I want to clear this whole thing in one video. Faithful Mischief, a what-if story about Goku and Raditz' faithful reunion. I don't know about you guys, I am such a loser when it comes to Dragon Ball Z what-if stories and games, man. I love these things. So my expectations are through the roof! Hey, faithful brothers! But in the battle with Piccolo, his memory was lost. He lost his- Piccolo beat his memory out of him? That plays into the gameplay. Raditz has been thrown into turmoil. He's re- damn, this is like emotionally deep! But he must at last make a choice. This is so- this is actually so sick! Wait, this is actually an emotionally deep story, so this is actually a good story.  Wait, who is this?  This happened in the first playthrough. Nah, I'm- I'm- Hold on, let me equip my Evolution Z and just absolutely beat the brakes off this guy. He tried to rob me in the first playthrough. Editor, come to when this guy's dead at my feet for trying to steal my wallet. I'ma show him how we Saiyans do it. All right, you're dead. You're smoked, you're smoked. Hand over your wallet. I like how it unlocked a memorial campaign. I actually put- I put Tao on a t-shirt. That's crazy. Overconfident in his own power. Wow. Okay, well, as a Raditz fan, I gotta say this is a little wild. Piccolo is not doing that. Whoa, whoa! Raditz unleashed his fighting creatures, the Saibamen. Wait, Raditz brought Saibamen to Earth too? Now this is just embarrassing. Bro lost so he had to upgrade to a Saibamen. Wait, I get to be Raditz and the Saibamen? Now I'm gonna fold Piccolo with the Saibamen. This is- this is the greatest Dragon Ball game of all time. Look at the way Saibamen stands, bro! He's just different, unfortunately. Sorry, Piccolo. But if you really thought you'd just beat Raditz, bro, it's kind of just like an understatement. Wait, actually, Piccolo's kind of buff. Wait, why is Piccolo so buff? Are we- are we seeing how much health bar Piccolo has? Full power energy wave! Oh, no. Yes, I still clipped him. Oh, no. Oh, no! Saibamen, no! Damn, he's faced down in the dirt just like- just like how he was born. All right, well, that actually made the fight a little more balanced. And this is actually gonna be a- this is gonna be a hard fight, man. He's got so much health! I'm already at two bars. The Raditz 6k, full power energy blast! And he somehow hit me from eight miles away. No way he dodged a special beam cannon! You can't block that! I see why it was so weak without a charger. Damn! Oh, he is quick- bro! But never mind, Piccolo was that guy! That was a crazy beating. I failed.  Let me go into the eva- oh, I can't upgrade Saibamen. Hey, I might as well give Raditz plus two speed, though. All right, well, I couldn't really upgrade the Saibamen, so I'm just going raw Raditz on this one.  Yeah, let's go Saibamen! Yeah, play with him a little bit! Okay, hold on. Hold on. Let's Saibamen cook. Yeah! That's my guy right there! Full power energy wave! Yeah, take 7k to the face! How about that? Hold on, let me do a little acid-spit combination. I told you he wasn't gonna get past me! Acid! Full power energy- oh, high speed rush, actually! Combos? Combos? Yeah! What, you think I was grown yesterday, bro? I was grown today. My reaction time is crazy. Oh, that was a nice grab. All I really want to do is self-destruct on him, though. Is that- oh god, I don't think I'm dodging that. I am. Wow, acid is so close range, it's crazy! I could have done so much better if I didn't whiff the acid. Block that. No, no blocks. Bro, how did he take two of my- Dude! What is up with this pickle away? He hit it! 21k! What is up with this pickle away? He is crazy! What the f- This is the hardest fight of the game so far. He's level 175. Look at his neck muscles. No wonder, bro. I'm not gonna sit here and lose again. I gotta mix him up. Oh, you're taught to- He just taught it on me. This AI is so full of it, bro. Am I connected to an online player or something? There's no way! I'm gonna lose Sidemen already. I didn't even land one full- Oh, god. Stop! No. No, no. I didn't even get him down to three health bars again. And now he's going to kill me. Woo-ha-ha! He took a bar even though I blocked it! This is the hardest fight in the game! He's got counters. He locked me off of him. He's- Oh my god, look at the way my health bar moves! Jesus. Where is he? Right, it's please. He's above us into the right. Even I can do that with- Wait, you think you're gonna do Hellzone Grenade? Think again. Think again, bro. Yeah! No Hellzone Grenade. Comments, if he does Hellzone Grenade, how am I supposed to dodge that? Oh, it's over. I bet even if I block this, I die. I'm blocking it. What are we actually talking about? They really made this an optional side story and they said, well, if the player's good enough to beat Raditz, he's probably good enough to beat Piccolo. Bro, no. Okay, so I have to admit, I came into this video thinking I was gonna beat the whole Raditz storyline, but if it's all this hard, this might be split up over multiple videos. This is crazy! This is actually crazy. I'm gonna get behind him. Yeah, taunt me again. Childish, bro. Yeah, where's all that taunting gonna get you, bro? He's weaving me.  Oh my god, he broke my stamina.  Oh my god. Nah, nah, I was messing around, bro. Of course I'm gonna get to play.  Don't grab me! Oh, I'm just gonna surrender.  I'm gonna be honest. I'm gonna be honest. He got me there. I'm just surrender and go next. Okay, cool. We put Simon on the back line. Don't ask me why. Oh, I'm behind you. Yeah, I'm behind you. Okay. I just wish his guard wasn't impenetrable. It's a little embarrassing to say, but I usually do better with the Simonmen. Oh, this is crazy. Bro, the AI is not- This is crazy. Oh no! I would have died instantaneously. Why did they give the Simonmen better combos than Raditz? Please get- Oh, goodbye, mother. I li- Wait. How come Simonmen can live that but Raditz can't? This game is hating on Raditz like crazy in this art. I just got mixed. Oh my god.  I'm gonna actually be here all day. I can't take the failure music anymore. I can't- Okay, get behind him. No, get behind him. Get behind him. No! We lost a free back combo. Is there any way to like disengage? I'm dead. I'm literally dead. I'm dead. Are we not seeing this? Are we not seeing how overtuned he might be? Oh my- I can't believe this is gonna be a multi-video long series. I'm behind him. Yo, Simonmen backshots go crazy though. No, nope. It's already gone. No, breaking my guard already that is so cheap. Am I dead?  Hey, piccolo!  Oh my god. Oh my god. 16k is quick. 22k? 22k, that's two health bars. This is crazy. 10k and four hits. 10k and four hits. Somebody come back to the game and rebalance this. See the thing is like I should probably go to the Baba shop and just buy health ups, right? But I'm not a loser, bro. I'm not gonna just let piccolo know that he can wash me like this. Come on. Come on, Simonmen. Let's go. There we go. Oh no. It's already bad. It's already bad. It's already bad. It's already bad. It's already over. It's already done.  Are we actually serious piccolo? Like is this actually something that I'm supposed to be able to beat? Oh my god. Dear god. Dear god, man. I'm good. I am so good.  I don't care. Come on. Get behind him. Get behind him like we always discussed. Let's go. How did he already turn around? It's over. Once piccolo has you in his grubby little claws, bro. He's crazy. He's just different. He's just a different beast, unfortunately. Oh my god. Damn. He just dashed at me and laid me out. The only way this is probably even remotely possible is if I land beams. I can't believe how close. By the way, like I've gotten him down to three health bars. How the hell did I do that? High power rush. Let's go. This is the one I win. I just have to charge up more and hope that he stays away. No. High power rush. Yeah. Yeah. Oh, now I'm cheating. Yeah.  And I'm gonna stay cheating too. Yeah.  Pickle. 7k. Yeah. Come on. Yeah. Oh no. I just have to survive this one then I can go back to cheating.   Yeah.  Oh my god. I'm panicking. I'm panicking. We can actually win this right now. We can actually win this right now. Oh, oh, oh. Piccolo, what happened? What happened, big guy? He dodged that one. Don't do Saiyan Soul. I didn't block low. I didn't block low. I didn't block low. Dodged it, Raditz. I'm alive? No way I'm alive. With like zero HP. He's gonna do Hell's Oak Grenade. He's gonna do Hell's Oak Grenade if he does Hell's Oak Grenade. I'm cooked. I'm not gonna make it in time. Dodged it. He did Special Beam Cannon instead. There's still a chance. There's still a chance. I just gotta cheese him to win.  Hey, whoa. That was cheap as hell. He busted out the stretchy arms, bro. What was I supposed to do against that? That is crazy, man. That is actually crazy that he had that reach. Oh my god.  Notice how I didn't go to Baba Shop because now I know he's easily cheeseable. The new strategy is just run. Okay, maybe the new strategy shouldn't just beat a run. Let's go. Cybermen. Put him into dirt, little buddy. Put him into goddamn dirt. 7K. Where's he going? I can't see.  Bro thinks he's filming a goddamn nature documentary. Get off me. Get off me. Bitch. Bitch. Acid. Oh, now he stuns me. I understand, Pickle. I understand that it doesn't feel good. All right, we still got him down to four health bars, though. Pickle with your cheap. Oh, you.  He vanished it this time. You're just literally making stuff up, Pickle.  Go ahead. I dodged it. Yeah. Yeah, but you thought it was going to be over, huh? And he kicked me out of it. Every day gets a little bit harder to go on. All right, run.  In your face, Pickle.  High speed rush. Oh, God. How did he win that 74 hits? That's not human. Ah, full power energy wave. Got him. Oh, I'm ratted. I am setting you up big time. Full power energy wave.  Full power energy wave. Oh my God, Sidemen's going to solo him. High speed rush. And he somehow cooked me different, but that's fine. That was great, honestly. No, there's just no way I can throw away that beautiful start.  Dodge it. He just launched me up into the air and it was, bro. Bro actually just shot me like I was one of those discs, bro. That's crazy. Great. I'm so glad I lost. It's awesome. Oh my God.   All right. I'm going to try this one more time and then I'm going to bob a shop. I promise, dude, because nobody wants to see me struggle with a picklet. Nobody's watching this video for this. Nobody's watching this. I still stand by the strat of going over here. Oh my God, Sidemen. Why? No, please, Piccolo.  Henry, can we get out of the goddamn? Oh God, please hit him. Yes. You can't block that. That is so cheap. Stop it. Stop it. Broke my goddamn controller. How did I lose my 20? This, this cannot be like, oh my God. This is actually crazy, man. This is crazy difficult. Let's go. I blocked those. Mix up. That's fine. No way. What you're cheating. You are cheating.    This might be the most mad a Dragon Ball game has ever gotten me. Even Infinite World didn't have me feeling like this. I'm only 30 minutes in real time. I don't know if that's a bad. I don't know how far you guys are into the video, but I'm only 30 minutes into the recording and I'm still sitting here pissed, bro. This is really frustrating. He doesn't know where I am. Got you. No way. No way. No way. So, so Piccolo doesn't know where I am. And then as soon as he sees me, I basically am charging at him with a direct attack and you're telling me that he can counter that. You're telling me Piccolo at 100, whatever the power level he's got right now. High speed rush. I'm never using high speed rush ever again. I'm never using high speed rush ever again. What if Piccolo beat Raditz? The crazy true story. Piccolo is actually the undisputed goat when it comes to fighting. I'm going to hide behind this tree so he can't fight. What did you do? Oh, this is like a survival or a game, bro. I don't know where he is either. Here's my silver. I'm taking it anymore. That's actually a good strat though. Okay. So, I just hid for too long, but that's actually the strat. I can't believe I'm playing hide and seek to survive. He found me. No, I didn't get to hide. I didn't get to hide enough. My stamina's gone. And now I'm resetting because that's not even worth playing. No, where is he going? Where is he going? I don't know why his AI was doing that, but I'm very grateful. I am very, very grateful. This is the exact spot I need to be. Please hit him. No, high speed rush.  And I'm never using you again is what I said, but I, why do bad things happen to good people? Sign him in. Block. I blocked all of that.  Oh my God. I can't explain how frustrating this is. I can't explain. I can't explain. I can't. I'm losing it. Every day gets a little bit harder looking at this character select screen. Just know I do this every time. Every time you don't see it is just the time it was cut out and I did it behind the scenes. Okay, don't mess up the strap, please. No, I didn't make it. I was charging. Thank you. Thank you so much. No, don't you mean? What do you mean?  Cyberman, I'm so disappointed. Hit him. Let's go. We need to be more high up so that we can actually do damage though. Like, loop it. Let's go.  Oh my God. Blast away. He's stunned. Run for our lives. Run, Cyberman. And he found us. Wait, I just realized. Is Piccolo regening health? No, and I'm stunned. He is. He's regening health. I'm sorry. Did he need another thing to be strong? I'm dead. Blocking and attack is that much damage. And there goes my stamina. You guys will have to let me know in future videos if you want the challenge to be accurately depicted or if you want me to play on easy mode so you can just see the story if there's more what ifs. Well, actually there is going to be more what ifs because I'm still trying to play through the whole ratat saga. Oh my God. I'm sorry. I really didn't. I really wasn't trying to get away. High speed rush. There's no way I'm just going to surrender. That's how that's how beaten down I am, bro. Is that when I see a clash, I just know it's over. I just know the game's already over. It's already been decided.  I wanted to come in, play a fun ratat sub game and just have a good time and now I'm struggling. Okay. Just going to run behind the tree. Come on. Get there. Get there. Get there. Get there. Okay. Okay. We're behind the tree so we technically still can't see us. He's right there. High speed rush. Don't let him go. That was so scary. That was so scary. Charge up. Charge up. Charge up. Oh, Power Energy Wave. That's good. That's good stuff. Dodge that. Step to the side. Oh, Power Energy Wave. Let's go, Cybermen. All right, Cybermen. It's time for your final mission, little buddy. It's time for your final mission, little buddy. That didn't do that much more damage than a normal beam. I just lost Cybermen. Oh, am I? If this kills me in one hit, I'm going to take a 10 minute break because I'm going to scream until I pass out. Oh, my God. And now I'm paralyzed. And now I'm paralyzed. And now I'm paralyzed. And I'm still paralyzed. And I'm still in the combo.  And I'm going to scream. And I... Wait, wait, where's the chance? Wait, there's still a chance. There's still a chance. There's still a chance. Oh, my God. There's still a chance. Even as slim as it is, there is still technically a chance.  And I accidentally did Saiyan Soul. How strong is your guard? No, do the acid attack.  Come on. Let's go. Big deeps. Big Cybermen deeps. How... How did he weave me so effortlessly? What a blink. Oh, I can't even be mad. My Cyberman was kind of going crazy. No, how do you... How do you tech? I'm not good at the game like that. My stamina. Oh, God. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. Get it back. God, sometimes the buttons just be doing what they want. I'm mashing to save my light. How many more attempts can I logistically take before I have to go to Baba's shop and just buy the most powerful items and just come back and literally kill him in one hit? I just can't take it anymore. I can't take it anymore, man. Please lock on, Cyberman.  Oh, Power Ranger wave. Don't dodge. Get up, Cyberman. Get up before I... Oh, my God. Okay. That's an easy punish. That's an easy punish. Dora, what are you talking? He has the ultimate answer. He's just the ultimate... He's the ultimate gaming god. That's what Piccolo is. He's just the ultimate gaming god. Yeah. All right. Yeah. This AI is crazy. What's crazy is in this what-if scenario, this Piccolo is definitely taking over the earth, bro. Goku is not beating this guy. Don't hit me. Yes. Yes. Yes. Yes. No. What's the matter, Piccolo? Can't catch what he gets. He paralyzed me. Do the move. No, he was supposed... No, if Cyberman did the paralyzed acid, we would have won for sure. Okay. But that's a really great start. I can't even be mad. No, no, no. It's grabbed. I didn't react fast enough. Oh, my God. No. What is this combo? No. It's been 50 minutes. This is worse than any infinite world boss I ever fought.  Please. Don't hit me. Yes. Thank God, man. Come on. Come on, Cyberman. Clutch up. No, I take that. Back step in his face. Drop down on him in the sky. This is huge. If we can get him to sub two bars, that's where I'm going to start actually kind of getting hype. Full power energy wave. It does a little bit of chip. Back step. Full power energy wave in his face. Dodge that through his activated ability. Come on. This is it. This is it. I can tell. Full power energy wave in his face. Hold that. He's almost dead. Oh, you already know how I got to finish this. No way. No way. I'm dead. I'm not dead. No, I am dead. Oh, God. Oh, God. Oh, God. Oh, God. Oh, God. If he kills me now. Oh, God. If he kills me now. I've seen 20 kick combos up this graph. Piccolo. Sit down. Holy moly, dude. Level up. Yes. Level 19. I got one whole level. Ace. Well, the Saibamen were. Piccolo proved to be an even match. No way, bro. He was a better match than ever. Is that all you've got? That's crazy. This is a crazy scenario. Suddenly the Saibamen halted their attack on Piccolo. They swarmed Raditz as they prepared to self-destruct. Wait, the Saibamen, the Saibamen are, what? What? And thus, Raditz was defeated by his own Saipamen. He betrayed me. Come on, man. I thought we had something special. Where am I? Having hit his head, Raditz's memories were lost. His mission forgotten. He began to wander the earth. This is crazy, bro. He forgot his whole memory. He forgot everything. Oh, my God. That I can't believe this has to be its own video. I'm so sorry for that. So Piccolo beats Raditz, causing him to get head trauma for getting who he is, where he's supposed to be, and his entire mission. And now we're just going to go meet. Like, I guess I can just go check the wasteland out. It's the little Saibamen punk that betrayed me. What are you looking at? I'll beat you to death. You dare raise your tone speaking to me? That's three of them. Hey, you were saying something about beating me to death? Oh, I'm sorry. Oh, I'm sorry. Oh, why did I even block that? Oh, I'm sorry. You must have thought you were something different.  You must have said you were going to beat somebody else to death. What are you doing? Throws, bro. We're using throws. The thing is, Piccolo was just actually unbalanced, but you're just a Saibamen. You're just, you're nobody. You took my memories from me, threatened to beat me to death. Oh, I'm going to enjoy this. I'm going to enjoy this very much. How do you do that? Another grab. Wow. Original, real original stuff there, Saibamen. He's going to try to blow himself up. He's, get out of here. That's one Saibamen now. Where's your other two friends? Oh, that one is red. That is not good. A grab. You guys aren't doing Piccolo levels of damage though. That's the thing where you guys messed up is like, you, you're not him. Come on. What I'm calm was that. What I'm calm was that. What I'm calm was that. If you can't do any damage, then you got to get out of here. Block that. You can't block that in this game. I forgot that's how I beat Piccolo. That did a bar. Who are you people? The scaling in this game is crazy. Oh my God. Come on, you little, this red one's taking forever in a day. Die. Oh my God. Those were the slowest key blasts I've ever seen in my life. Okay. Red guy's down. Another red guy comes out. I've got Saiyan Soul activated now. I've got Saiyan Soul. Oh no. You can't block that cheap. Does 9k damage cheap? No. I can't afford to lose to a Saibaman. Not again. I already had one take my memories. Okay. That was big damage. Yeah. Allow me to get the first high power rush off. This fight was a lot closer than I wish it would have been, but it's already over. GGs. Give me back my memories or whatever, you know, actual reward I get. I could really use something. I need to power my character up. Saibaman said, okay, I'll take it. Can I at least get some XP? Level 25. I needed that. I needed that. Well, unfortunately, I'm ending the video here because this has been crazy. Tune in next time to find out what if Raditz met Goku.