and we are back on the backstory and blasting out on the radio in the Empire of Lies on 105.5 FM and AM 1390 in Washington DC. Join now by the great Joe Lauria. Joe how you doing? I'm finally how you're doing? Doing great and really pleased to have you with us. We were just talking with Alkiller one of our callers about the rumors about Xi Jinping. They're saying that there's been a military coup. Now as one of the great Indian news publishers, when you hear stuff like this, how do you approach because obviously if there's a military coup, it's a big story. But when you hear about a story like this, how do you approach it, Joe? First of all, where is this coming from? From social media? I mean, I've seen these tweets. I saw someone at Newsweek, a reporter who apparently won a Pulitzer Prize and some other big awards from mainstream media was tweeting it out, but then had to and said it was a rumor and then had to pull it back later.  I don't know where the origin of it is. But I think if this, we just have to wait to see if something like this is true and we will see pictures from Beijing, we will hear people from there. I mean, it is not a completely closed society. We're not talking exactly about North Korea here. So if something like that happened, we wouldn't know it. And it's rubbish. It's rubbish. I wouldn't, I'd spend five seconds talking about it, frankly, Lee. No, no, that sums up what I think. But I, you know, I almost think people learning what your approach to something like this is you come into it skeptically, right? Yes, I would call, you know, I mean, normally I would call someone at the Chinese government in the embassy here in Washington or at the UN, but not in this case because they would laugh at us and they would never say what was true, not anyway. So yes, absolutely skeptical on every story you approach. You must. That's a bedrock of journalism that's, we don't see a lot of anymore, especially when it comes to US officials unnamed, pushing some classified information leaking it to push American agenda, which is what the mainstream media does, unfortunately. No, and that's, and it's gone into, I would say overdrive in the past six, eight months since Russia began the special manager operation. I've really never seen it as bad of blatant lies over and over and over again, but they never it's wartime, Lee, and both other side lies and puts out nonsense. And so we we seem in the United States to think that we've got this free objective and serious professional press so that it's shocking when you know that they're just regurgitating things that are coming from Ukrainian officials, the US officials, unnamed, just go back to any war, First World War, the Germans were eating babies in Belgium. And we've got a long history of this. Yeah. So that's what they were reporting then. So now we're hearing stuff that you cannot verify, especially what's going on on the ground. This is whatever either side says, I definitely do not accept at first glance. If both sides are saying the same thing happened, then that's when you can pretty much assume that it's true. But if they don't, you just can't decide necessarily, unless you're there on the ground, yourself observing it. And there are very few war correspondents on the ground, especially from the West. And I'm certainly not there. Now, Joe, lawyer, I pointed out that you're one of the premier publishers in independent actual independent media at consortium nose and founder of Robert Perry is a mistake you think for people to assume that news coverage used to be better. I think in some ways it used to be better. But I think in a lot of ways, this news coverage for decades has been a pile of lies. You agree? There's a lot. There's a lot of deception going on. Yes. I don't think the press has ever been what some people may have thought it was never close to perfect. However, there have been some fundamental changes. Let's look at television news from ago to YouTube and look up the first ever broadcast of CNN. You could see it. It's there the whole couple of hours of it. It's extraordinary. Interviews with the president is investigative reports 10 minutes long on a faulty fuel gauge on an on airlines. They gave news. They did investigations. They show that you could do journalism on TV. What happened? Fox News really changed the game because they made an openly, openly partial partisan broadcast for the Republicans, and they killed CNN and MSNBC, which just had started some time after that.  That's the name of the game, obviously. So what did you see? Gradually, CNN and MSNBC have turned into just a mouthpiece for the Democratic Party. So you've lost any kind of television news and what you've got a talk show hosts, not news anchors, not news presenters as you once did. People who like Walter Cronkite, for example, had a background in print journalism, newspapers or wire services. That's where those guys came from. Now they're movie stars. It's all about the personality of the presenter in each show, and they're saying the same garbage and it's a talk show. So there's no more TV news. In terms of newspaper journalism, there were some in New York City, there were 12 newspapers at one time, eight dailies when I was born. So it is down to three, essentially, now. Two tabloids in the New York Times. There's been a consolidation of ownership. And we've also seen, of course, from the 50s, the CIA without question infiltrating newsrooms to control what's going on. And now it seems like they don't even need to do that because CIA officials are actually former and national security officials are on TV right now. So they are directly involved in promulgating what used to be just whispered in the years of reporters that go around themselves on TV to push this stuff. So there's no question that there's been a decline in journalistic standards on TV and in the press. There are fewer jobs and they are openly now pushing a government position where they did it more covertly before. But it was never great. I'll put it that way. Now, Joe, people talk about the Uniparty, and they say that on issues of foreign policy, the Democrats and Republicans are basically the same. But do you think there's also a unit narrative, a narrative that everyone goes along with as beyond ideology and gets into some of this? How important do you think people talk about the World Economic Forum? Do you think they're under something or do you think they're crazy conspiracy theorists? Joe Lawyer? Well, just in general, I would say that there's no question there's one narrative that's enforced about foreign affairs on international policy. Domestically, there are differences, I think, between the two parties. But on foreign affairs, they're indistinguishable from one another. And it's an agenda that pushes the US interests abroad. That's what not what journalism should be doing. You should be reporting what's happening in the conflict between nations, which is incredibly dramatic and important to report by giving both sides of the story to try to get the point of view of all the players, whether one of them is Iran or North Korea, try to find out what's going to make the US just one of the players. But of course, the way it's news is presented to us about international affairs. It's the US is the good guy. It's that kindergartenish and certain countries who are not with the US are the bad guys. I'm not going to go with the World Economic Forum because it's not something that I have dealt very deeply into, but I don't trust them. I mean, this is a very important meeting in Davos, for example, every year, and other things happen throughout the year, and these are very powerful people who compare notes. And there's no question that they probably agree on things, whether they could implement that through the media, through their government is another matter. But if they don't to be trusted, that's for sure. I'll say that about the WES. Joe, you talk a lot about US homogenity. Did I get that right? I think so. Okay, I think so. It's a tough word for me, but homogenity. Yeah. Can you talk about ways in which this world that the US has run has not worked out well for the US? We talk about the US running everything and global homogenity, but do you think that's worked out well for the US or badly for the people of the United States? For the people of the United States, it's worked out terribly. For the rulers, for the economic and political interests of very powerful people, it has up until now worked out pretty well. That's why they're doing it. They're not doing it because they're interested in the well-being of the American people or the European people or any people, the Ukrainian people. They don't care about this. From their actions, you can tell this. So what is happening now, of course, is what they've done in terms of the economic warfare against Russia is certainly backfired, particularly in Europe. It is not brought down the Russian economy. It's threatening the European economy and to a lesser extent the American one. And this is something extraordinary. Is this what they want? They had to know this could happen, or they didn't. I mean, we never know exactly the level of intelligence, the amount of thought, or gaming theory that they went through to see, well, what could happen? Somebody had to know that this could be one of the results, that the sanctions against Russia could backfire on the West, which is what they have done. But as I argued in a piece that I wrote on February 4th in consortium news, that's 20 days before the Russian invasion, that the US was setting, the US wanted this invasion. They needed Russia to invade because otherwise they couldn't launch the economic war. The information war and the proxy war against Russia was whose aim is to bring down the Russian government. We've heard that directly from Biden now, from Lloyd Austin to weaken Russia. There's no down on my mind. And I thought I was really smart during that 20 days before the invasion. But now we just republished a piece from John Pilger, who wrote, if Putin can be provoked into coming to their aid, meaning the people of Donbass, his preordained pariah war will justify a NATO-run guerrilla war that's likely to spill into Russia itself. So even Pilger, back eight years ago, saw where this was headed, that this would be a US, mostly the responsibility of the US, to push Russia as far as they did until they could not take any more and they actually invaded. And again, that's what the US wanted. But I want to add this right now, that I think the time for responsibility, the time for who's right and who's wrong in Ukraine, is over. We've got to end this war. It has gotten way too dangerous now. We can have that argument later. We've got two powers facing off now. And if Russia interprets an attack on these new republics, that they're going to new provinces of Ukraine that they will absorb into Russia very soon, if they interpret that as an attack on the Russian Federation to rise into the level where we could see a nuclear exchange, we've got to stop this immediately. And normally, you need an outside power to come in, a neutral power to say, okay, guys, stop it. And that would be the UN. And unfortunately, throughout the long history of the UN, and I covered UN headquarters for 25 years, as you know, Lee for the Boston Globe and the Wall Street Journal and a bunch of other newspapers, the Secretary General of the UN, the only one who ever did something like that was Dag Hammershowell, the second Secretary General who stood up to both the Soviet Union and the United States and made himself an impartial arbiter affairs. And guess what happened to him? He was most likely assassinated when his plane went down. The current Secretary General has completely destroyed any impartiality. He's totally taken the West Side 100% in this very complex conflict rather than being nuanced about it. So he has no role to play. And this is what I fear. This is really what I wanted to say on your program that I fear that without any role by an arbiter, we are just putting out everyone's lives is in the hands of the leaders of the United States and Russia right now basically. You could forget about NATO and Europe because they just pretty much do what the U.S. says. Although at the very beginning of this conflict, you did see Macron of France and Schultz of Germany going to Moscow to try to listen to what Putin was saying at least. And that's when Russia put forward those treaties, those draft treaties in December that had they been at least negotiated seriously, had Minsk been implemented about Donbass, giving it autonomy. Don't forget, Russia went eight years ignoring the Declaration of Independence of both those provinces in Ukraine and Donbass. They were pushing for the Minsk Accord. So for eight years, Russia was patient about this. And France and Germany, the leaders, they realized that Russia's security interests are important. Henry Kissinger has recognized that. But this group of neocons running the show right now in Washington with their allies like in the Green Party in Germany have really pushed this thing way too far. And I don't know where it's going to end. Nowhere does. And as I said, there's no one to step in who's impartial to try to stop this. And do you trust the U.S. people, Austin and so on, to not go nuclear? Up until now, I have thought the Pentagon was the only force that was saving us in the U.S. side because from the very beginning of this conflict, there were voices in the State Department, some in Congress who talked about a direct NATO or U.S. war against Russia. And this had to be avoided. Even Biden, to his credit, said we have to avoid that because that's World War III. He used that term early on in the spring. And the Pentagon, I still put my hopes that they will pull back and not allow this to happen. But of course, there's the other side. And I don't know what's going on in the Kremlin. And we, as I said, what we don't know now is are these new territories that are about to become, from Russia's point of view, part of the Russian Federation, if they're attacked, in what way will they be attacked? Could it trigger some nuclear use by Russia? I don't believe they put in threatened nuclear attack, as everyone in the West is saying, as Biden has said at the UN. I think this was a warning. And I think there's a difference between a threat and a warning. If you go up to an electric power station and there's a sign that says, warning, high voltage. It doesn't say threat, high voltage. There's a difference. That was a warning. And I hope that the warning is heard. But that would mean that the NATO and the West would have to start negotiating now and end this conflict with this territory most likely staying in the hands of Russia. Ukrainians are not going to accept that. NATO's not going to accept that. Certainly, Washington will not, because their aim is to drag this war out as long as possible to bleed and weaken Russia. Are they going to give up on that faced with nuclear attack? This is why the warning was given. And it was a warning given on February 24th in Putin's speech announcing the war when he said he reminded the world that they had nuclear weapons if anybody interferes. So that was also a warning that we have to take that warning seriously and not allow this war to continue another day. But I don't see it ending very soon. Do you, Lee? I don't see, I don't see where this is going at all. And I'm very worried about it because I used to think that the U.S. would not possibly go there. Now I think they might have no choice but to go there because the only way to get out of the trouble they created for the world economically may be to go to war. Does it make sense, Joe? Yeah, but not nuclear war. You know, if there were no nuclear weapons, there was no question there would have been a conventional war. NATO would have probably invaded Russia. There's somebody, Alberto Maravi, an Italian novelist from way back in the 60s and 70s, wrote a book about basically how nuclear weapons have saved the world from World War III. And it still is to this moment. Otherwise there would have been, without question, a conventional war right now between Russia and NATO. We have to avoid that. This never should have happened. The U.S. could have stopped this by agreeing to talk about those draft proposals, implementing Minsk. And that would have at least put a long break on this. There's no way Russia. And I do think that Putin has made revanchist statements in the past that Ukraine, parts of which were, of course, conquered by Catherine the Great. That's the Russian imperialism, by the way. There's nonsense about it on Russian. They're not an imperialist power in Ukraine. That happened in the 18th century. That was Russian imperialism. It was part of Russia until Khrushchev gave that to Ukraine in 1954. And those were all and still are Russian lands. And those people were attacked in Dumbass after the coup in 2014. And I think just given an opportunity for Putin to say, we're taking back those countries, those parts of Ukraine that were part of Russia for so long. That's not imperialism. Because imperialism, we go somewhere where you've never been before and they don't want you there. That's imperialism. They were there. The Russians have been there. And the people are welcome. Many of the Russian speakers are welcoming at least Russia. And they're going to vote for this referendum. I just want to clear that this is a, revanchism is different than imperialism. And it wouldn't have happened. It's not a cause of this war. It's a consequence of this war. The causes of this war, I put squarely on the West side. I know this makes me a Putin puppet.  You know, I'm sorry. I was just saying to my friend today, because he was asking me about this. I said, he was who's responsible for the war? You know, the war is it Ukraine or Russia? I said, United States. No, I had to go into a whole explanation about what we did and NATO. Right.   These are basically Russians. They've been wanting to be a part of Russia. They don't talk about that on the news.   What have you heard about the thousands of people who were killed since 2014 by a U.S.-backed coup government in Kiev against the people in the Donbass? I mean, it was not one word spoken at the UN Security Council meeting about that, except by Lavrov. So this is just airbrushed out of the story. And that's the way you control a story, but not by necessarily overtly lying, by cutting out an important context, which changes the entire narrative. And this is the one that the majority of people, and if you want to put forward causes of the war like historians did when they said that the Versailles Treaty, the onerous conditions on Germany led was one of the reasons leading to Nazis in World War II. Well, nobody accuses those historians of being pro-Nazis. But if you try to explain the causes of this war, then you're, of course, I'm just getting paid by the Kremlin. So it's just a very, very difficult environment to speak in and to argue in because there's such confusion purposely sown, mostly by the West here. And Joe, I put it on that at concerning news, you were carrying on the journalist's legacy of the great Robert Perry. Have you went back and watched the film Ukraine on Fire, featuring Robert Perry lately? Well, I saw the follow up feature in you, Lee, as well. Yes, I did. I saw both of them. Yes, when back a couple of months ago, when the crisis really turned hot, but I'd seen it originally too. And we had Igor on the director on our webcast, CN Live, for about $3, he spoke to us. Yeah. And Robert Perry in 2014, in 2015, was prescient on this. You've been, concerning news have been reporting the truth since well before the military operation went off. Is that right, Joe? That's, that's correct. As I pointed out, Pilger's piece was published in The Guardian, which we republished, yes, or over the weekend. But yes, Bob Perry wrote a story in 2014, saying, are ready for a nuclear war over Ukraine. And I frankly, when I saw that, I read it, I thought, well, maybe he's gone a little too far this this time. And he was completely on on the mark, wasn't he? Now I know he was right. But at the time, I thought it was exaggerated. It wasn't. Yes, Bob understood the key facts of Ukraine before a lot of people in the United States, certainly at that time, there wasn't as much alternative media. It was starting to pipe up much more now in the last eight years. But of course, we've been around since 1995. But Perry founded this thing, former AP investigative journalist. So Bob was way, way ahead of the game. And there were our reporting on Ukraine, then, and I have to say now, has been amongst the best you're going to find anywhere. That's unfortunate. I wish it was wider known. I agree though. I agree completely. Yes. And Joe, let me talk about this for a second. You're a great publisher and journalist with a lot of mainstream and independent journalists, credibility. Do you think, as I do, that the most important virtue for journalists these days is courage? It's not so much. It's not. The truth is actually not that hard to figure out. But reporting the truth requires, I think, a lot of courage and bravery to fight against the narrative and the attacks that come on people. What do you think, Joe? I do. It's not the same kind of courage as being a war correspondent, but it hasn't done us any favors. It hasn't done us any favors to report what we've had. Instead, it's brought PayPal to suspend us permanently so we can't raise money through PayPal and a news guard gave us the red letter because they say that we've published false information about Ukraine. I responded with a 9,000-word article that anyone could read in which I dissected everything that they said that we had said wrong. And I think I made the case that they, in fact, needed to correct their reporting on Ukraine. But of course, I didn't stop them. There are many difficulties to stick to what you think the facts are telling you, despite this outside noise. And of course, everyone knows what it could be like to be attacked by trolls and organize trolls on social media. I mean, I put that Pilger story on our Twitter page, and about 30 trolls came out immediately to attack him in the most vicious kind of way. It's ridiculous. It made me laugh, but that's out there. They're organized. They're ready to stop you. There are organizations like News Guard that want to damage your reputation with a red mark. There's PayPal that wants to damage you financially. We don't know where else this will lead. But yes, so that's the kind of courage. I think before people would say to me, oh, you have a lot of courage. I didn't believe them.  So that was the level of attack then, which was pretty bad, but okay. And now it's- It was. Yeah, that still happens. But now it's, we've added organization like News Guard, giving people red marks. We have gotten out PayPal and we don't know what else is out there. We've got this kill list in Ukraine in which one of our writers, Scott Ritter, is on that list. Roger Waters, the rock musician, is on that list. So it's that the stakes are getting higher. So the courage has to get stronger. And in regards to that, do you have any opinion on Edward Snowden becoming a dual citizen of Russia in the US today? I know only that what, what took so long is that Snowden was not trying to become a Russian citizen. In fact, I think he was trying to avoid that because he knows that once he becomes one, a lot of people use that against him. What do you think, Joe? Oh, absolutely. He knew that that's what happened and it's happened and already, from what I understand, I read, I don't know how true it is, but I think he wanted a passport. He doesn't have his American passport. Do you remember it was canceled? That's how he wound up in Russia to begin with. He was on his way to somewhere in Latin America and the plane, probably Cuba, and the plane from Hong Kong stopped in Moscow and he was going to transfer to another plane. And when he landed, the Russian authorities swore that his passport that he presented was not valid. It had been canceled while he was in flight. So it's the American State Department that forced him into Russia to begin with. That has to be known. Now he wants to be able to travel. He has no passport. He'll have a Russian passport. He's got to be damn careful and I'm sure he's very well aware of this to wherever he goes because there are people out to get him. There's no question about that if he leaves Russia. And I don't know where he would go and certainly he'd probably be in disguise and I don't know where he's going to go, but he's certainly not coming back to the U.S. because he will be immediately put in jail and tried under the Espionage Act as they're trying to do to Julian Sange, who by the way helped him get out of Hong Kong. So I think this is all a practical thing for Snowden. I don't think he'd rather not have a Russian passport. It's the Americans again who forced him into Russia and I'm forcing him to get a Russian passport. What other passport would he get being living in Russia right now? Right. And you brought up a Sange and recently you co-hosted a Sange event in D.C. So talk about that a little bit and the upcoming October event for a Sange. Yeah, we were at the Cleveland Park Library in Washington and we had a live audience there and we also had guests online on our Zoom, on our webcasts through Zoom. And first time we ever did anything like that technically and it came off pretty much without a hitch.  And also we brought on Daniel Ellsberg, of course, the Pentagon Papers whistleblower. James Goodell, who was the New York Times General Counsel during the Pentagon Papers case, both extremely worried about a Sange in the fate of the First Amendment because of what they're doing to Julian Assange, what they want to do, what they bring him here. We also had John Kiriako, a CIA whistleblower. We had two people who were charged under the Esplanade Act. Ellsberg and Kiriako, he was at the library with us. We had Chip Gibbons at the library.  And Kathy Wogan, our executive producer of a webcast and who's written articles for us about the hacking allegations against a Sange, why they're false. So this was a basic exposition of the issues around a Sange intended for a general audience. 15,000 people were invited in a circular in that neighborhood around Cleveland Park in Northwest DC. And 40 people showed up. It's pretty sad. But we had over 4,000, close to 5,000 viewers so far online. But it's still, people are not wanting to open their minds about a Sange National Press Club, refuses to support him. Even though the committee protect journalists, reporters without borders, International Federation of Journalists, and numerous other press and human rights organizations are supporting Assange and calling on Biden to drop these charges, the press club in Washington, which I remember, refuses, even though they're very well aware of the case. Joe, we don't want to get into a fight with anyone because I don't want to. I'm ready. Go ahead. Are you suspicious of journalists who do not talk about Assange? Well, I think I know why they probably don't because they don't want to face the issues. Because if they did and they really studied it just a little bit, they realized what is going on and what's wrong with the prosecution of this journalist. And he is engaged in journalistic activity. It really doesn't matter whether we call him a journalist or not. His activity was journalistic. And that was what Bob Perry, our founder, wrote in December of 2010 that what Assange was doing was exactly what he did. And he is well known for breaking some of the biggest Iran-Contra stories for the Associated Press, including naming Oliver North and his role in that. So the article that was titled, we are all journalists are doing an Assange. So they don't want to look at it. They want to cling to the fact that Joe was a hacker. Yep. Joe, we're out of time, but it's truly an honor to have you on the show. Great parents, as usual. And please come back on sometime soon to talk about more stuff that's going on. A dose of truth from Joe Lawyer from Consortium News. Read that every day. And thanks so much to Carmine Savia for doing a great job as our guest co-host. And thanks so much to the great Ted Rawl. I got to buy some of this art soon at rll.com. We'll see you tomorrow, here on The Backstory.


Central Lakes College has named Joy Bowden as its Vice President of Academic and Student Affairs. Bowden was previously at Hennepin Technical College, where she'd been serving as the Academic Dean of Industry and Social Science since 2010. While at Hennepin Technical College, Bowden was the interim dean of Student Affairs from 2011 to 2012 and served as Director of Marketing and Admissions from 1999 until 2010. Bowden was selected after the college conducted a national search. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


Vassily, a wonderful game against Latingly from China today. A great win. Tell us about the game. Okay, so my preparation was okay. I will just play E4 and then we'll see what will happen. Okay, and when she chose French game, okay, so N3 is too aggressive, so N2 more solid. She took with that Queen. Okay, I started to think, okay, main theory, Nb5. I played myself this and Magnus played this against Karuana. When Karuana just missed piece on A6, okay, I think probably, okay, I need to create something new. So I started to think, okay, maybe Ndf3, okay, maybe not the best move. But at least looks solid. So I decided Nf3. Black has white choice here. Very natural to play A6, for example. Because Bishop can, from f8 can develop it to D6 or c5, okay, up to next moves. But she played B7. I didn't want Karu with c4, okay. B3 is natural, but okay, I started to think that if I was possible, something very sharp. I started to calculate, okay, maybe 3 minutes, maybe 4 minutes. Okay, my estimation of position is very complicated, but at least it will be something interesting at the board. If she will choose E5, of course. Okay, maybe should be 3. Of course, Black can play, for example, castle, castle A6, something solid position. But she started to think long time and played E5. Now, many, many interesting things. So Nb5, of course, castle. Castle E4, Nc3 more or less forced. Qc6 also, only move because if Qf5, Nxc4 and Qe2, so Qc6. But now I had choice. I have seen that. I had choices. Because Qe1 was interesting alternative if it takes on D3, Qxc7. At least I have safe position. But okay, I was not sure about bishop before. Firstly, I considered idea, bishop takes E4, Nxc4, Nd5. But it doesn't work because Rd8. Okay, so I started to consider exchange sacrifice. If rook takes E4, Nxc4, Nxc4, or bishop takes it for both. I calculated everywhere, not clear position. Okay, so I decide to play what I played. So I played, I played Nd4, then I took on E4. Okay, I calculated if Rd8, bishop E3 takes on B2, Qd3. My estimation, complicated position, very unclear position, but okay. White has good development, so I hope at least I am not wows. And suddenly I realized I made move and my pawn on B2 hanging. Suddenly I realized there is very interesting idea. So NxE4, NxE4. And now not take on B2. Not play Nc6, Nc6 is possible, but I just taken on C6, Qc6, Nd2. Black has compensation, okay. Enough for equal, typical martial compensation, but okay. At least I have pawn up and I am not risky too much. But I started to calculate F5. Firstly it was shock for me. What to do? My knight is hanging and if I go with knight, F4 is coming. I didn't see it before. Okay, I started to calculate F5, NxF5, BxF5, BxB8, BxB6. Rook takes the one. Rook takes the one. A takes B6. And now C3 smart move. If bishop takes E4, rook E1. But unfortunately not so good because rook A4, B3, rook A3, rook takes E4, Nc6 and probably even black is better because A2 pawn is weak. Okay, so I don't like something wrong. And suddenly I was happy. I find brilliant idea. After F5 I have Nd2. So according to my experience in chess, the most difficult in chess is to see moves with knight back. So Nd2, idea if F4 I have Nf5. And if Bc5, Nd7, check. And if F takes E3, Nx7, check and then take on C8. But the most brilliant after Nd2, if rook takes D4, looks like good. C3 rook takes D2. But instead C3, queen E1, very smart move. I won't take on D4 and take on E7. And another threat is C3 and black cannot defend everything. I was so happy with such threat and I was lucky because if not after F5 could be trouble for me. But okay, she played differently. She lost a lot of time. But okay, she played 2 on B2. Okay, it was possible also Nxc4 first. Nxc4 takes on B2. I consider this like more or less solid line for black. Because after queen B2, queen D3, if Nxc4 maybe possible too. But now I can consider also taking with queen, not only with knight. Or maybe probably was more precise. Just Nxc4 and queen takes B2. But okay, she took on B2 immediately. Queen D3, Na6, this more or less I expected. Rb1, okay, Bf3 immediately was possible. But Nb4 and if queen c4, Nxc2, I didn't fight nothing concrete. Okay, so I started with Rb1, queen A3 and now Bf3. Now, okay, position is very interesting. And I was very happy to see Nc5. I consider in this position like bishop before. It's like main line and I wasn't sure that I'm better here. For example, if Rb3, idea Nc5. RxA3, Nxd3. If Rb3, Bxc3, Rxc3, Nxe5. And attacking my bishop on f3, bishop come back Nd5. It's coming, everything's okay for black. So probably it was the best. Okay, I consider it another moves like Na4, but I didn't find advantage. So, but she played Nc5, okay, queen c4. She played Bb7 and now she left on her clock only five minutes. I had one hour, 15 minutes, something like this, okay. And I started to think and very big choice. I don't know what is really best. So, not Nc5, she played Nb4. Qc4, Bxd7. If Nc5, Qc4, of course I am better. At least I consider this position like I'm better because if Bg4, Bb7 takes, takes with Rxc8, I have Nc6. So I consider this must be better for me. After Nb4 I started to think, okay, not sure. I played Ncb5, this idea, Bf4. I was sure about Qa5, so maybe Qa4 is possible, I don't know. But then after Bf4, okay, I started to play reasonable moves but also follow her clock. So I tried, if I have possibility to make quickly two or three moves, I do it and always she was in time trouble. Okay, probably it wasn't the most precise way, but okay, I at least check not miss something very primitive and then okay, I realize my advantage. Amazing. Vasily, now listening to you talk about your game, I get the feeling that you truly enjoyed and were feeling very happy while playing today's game. Yes, yes, that's true, yes. And you mentioned that you're almost sad that there's only one more game left in this tournament. That's true, yes, that's true. Why do you feel like that? Okay, I want to play some more interesting games. Today it was only a game which I like. Okay, I didn't check this computer, maybe it was some mistakes, but at least it was something creative. I have seen some interesting things, other games, okay, sometimes viewer technical, sometimes primitive mistakes, not so interesting for me. So for you the most interesting thing is to play creative chess. Yes, yes, yes, and I'm a lot of thanks of my opponent today that she also played E5 and many creative moves, so she allowed me to demonstrate, not even allowed me, she compelled me to demonstrate something creative because every city is hanging, I need to think. So also it's kind of nice that she did not choose to play solid, but also... Yes, yes, she could play A6, the castle, NB7, so it's difficult in early stage to create something very special. That's absolutely fascinating to hear now. Vasily, we have often seen you after the game in the lobby playing many Blitz, you enjoy that. Okay, not many, okay, usually after some lose if I want to forget about everything I just... But I'm not advising to players do this during important tournaments. I consider Gibraltar open like very important tournament for me. So for you what you're saying is that if you have had a bad game on the board playing Blitz helps you recover? Sometimes it's possible, but okay, it's also important not do it too much. And tomorrow you've got a morning round? Yes, okay, what can I do? I know 11 in the morning. And how are you going to sleep early, prepare? What is your plan? Just sleep and then create something special if it's possible. We can't wait to see what you create. Okay. Thank you, Vasily. Okay, okay.


Let's get started. Thank you so much for attending, and thank you so much to the organizers for hosting this amazing event. So my name is Mark Mossberg. I'm an engineer at Trail of Bits, and today I'll be presenting some joint work done with my colleagues Flipe, Manzano, and Jan Ivnitski on porting binary analysis techniques over to an alternate execution environment, namely the blockchain. So we'll begin with just what is the blockchain? So from Wikipedia, we have this definition. It is a decentralized, distributed, and public digital ledger that is used to record transactions. And so I've highlighted what I think are some of the more important parts of this definition, just the fact that it's a digital ledger, and it can be used to record transactions and enable transaction between parties. Blockchains have a number of very useful properties, and so they're resilient because they're distributed systems. You can drop nodes off the network, and the system is designed to function like that. They're verifiable, and anyone can recompute the blockchain and verify what's on there. They're transparent, and the data is public, and they're also immutable. And so that's just about all I'll say about blockchains. I'm not only here to extol the virtues of using blockchains, and so we'll proceed into one particular blockchain of interest. It's called Ethereum. So Ethereum is this very interesting blockchain-based, decentralized computation platform. And so it also has a cryptocurrency and a lot of other things, but there's a lot of angles we can look at Ethereum. Today, we're going to really look at it as a computation platform. Some other facts about Ethereum. It's the second largest cryptocurrency by valuation and has this ridiculous peak market cap earlier this year of over $100 billion. And it's also a smart contract framework, and that's what we're going to focus on today. Smart contracts are applications. This is from the Ethereum website. They're applications that run as programmed without downtime, censorship, fraud, or third-party interference. And these are all properties that these applications inherit from being on the blockchain. You can basically think of them as the application layer of this execution environment. Using Ethereum smart contracts, you can implement many types of applications for useful tasks, like managing assets, conducting voting operations, auctions, crowdfunding, making your own currency. But just like any other programs written by humans, they can, of course, have bugs. And so I just want to point out that it's very unique to Ethereum how much money you can lose from bugs in smart contracts. And so I actually won't focus on that too much in this talk. There's another great talk tomorrow that I'll dive more deeply into this. But the main takeaway is that it's really important to have analysis tooling for these smart contracts, because we want to enable these really useful applications built on the blockchain. But if we keep having these programs getting massively hacked, losing tens of millions of dollars, that will never occur. And so we really need better analysis tooling. And that's why we're here today. And so that brings us to symbolic execution. It was mentioned a little bit earlier in an earlier talk. And so we'll dive into it a little more deeply in this one. It's a very powerful program analysis technique that over the past decade has been really proven in terms of its usefulness for the fields of software security and testing. And so our research question was to see if we could port this over to Ethereum and make it useful. So we have a very simple agenda today. First, we'll review what symbolic execution is. Sorry, we'll review what symbolic execution is. Then we'll dive deeply into the internals of the Ethereum virtual machine and computation platform. And lastly, we'll talk about what it's like to combine the two and what we can do with those abilities. So let's begin symbolic execution. So the story with symbolic execution begins in the 70s, actually, with this paper by James King, which coined the term symbolic execution and program testing. The field was very dormant for the next 40 years. And it was only in the last 10 years have we seen real resurgence in research in this field with the number of really breakthrough papers. Called out a few here. We have the Klee paper in 2008. Bap from Carnegie Mellon, Sage from Microsoft, Mayhem. And this kind of leads up to the DARPA cyber grand challenge where symbolic execution was really heavily used by nearly every team for automatic bug finding and exploit generation. But today we're gonna focus mostly on the research presented in the Klee paper, which is kind of coined classical symbolic execution. And so let's begin. And so it's useful to contrast symbolic execution with concrete execution. And so everyone knows how this works. At every point in the pseudocode program, every variable has a concrete value. And so when the program asks for input, the user provides input and maybe they enter it in 42. The program executes accordingly, so A will get 43 and B will get zero. One really important thing changes in symbolic execution is that variables are no longer required to have specific values. They can actually have ranges of values. And so if we execute this code under a symbolic execution model, the X input variable is not going to be a concrete variable anymore. We'll actually replace it with an input symbol. And this symbol will represent any integer. So then the program will continue executing accordingly. A depends on X, so A will also be symbolic, and B is a concrete variable and so it'll remain concrete. And so here we have this distinction between symbolic and concrete variables. So things really start to get interesting when we consider control flow in symbolic execution. And so in this program, we have some code on the left that gets input and then makes a decision. It checks if the variable is 42 and does something, otherwise it does something else. And so in symbolic execution, number of the var variable does not have an actual value. It could be any integer. And so what happens when we're executing this program? It looks like execution could actually go both ways. And in practice, that's actually what happens with symbolic execution. So the engine that's running the analysis will make a copy of the program state. In one path, one state, it'll explore one. In the other state, it'll explore the other. In order to do this, it needs to keep track of something called the path constraints. These are the constraints on the variables that must be true in order for the state to be executed. And so in the do something state, the var variable transitions from an unconstrained symbolic integer to a constrained symbolic integer that must be equal to 42. Conversely, in the other state, the symbol is constrained to be anything, except 42. So this is a little bit more of a complex slide, but it serves to visualize what happens when symbolic execution happens on the code. And so on the left, we have some code. And on the right, we have what's called the symbolic execution tree. So this program on the left has a number of input variables, A, B, and C. It has some concrete integers. And then it has some control flow. And so there's branching based on the symbolic variables and some assignments. At the bottom, there's this assertion. And so our goal is to check, is it possible to ever violate this assertion? And we can do this using symbolic execution. So on the right, we can see what happens when we symbolically execute the code on the left. We have these, you can see visually the state forking that happens at these points in the program. And we can see that the analysis will fully enumerate the state space of the program. We can see that in one particular path, this one right here, it shows that it's actually possible to violate the assertion. So if A is false, B is less than five, and C is true, we end up in a state of always the assertion. Furthermore, in every possible state we find, we also collect the constraints. And these are very useful to have around because then we can use things like constraint solvers to reason about them and ask questions about the program. We can also do things like generate inputs. And so the way constraint solvers work from the outside is very simple. You just express your query as a set of constraints and it will either return satisfiable or unsatisfiable. And if it was satisfiable, it'll also return a proof. And this proof is very useful because in the context of program analysis is basically the input for the program to drive it down to state. If the constraints were not satisfiable, the solver just tells us so and that's it. So of course, not everything is super easy with symbolic execution in there. A number of challenges, I've selected three of the main relevant ones for us today. And so path explosion was mentioned earlier. You might have the intuition that programs are huge, right? You can get into infinite numbers of states. And so how could you possibly manage an infinite number of states? And that's really true. In order to make symbolic execution effective, you only need to have strategies to prioritize the search, the state space to find the bugs you want. And so we'll encounter this. We also encounter this in Ethereum to a certain extent. I'll talk about that later. Symbolic memory indexing is another kind of unique problem. And so consider this snippet of assembly code. We're dereferencing a register. Say rex is actually a symbolic variable though. And so now we have to dereference this symbolic pointer and load it into another register. Well, that's kind of a weird situation. Where do we actually dereference that pointer? It could point to a number of different locations. So how do we actually continue beyond this point? This is an accepted, this is a big problem in symbolic execution. There are a number of strategies that exist for handling it. One might be to just concretize the REX register into one concrete variable. But of course this will compromise your analysis and limit the number of states you can search. Another problem is loops. And so infinite loops and symbolic loops are also very challenging. Because if you consider this code, which gets an input and then uses it as a loop bound under symbolic execution, that var variable doesn't have a real value. And so the termination condition for the loop never really gets met. And so a naive engine will just kind of loop forever in this kind of case. And so there's a lot of challenges with symbolic execution and we run into a number of them also with Ethereum. So this kind of finishes our review, brief whirlwind tour of symbolic execution. The main takeaways are that using it we can test many paths in the program. We can do this without actually knowing that much about the program ahead of time. And so the analysis will systematically explore the different branches in the code, negate them and generate inputs for them. Also using the constraints that we gather, we can prove properties about programs and reason about them using constraint solvers. This is very useful. And so now that brings us to Ethereum internals. And so like I mentioned before, Ethereum is this decentralized computation platform. It has this cryptocurrency aspect to it also, but most interestingly for us it includes a virtual machine. And so today in our discussion of Ethereum we'll talk about a number of different things. We'll talk about smart contracts. We'll talk about transactions on the Ethereum network. We'll go in detail on the Ethereum virtual machine and talk about other things like the Ethereum application binary interface and the bytecode format used for smart contracts. We'll start with smart contracts themselves. And so in Ethereum there's two kinds of entities on the network. There are external accounts and contract accounts. External accounts are simple. They're controlled by humans and basically just have an account balance that tracks how much ether they have. Using external accounts to humans can transact with each other and send each other ether. Contract accounts are controlled by code. And so they also have a balance, but then they have some code that will execute whenever they receive a transaction. And so these are very interesting and this is what we're talking about when we talk smart contracts. We're talking code that's deployed onto the network that executes when people send their transactions. Furthermore, contracts can also interact with other contracts. So we can have these highly complex stack traces between different contracts on the network. So smart contracts themselves, this is just a little bit what they look like. Don't really, I'm not sure you can read the code on the right, but don't even try. This is just to give you a sense of what they look like. They're programmed in this language called Solidity and they basically encode state machines. And so you can declare a certain number of state variables in them and you can also declare some functions to mutate and modify those state variables if you want. One thing that's really unique about smart contracts is that they actually have a lot of assertions compared to code written in traditional languages. And so this is actually how error handling is mainly done in Ethereum. When a contract encounters an assertion or require a statement that's false, there's a state rollback mechanism that rolls back the state of the contract. And like I mentioned, these contracts will execute whenever they receive a transaction. Also mentioned that even though they're programmed in Solidity, Solidity is a compiled language and so these are actually compiled to binaries and that's what's deployed onto the network. And so because of that, binary analysis is useful because generally we don't have a source code for many contracts. So now let's talk transactions. These are the fundamental communication interface for the Ethereum network. That's really it. You send transactions between two entities on the network and you can do things like transfer ether between entities. You can deploy contracts and you can also interact with contracts. Interacting with contracts just means calling functions in them. The structure is pretty simple. You specify a to and from address because every entity has an address. You can specify some ether to send and you can also optionally specify an arbitrary data buffer. And this becomes very important when dealing with smart contracts. And we'll dig into that later in the ABI section. So let's talk about the Ethereum virtual machine. This is a pretty interesting virtual machine. So it's a stack machine and it has 256 bit native word sides which is huge. It has about 200 instructions and these fall into a couple categories. You have your standard arithmetic instructions like add, multiply, divide and whatnot. And you have very simple control flow, just conditional jumps and unconditional jumps. We have a variety of memory access instructions because there's a variety of types of memory in the Ethereum virtual machine, which we'll see in a bit. And lastly we have a number of kind of interesting domain specific instructions related to blockchain stuff. So we can get the timestamp of a block. We can get the address of an account. We can revert a transaction. We can self destruct. These are all interesting kind of odd instructions that are very domain specific. There's also this concept of gas, which is basically a cost to execute an instruction. And so you actually have to pay money to execute your programs in Ethereum. And the reason for this is because these programs are turned complete. And so in order to avoid situations where the network gets dosed because someone intentionally or accidentally executed an infinite loop, for example, instructions have a cost. And that limits the ability of denial of service in Ethereum. And lastly, like I mentioned, so this is the compilation target that ultimately smart contracts are compiled to. The Ethereum virtual machine has a number of virtual address spaces, which is also kind of pretty novel. And so there's four main address spaces that the EVM can talk to. And just to be clear, these are all virtual address spaces. These are not, there's no real hardware involved in any of these. And so the first is storage. And so you can think of this as a smart contracts persistent storage, almost like disk. This is where a smart contracts state variables get stored. And what's really interesting about it is that it's virtually infinite in that it's a 256 bit addressable address space, which is really massive. It's also relatively expensive to use the instructions that write to storage. Memory is a second region. And so this is a volatile address space that gets cleared out every execution of the smart contracts. And it's just used for intermediate computation. It somewhat resembles a heap, a very simple heap, almost like a break or S break in Linux. And it expands as you need more. But that incurs gas costs. There's a separate region of memory for the call data. And that's the transaction data buffer. And so the contract needs to access this in order to know what functions to call and access arguments and stuff like that. So that is a separate address space. And lastly, we have the stack. So like I mentioned, the EVM is a stack machine. And so all of the instructions are going to be mostly using the stack to perform the direct memory accesses. So now we'll get into something called the Ethereum Application Binary Interface. And this is really the core of how calling functions and interacting with contracts work. And so when you call a function in a contract, you need to specify some information. You need to say what function you would like to call and you need to provide some arguments to that function. All of that is serialized into the transaction data buffer according to this ABI spec. It's pretty simple and has two main components. Like I said, the first four bytes are used to identify the function that you want to call and followed by the arguments in serialized form that you're calling the function with. Here's an example of a simple ABI encoded transaction data buffer. And so say we have a smart contract function that takes three unsigned integers. Okay, so say we want to call this function with one, two and three. To formulate our data buffer properly, so first we need to compute the function identifier. And this is defined to be the SHA hash of the prototype and just the first four bytes of the SHA hash of the prototype. For the simple example, the arguments just follow after that. And so we have one, two and three in big endian formats after that point. So it's pretty straightforward. Things get more complex when we start using more complex Solidity data types. And so if you had a function that takes an unsigned integer and a variable length array of unsigned integers, and we wanted to send it the argument one and then this array of 42, 43, 44, then things become more complex. And so we have the one encoded like before, but after that point some other fields get introduced. And so we have this offset field and n elements field that basically you can use to identify where the actual data lives in the transaction data buffer. And so now this thing is starting to look more like a complex binary format. And so that'll become relevant later on when we try to symbolically execute things. And lastly, let's talk about the bytecode format. It's also very simple actually. It's really just code. And it always begins with a certain section at the start called the dispatch stub. And there's an implicit entry point of zero. And so the responsibility of the dispatch stub is to parse the first four bytes of the transaction data buffer and dispatch to the functions accordingly. And so after the dispatch stub, it's really just the functions in the contract. So here's an example disassembly of a dispatch stub. It's not super important to read every single instruction here, but it's useful to walk through just to understand how it works. And so at the top here, we have this call data load instruction. So this is used by the contractor to actually access the call data region of memory with the transaction data buffer. We can see later on in the code that it's pushing this hex number onto the stack, doing an EQ instruction and then jumping. And so this is how it's dispatching. Check. Okay, we're back in business. Sorry about that. Does anyone explain to me what the rest of this disassembly does? Okay, so like I said, this code here that's circled is pushing this hex constant, comparing it to the first four bytes of the data and jumping. And so that's how the dispatch mechanism works. It's looking at the data and then jumping into the bytecode based on that. We have an identical construct later on in the code where we have this different hex constant and it's comparing against the first four bytes of the transaction data and jumping. So that's really how the dispatch mechanism works in the Ethereum virtual machine. If we send it junk data and the first four bytes didn't match any of the function IDs, we hit this revert instruction and the state reverts. And so just to summarize, Ethereum is this interesting decentralized virtual machine based computation platform and using it we can write and deploy smart contract applications and interact with them using transactions. So now let's really get into the meat of things and combine symbolic execution with Ethereum. And so our goals here are pretty straightforward. We want to kind of follow in the tradition of classical symbolic execution and generate inputs that exercise the functionality of the contract. We want to do this in such a way that where we enumerate the state space and discover failure states, we also don't want to generate false positives in that if we find an error state in the program, we will always be able to generate an input that triggered it under concrete execution. Lastly, we want to allow humans to reason about and prove properties about contracts. And so here's the methodology of how this is going to work. Basically, first we need to implement a symbolic EVM interpreter. This interpreter will differ from normal ones in that it can handle symbolic arguments and it's able of building up symbolic expression trees and propagating things based on how the program executes. Once we have the symbolic EVM interpreter, we'll then start executing contracts with symbolic input. And in this case, symbolic input is really those fields of the transaction. And so we can provide two main inputs to a contract in a transaction. We can provide a symbolic transaction value and a symbolic transaction data buffer. And really the data buffer is the more interesting one here. This is what we can use to pass symbolic arguments to contracts and automatically do things like find all the functions. And so that's what we'll focus on today. So just to review in a concrete transaction, we have one initial contract state. We apply a transaction, a concrete transaction and we have one output state. It's a little bit different for symbolic execution of Ethereum. So now we have symbolic transactions that we're kind of throwing onto network and we won't get one output state anymore. We'll actually get a number of output states. The number of output states we get will depend on exactly what the contract does, what state forking happens, when the contract executes and so on. And so, yeah, so this is just illustrating that. We're going to make the inputs of the transaction symbolic. Each of the output states that we get out of a symbolic transaction can be classified into basically, we call them alive and reverted states. And so if the contract encounters an error and reverted, that's obviously a reverted state. But if the contract is kind of executed cleanly and got to one of the valid terminating instructions, namely just stop and return instructions, we call them alive states. And these are candidates for sending further symbolic transactions to further explore the state space of the contract. And so here's just a couple applications that we've been exploring of Ethereum symbolic execution. So for one thing, we can automatically check assertions in the contracts. This is because the way assertions just work in Soliti is they're compiled as branches to invalid instructions. I'm not quite sure why it's an invalid instruction. These are handled by interpreters as the same as reverts. But because in symbolic execution, we try to explore all states, if we can find a state that gets us to a revert, then we've found a way to make the program fail. And so we get this checking automatically just because the analysis will try to fully enumerate the states. Function discovery is another really good application. And so if you have experience with traditional binary analysis, you know how hard it is to actually extract functions from like a statically compiled Linux L binary. It's not trivial to find the functions. Things are a little bit easier for Ethereum because of the dispatch stub. And so remember that if we symbolically execute the dispatch stub, we're gonna find all paths through it. And luckily for us, all paths through the dispatch stub lead to the functions. And so simply symbolically executing the dispatch stub will automatically recover all of the functions in a contract. And this is actually very straightforward and a very nice use of this technique. So now let's walk through an example of actually generating transactions that will drive a contract into a certain state. So this is an example, smart contracts, run in Solidity, and it has some buggy code. And so at the bottom, guarded by this kind of if statement, there is this possible integer overflow. However, in order to get to that point, you first need to kind of prime the contract and get it into a state and exploitable state. And so it actually requires two transactions to reach this overflow. And so that's still fine using our symbolic execution. We can still generate transaction sequences for arbitrary numbers of transactions. And so here's a visualization of what is actually going to happen if we try to symbolically execute this program. So on the left, we have our initial starting contract state. And we'll submit one symbolic transaction. Out of this, we'll get two states. And so one of the states will be a revert state. This will be because the first four bytes did not match the function identifier for the function. And so that will revert. And so more interestingly, in the state on the top, this will be the state where we discover where the function is in the contract and execute it once. So this is going to prime the contract and get it into the exploitable state. At this point, we have one alive state, so we can go ahead and submit one more symbolic transaction. From this, we'll get two more states. And one of these will be the overflow. If we flip back to the code, we can see that there's this check. If the input parameter is less than 42, it's safe. Otherwise, it reaches the buggy code. And so those are the two paths that we'll find later on. If we dig into this a little more deeply, we can look into exactly what's going on with the constraints. And so for the revert state, there's two symbolic inputs. It's just the value and data. And the only constraint is that the first four bytes cannot equal leet-leet. And so let's pretend that the function identifier of this function is hex-leet-leet. And so the only constraint is that this is not the case. For the safe path, one transaction later is very similar. So the data must be constrained, the first four bytes must be constrained to hex-leet-leet for both those transactions in order to execute the function. And for the second one, the argument actually matters. And so we have constraints that the first argument must be less than 42. And this is to execute that safe path. And lastly, for the unsafe path, we have almost identical constraints except for the last one. And so remember that the if statement mandated that the input variable needed to be greater than or equal to 42 to reach the buggy path. And so that's the constraint we have here. So using these tables of inputs and constraints, we can then use a constraint solver to actually generate real transactions. And so basically, we can say Z3, which is a solver from Microsoft. Given that there's no constraints on the transaction value, what is an example transaction value I can use here? And it might generate this random number, which is fine because there's no constraints. On the other hand, that is of course constrained. So anything except leet-leet will work here. And so maybe Z3 will say hex-cafe-cafe, that's fine. And the same kind of thing happens for every path that we want to generate an input for. We have our set of constraints. We can use Z3 to fill in the values and the transactions and actually generate transactions that we've used on the blockchain. We'll make the contract get into one or more states. So now let's talk a little bit about challenges. And so we'll talk about three main ones here that we encountered. And so first state explosion. So here's a snippet of code taken from the Veritesting Paper, which is a paper from Carnegie Mellon, pretty famous. And it basically shows as an example of kind of worst case scenario for symbolic execution. So in this code, we have a certain structure as a loop over this symbolic buffer of input bytes and inside the loop, we have a branch. And so for every iteration of the loop, we're checking if it's a B and bumping some counter. And then finally, after the loop, we check if the counter was precisely equal to 75, we hit a bug. So this is really bad for symbolic execution because every iteration of the loop is going to double the number of states that are currently being explored. And eventually, after the loop executes, it will have produced two to the 100 states that need to be explored. And so it's very difficult to pick out this one state where counter is 75 and hit the bug and choose that out of all of those two to the 100 states. And so this is pretty bad for symbolic execution. And so when we were first looking at this, so we knew that symbolic execution really struggles to scale for large programs because you inevitably hit massive numbers of states. But when we noticed that smart contacts are usually very small, they're really in the hundreds of lines of solidity code or less. And so that was initially really promising for us. We thought this might not be a big deal. Then we kind of realized something. And so even though the smart contract itself is less than 100 lines longer or so, there's always this infinite, implicit infinite loop around it for receiving input. And that kind of throws a wrench into things. And so if we make this kind of metaprogram of what we're actually trying to analyze, it's basically this infinite loop where we're getting transactions and running the contract. Then it becomes a little bit clearer how we have not avoided the symbolic execution problem. We still have this loop and we still have this branching inside the loop based on input. And I don't know if this looks familiar to anyone, but yeah, this causes problems. And so here's a little visualization. So if we have a simple contract with three functions in our first transaction, we can we'll get three up a state space on each function. And after each transaction, we'll kind of start exploding our possible state space. And so of course, the caveat here is that it really depends on exactly what code is being executed by the contract, but in the worst case, we can have these kinds of patterns, if not worse. And so something that we're doing currently is actually exploring ways to use concoct execution, which has been used very successfully in the literature in the past, where you take a seed trace and use that to help your analysis. And so using this, you can explore deep paths close to the seed trace and not be overwhelmed by the state explosion that still occurs. So now we'll talk about a couple Solidity language features that make it really hard to have symbolic execution for Ethereum. So one thing is mappings. So mappings are the native data type for hash maps in Solidity. And this is a very simple contract that uses one. And so it uses a map to keep track of the balances of users. And so it maps from an address type to an integer. And using this update function, you can actually call and update your own balance in the contract. And so the mapping type is actually very interesting. It has some pretty interesting semantics. And so the semantics are that all possible keys already exist in the mapping and are zero initialized. Because of this, mappings are not iterable because, for example, if you key on an unsigned 256-bit integer, that's an enormous amount of keys. And so it doesn't actually, so of course it implements that using kind of sparse memory allocation and stuff like that. But the most interesting part of how mappings work is that there's this direct mapping implementation where if you want to store or look up an entry in a mapping, you do something like taking the hash of the key and using that as the literal address and storage of where you want it to store the data. And so we have this really interesting pattern where we have true constant time access for members of our hash table because there's no buckets. Everything is direct mapped into the address space. And we can do that because the address space is nearly infinite at least virtually. And so this presents us with some challenges though because, so first of all, hash accessing mappings with symbolic keys is pretty common, but then we lead, that leads to hashing symbolic values. And that is a hard situation. Furthermore, we have more symbolic storage indexes being used which complicates things. But basically computing the hash of a symbolic value produces a symbolic expression that is intentionally impossible to solve. And so this way throws a wrench into things. As an example, just look at this. And so we tried to hash a symbolic variable and let's say we want to constrain it to this random hex value. If we could provide this equation to a constraint solver and have it solve it for us, we would be effectively reversing the hash. And that is explicitly a property that is impossible with cryptographic hash functions. And so this is pretty problematic because if we just straightforward symbolically execute through hashes, we will not be able to solve for constraints in any of the later states. And so this is a big problem. And so we have kind of a work around solution that we've been experimenting with for our implementation. And it's based around concretization. And so as we analyze and execute through a program, we'll see some concrete hashes being computed. So maybe user A is hashed and used in the mapping. Maybe user B is also hashed and used. And then when it comes time to compute a symbolic hash, rather than really just straightforward computing the hash and being unable to solve constraints from that point on, we constrain it based on what we know. And so the idea is that if a dictionary map was, or if a hash map was looked up based on a certain key previously, chances are later on it will be interesting to use that from a symbolic execution perspective later on. And so we replace the complex hash expression with this kind of alternate expression object. It basically just represents everything we know about all the concrete keys. And so it's basically just uses an SMT if than else expressions. So using this strategy, we can avoid the case where we can't solve our constraints anymore. And it will allow our analysis to continue with soluble constraints and so we can continue and fork states in this way. One of the other challenges we've been encountering is trying to have our analysis support all types of solidity types basically. And so we found some challenges with supporting dynamic arguments. And so dynamic arguments are variable length arrays essentially. So expressions can receive variable length data passed to them. However, like we mentioned before, this makes the transaction data become a much more complex format with lots of offsets and elements fields which will lead to symbolic indexing and mem copies later on. Because if this field that contains the offset to the actual data is symbolic will inevitably get an instruction that tries to load from there. And I will produce a symbolic index which as mentioned earlier is a pretty tough problem to solve. And so the workaround we've been using for this is to really aggressively concretize the transaction data based on what we know. And so for example, for this function that takes two dynamic length arrays A and B based on since we were passing it a concrete length buffer even though it has symbolic elements in it we still know how long the buffer is. And so using this we can kind of compute a fair distribution of space for each element. And so we take the total space and subtract all of the space for the metadata for each argument like the offset fields and elements fields and divide that. We can arrive to the conclusion that there's actually only 32 bytes of space for each argument and that's enough space for one element in each. And so we can effectively concretize everything else based on that. And so using this we can have constraints that are much more easily solvable and have more performant analyses. Of course the main limitation of this approach is that the state space gets artificially limited. And so it's just based on however much data we chose to provide in our execution. And so if we do this we're going to miss branches. For example, that require the length of A to B greater than one because we concretized it. But this has been working somewhat well in practice so far. And then some other miscellaneous challenges that I won't get into today are that in order to really have a complete symbolic environment model for symbolic execution you need to support complex intercontract calls and in a very full environment model. You can't just model the environment for execution of one contract because it's often the case in real contracts they talk to you many others. And so you need to have a very full environment model. And lastly, gas and symbolic gas in particular is a very interesting challenge that we need to support also. So now I'll just have a few words on our implementation. So it's implemented within this project called the Mantra Corp project which is an open source symbolic execution tool. Historically it's a symbolic execution tool for regular binaries for x86 and RM and so forth. But over the past I would say nine months or so we've added support for Ethereum to it. We've made a little sub module and done it in about 4,000 lines of Python code and using it exposes a pretty nice Python API. You can do things like launch symbolic transactions and some of your own SMT solver queries to ask your own questions about what's possible for the contract to do. It's available on GitHub also and from PyPy. And so we've been using Mantra a lot recently internally at Trail of Bits for doing smart contract audits. And so our auditors have been writing quite a lot of Mantra Core scripts recently to test their own assumptions about what the contract can do and once they narrow in on a kind of a sketchy or part of code that's worth noticing more they'll often write Mantra Core scripts to test that. We've also deployed it within client test infrastructure. And the pattern generally looks like this. And so we'll have a set of Mantra Core scripts that don't attempt to just run on the contract and find all the bugs. They're more targeted for checking specific invariants that are important for security. And so the general pattern is to have a script that initializes the state of the contract and watches a fixed number of symbolic transactions and then asserts certain invariants in all states that are discovered. So now if I have some time I'll just do a few quick demos of Mantra Core tool. And so we'll start with a simple demo of running Mantra Core on the contract that I showed before. It's this smart contract that has the integer overflow path and requires two transactions to reach that path though. And so Mantra Core supports a really intuitive command line interface and so you can really easily just launch it at contracts and start sending symbolic transactions and generating states. And so in this case you can see that it's starting symbolic transactions, started one and started a second transaction over here. And lastly it detected that 100% code coverage was reached and so it halted the analysis. And so we can see if we dive into this workspace directory that's produced. Now there's a lot of files here. And so for each state that Mantra Core discovers it generates a set of files corresponding with various pieces of information about that state. And so for example it generates in this Solidity code we have these little log lines that execute when the path is reached. And so we can search through them for the overflow path. Let's do that here. And so you can see that in the test for test case there that's the path corresponding to the overflow. And so if you look at the files produced for test for we have a lot. We have the file containing the constraints that make that state true. We have a file containing the runtime code execution that the contract executed there. And probably most interestingly we have a file that actually has concrete transaction data in it. And so remember every path that Mantra Core finds it generates a set of inputs for. And so you can use these to concretely get the contracts into a certain state that's found in the analysis. And so we can see what it generated. And so the first transaction is a transaction to create the contracts on the blockchain. The second transaction is calling the test me function with this certain variable. And if we look at the solidity the input is not used for this section that primes the contract. So it doesn't matter. And so this will work just fine. And lastly you can see that it's calling test me again within this other argument. And in order to reach this code the input just needs to be greater than or equal to 42. And this number looks bigger than 42. And so that will work just fine. Now I'll quickly demo some of the more powerful features of the Mantra API. And this is what you really want to use for auditing contracts. And so we're gonna be analyzing the source code of this wallet contract. It's pretty simple. It, once you make it, it sets you as the owner. And then you can do things like deposit ether into it and withdraw it at a later time. The withdrawal function is protected such that only the owner can withdraw the ether. And so we can test this contract with Mantra Core to see if it's possible to withdraw the ether even if you're not the owner or something like that. So to do this we can import Mantra Core, create this initial blockchain state. This is Mantra Core EVM objects. And later on we can set up our custom environment. And so our environment will have an account, an external account for the creator. And we'll also have an account for a simulated attacker. Lastly we'll use a Solidity Create Contract API to deploy the contract onto our emulated blockchain. After that we'll submit one transaction. And so we'll call the deposit function in the contract account. And this will put some ether into the wallet. And so we'll pass that with, so we'll call that with the creator account as a caller and this value for the number of ether to send in that transaction. After that we'll send two symbolic transactions. And we'll send them from the attacker's account. We'll make a symbolic transaction data buffer using this API and just use that as the data for the transaction. And then after we send two symbolic transactions from the attacker we'll check every state. And each state we can do a custom query to see if the attacker's account balance can be greater than one. And so the attacker started out with account balance of zero that is right here. And so we'll see, is there any situation where the attacker actually has ether after submitting two transactions? And we will print yes if we find a state like that. And so let's just go ahead and run the script. You can see that it goes ahead and creates some accounts, deposits some ether into the wallet. And now it's starting to send the attacker transactions. So it sent the first one pretty quickly and now because it needs to run over every produced state, it's taking a little bit longer for the third one, but in a couple seconds it's going to finish. And we'll see if we found any states where you can steal the ether. And so of course we found a lot of states or that didn't work. But Manicor tells us that there was actually one state where we can steal the ether. And so let's look into the output directory. And so the script generates this custom test case called wallet hack. And let's look at how Manicor found a way to steal the ether. We'll look into the transaction file to see that. And so we can see a transaction that creates the contracts. We can see the first transaction, which is from the creator's account, which is depositing this amount of ether into the contract. And then we have our two attacker transactions. So let's see what it found. And so it found that if you can call the change owner function and then withdraw, you can then change the owner to yourself and then withdraw all the ether. And so the bug in this contract was that the change owner function is public and anyone can call it and make themselves the owner. And so the key point here is that all we needed to express is our desired end conditions. We just needed to say give a contract here and is there any possible state where an attacker gets an ether? And that's it. And then the analysis can go and find a way to make that satisfiable. So that pretty much wraps things up here. Summary is that we found that symbolic execution is definitely possible for Ethereum and shows a lot of promise for use already. There are of course many interesting challenges that we need to overcome, but there's a big potential depth in fact in this space here. If you're interested, you can check out Manticore, which is available open source implementation. And I just also want to give a special thanks to my co-worker, Flavio Manzano, who did most of this work. But yeah, that's pretty much it. Real slow hiring, so if you find this very work interesting, please get in touch. But thank you all for your time and attention.