Good afternoon. Y'all enjoying this conference? Come on, Stephka! Come on! Yeah! So Christopher Dumas, he's going to do his talk. He's going to be running completely long. He'll be using all the help of his time. He's kind of asked that if he got any questions to do it after the talk. So with that, go ahead, Chris. Alright, welcome everyone. We'll go ahead and get started. So what I wanted to talk to you about today is honestly something that I didn't think was possible, but it should be pretty interesting. So, you know, the word hardware backdoor gets thrown around a lot these days, so much that it's kind of lost all meaning. But what I want to look at today is not the things that we're normally worried about. It's not the management engine. It's not the platform security processor. This is something totally different that I think wasn't on anyone's radar. Something we didn't really see coming. But like any good presentation, I think we've got to start off with a disclaimer. Basically, all of this research was done on my own. This does not reflect the opinion of my current employer or any previous employers. But with that, my name is Christopher Dumas. I'm a cybersecurity researcher. I've tinkered with a lot of different things in the past, but recently, the last few years, what I've sort of been focused on is the idea of low-level processor exploitation. It turns out there's a lot of fun things we can do with that. So in order to frame the discussion for the rest of the day, I want to start off with a demo of exactly what we're going to be talking about. So what we have here is... Let's see if I may pause that. What we have here, I'm logged into the system as a regular Unprivileged user. I'm going to open up a very simple C file. All it does is it loads some values into the EX register and then it executes all of these bound instructions. Now, if you're not familiar with the X86 bound instruction, it is a pretty simple instruction. All it does is it takes two arguments and it checks if your first argument is within the bounds provided by the second argument. Now, if you look carefully at these bound instructions, what you'll see is that they use some kind of weird values. Basically, it looks like random values on the right. What that means is that these instructions don't actually even have access to the memory that they're trying to use. Now, in X86, when you don't have access to the memory that you're trying to use, you get a general protection exception. Every single one of these bound instructions is going to throw one of these general protection exceptions. In Linux, you see that as a SEG fault. Despite knowing that that's what's going to happen at the end of this program, we are going to try to execute a shell. We'll exit out of here and we will run this program. We'll compile it, launch it, and exactly what we expect to happen will happen. We'll get a segmentation fault because those bound instructions don't have access to the memory that they're trying to use. I'm still the exact same user I was before. Still logged in as delta. If I make one tiny change to this program, I'm going to add one X86 instruction. It's an instruction that's so obscure and unheard of. It doesn't actually have a mnemonic associated with it. It is going to have to be written in raw machine code, OF3F. What this instruction is going to do is it is going to fundamentally change the nature of all the subsequent bound instructions so that now, instead of their original functionality, instead of checking whether or not one value is within the bounds of another, they are going to reach into kernel memory and modify the system itself. So I'll compile this and re-execute it. And all of a sudden, we'll see I am now rude. So the rest of this presentation is going to be a very long, quick convoluted journey onto how exactly I stumbled across this. And the whole thing begins with this idea of X86 rings. So in the beginning in X86, about 30 years ago, there is no concept of separation of privileges. All the code running on the processor executed with the exact same privileges as all the other code running on the processor. And it was basically chaos. But then we added the idea of rings of privilege to the processor in order to separate out permissions. And the idea being rings of privilege was that at the lowest level, we would have ring zero. That would be the most privileged realm on the processor where the kernel would live. The only really trusted code would execute ring zero and it would have complete access to the hardware. Little less privileged than that was ring one, less than that was ring two. And then way out here in the outermost ring is ring three. That's where the user code lives. Basically all the code that we don't trust to have access to the hardware is going to execute way out here. So this was the fundamental idea behind privileges on X86 where ring three, if they wanted to do anything interesting, it would have to go through very specific, carefully checked hardware privilege access mechanisms in order to ask ring zero to do something for it. And all of our other security on X86 is all based off of this fundamental premise of separation of rings. And things got kind of interesting. People started digging deeper. We found out we needed things more privileged than ring zero, like the hypervisor had to have more access than the kernel normally would. So we kind of called that ring minus one. We found out some things had to be more privileged than that system management mode. We called ring minus two. A couple years ago, some researchers found another core off the X86 core that they called ring minus three because it could do things that the X86 core couldn't do. So things were interesting. But if you've been following any of this research, sort of in the back of everyone's mind is this question, can we go further? Are there even more layers to this puzzle? So I started setting off to sort of explore that idea. And a lot of times when I'm starting out on new research, I find an interesting place to begin is with patents. Sometimes you can find some really interesting information that people don't document in public information, but you might be able to find some bits of useful ideas inside of patents. So keeping this whole idea of this ring model of privileges in mind, imagine my surprise when I was reading through a patent and I saw it just sort of nonchalantly buried in the middle, this quote, additionally accessing some of the internal control registers can enable the user to bypass security mechanisms, for example, allowing ring zero access at ring three. That's a little bit alarming from a security perspective.  So they go on to say in addition, these control registers might reveal information that the processor designers wish to keep proprietary. And for those reasons, the various X86 processor manufacturers have not publicly documented any description of the address or function of some of these control MSRs. So this, this was really interesting. I was really, really excited about this and wanted to run with this idea. So like any rational person, I went out and bought 57 computers to start doing some basic research on. So I had a, based on the patent typing and the patent owner, I had some, some idea of what processor I might specifically want to focus on for this, this research, but patents are kind of a funny thing. IP gets bought and sold by different companies. Ideas trickle through the industry. So I sort of wanted to cast a wide net and look at a bunch of different systems for this research. But what I eventually settled on was the VSC3 processor. So these are interesting processors sort of targeted at an embedded low power market. You can find these often in point of sale systems, kiosks, ATMs, gaming, since we're in Vegas, you might want to start poking around digital signage, healthcare, digital media, industrial automation, and they're in PCs and laptops as well. So I pulled off my shelf this specific system eventually. It's a thin client running a C3 Nehemiah core. And this is what we're going to look at for the rest of the presentation. At the very end of the presentation, I'll look a little bit more at what other processors might be affected by this issue, but this is sort of the target of this specific research. So I wasn't able to find a developer manual for this processor. So when we're sort of left in the dark, a good place to go is sort of follow a trail of patent breadcrumbs. See what information we can derive from patents and see if there's anything useful in there that can give us hints as to how we should move our research forward. So I had to dive through a lot of patent literature and I wanted to give a little bit of a glimpse into what that's like. So this isn't actually a quote from the patents that I ended up, or the patents that I ended up using, but it is something I stumbled across during this research. So this quote says, figure three shows an embodiment of a cache memory. Referring to figure three in one embodiment, cache memory 320 is a multi-way cache memory. In one embodiment, cache memory 320 comprises multiple physical sections. In one embodiment, cache memory 320 is logically divided into multiple sections. In one embodiment, cache memory 320 includes four cacheways, i.e. cacheway 310, cacheway 311, cacheway 312, and cacheway 314. In one embodiment, a processor sequesters one more cacheways to store or to execute processor microcode. Like my head just exploded when I read stuff like this. It's so convoluted and so wrapped up in legalese, it's hard to understand what the heck you're even reading. And just to put that into perspective, this one four-page patent contained the phrase in one embodiment 147 times. So following this to start your research when you really want to dive into things is a really, really painful process, but if you're persistent, you can pay off. So I eventually settled on these six different patents that seem to have some basic ideas that could point me into the right direction for this research. So I want to highlight some of the key ideas that I got out of those six patents. So one is it sort of looked like at the time VIA was embedding a non-X86 core alongside the X86 cores in their C3 processors. And this non-X86 core was a risk architecture. And the patents didn't have a consistent terminology for this, but I just sort of started calling this the deeply embedded core or the deck on these processors. They also talked about something that they call the global configuration register. It's basically a register that gets exposed to the X86 core through a model specific register. And they say that this global configuration register can activate the risk core. They also talked about an X86 launch instruction. It was basically a new instruction that they added to the X86 ISA where once the risk core is activated, you can start a risk instruction sequence through the launch instruction according to the patents. So kind of putting all these ideas together, what it looked like is if our assumptions about what this deeply embedded core can do are correct, you could essentially use this as a sort of backdoor, a means of surreptitiously circumventing all of the processor security checks. So that's absolutely ideal, worth exploring more for security purposes. So there are sort of three patents that give us some initial ideas on how the overall mechanisms might work. So one patent tells us that a model specific register can be used to circumvent processor security checks. Another patent tells us that a model specific register can be used to activate a new X86 instruction and another patent tells us a launch instruction can be used to switch to a risk instruction sequence. So if we sort of put those three things together and try to fill in the gaps, we end up with a sequence that looks something like this. We have to find a model specific register bit that when toggled will activate a new X86 instruction that didn't previously exist and running that instruction will activate a risk core on the processor and that core should be able to bypass the processor's security protections. So where do we begin? Well let's look at the very first step in that chain, these model specific registers. So if you're not familiar with the idea of MSRs in X86, they are basically 64 bit control registers used for a wide, wide variety of things. They're used for debugging, performance monitoring, cash configuration, feature configuration, basically anything that doesn't have to do with general computing can get tossed into the MSRs. And unlike the X86 registers you might be more familiar with, they aren't accessed by name, they're accessed by address. So instead of EAX and EDX, we have addresses from zero to four billion is how we access our MSRs. So basically you load up an address into the ECX register and then execute the read MSR or write MSR instructions in order to access an MSR. Now there's some saving grace here. We think that maybe we can use this to circumvent the ring protections on the processor, but these MSRs are only accessible to begin with with ring zero code. So maybe the rest of this stuff we can do from ring three, but in order to activate that bit to begin with we need ring zero execution. So that's good news, although maybe we don't need ring zero execution. I'm going to revisit this idea later in the talk, but so that we can move the research forward. Let's assume for now that we have one time ring zero access on that processor just to enable this backdoor feature. And we'll revisit that concept later. So let's look at these model specific registers some more. Well the patent basically comes right out and tells us that the various X86 processor manufacturers have not publicly documented any description of the address or function of some of the control MSRs. So that's a challenge for us. I think there's a bit in one of these MSRs that might activate something cool, but it's probably not going to be documented. So step one in order to try to explore this idea is just figure out which MSRs are actually implemented by the processor, regardless of what the documentation says, which MSRs are actually there. So this one's pretty easy to solve. Basically you can set the general purpose exception handler on the processor to point to some handler under your control. You can do that with the LIDT instruction. Then you can load up an MSR address that you want to check. Let's say you want to figure out does MSR number 1337 exist on my processor? Well load that number into the ECX register and then execute the read MSR instruction. Now if you don't get a fault from that read MSR instruction, you know that that MSR exists.  So this is a really easy way to figure out exactly which MSRs actually exist on your processor regardless of what documentation says. So when you do this on the VSC3, you end up with an alarming number of MSRs way more than would normally be on an X86 processor. We found 1300 implemented MSRs on that processor which is far too many to analyze. I think one of these is going to activate a new X86 instruction that's too many to go through by hand. So step two is sort of figuring out which MSRs here are actually interesting. Which one should I be exploring for this research? So I came up with this idea of sort of a timing side channel attack against the MSRs where basically what I would do is I would calculate how long it took to access each of the four billion possible MSRs and what that looks like is you've got this read MSR instruction and then on either side of that you've got a serialized read timestamp counter instruction that lets you see exactly how long it took your read MSR to execute and that shows you how long it took to access the MSR. So if you run this code it looks something like this where on the X axis I've got the MSR numbers and on the Y axis I've got the access time for that MSR. Green is MSRs that are implemented on the processor, red is MSRs that are not implemented on the processor. So this side channel attack actually gives you some really, really interesting insights into how the processor works under the hood that we normally would never have access to. But what we can do with this then is sort of form a hypothesis. I'm going to theorize that this global configuration register, this really powerful register that the patents talk about is probably unique. There's probably not several similar versions of this register within the MSRs. There's probably exactly one of these on that processor. So what I can start to do is I can start to look for MSRs with unique access time. So like these that are circled in red and when we actually start to do that what we find is that there's relatively few MSRs that are truly unique on this processor. In fact out of the 1300 MSRs that are there we identify 43 that actually seem interesting and worth exploring more. So that's good. That seems like we're making progress. I've sort of whittled down the number of MSRs from initially 4 billion down to 43 to actually explore in this research. But it's still a lot to tackle by hand. That's 2752 bits worth of MSRs to check. Now my theory is that one of these bits is going to activate a new x86 instruction. So I want to figure out when I toggle these bits did a new instruction appear on the architecture. Well x86 is a really complicated instruction set and it's sort of hard to estimate how many instructions could actually be in x86 but a rough upper bounds would be somewhere on the order of 1.3 undecillion possible instruction. So I want to figure out did one of these MSR bits create a new instruction but I've got to search through 1.3 undecillion instructions in order to find that new instruction if it appeared at all. So even taking a really optimistic estimate if we could scan through a billion possible x86 instructions every second you can do some quick Fermi calculations in order to see 1.3 undecillion divided by 1 billion divided by 60 seconds a minute divided by 60 minutes an hour divided by 24 hours a day divided by 365 days a year means it's going to take about an eternity to scan that entire instruction set. So that's not reasonable. Making things worse that's for one scan. We have to scan each of these 2752 bits that's about 2752 eternities in order to find which bit creates a new instruction. So fortunately there's a better solution. I actually released this tool last year called sand sifter which was kind of neat. It found a smart way of searching through the x86 instruction set using page fault analysis and a depth first search algorithm in order to scan all of x86 for the most probable instructions in about a day and it can be used to find things like undocumented instructions or new instructions appearing but it still can't be run 2752 times if it takes a day to scan a single bit. So what we can do instead is we can try to toggle each of those 2752 candidate MSR bits one by one. But these are configuration bits. These control the inner workings of the processor and I have no idea what these bits actually do. So a lot of them are going to lock the processor or freeze it or panic the kernel or reset the system entirely. So trying to toggle 2000 some bits one by one can't be a manual process. We need some sort of automation in order to make this work. So the system I came up with looked something like this where we would have a target that's a C3 processor hooked up to a relay basically wire would be soldered on to the power switch on the target and that's hooked up to a relay. The relay is hooked up to a master system so the master can power cycle the target through the relay. The target also network boots through a switch from the master and the master then can SSH into the target. What the master can tell the target is toggle this MSR bit and the master is going to check did something become unstable that the system stopped responding to the kernel panic. If not it's going to try to toggle the next MSR bit. If so it's going to power cycle the target. This way the master can sort of repeatedly go through and identify exactly which of those 2752 MSR bits can be activated without the target becoming unstable. So over the course of about a week through hundreds of automated reboots we're able to identify exactly which bits we can actually turn on on that processor. So after that what we do is we try to turn on all the bits that we possibly can get all of those bits on at once and only then do we actually run sand sifter. Only then do we scan the processor for new instructions. So that looks something like this using sand sifter for this purpose. So like I said sand sifter uses page fault analysis in the first search in order to search through the x86 ISA. We're watching sand sifter sort of in the middle of a scan probably about 12 or 15 hours into a scan and what you can see it doing is generating machine code in order to try to search through the feasible x86 instructions on this processor. And if you let sand sifter run for long enough eventually it will spit out something new in that lower window there. Sand sifter after about a day finds exactly one new instruction on that architecture, OF3F. So this must be the launch instruction that the patents are talking about, the new instructions that got activated by these MSR bits. So through GDB and some trial and error I was able to figure out that the launch instruction is basically a jump EAX instruction. So from that we can figure out what the global configuration register is. Now I activated all of these possible MSR bits in order to find the launch instruction. Now I'm curious which bit was really responsible for activating that launch instruction. Fortunately now that I've identified the OF3F instruction I no longer need to run sand sifter for additional scans. What I can do is activate each of those MSR bits one by one and after activating one I'll try to execute the launch instruction. If it doesn't work then that was the wrong bit. If suddenly the launch instruction appeared on the architecture then that means I found the bit that activated the launch instruction. So using that approach we're able to find out that MSR number 1107 actually was the MSR that enabled the launch instruction and specifically it was bit zero inside of MSR 1107. Now I suspect that this is going to open the door for another architecture on the processor which will let me bypass those ring protections once and for all and circumvent all the processor security checks. So because of how much power that single bit has just potentially enabled I started calling bit zero of MSR 1107 the God mode bit. So at this point we've figured out the God mode bit. We figured out this hidden launch instruction in the x86 ISA. The next question then is how do I actually execute instructions on this x86 or on this new risk core that we've enabled. So we can sort of dive into patents to try to figure this out. The patents sort of hint at this idea that instructions are fetched out of memory and then passed to different decoders depending on whether you're in x86 or risk mode and I had to go through a lot of trial and error to figure out exactly what that might look like under the hood but this is sort of what I ended up with. Essentially an instruction will be fetched out of the instruction cache and it would be passed to some sort of pre x86 decoder. And that decoder is going to break apart the components of an x86 instruction and then those components are going to get passed to a check and that check is going to determine am I in risk mode or not. Namely has that launch instruction just been executed. If the answer is no then those components are all passed on to a further x86 decoder and the instruction executes as x86. If the answer is yes one of the components of that instruction 32 bit constant value will be torn out and passed over to the risk decoder in order to execute as a risk instruction. So basically with this setup there needs to be some x86 instruction where if the processor is in risk mode it can pass a portion of itself over to the risk processor on this chip and since this instruction whatever it is sort of joins the x86 and risk cores I call it a bridge instruction. It basically gives me a way to feed instructions over to the risk core. So the next question now is how do we find this unknown x86 bridge instruction that will let me execute risk instructions. It's not easy but it should be just sufficient just to detect that a risk instruction has been executed. So how can we detect if a risk instruction has been executed given that I have no idea what these instructions can actually do or what their execution will look like. Well an easy way would be if our theory is right if this risk core really can circumvent processor security checks then there should be some risk instruction. I don't know what but some risk instruction even when executed in ring three should be able to corrupt the system and corruptions are usually pretty easy to detect. That should look like a processor lock or a kernel panic or a system reset. Basically if I observe any of those behaviors that means I've executed one of these mysterious risk instructions because none of those things should ever happen executing ring three x86 instructions normally. So I sort of tore apart sand sifter in order to help me with this. I ripped out the core of sand sifter, changed it to run in a brute force mode. So it's still executing x86 instructions but before each x86 instruction that it generates it's going to execute the launch instruction in order to switch to risk mode. And what it's trying to find is some x86 instruction that corrupted the system and that's actually what we just saw here. We saw the processor lock when the sand sifter hit exactly the right combination of x86 and risk instructions. So once we observe that processor lock that means that we found this bridge instruction, this x86 instruction that can execute risk instruction. So it takes about an hour of buzzing to get here. We just saw a short snippet. But it turns out that this bound eax instruction is this bridge instruction. It's what's going to let me feed instructions over to the risk core. And specifically this 32 bit constant value used in the bound instruction appears to be the risk instructions that get executed on the deeply embedded core. And that's a pretty easy thing to check. Basically I can see that for some specific 32 bit values the processor locks every single time and for other 32 bit values nothing seems to happen very, very consistently. So now we found the bridge instruction. I know how to send instructions over to that deeply embedded core. So the next question is what do we want to execute on this alternate instruction set? What do these instructions even look like? What architecture am I even dealing with? So ideally moving forward I would just assume that this other architecture is probably some known common architecture. It's probably something like ARM or PowerPC or MIPS. It doesn't make a whole lot of sense to invent an architecture from scratch. So we could assume that this other architecture is some common architecture and I could try to execute a common architecture's instructions on this other core. So for example if I thought maybe I'm dealing with ARM I might try to execute an add 1 to r0 instruction. The problem or what I encountered was that for some of these very, very simple risk instructions I was generating the processor would lock. So if I generate an instruction like add 1 to r0 and I try to execute that on this risk core and the processor locks that probably means I'm not dealing with the architecture I thought I was dealing with. I'm probably not dealing with ARM if that instruction, that simple instruction locked everything up. So I was actually able to rule out 30 different common architectures this way. And I still think most likely this other architecture, this risk core that we're dealing with is probably derived from some common architecture but it seemed like it was maybe modified enough that I couldn't identify it. So that sort of forced me to move forward just assuming this thing was a black box basically treating it as some totally unknown architecture that we've never seen before. That means that we have to reverse engineer the format of these instructions for this deeply embedded core. And I spent probably the bulk of this research actually trying to reverse engineer the format of these instructions and so I started calling those the deeply embedded instruction set or the dice. So the question is how do we begin reverse engineering a totally unknown instruction set? Ideally what I would do is I would execute one of these risk instructions and observe its results. The challenge though is I have absolutely no knowledge of this instruction set architecture that I'm dealing with. And I probably can't observe the results on the risk core. So for example, if I did generate an instruction like add one to R0, but I can only view or I can, the question is then how do I view R0 from my x86 core? How do I even detect that I've made any changes to the risk core? Fortunately, there is an approach for this. The patents actually suggest that these two cores share register file, at least partially share a register file, which means I may not be able to view all the effects of my risk instruction, but I should be able to view some of the effects of the risk instruction from the x86 core. So for example, the patents show an example where an arm in x86 core share some of their registers. So that means from the x86 core I can actually see some of the effects of these instructions. So what this would look like then is I can generate an initial state for the processor. I'm going to generate a bunch of values for the processor registers, maybe random values, maybe set all those registers to be pointers to various buffers. I'm going to record that information. I'm going to generate some buffers in userland memory and in kernel memory. I'm going to record those buffers basically record all the information I can about the system state. Then what I'm going to do is I'm going to execute that launch instruction that OF3F instruction in order to toggle the risk core. After that, I'll execute the bridge instruction, the bound EAX instruction that lets me send a risk instruction over to the risk core. And I'm going to generate an arbitrary risk instruction to try out. After that instruction executes, I'll record the results of the system state, I'll record all the registers, all the buffers and everything else. And what I want to see is did something change on the system? Did that input state and output state differ in any way? Unfortunately, we run into even more challenges here. I'm dealing with a totally unknown instruction set that probably has unfettered access to ring zero. So it is really, really easy to accidentally generate instructions that cause kernel panics or processor locks or complete system reboots. And in practice, I could only generate about 20 risk instructions before the system became unrecoverably corrupted before I had to reboot the system and start over. So even after optimization, it took about two minutes for one of these systems to boot. So some more rough approximations kind of indicated it was going to take months and months of buzzing in order to gather enough data in order to reverse engineer this instruction set. So I expanded my initial setup. Instead of fuzzing one target system, I bought as many systems as I could on eBay, turned out to be seven of these thin clients, and I hooked them all up. And if you look carefully at this, what you'll see is each of these systems has a little green wire coming out of the chassis that wires soldered onto the system's power switch. All of those wires go to a relay module that relay module is hooked up to a master system over USB. All of these systems boot over the network from the master system. So the master system can boot up these systems, can SSH into them, and can assign each of them fuzzing tasks for this risk architecture. It can then record all the results of those fuzzing tasks for offline analysis. And when it detects that one of these systems has become corrupted, when it stops responding, or at the kernel panics, the master can use those relays in order to reboot the target. So we can actually see an example of this in action. So what I'm going to do is I'm going to tell the master to start a fuzzing task. It's going to think for a little bit as it generates some tasks for the targets. And then if you listen to the relays, you can hear each relay clicking on. You can see the relay lights. And if you look closely at those target systems, you can see the green LEDs on them coming on one by one as each of those systems boots up. So I think for brevity's sake, I'm going to cut this video a little bit short. But if you'd like to see a full demo afterwards, you can grab me. But in about a minute when these systems come online, we'll be able to see the targets start tasking them with fuzzing jobs. And we'll be able to see logs coming into the target. And eventually the target will detect that some of these systems have frozen and it will bring them offline through the relay so that this process can continue. So this was slow fuzzing work. It's fairly laborious. I let the system run for about three weeks. I collected 15 gigabytes of logs across 2.3 million different state diffs for about 4,000 total hours of compute time. But it's really exciting after I had the final results. We can start sifting through these logs in order to try to find something interesting. Basically, I'm curious, can I actually do anything to ring zero from ring three, according to these logs? And it turns out we can. We can pretty quickly start to find some things that shouldn't exist in a secure world. So for example, the instruction A7719563, if you look at that EDX register, I was able to read control register zero into the EDX register. Control register zero is supposed to only be accessible by ring zero, but we just read it from ring three using one of these risk instructions. And we're not limited to reading ring zero data. If we look here, instruction 8AB4 was actually able to write debug register zero. You'll see that the EBP register got written to DR zero. DR zero should only be accessible to ring zero or circumventing the ring protections through this risk core. So at this point, it's kind of time to start thinking about a payload. What we should actually be having this risk core do for us. And really, once you can reach through the ring boundaries, the sky's the limit, you can do whatever you want. But I thought it would be useful to have some sort of easy to demonstrate payload. So I thought a good demonstration would simply be elevating the current process to root permission. So that would look something like grabbing a structure called the global descriptor table, parsing out a field on the GDT called the FS segment. That FS register can actually point you to a structure in kernel memory called the task structure. And if you grab a certain field from the task structure, you can get a pointer to what's called the cred structure. And from there, you can actually set yourself to have root permissions as long as you can reach directly into kernel memory and grab and modify all of this information. Now there's really only a few pieces here, those parts highlighted in red that require us to cross ring boundaries, things like addition and bit manipulation. We can technically do that on the x86 core. We don't need this risk core to do that for us. But it was kind of fun having this unknown core execute instructions.  So I've got 15 gigabytes of logs. I want to try to build this payload. So it's time to start sifting through those logs, trying to find some primitives to use. And this sort of feels like building a ROP chain. You've got these tiny little pieces of functionality. You have an overall idea of what you're trying to accomplish and you're trying to figure out how to piece together those little pieces in order to form your final payload. So we can start finding those little pieces that we need. So for example, A331 or A313 was an instruction that was able to read the global descriptor table. That's the first piece of our payload. I'm able to find a kernel read instruction inside of those logs. D407, you'll notice a low byte of EVP got read out of a kernel memory buffer. I can actually modify kernel memory. E2B7 was able to write a single byte into kernel memory. Now this is really promising. If I can write a byte into kernel memory, it means I can do precision exploitation through the deeply embedded core. But at the end, I sort of decided sifting through logs like this by hand just doesn't scale. I want to be able to write more robust payloads for this deeply embedded core. So I wanted some sort of automated approach for doing this. So what I wanted was some way to extract behavior patterns from these state diffs in order to identify the bit patterns inside of these instructions. So I built a tool called the collector. So the collector basically helped us do automated reverse engineering of completely unknown instruction sets. So the way the collector worked is it would basically look at those state diffs recorded by the fuzzer and it would try to identify some basic operations like loading immediate values into registers like transferring one register to another. There we go. Like reading memory, like modifying memory, like shifting registers, any number of arithmetic and bitwise instructions. The collector would try to identify those just by looking at differences in the input state and the output state between risk instructions. And then what it would do is it would bin instructions based on what effects it saw those instructions having. So it might spit out, well, here is a bin of instructions that all exhibited this property of transferring one register to another. And after it had these instruction bins, what it would look for is patterns within the bins. So for example, one of the first things we might want to figure out is how are the register values for each of these instructions encoded inside of the instruction? For example, where is EAX encoded in this instruction? So it would look for each of these instructions which bits might represent EAX, which might represent EDX. So that's what I have highlighted in purple. Basically for each individual instruction, which bits might be encoding the registers that the collector saw being used by that instruction. So then what the collector does is it tries to identify patterns across the entire bin. So we can see then that these two middle columns are the only consistent piece of this pattern. In other words, these two middle columns must be the thing that records or encodes the input and output registers for these instructions. So we can do that for all sorts of the different facets of an instruction encoding. You can try to figure out which bits are used to encode the op code of the instruction. And it's not a perfect process. Ideally we would see totally consistent patterns across the entire bin. That's not what we see here. But what the collector will do will be it will try to pick the things that are most common. In other words, in this situation it'll say, well, these are the most likely bits that encode your op codes. It can even try to find things like don't care bits and the instructions or bits that seem to follow some sort of statistical patterns. But we can't necessarily tell what they are. And then it'll mash all this information together in order to sort of automatically derive the bitwise encoding of each possible instruction on this on this deeply embedded core. So looking at the bins that it creates and what sort of functionality we might want to get out of the deeply embedded instruction set these are sort of the encodings that it came up to came up with for a variety of different instructions. So we've got instructions to move registers around and load the global descriptor table. Basically we have a primitive assembly language now so that we can write payloads for this for this deeply embedded core. So we could now that we know the instruction encodings we could write some payloads by hand if we wanted but I thought it'd be cooler if I wrote an actual assembler for these things so that I could I could write some of these programs at a higher level. So basically I wrote this DICE assembler custom assembler just for this unknown instruction set that will assemble these different primitives into their raw binary representation and then wrap them in one of these x86 bridge instructions so that the DICE instruction can be sent over to the deeply embedded core for execution. So now we're ready to revisit that payload idea that we have. We can use the LGD instruction in order to read out the global descriptor table. We can use some of our other DICE instructions in order to parse that descriptor field in order to grab a pointer to the task structure in order to grab a pointer to the cred structure in order to write to the cred structure circumventing the ring protections modifying kernel memory in order to give ourselves root level access on the system all using nothing but instructions specifically for this unknown architecture embedded alongside our x86 core. So the output of this after you run it through the assembler looks something like this. Basically we will activate that deeply embedded core with the launch instruction that's on the left. Then we execute all these bound instructions. Each bound instruction sends a single instruction over to the deeply embedded core for execution by the risk processor. These instructions are going to circumvent the processor security mechanisms in order to grant the current process root permissions and then we launch a shell. So let's revisit that demonstration from the beginning and walk through that in a little bit more depth. So here we have our complete payload doing the steps that we just talked about. We load the address of the payload into the EAX register and then we execute this launch instruction on the C3 processor. After that we've got our actual payload. All of these bound instructions the x86 instructions that are able to communicate with the risk core. Each bound instruction sends a single risk instruction over to the deeply embedded core and at the very end of this sequence we launch a shell in order to hopefully gain root permissions. So if we exit out of here and run this program we'll compile it first. We'll double check exactly who we are again so we are just a regular unprivileged user but when we run the program we use that deeply embedded core in order to gain root permissions. So it's thanks. So I want to toss this out here only sort of tongue and cheek. Researchers have sort of explored down to what we were calling ring minus three but I want to pitch this as sort of a ring minus four. It is in some ways more powerful than our previously known ring minus three. It is a core sort of co-located with the x86 core. It has unrestricted access to the x86 core's register file unlike ring minus three. Unlike ring minus three it shares a lot of execution pipeline with the x86 core which gives it sort of more power than ring minus three but at the same time the whole thing is just nebulous when we're this deep the whole ring model is completely broken down and this is sort of nonsensical anymore. But the point is we've now gotten direct ring three to ring zero hardware privilege escalation on x86. That has never actually been accomplished before. Everything else where we've come close has had to rely on code in the operating system or other bugs to sort of work as a launching point. This is a purely hardware approach for accomplishing this. So the good news is that fortunately we need initial ring zero access. Everything else in this payload happens in ring three but we have to activate that backdoor using one time ring zero access to set the God mode bit. At least in theory but I wanted to poke around with this a little bit more. So here we're looking at a different system. This is another system I had sitting on my shelf here. So this is a VSC3 processor but it's a Samuel 2 core instead of the Nehemiah core that I was using. What we just saw is the system cleanly boot. It's a freshly booted operating system totally unmodified. I'm going to log in as a regular unprivileged user. It's not the fastest processors but once we get to a prompt what I'm going to do is insert the MSR kernel module in order to gain access to the MSRs. So you notice I'm pseudo here but I'm not writing anything. I'm only using this to read things out to show you. I don't have the read MSR tool installed on here. We're going to just use the hex thumb tool in order to dump out that global configuration register. MSR number 1107. So the low bit of that register was the God mode bit. If you look at that low byte what you see is 1 1 0 1 0 1 1. The low bit there, the God mode bit, is on by default when the system boots. That means on the Samuel 2 core any unprivileged code that knows what it's doing can escalate to kernel level privileges at any time. And when you totally break down x86 ring protections and privileges like this, all of our other protections fall like dominoes. Like antivirus does nothing when you can just reach directly into ring zero. ASLR depth don't help you anymore when you can just circumvent the ring privilege model. Code sign and control flow integrity. Kernel integrity checks. None of this helps once rings mean nothing. But there are mitigations. None of them are great but there are opportunities here. So one is we could update the processor microcode in order to lock down the God mode bit. Just don't let people set the God mode bit to begin with. We could update the microcode in order to disable any U code assist on the bridge instruction so that you couldn't send instructions over to that risk core. You could update the operating system in firmware in order to disable the God mode bit during boots and then periodically make sure that that bit has stayed off and nobody's enabled the back door. But at the end of the day the points kind of moved. This is an older processor. It's not in widespread use and I don't really want to throw via under the bus here. I think their target market is embedded and I think this was probably a useful feature for their customers. It was just a very flawed implementation in some of their earlier iterations of the processor. So instead let's take this as a case study. The reality is that back doors do exist. This is not just conspiracy theory stuff but they don't have to remain invisible. We do have the techniques necessary in order to find these. So sort of looking forward, even though this is not a common processor, I do think this is a big deal. This is not just a big deal for C3. This is not just a big deal for x86. I think this is a big problem for all of computer engineering in general because this hardware that we're using to protect all of our secrets to do all of our computation, we have no way to introspect it. So whether or not back doors are real in a general sense is sort of irrelevant. That question is going to haunt us as long as we can't introspect our own hardware. So I hope that's what people will take out of this. I hope when you see something that seems off limits, when you see these weird hints in patents, because the patents that I saw were just the tip of the iceberg and some of this weird stuff that's out there, I hope people will dive in deep and really see what's under the hood. Because that's how security works. That's how we build trust in these systems. So sort of along those lines, I've open sourced all of the research that I used for this. All the tools, techniques, all the code and data I've demonstrated today are freely available. So I hope people will use those to scan their own systems. I hope people will use this as a starting point for much, much deeper processor security research. And along those lines, I want to quickly throw out this other idea that I didn't have time to cover in any depth during this presentation. But I demonstrated this side channel attack on MSRs. And I actually found some really cool uses for this, totally outside of what we just looked at now. And found some kind of unsettling results on the number of processors. So that's topic for another presentation. I'll be talking about this tool, Project Night Shift, specifically tomorrow at DEF CON if you're around. And I'll sort of show some of the totally different things I found using this approach. So I hope you'll check that out if you have time. But in the meantime, all of this stuff is available on my github. That's github.com, XOR, E-A-X, E-A-X, E-A-X. This project, I'm calling Project Rosenbridge. All the backdoor research is there. C.N. Sifter, that processor fuzzer that I used heavily throughout this is also available there. I wrote a single instruction C compiler a few years back. I've written some cool control flow stuff. There's a system management mode exploits on there and a lot of other fun stuff I've just tinkered with over the last few years is all available there. So I hope you'll check it out. What I really love is some feedback and ideas on these topics. So if you want it to reach out, either after this presentation, I'll just be next to the stage. Or you can ping me at XOR, E-A-X, E-A-X, E-A-X on Twitter or same thing at gmail.com if you have any feedback or anything else you'd like to discuss about this. So thank you, everyone, for coming. And that's it.


What's going on guys got Kyle here with Layton sports cards, and we are ripping two boxes for Lynn F Gonna be both gonna be Star Wars signature series. Good luck Lynn. Let's see what we got Complete the order Think so there's to be one that's Toby from Star Wars visions as Jaden Waldman as Toby on the auto Yeah, I don't know. I don't know really know much the difference Toby and box two that'll work that'll work Rory This one is the 50. It's gonna be corn trawler. Come on corn trawler. That is a Demetrius Vistreff ski from the Mandalorian This one they're low number to 50 corn trawler on the auto Alrighty there Lynn that'll do it for your two boxes Star Wars six series. We'll get those right out to you. Thank you


That would be, um, mud-lub. That means I don't understand. I know. It's just one of the things I've picked up on in films. Wow, a non-curse word. Yeah, anytime they say mud-lub. Yeah, every time. Mud-lub mud-lub.  I'm a gumbo. Cush-wha. Is it cush-wha? Or cush-wha. Cush-wha. Cush-wha. Who was that? Three syllables. Cush-wha. Coo-chee-whoa. Coo-chee-mama. M-gumbo. Coo-chee-mama. Today we're doing a movie with Phil. And we are doing dawn of time to the king returns. Dawn returns again. Dawn, the dawn of time. Dawn, the second coming. And so is Priyanka. Hey, hello! Hey-o! Anyways, so yes, obviously we're reviewing Dawn too. If you haven't seen our review of Amitabh Bakhtan's Dawn, and then Shah Rukh Khan's First Dawn, we've done those. Those are already posted on the channel, so you can go check those out. If you'd like this, it'll be a 100% sort of review. Obviously, you've all seen this. You've all seen this. You've seen it. If you haven't, what's the matter with you? Are you really Indian? It came out 2011, so 13 years ago. Geez. Why would that be 13 years ago? Aren't we in 2020? Oh, no. It would be 11 years ago.  Regardless, a long time. Happy 2027, everybody. Directed by Farhan Akhtar, written by Farhan Akhtar, and starring Shah Rukh Khan, Prankochopra Bomanarani, the same cast as before. Before you get him in here. Om Puri. Om Puri. But like I said, if you haven't seen our other reviews of The Last Dawns, you can go watch those. Rick, your initial thoughts, please. Also, I have my Shah Rukh Khan. Hey. I have a lot of notes I'll get into when we get into the thicker thick of it. Love getting into the thick. My basic feedback right at the top is this. I like the second half, like from the interval, I like the second half more than I like the first half. And I ultimately, I like this more than I like Dawn. But it's got a lot of problems. So if this was on and I had nothing else to watch, depending on the mood, I'd probably leave it on if it was the second half. I wouldn't revisit it necessarily. But I'm also oddly interested to see if they might do a Dawn 3 and take it up another notch. Because I think this is a notch above Dawn. Oh, I think it's 10 notches above Dawn. I still think there's a lot of problems. Yeah. No denying that. But this was more enjoyable. Oh, yeah. Because at least... Even from start to finish, even though I like the second half more, at least you have all the good action and good stuff like that, and this one that she didn't have in the first one. But... And it didn't seem as dated as the other one. This has got to be of everything we've watched.  The English the most? Because we've seen some a lot. Yeah, but... It's actually impressive. This was a lot. How much... It's actually... I can tell you how much I was busting out laughing. It's actually impressive how often they can get bad white actors. I said that's exactly what I said to Indran. Because you think at one point... You think at one point, I mean, I guess we've had it once and started to do Dawn, but he actually paid for actors. But the fact that it's always consistently awful. It's glorious. It's like they're going out of their way on purpose. Yes, it used to. It used to really annoy me. Well, it would really annoy me if it's a movie.  But when it's Dawn, too, I laughed out loud five, six different times because not only was it bad, but most of the time, they had one frickin' line. They just had to deliver like the dude in the elevator. Steph says, I'm so glad they kept that in. He had his moment. He had his moment. So anyway, that was amazing. I think it was way better than Dawn, the first Shahrukh Khan Dawn. Yeah, I enjoyed it more. I think it's way much better of a film in terms just of all, in all aspects, even though it still has for a heist slash spot. This was almost like a combination of not the current bonds, but more 90s to early 2000s bonds and oceans. And if you'd seen MI1 through three. Oh, okay, yeah. Especially MI1. I mean, there's a lot of that as well, a lot of inspirations. There's almost, almost, almost a full-on rip from MI1. Oh, really? Which one? The whole breaking into the vault. Literally hanging upside down and typing in the entry password. Oh, really? Yeah, that's, you've seen clips of it. Oh, yeah, I've seen, I've seen, you know, I've seen Dawn, well, I mean, um, yeah, that's where Tom comes in and he's hanging above it and then they let him drop and he drops to the floor and his sweat's going to hit them. So he, to get in, he's hanging upside. So I was like, okay, are you going to do everything or are we going to do the sweat? But thankfully it didn't. It was just enough, just enough. And it feels very much. In fact, I wanted to, I know I won't forget, but that was a good time to give the shout-out. One of my favorite things about this, this was a Mission Impossible level score. I thought the score, which the score is from composer, that just goes by Shankar, but it's Shankar Mahadavad, who's done, like, Dildohak Nado, and we've seen, my name is Khan, yeah, you name it. We've seen a ton. I was very impressed. This was the kind of score you want for this kind of movie. Especially for the time, this is, even still, one of the better action films we've seen from India. Second half. Obviously we haven't seen a ton of action films. Obviously we saw War, and obviously that's, you can't really compare it because obviously the, at least an action aspect I'm talking about, that is, came out what, two years ago. So 10 years of VFX is a long time in VFX. But like, we haven't seen a ton of action films. No. In our, in our whole library of films we've watched. Of Indian films? No, we really haven't. We've watched some that have action in them, like Padma Vat and Bajirao have action in them, but they're not action films. Yeah, I mean, it's, obviously this year's very different because we've been in all over the place. And stuff like that. But for 2011, I thought it was actually quite good, and I was much more entertained in this one than I was in the first show. As was I, especially against second half. I didn't actually have any difference. Actually, I think I, the end, just, what, the twist? No, just, I mean, I knew there was a twist coming, but I hate it when like, all right, now this is what we did. Yeah. This, and then, you know, it's 10 minutes of montage of what happened. Here's what's really happening. Okay, cool, whatever. It's just, you guys will always hear me gripe on ends. So before, before I jump into my, the things that were beautifully wrong with the film, and I mean that, they're beautifully wrong. There's like, it's almost like it's an endearing quality to them in the same way that some of the earlier SRK films have cringy things in them, but you wouldn't want to change it. I kind of like the flaws.  Let's go, let's go down the line of performances of the actors and then the direction and then get into the weird stuff. Yay. So apparently, okay, so there's two different sites I looked at. One said he did all of his own stunts. Another one said he did almost all of his own stunts. Do you know what's the case? You guys can tell. Yeah, like they said he did the fall off the top of the building. Like he was trying to go full Tom Cruise on this. He did the fall on the building and that I didn't see a stunt double anywhere. So I'm voting for the fact that SRK did his own stunts. Good, I'm glad. Yep. Yeah, I thought he did a good job in this section. Me too.  I much prefer him as the romance guy. Yeah. Just obviously that's just I feel like his wheelhouse is at least especially back then we'll see it in the next year. Yeah. Because obviously as you mature as an actor and stuff like that it could change. It'd be interesting to see him play and he may have done this before and we just haven't like Ethan Hunt from Mission Impossible or James Bond straight spy hero guy versus in this one where he's the bad guy spy where he's just SRK being like a James Bond type. I think that would work. Yeah, I think it could. We might get it next year. Who knows? I don't know what these new films have in store. But I thought he looked a lot better in this one obviously he was a lot more especially with the long hair. Yeah. The opening. Me and my wife were both like, when he cut his hair I knew you would. When he gets off the plane with the haircut. No it was I think the song started right? The Oh yeah it was. It was the song. The Don song of the film. Yeah. And me and my wife were both like Oh no. He cut his hair. I was like Why? Cut his hair I knew for him. And shaved his beard. Yeah. It was so sad. But hey at least he put on the Rithic mask. Did you see that going? He took it off. I automatically No! I was like that is some great mask technology right there. Yeah.  I did too. I loved that. I thought it was a great little addition. Yeah.  Fun spy stuff. I enjoy that stuff right when I have it I was like Yeah! He killed Rithic.  And was very believable. I really enjoyed that aspect of it. Though the first scene they have together where they're talking got to say little bit cringy there just the acting stuff I don't know what was going on but they both weren't at their best in that scene but the rest of the time I really enjoyed them I really enjoyed her I have something to say when I get into the stuff that for me was just like really come on guys later in the film but I mean I for the most part I like the fact that she was Roma again. I did not like the fact that they made them a love thing. No. No. Okay. I was like this really this person that she's wanted to kill because she killed her brother and then she's the entire film wanted to get it Don but now that Shara Khan does is hey baby and now she's all like wet in the pants bad boy complex it's the bad boy complex like really like that's women are so stupid they just get so horny and forget everything they want to do so what happened with that was that Farhan's idea I don't know what it is did SRK did SRK did SRK say okay I want Priyanka in this and her character needs to fall in love with me maybe it's just if you're in a Shara Khan film you have to have somebody fall in love with you because you're Shara Khan and somebody's going to fall in love with you of course well this is a completely different thing yeah I know this is its own thing which is fine also how did she become like a detective real fast you don't need to know that okay don't ask so many questions Gorman all you need to know is that she decided to work for Interpol I know wait what you know why you know why because Priyanka knew and four or five years later she'd be needed for Quantico so she needed to have that kind of thing on her resume yes of course for that it was just confusing it was very strange I was like oh Roma works for Interpol do we know why shh don't ask questions don't look just the movie started shut up if we missed it I don't I'm sorry you did it's a five year lapse a lot happens in five years Corbin oh wow jeez yeah see it's a five year period he's in Malaysia for five years I thought she did well in her role she did fine and I thought she had much better action scenes this time nothing to the level of like agentina which you know Roma and Don she's the queen of that bang man I still want an agentina film come on I can't wait that's a franchise people it is it is like the anti-heroes the post is gonna be like forks yes fork the bad guys it's the best idea please do it so yeah I thought this one in terms of having pacing throughout the film was much much better especially the second half and I mean maybe it's just the fact that I didn't know what was coming obviously and I love that I love that they could just do whatever they wanted yeah so it was obviously Farhan was much more freed to just kind of do what he felt the story wanted and I thought his direction was everything in this was better than the first one in terms of I felt like you could feel the freedom he had with his DOP as well like really great car chase is really great stunt sequences I put down great stunt work a lot more money was really good job by the whole stunt team in this one of the better things we've seen was with stunt work and you could tell like if I was making a film and somebody said hey you need a director who can do like a mission impossible style film and they showed me this as part of like his real I'd be like dang yes he can direct a spy thriller yep absolutely 100% still had some of obviously the dated kind of stuff now nothing like yeah we get into the last one should we get into the yeah sure yeah we want to talk about so first of all the prison that they're in at the beginning Bowman and SRK has the worst security on earth so fights are unstopped weapons come in unchecked and you don't watch the cooking staff so they can easily slip poisons into the food it is the whoever that prison if it exists it needs to have a complete overhaul it was beyond ridiculous we both said there's security it's also it's really funny to watch SRK leaning for a kiss because you know it's never gonna happen he almost did he almost did I know it's not gonna happen I still want to see that film which one is the film that he actually does kiss somebody no do you know how did that happen what's the he's saying there's a film where SRK smooches I think it's not one of his more popular not a kiss on the neck lip the lip yeah it's a kiss on the lip who'd he kiss I don't know I can't remember wow yeah I love that he loves Tom and Jerry I love that I love that Don loves Tom and Jerry and they brought that back I also want to know how did Don get use of a huge stadium for his secret criminal meeting he's overcome he owns it oh that's right it was the night stadium nevermind and then I wrote again oh no more white people yes so both of these guys are wanted by Interpol how would they not be recognized at this high of a level financial institution I don't know when Bowman came in no questions asked none at all nice stunt work and if you had to watch oh yeah so this part first of all I don't know if y'all know but if you were shot anywhere on your body that can cause severe bleeding you've got three minutes five max before you're dead and you bleed out Priyanka'd be dead she'd be dead I thought she was I thought she was too the fact that she wasn't dead I was like really guys come on she was dead well but here's the thing they didn't even check like she's not dead of course well Don knows but here's what I want to know why the heck if he could blow the room up with his watch at any given moment why didn't he do it before they shot her when they were doing the countdown and saying you need to shoot him or we're shooting you he's here like this and then he says oh put the gun up here why didn't he just do what he did 60 seconds later when his hands are behind his head and he goes chink chink he let them shoot her he doesn't love her clearly not okay that does not make Priyanka happy and when Priyanka's not happy everybody's not happy it's funny but I actually for as annoying as those things are this is one of those movies that is given permission to have those kind of flaws oh yeah I don't most several con films unless I'm told in the beginning this is right like you're going into Swadesh or my name is con right and obviously this was an old Bollywood action film and so I was like there's clearly going to be some stuff that probably is going to go on here and so my bar even though the second bar was higher than the first bar because I just heard more about it I think it lived up to it and I would watch this one again just like if it was on I would too oh this will be fun I'll have a good time in this one it met my expectations it's not without it's flaws for sure 100% and it's I still think if it was done today it would probably be a much better film just because of our technology nowadays and I think the amount of money that people will put into an action film now yeah and I think fight choreography is better and story story is better yep story is better I thought Bowman thank you I was just about to mention him I thought he did well I actually thought he did better than the first one really I liked him equally as I did in the in the first one yeah I just there was a moment it's right around the time that they're going to shoot him which again I love the you have every opportunity to just shoot him in the head right now but you need to talk to him for a very long time well that's not something that's specific to Bollywood of course Bollywood does it too but there was a moment when he was doing that and I thought you know what Bowman is just freaking solid all the time all the I'm telling you revisit it revisit it especially now that you've seen him serious so many times what was it about that that annoyed you so much because I loved that character mostly the performance I love that character I like it I love that character I love that character I thought all the supporting people were fine well not the white actors but they no I'm talking the other ones but they were beautifully horrendous just I laughed out loud I thought five or six times I thought a lot of the action in the film was actually really convincing it was I think it was practical explosive practical effects most of the time as opposed to the VFX which I like better because it looks better on camera very good cinematography on the one-on-one hand-to-hand combat and good sound really good sound quality there were some moments I recognized even ambient noise that they added was really well selected and put together and I bet if I didn't have so much that I was thinking about and going through film editing was probably pretty darn solid too it was it was actually the technical sides of things was pretty darn good yeah if the the Don-1 shower cons Don-1 was like a a zero like it wasn't but this is a hundred points above that one in terms of overall filmmaking yeah it's a much better movie overall in a much more entertaining film agree which is what I want from a spy espionage heist-ish film yep because I mean I've seen Ocean's 11 I've seen the first Mission Impossible I don't I don't love any of those films I think they're fine they're I love the entertaining films obviously I've only seen first MI so it's not like I'm telling you up to snuff on them I believe if you watched all of the Mission Impossibles except to just avoid it like the plague I believe you would not only like the series no that's MI3 that's spectacular so I believe you would not only really like I like it as much as I like the James Bond franchise and that's saying a lot and it also I mean it would not surprise me if you got a little bit of a higher opinion of Tom Cruise no no absolutely no in terms of ranking them I this is the one that's the most entertaining unless you're going for if you like if you want action of course but if you just want laughs obviously you're going to the first Don at the original Big E Don oh yeah okay so we're using all three now yes right if you're if you're ranking all three but it's hard to because the first Don and this Don they're two very different films yeah it can't be like oh I want to watch some hilarious 70s comedy spy and then I also want to watch some hardcore action yes big enough films they're I don't there's they have the same name nothing else you know they got Don and Roma and they're not even you can compare obviously the remake but Don too is its own movie yeah obviously if you're comparing both single Don's I like Amitabh by a long shot a long shot better film yep for me 100% I don't know if it's better film cause I want to flaws in that film but I was much more fun entertaining film agreed in that film yep this one I mean if you're in the mood for an action film like I it's hard because obviously R is amazing right but it's like that's a completely different animal I feel oh it's a very different animal how many spy films have we seen two from India two war we have war we have these two Don's so that's three I'm thinking about would you well we've had TV well actually a lot of TV we just had Vikram yeah Vikram is Karthi I don't know if you does Love Hostel count I mean it kind of it's more of a thriller I guess yeah and so does I mean there's a couple of things that have it in it like article 15 is it's not an action spy thriller so you're talking like the specific spy thriller genre I don't know that we've seen very many at all I think you can count them on one hand probably yeah and I think the best ones are probably the ones that came out this year now Vikram and doesn't doom fall into that category yes doom does I don't know if we'll ever get to doom I'm scared of dooms so am I what about does Krish fall into that category Krish does yeah but there's reasons we haven't watched those yet isn't there we've just been a little wary just haven't gotten to them yet we've been a little a little shy of those well I think let's watch Kalank I think if we if we ever get to those which I don't know if we will we'll have to see but we have to go in the same way that we go into a Rokan spy film yeah this is and what about the spy film this is just for entertainment what about the spy film with isn't it Mahanl no it's Rajnikanth with all the guns and the it's 2.0 yeah I think that's right that's what it's called right yeah with the those 2.0 right we're talking about robot no 2.0 what's the movie that has Rajnikanth and Raya Rai and Rajnikanth at one point he's got the glasses on and he gets all of these machine guns that come out of him because he's a robot it's called robot is it called robot I thought it was called 2.0 I want to see that I heard it wasn't great though I think it's the most expensive Indian film ever though in terms of really how much it costs how much did it make I don't know I don't think it made so what do you guys think we should watch as far as like the next of a spy thriller Mission Impossible James Bond there are ones like Akshay has Airlift and yeah what happened to Airlift is it baby is it called baby I think no what are you talking about Akshay like a spy thriller I think those there's one that's called for him it's called Airlift and I think the other one's called the trailer for Airlift I think the other one's called baby obviously Salmon has a couple I guess but I think not crime thriller spy no because I think he Salmon is it Sultan Sultan Sultan I don't know I don't know which one's the spy I'm just thinking of stuff on the top of my head that I know that I think is spy but maybe it's not that does Mr. India count as a spy one because I think it does I guess it kind of does it gets very James Bondy it kind of does that's in there but but then there's also South remix of Don as well well well well I think Rajanakant plays Don what the freaking circus net really I think so I think it's Bila or something like that so why won't why don't we watch that next I don't know I don't know how good it is obviously we have access to it probably oh my goodness I want to see that but what if it's the exact same story as Don I'd like to see how they do it down there and see if it's a remake of Don compare it to the SRK remake and see who came out the head on the remake it's probably B well that's the original superstar yep I think we're about to get some a lot of really good spy stuff though we are we're gonna get in my seven I guess next next summer yeah why would you know about coming out well Pathan which is Shah Rukh Khan that's a spy yeah and then Ramashra that's a big spy movie big spy movie anyways you're done listening to us yeah anyways let us know what you thought about the film what should be our next Shah Rukh Khan film there's only ten more left yep that's it and then we're done with the whole SRK library that's a lie ah but anyways let us know what should be the next Shah Rukh Khan film we should watch down below


I am Michael T. Geel, accounting lecturer from University of Mississaur. Today I will continue with taxable supplies. There are four concepts in taxable supply. Number one, type of supply. Number two, place of supply. Number three, time of supply. Number four, value of supply. First is the type of supply. The type of supply can be categorized into taxable and non-taxable supplies. A taxable supply is a supply which can be standard rated or zero rated. The non-taxable supplies are examined and out of scope supplies and are not subject to GST. The first one of type of supply is the standard rated supplies. Standard rated supplies, taxable supplies of goods and services, which are subject to GST rate of 6%. A company who is registered for GST has to collect GST on supply and is eligible to claim input tax credits on his business inputs in making taxable supplies. All goods and services made in Malaysia, including imported goods and services, are standard rated supplies except for specific goods and services, which are categorized under zero rated supply and exempt supply. Second is the zero rated supplies. Zero rated supplies are taxable supplies of goods and services, which are subject to a rate of 0% GST. However, a company will not collect any GST on the zero rated supplies, but are entitled to claim credit on business inputs used in making those taxable supplies. Example of zero rated supplies include items such as essential products, such as basic goods items, electricity up to 300 units, treated water for domestic consumption and essential medicines, which are all zero rated. In order that Malaysian products and services are competitive for export, they are all GST zero rated. Third is the exam supplies. Exam supplies are the supplies of goods and services, which are not subject to GST tax. A company will therefore not collect any GST on their supplies and will not entitled to claim credit on business inputs. In the above case, the GST input tax incurred by the exam supplies company would become a cost to the business. Some of the examples of the exam supplies are private health care and education, residential properties, mass public transportation and financial services. Fourth is the supplies not within the scope of GST or out of scope supplies. Supplies that do not fall within the GST environment and legislation include doors, which are non-business nature. Sales of goods and services outside Asia to another location outside Asia, employment income and penalties. Services provided by the government is also out of scope, such as supplies made by the government, except as otherwise prescribed by the Ministry of Finance and supplies made by statutory bodies and local authorities with regards to regulatory and enforcement functions. Last but not least is the supplies given within. To relieve the difficulty due to GST on certain categories of business, the government will provide the GST relief on supply of flexible supplies which would otherwise be subject to GST. Some of the supplies which are given relief to the above effect include supplies of goods by business through government and related agencies, supplies of petrol on a retail basis, goods imported on temporary basis for repair purposes, acquisition of healthcare equipment by registered private healthcare provider, acquisitions of certain education equipment by registered private education provider. This is the end of the slide for the type of supply. Thank you for listening.


In today's video we find out if my $1,000 TCG investment was not completely terrible? Maybe? Hopefully? One year and about nine months ago I invested $1,000 into TCG player Yu-Gi-Oh cards. I had dreams of grandeur. I thought one day this $1,000 will turn into $10,000, $100,000, a million. But that has not been the case. The first year not only did we not make money, we didn't even break even. We lost money. And so in year two I decided I'm putting another $1,000 into Yu-Gi-Oh cards because that's what you do with investment. You just keep putting money in, right? Well it's been better this year. It has been better. Well at least it was on the last check-in and we're about to find out if that continued because the first year we lost a couple hundred bucks. It was not good and it's been getting worse and worse every time I've checked. Now we're going to see if it's gotten better. Before we get into it we have a giveaway. I'll be giving away a $50 TCG player gift card. All you have to do is like the video, be subscribed, turn on notifications. Let me know down below what you want to see me invest in in 2024 and what our best and worst investments are from this year. So as you can see we have our year one spreadsheet and we had lost $164 at the end of last year. Last time we checked in we had lost about 339. So I should have sold these a long time ago. It's just gotten worse and worse and worse the first check-in. We had made money then we had lost a little bit then we lost even more then we had lost way more. So keep this in mind and when you're thinking about investing in cards whether or not I mean you might choose better ones than I did but it's been pretty rough. So let's get on with the check-in. We've got Ultimate River Blue Eyes by Dragon. You guys have seen these cards before let's get to them. All right so we have a first ed lightly played. We've explained a million times but it was not supposed to be lightly played. We invested in it. It's $5.67. It's been about the same for a long time so it's actually a little bit lower. We lost $20 total since it first started. So that's pretty rough and 78% of our value. So it's been pretty bad. We even went down since last time. Let's check on the unlimited. The unlimited I don't expect too much. Let's just click that off. It is near mint but I'm not yeah 354. So hey look look at that. Since last time we've gained 19 cents. Not bad. Not bad. Overall we've lost about 55% of our money. Not great. Let's go to Silent Swordsman level 5. This is one another one that should have been near mint but I should have known buying Flaming Eternity. There was no way I was getting a near mint card buying on TCG but it doesn't matter where you buy these from. They're almost impossible to get near mint. So 35.94. I mean there's only one listed at that so it might be go up to 40 soon but 35.94 it's gone damn and it was 40 last time so not looking too good there. For a number 17 Leviathan Dragon all this thing has been an absolute home run. Every time we check on it we have made massive money and I'm sure when they reprint this thing just like they did with the Astral it's going to do great.  How is it even worse? It's 33.85. Oh this was the absolute worst investment. Oh my goodness I paid 110 dollars for this car. Literally I've lost 70% of my money. Oh guys please please don't invest in new Yu-Gi-Oh cards. When I first started this they were not reprinting everything all the time but at this point with the 25th anniversary star lights and everything there is no chance anything is holding up from the new stuff so I would not buy those expecting those to go up in a very very very very very long time because we've almost hit two years and guess what happens after two years you lose 70%, 59%, 55%, 78%. Good investment? No. All right lightning storm uh which does this doesn't have a 25th anniversary yet does it somehow so when this gets a 25th anniversary I'm going to be even more angry.  Did it not get a 25th anniversary because that's what it feels like right there maybe this card just not usable anymore. $123 my goodness we are getting annihilated on this $298.41 it's $123 we've lost $175 in this card so if you're buying new cards you're not playing with them you just need to sell them that's just how it goes if you start collecting these things what's gonna happen this this is what's gonna happen so be ready for it if you pay 300 for a lightning storm just sell it right away do not hold on to it you'll lose 59% of your money this is going to be the worst episode yet solid warning unlimited okay this this one's probably fine I mean it probably hasn't gotten down that much I would say I think I paid like 70 for this near-mid unlimited $4173 it's still down somehow I mean to be fair all cards are down so that there's that to consider but we're still down $28 on that card it's an unlimited one so it's not crazy Evil Hero Dusty Gold yeah this this one is a crap shoot it was a really this was a bad choice did they have the legendary duelist seasons yet or whatever because if I had known about those those absolutely destroy value out of legendary duelists so I don't recommend investing in anything legendary duelist it's pretty rough I mean I've lost 90% of my money on a $12.99 purchase is $1.46 now and that's gonna happen every time you do legendary duelist because if you buy the original they're just gonna reprint it and they reprint it in secret rare like the same rarity so it's the exact same card actually I say that I don't think it was a secret but they do reprint it immediately so like a year later so it's gonna get crushed Stratos Ulti has been one of our best like of all time and it's probably gonna be one of our best investments just because elemental heroes and stuff it is down but look at this look at that recovery we've come back a little bit recently you love to see it $1.23.68 so it's down but it is not ridiculously down okay so we're down about 26 bucks 18% I mean that's like that just looks like a normal investment like okay 18% is a lot still for but compared to everything else is not too bad we got a flare metal dragon come on flare metal I mean you're at least a ghost rare I mean maybe I don't think it's had a reprint or anything okay near mint first edition we have $90 that's definitely lower I think yeah I paid 140 oh my gosh even that's down all right now the deck this is actually the deck has been the most consistent because nobody sells these so that helps that there's just no sales data oh so what oh limitless I think they did I think this was on here last time why limitless 92 94 no they've lowered it oh this is so sad look at this 45% of our money gone $551 we're down another 110 in the last three months this is only the first thing we haven't even gotten a year well I mean actually it's probably worse this is your one we haven't gotten a year or two yet oh it's so sad okay time to run through year two last time we had lost and we had actually made money last time so let's see if that keeps up uh I'm not feeling too good after the last one sky striker we have a 45 cent card we bought three of these so it is $1.35 for all three wow we are getting destroyed on these okay dark arm dragon ghost rare up next 3698 okay we're down another 15% on that one colossal fighter ulti this is what I saw house of champ shared this on his twitter the other day or x or whatever you want to call it these days and it has gone way up I think we paid okay we paid 88 so I think that we're actually gonna be okay on this one let's see yeah look at this oh thank you Edison format shout out to e3 and all the Edison people out there you guys are really saving my investment year 1668 also best format out there let's not let's not lie to ourselves go format guys I'm sorry okay that that was a game changer I'll have justice catastrophe that's another one that's Edison stuff I don't know if it's gonna be that good all right near minute we're looking at 94.99 that's not bad 94.99 I should have I should have just done an Edison investment and I would have been fine I would have been killing it right now ash blossom we have six of these I think these are down lost I saw okay 10 of the pharaoh gods we have 735 times 6 okay 44.1 so we lost 26% not great I mean it's not the worst ever but it's actually up a little bit from last time so that could be the trend if ash doesn't get another reprint soon this is a really pretty card so maybe it could make its way back to that 60 we paid for him pot of desires ulti okay I don't think this one's done anything recently but could have missed it yeah it hasn't looked at that downgrade on the way by 41.49 ouch that's not good at all guys losing 25% on that one trap check trap hole we did sell these yeah 292.26 so that's locked in glad I sold those because that was a 68 increase when I sold them all together so very solid all right tune black cluster soldier I don't I haven't really checked on this one but I'm not feeling that crazy it's just these new cards just are really destroying me next year we are not touching new cards okay remind me that next year okay 649 even though this year it was not my choice and you guys actually did better than me in this uh the twitch chat did it on when we were live and it's been much better than when I did it instant fusion this is what this was a meme man I didn't want to I didn't want to invest in this one they made me and it's bad it's bad it's bad we're losing so much on this one okay Spanish 7175 that's way less than what we paid $121 we're getting destroyed on that one night beam our favorite card night beam I think we bought 10 of these this one was doing good until the reprint recently 1267 I think it's still up but 13 of these 1267 yeah it's just time 10 is easy but I like to have it in there okay up 19% they get a speed dual reprint so that could have I think I did lower the price a little bit because last time it was at 130 not too much just a little bit back to the ultimate rare all right 2995 wait okay we only lost a little bit on this one it's basically the same price essentially there's like I mean 55 cent difference is not really a difference uh yazi now okay that's pretty good can we go back to back with decent ones not destroying us $20 and 95 cents feels low it's not that much lower though it's only $2 and 94 cents okay rescue rabbit secret rare the original print of rescue rabbit did have a cr since then I think so well maybe not since then but we went for the foe this is not looking good on that preview 1799 okay it's not it's not bad bad but it's not good it's kind of how all these are rising energy so last time we were making a little bit this time we're kind of just giving it all back we're not making a ton rising energy we had a few I remember we had one like returned and stuff 732 still up there two of these okay we're definitely down definitely down a decent a bit on those fiber jar well we have to put zero on that one because uh you know you guys know what happened with the fiber jar obviously we uh returned that one anything on the surface actually looks pretty good surprisingly droll and lock bird rare last time this one was actually balling out let's see if it is just the regular rare from the tactical map oh look at this oh this is our big hit 475 that's our big hit for this one we bought we should have about 23 these are the stupid gate guardian 475 times 3 we made back 12 we're making 900 percent we paid we paid nothing for these wow we paid $1.40 for three of them yeah they were like 40 cents at the time because they were basically commons in that set so they were everywhere for a time now they're up to how much per card 475 almost a 1000 percent increase that's the one to get excited about I mean we only made $13 off of it so we really needed to buy like hundreds of those for it to be worth it but still that's pretty amazing penny stones right there all right time for our anti penny stones we have the gate guardian this was this was the chat's fault I definitely would not have bought this not that I'm like a genius at this obviously I kind of suck but I definitely would not have bought this it we paid like $5 a piece on these the 80 cents minimum we lost 82% of our money that's so bad okay the battle fader I've actually this one was way up last time because it got bought out or something and I posted I couldn't sell it so and it's also lightly played I realized so I tried to sell it for the gain we didn't actually get to sell it so let's see if I lost all that potential right there I mean I posted it for the lowest price and it just wasn't selling it was based on a buyout so okay $69 is still higher than what we paid so $69 unlimited I mean if I sell it it's going to be a lightly played so it's going to be like 46 but that's still up if somebody wants to buy my battle fader and beat you know help me out in the video hit me up I got an ultimate rare and finally we have 14 unlimited petite moss let's see what they're doing petite moth if these look I honestly just want to do a buyout of these just for like a meme but then also it would help our help our spreadsheet a little bit you know look a little better okay metal raiders 25 cents that's way lower come on how is the moth getting disrespected like this okay we lost another 60% of our money there ouch all right so overall we made 5% that's not bad I mean honestly we locked in some of it with the trap tricks trap hole nightmare but thanks to stuff like the battle fader still being up we did really well in the drill and lock birds I mean they're not making a huge difference we did pretty well with the what is this night beam night beam still balling out yeah then we got a couple here with the uh the two Edison cards are really carrying us so honestly there's a few cards that I'm really happy we invested in there's a bunch that I'm I'm not happy I didn't have a choice on any of them so good job chat and also terrible job on some of them but I'm honestly surprised we have not actually lost money and if we sold them we'd have all the costs and stuff so we didn't have losing a little bit but this is honestly surprising that it's holding up this well compared to 2022 which was an absolute nightmare you guys just saw shout out to tome foe show dax or tomato juice puffs of doom or nesto dn america doister supreme stage 21 cj and then a tie show in moose jr barney robert f and thomas mclean thank you guys for supporting the channel i'll see you guys in the next video peace