Hey guys, welcome back to Six Sister Stuff. Today we're gonna show you five of the easiest things to cook in your Instant Pot. So my name is Kristin. And I'm Kendra. And we are two of the sisters from Six Sister Stuff. So today we're gonna show you five of the easiest things to cook in your Instant Pot because, I mean, people are getting Instant Pots for Christmas. And I'm even a beginner myself. I'm so proud.  We're learning the basics. So if you just got an Instant Pot, you're gonna wanna watch this video. All right, should we get started? Let's get started. Okay, first recipe, we are making Instant Pot rice. And at first I was a little bit skeptical of this. Before I add this, I'll tell you why. Because I was like, I'm all about the easy-minute microwave rice. And then I tried the Instant Pot rice and my life was changed. And now we have rice about every other night because it's so easy, so fast and it's way better than any microwave rice, so. Amen. Okay, so we have a cup of rice and then one and one-fourth cup of water. I'll get a little stir. Nice. Now I get a lot of comments that lots of people like to rinse their rice beforehand. It doesn't matter if you rinse it or if you don't, it will still work wonderfully either way, so. Okay, that's it. I'll let you push the buttons because I still get scared of them. I can push the buttons. Okay, so we're gonna put the lid on and we're gonna turn the knob to ceiling. Ceiling. Ceiling, knob venting.  And then because this is white rice, it only cooks for seven minutes. So we set the timer for seven minutes, then you're gonna wait a few seconds and it's gonna beep and then it's gonna say, wait for it. On. If it says on, that means you did everything right so you can just walk away. So, we're gonna let this cook here. Then we're gonna go over here and show you how to cook Instant Pot eggs. Now I love making hard boiled eggs in Instant Pot. It's one of my most favorite things to cook. So. Okay. You are quick. So, this is just easy too. I know. It's eggs in water. It doesn't get any easier. So we have three eggs and then, what did you say about a cup of water? About a cup of water. So now we're just using three eggs but you can do up to like 18 eggs with just a cup of water and you'll still cook it for the same amount of time. Yes. So. Okay. I'm gonna put your lid on and I'm gonna show you how to do it. Okay. I'm nervous. You got this. Ah! Is it on? No, not yet. Oh. Here we go, so make sure it's all the way over here. Oh. It's seen right here. There you go. Okay, now turn it off. I did it. Okay. Turn it so it's on. All right, there you go. On. Good, so you turned it so it's on. Okay. And then first you'll check your knob. No, it's a ceiling. No, the ceiling, not venting. Very good. And then we're gonna go to the buttons. Okay. So this one has a pressure cook button so that's the one you're gonna push. Pressure cook? Good. And then we wanna go to five minutes. So I love to do the 555 method and I'll show you what we're gonna do there. Okay. So go down, so push the negative button. Does that make sense? Yes. And we're going down to five minutes. Okay. So you can push a lot of times or you can even hold it. Oh. And it will, no, I didn't know that until I had it. Okay, so you set it. Set it. Good, now we're gonna just wait a few seconds and wait.  Mm-hmm. And then we're done. You're right, let's see. There we go. Go on. Thanks. So rice is done. So the elve appeared, so that means it's been done for about 13 minutes. We got busy, we got jammed. So we're gonna turn it to venting and there's no steam left, so we're good to go. We can just open it up. My, can you see this? Perfectly perfect. Perfect rice. Okay, so this rice is perfect. I love it because it's like the yummy sticky rice that your mom used to make. Mm-hmm. The good stuff. The good stuff. And it turns out so perfect. It's not too hard, there's no hard chunks and then it's not too soggy like some of the rice that you make in your rice cooker. Now how much more rice can you make? Cause we just did a cup. We did a cup. You can do all the way up to, I would say about, oh, six to eight cups is your limit. Okay. Because you don't want it to get too full, you want to watch out for the max line on your pot. So, but whatever you do, the cooking time will be the same. So even if it's six cups of rice, it's still gonna be seven minutes. Okay. All right. Awesome. Okay, moving on to our eggs. Okay, so now that our eggs are at five minutes, so we cooked them for five minutes, we let them do a natural release for five minutes, meaning we just kind of let it sit there and let the timer go up for five minutes. And now we're going to vent the rest of it. Oh, it's good to go. And we'll pull the lid off. So the other five, so we're gonna take these eggs and put them in an ice bath for five minutes. Okay, ready? Five, five, five. Okay. This is so nice. And you put them in the ice bath because it will make them just peel so easily. Come inside. All right, wait for five minutes. Okay, so it's been five minutes. Yep. Now we're just gonna pull them right out. You want to crack that one? You just show them how easy it is to crack. I roll mine. Do you roll yours? I never thought of rolling. I just like tap, tap. I'm good. Check those out. It literally just peels right off, huh? Okay. You good? So just to show you the inside. Perfection. Perfect. I love it. Awesome. Oh, eggs are literally one of my most favorite things. I'm gonna do this for Easter eggs. Or I just, I like to do a dozen and just eat them throughout the week. Yeah, I know. Perfect, healthy snack. All right, done with recipe number two. Okay. Now let's head over to recipe number three. Recipe number three, we're gonna do some oatmeal really quick. So all it is is we're just adding one cup of oatmeal and then two cups of water. And you're gonna want to stir the cell around. How much could you do of oatmeal? Same thing. You could fill it to the top. Five, okay. Yep, yep, so about, I don't know. Five cups, six cups of oatmeal. Okay. Okay, so you just want to make sure all the oatmeal is covered in water. Nice. And then put your lid on. Okay, here we go. Two, sealing. Not venting. Not venting. And then you are going to do manual. Yeah. And then you'll take it down to four, four minutes. Nice. Now also if you cook a lot of oatmeal, you'll still only cook it for four minutes. So whether it's five cups or one cup. Four minutes for oatmeal. Yes. And we're going. All right, so once you see the on, you're good to go. Okay, recipe number four, we're showing you how to make pasta in the Instant Pot. Now pasta is one of the easiest dishes to make because lots of times you can make something on stove top and you can just throw your pasta in the Instant Pot and just not even think about it. It's cooking while you're cooking other food. So that's why I love cooking pasta. So we're going to do a pound of pasta and it can be any kind of pasta. I mean, we're talking from macaroni to... Ooh, spaghetti noodles. To spaghetti to anything. Pasta will cook for the same. So you're going to do a pound of pasta to four cups of water. Okay. Now sometimes you might need a little bit more water. You just want to make sure that all of your pasta is covered by water. So I'm just going to grab a little bit more. Then you're just going to spread it around a little bit and make sure all the pasta is really covered. Okay. Looking good. And you can put your lid on. You're going to make sure your little knob turned to ceiling, not venting. You're going to push the pressure cook button.  It's going to cook for four minutes. So after you set the timer, you're just going to wait a little bit. Wait for the on sign waiting. Yeah. All right. Once this is on, you're good. And you can just walk away. Okay. So back to our oatmeal recipe number three. We've let this sit for about 12 minutes. So we switched it to venting, but it already did its thing. So now we're going to take it out. Ooh. Okay. And you have the most fluffy, delicious oatmeal. Okay. So I'm just going to scoop this into the bowl and you can add cinnamon and sugar at this point or brown sugar or I like to top mine off with some berries. I like berries. I also like maple syrup. I don't know if that's a thing. Yes. No, it's definitely a thing. I like to hear the maple syrup. That is yummy.  Ooh, yes. I know. That's pretty good. Also, if you want a yummy instant pot oatmeal recipe down below in the description, we make some pumpkin oatmeal and it is amazing. Perfect for fall. But I tell you that all year long. I love my pumpkin. Okay. So there is your oatmeal. Awesome. Awesome. All right, moving on to the next one. All right, we're all the way done. So we're going to push this little knob to venting and get out all of the pressure. All right, so once all of the pressure's out you can open the lid, all those little bubbles and the noodles are perfect.  I love to put like sauce on them. You can do spaghetti sauce. You can do like a white creamy sauce. I mean, you can do everything with noodles, but this is just a simple, easy way to cook the pasta. All right. Number five, the last thing we're going to show you that is super simple to cook in your instant pot is to make chicken broth. Now I've had so many people ask, how do I make chicken broth?  So I thought I'd show you just how easy it is to make it, especially if you already are using a rotisserie chicken or if you have just other chicken parts sitting around. So are you ready? Let's do it. Okay, first we're going to put the chicken. This is a rotisserie chicken that we bought and we're just throwing it in the bottom of the instant pot. It's cute. So why do you need to take the chicken off just so there's not... You don't have to. So lots of times you use the chicken for your meals and then instead of just throwing the bones away you can put them in your instant pot. There you have it. Okay, so we have one chopped onion that we just did big chops because it doesn't matter. We're just using this for seasoning. So onion and then we chopped up two celery and then about two carrots, right? We didn't even have to peel the carrots because we're not eating it, we're just making broth. Now you can add garlic or anything else you want but this is how I like my chicken broth. So now we're going to add eight cups of water to make the chicken broth. So you're ready, there's four cups there and then I have four cups too. Oh dear, that's all right.  So we're just going to take the lid and put it on. Okay. To sealing. Sealing, good. Not venting. Yup, then what are you going to push here? Manual. Very good, push the manual button and then we're going to cook it for 60 minutes. So you're going to hold the plus button until it goes all the way up to 60. Now I love that, I mean you just, you literally take your scraps and all of a sudden you don't have to buy chicken broth because you're good to go. Okay, so once we have, once we're at 60 minutes, we're just going to let it sit there for a little bit until it beeps at us on, and as soon as it says on, you're going to walk away. We're going to go. All right, okay, we'll just wait and we're excited to show you what it looks like. So we let this release on its own for about, I don't know, 15, 20 minutes until it was done and then we can open the lid as soon as all the pressure's out. So we're going to open it up. Oh my goodness, can you see that? That smells so good. All right, you're going to ladle it out. Okay, oh, turn that to it. So right now we're just going to ladle it out for you, but usually I would take like a strainer and strain out all of the broth. And yeah, you don't want the chunks in your chicken broth. It looks so good though. Now I'm craving chicken noodle soup. This chicken broth is actually super yummy in our chicken noodle soup recipe, which we'll put a link below in the description for you. Yes. So if you want more Instant Pot recipes, of course, don't forget to subscribe and push that little bell so you won't miss any of our videos. If you are brand new at the Instant Pot, we'd love to hear what you have cooked in your Instant Pot and how long it took you to open your Instant Pot. Put that down below in the comments. All right guys, we hope you have a wonderful week. We will see you next time. See ya, bye.


All right, I guess we should address a few things. Hey guys, sorry to have been absent for so long This video is essentially for me to apologize first off to my patreon supporters I apologize for not having posted anything on the page for the last two months I wanted to give this video to you yesterday, but there was too much happening yesterday So I'm doing it right now literally right after I finish this this will be up But first off, I just want to say sorry that I haven't been posting as much on there as I should I know that most of you guys are supporting me just for the sake of supporting me Which I very very do much appreciate But I do want to also give something back to you and even if that's just the movie suggestions polls whatnot the fact that I've been Falling back on those has affected me and that's why either this month or next month. I'm gonna just pause all patreon The donations for the month I feel that I I should just as a principal to you guys as well as just for this channel Which I will say has gone to the wayside a little bit in the last little while and it's not Because I have lost interest is more so I have very lacking energy between My job getting into some really busy business as well as my personal business my photography and whatnot That's gonna start kicking up really soon. I'm getting ready for the summer of weddings I have my first at the end of May, so I'm really looking forward to that But at the same time just trying to do the two jobs at the same time as a bunch of other stuff has made this Obviously take a back seat the fact that I have all of the Reviews for season six in the bag already and I'm just releasing to you guys Them to you guys weekly has definitely been helpful because I don't know if I would have anything for you guys as you've seen I haven't posted a movie review really since The site from the Northman there was the crimes of Grint and I'm sorry the secrets of Dumbledore and then before that was the Batman It's been rough for me to even go to a movie theater and I love going to the freaking movies But that has also taken a back seat in terms of me trying to focus on my career and whatnot and I am not going to apologize for that Because I do want to try and make what I'm doing an active part of my career I actually did kind of delink my business from this page just to try and Differentiate myself. I still have an Instagram attached to this It's now the one where I'm uploading the nerdy photos I've taken and all the photo modes of all the video games So yeah, I kind of just wanted to apologize. I know it's been a while Since I've done anything really I haven't done Channel suggestions. I was supposed to do a patreon update video But that fell to the wayside because this show and COVID happened. I I got COVID at the beginning of the year And I was locked to this this room and Actually, if you guys have started to notice it in the supernatural views, you'll see that there's like a makeshift bed behind me I'm standing very strategically in front of it But you'll notice it in a few of the reviews as we go through them And then it's just been a really busy busy last few months guys Like I know everyone says that but it honestly it has between trying to do all these different things to try and get not only 2022 as profitable as it can be and as successful as it can be but also trying to focus on 2023 and that has not been as Great honestly as I would have hoped at this point. I'm still building but at In comparison to where I was at the beginning of this year as a feeling to next year. I'm not as confident I'm feeling nervous and I'm working on that. So again, that is why you haven't seen a lot of me in a while and I'm hoping that you guys can understand where I'm coming from. I Have all of these ideas that I want to do I I do want to do more of the gaming moments that blew my mind essays Even though I know they those don't get a lot of views. I've had one in the back burner I recorded the audio a long time ago and I have been sitting on it for forever And I mean to get to that. I really like doing the channel suggestions I might not do three peep at a time I might just do one but Like there's so much that's happening that I'm actually following like I'm actually following my YouTube beef For the first time I've ever seen one that actually happens At least to one person that I actually follow and care about being the act man and the quantum TV thing which if you Wanted a very good look into copyright use and fair you fair use and People abusing copyright striking and shit. You should definitely check that out There is enough videos talking about that feud right now, but I really kind of Want to try and get back to this but I do I will admit to you guys that it is Not my number one priority. It is a priority to me to keep making this channel. I have only been doing it for The last half of my life. So I'm not going to step away from this. I have no desire to do that. I Funnily enough can say that I've never had the want to stop doing my YouTube channel even when it was The various different things that it was before like the various various different things But there was a few things that I know you guys wanted me to do like one of them was going through that list of all 300 episodes ranked and the fact that the curious case of Dean Winchester was in the top 290 which was for like starting at the worst and then working the weight down to one I was like wait what the fuck is this episode doing up here? So that's something I do want to work on as well Admittedly there's gonna be a lot of episodes if I'm gonna be like, oh, I don't remember what this is So that's kind of my hesitancy. I kind of want to finish the reviews before I do that list So that means I'll be holding off on years. I'll see maybe I might do the episode Maybe I'll do the list review and then go through it again after I finish all the other episodes But at least to say the season 6 episode reviews will not be delayed. They are already all done All I have to do is edit them and then add your guys's comment tracks to them Which I guess if I should be specific about that I do the recordings every Tuesday night I take what I've seen and I add them They'll be sometimes where I'll add them on the Monday night if I know for a fact There's no way I can do it on the Tuesday or the Wednesday There have been times though where I have left it to the Thursday Which I don't want to do because like I said, I already have enough on my plate with everything that's going on so There's just that little tidbit of information to you guys again, um, I don't I'm not quitting. I'm not finishing. I hope I haven't given that opinion even though I've said it now and Now I've created that seed but no, I have no desire to stop doing what I'm doing. I just Don't have enough time. That is the nutshell the The nugget of it all is that I just don't have enough time And I was hoping to have more time. Hell, I was actually Looking at having the show that I'm on right now It was supposed to end in less than a month and now it's going for two and a half months So that's the film industry for you in a nutshell but Yeah Like I said, I hope you guys can understand where I'm coming from and I hope This doesn't come off as a soreful thing I just wanted to explain what was going on and I hope you guys Are doing well and you guys can understand where I'm coming from and I hope you guys will continue to give me your patience And same especially so for for more so for the patron supporters I will be suspending the pay I think in next month because I I've waited too long. I took too long to get to this So probably for the month of june. No one's paying anything Um, but yeah, I just I yeah, I just wanted to explain myself and I figured I'd rather do that in a video than typing because typing takes too long Anyways guys, I hope you're doing okay, and I hope you guys understand So but until then as I said the supernatural reviews are going to keep coming And then when this one ends I'm probably going to take a little break before we start season seven Because I know that one's going to take a lot because season six was a bit to go through like the first 10 episodes was rough, but then it got better and I'm kind of worried that I'm not going to have that same kind of thing with Over season seven, but we'll see anyways guys. I hope you're doing okay. If you are That's good until then. I'll see you guys next time


It was really tragic and then every time I think about it I cringe just one time in third grade. We just finished a test and I was really happy. I forget why but I decided to pick up my six-year-old like teacher who's like frail and like very small so I decided to give her a piggyback ride and started running across the pavement and then I tripped and then we like both fell. Yeah so I grew up in a rock quarry so I didn't have a lot of friends so one day like I had a play date my dad was so excited that I had made a friend that he didn't care that I had diarrhea on the way to my friend's house.  Luckily he wasn't there he had totally forgotten to hang out with me so I just sat there for a few hours until my dad came and got me. It seemed that I was looking for a bathroom but I looked up like the whole world and couldn't find it and eventually I found a bathroom and I started to pee and then I woke up and I found myself peeing on the bed. Napping in the car at my parents restaurant and I suddenly woke up like having to pee really bad but the bathroom at my parents restaurant is not in the restaurant it's like a plaza so you have to get a key and then go to the restroom like down a long hallway so I run to my parents restaurant looking for the key but right then like I just pee my pants in front of all the customers. I went to the Orange County Fair with my girlfriend and we kind of got separated and so I thought I saw her from the back so I thought I'd be really cute to surprise her and hold her hand but I held her hand and it wasn't her.


Hello and welcome to CMC Markets on Tuesday the 11th of October and this quick look at the markets and I think most people's attention at the moment is on the FTSE 100 and whether or not we can actually break through those previous peaks at 71-22, 71-25. The 2015 peaks we've had another look at them and we are currently in the process of retesting those particular levels. Key support remains back at 69-55 but at the moment we are struggling to push significantly through those peaks and I think the big question going forward is whether or not we have enough momentum to do so. Certainly the weaker pound is playing in to the narrative of a stronger FTSE but there is another factor I think also driving the FTSE higher and I think that's the rebound that we're seeing in commodity prices, namely oil and gas stocks. If we look for example at Royal Dutch Shell we can see that that is significantly higher from the lows that we saw at the beginning of 2016 up 65% as fears about the reduction or fears about a reduction in the dividend start to dissipate. I certainly don't think those concerns have gone away even though oil prices have significantly recovered from the lows that we saw earlier this year. I don't think it's any coincidence that the oil price rally has coincided with the rebound in the share price of the oil majors as well. That's certainly driving the rebound and I think the big question that really needs to be asked in the context of the rebound that we're seeing in not only Royal Dutch Shell shares but also BP shares is whether or not this rebound in oil and gas stocks has further to go. Markets generally tend to be forward-looking and actually if we look at BP's share price it is now approaching levels or peaks that we last saw in 2011, 2012 and 2014. So on a valuation basis it is actually looking quite expensive certainly in the context of where the share price has been over the course of the last few years. In 2014 it was only briefly above that £5 level. Now we are heading back towards that but again I think there is a concern that it is starting to get a little bit stretched at these sorts of levels. So we need to be careful about how much further upside there is in oil and gas stocks. That needs to be looked through a prism of where crude oil prices are and again if we have a look at this Brent crude chart and a WTI chart we can see that oil prices are pushing against a significant resistance level not only on Brent crude but WTI as well. Now what's causing this test? Well it's not hard to see why. OPEC and non-OPEC members have been continually talking the oil price up over the course of the past few months. Ultimately they've been talking about a production freeze or a production cut. Vladimir Putin the president of Russia has been the latest to weigh in on that subject by suggesting that Russia might be open to just such an agreement but words for me count for very little. They help in some respects in pushing the price up but ultimately it's about what oil producers do and Russia is pumping at record levels. Iran is looking to boost its production back to pre-sanction levels of 4 million barrels a day which really only leaves as the only remaining swing producer Saudi Arabia as the prospect that it will look at cut its output. Now talking about cutting output and actually doing it two totally different things. So ultimately while the momentum is for a higher oil price we are pushing it against a significant resistance area on the Brent contract here. 61.8 Fibonacci retracement from the May peaks in 2015 to the lows that we saw in early to mid January on Brent crude comes in around about $53 a barrel which was pretty much the peaks that we saw earlier this month and that's before you even factor in the prospect that shale producers could bring could bring back output onto the market as the oil price pushes ever higher and also the fact that a strong dollar could actually also start to weigh on the oil price. So let's look at the resistance levels on WTI because they're fairly similar and again we're pushing against the June peaks that we saw at around about 51 51.5 dollars a barrel. So again we can see we're once again pushing against a very significant resistance area on WTI. For Brent crude to break out on WTI to break out I want to see breaks on both those contracts higher really to open up the levels that we saw at through the middle of 2015. So we're talking about 55 $60 a barrel and we can and I think that is what is required to see a higher footsie. A move higher in the oil price but also a slightly weaker pound as well and there does appear to be some evidence that potentially we could be getting towards a short-term base in the pound. Everyone's talking the pound lower everyone's revising their forecast lower at some point that needs to stabilize and I know that's a very difficult call to make given current sentiment towards the pound but with the footsie 100 at all time peaks and Brent crude pushing against significant resistance levels there has to be a correlation there and ultimately you've also got the fact that a weaker pound is feeding in to the firmer footsie. So when you weigh all of those factors up unless we get a significant break higher in the oil price I think it's going to be very difficult for a footsie 100 to push significantly beyond 70, 130 and make higher prices without a significant also without a significant further weakness in the pound and at the moment it's struggling around that 123 area. We'll have to wait and see but ultimately the charts are telling me there's resistance in the footsie there's resistance in crude oil until those break to collectively then I think it's hard to see the case further upside in the footsie at this point in time. So that's it for this week thanks very much for listening this is Michael Houston talking to you from CMC Markets.


Привет, всем. Хороша видеть вас здесь. Сегодня я буду говорить о Pony ORM. Но перед этим, я хочу сказать, почему мы еще не разработали еще один мэпер в первом месте. В моей прошлой жизни я был техническим лидером в Нью-Йорке фонаресной компании. Нью-Йорке фонаресная компания. Мой кафандр Александр был интересен в объектах бассейна, с тем, что мы были студентами. Бассейна стала его пасшеном. Который ученый в Университете Санкт-Петербург. В какой-то момент он пришел с идеей создать предыдущий объект религийного мэпера. Хорошее и эффективное. Он делал эту идею с меня. И я просто люблю эту идею. После года, продавая продукты для такой динамики филдерской финансы, я увидел нуждание для этого. Если там был один, я бы его использовал. Как мы начали работать на Пони-Рам вместе? Как вы знаете, Пони-Рам очень хорошее, смарт. И это наш мэпер. Он очень хорошее, смарт. Что делает Пони-Рам из других мэперов? Во-первых, он использует динамичные генераторы для динамичных динамиков. Это пример для динамичных генераторов. Это помирает в бытах, а это же темпал. И, как вы видите, динамичный генератор выглядит какhardинал. Ни с какой стороны онplatится в рюкзаке. Динамичный генератор выглядит как фронт. И, наконец, видает и с кондиционами. Но эта какхо с тюрьмами, Регулируемый генератер расстирается в память, пока сико-локвере отбирается с датами. Предполагаю, как это будет, если мы используем генератеры для формии датами. Это точно, что Пони делает. Он же экземпляр по Куриаме. Эта формия, проведена от Пони, получит генератер с параметром, но не executes. Instead, Pony gets the generated bytecode. It translates it into SQL. Then Pony sends this query to the database and creates objects in memory based on the query result. This function returns a list of objects. The product is a class, which is declared earlier in the code. It represents the product entity and is mapped to a corresponding database table. So, let's compare the Pony syntax with other mappers. Here's the query in Pony. We select products with multiple conditions. The product name starts with A. The product has no image. Or instead of the previous two conditions, the product was added before 2014. In Pony, we iterate over the product entity. See how can we use a standard Python function. For example, a name is a string, so we can use start with function. And edit is attribute of datetime type, so we can use the attribute here. This is the same query in Django. The product class in Django has the objects attribute. It is a manager, which is used for querying this object. In our example, we have both and or conditions. We can express and condition, just providing a list, a comma-separated list. But in order to express or condition, we have to use the special queue object. And then we combine those conditions with a bitwise or operator. In Django, we have to use double underscores in order to apply a specific condition, such as start with is null and less than. In SQL Alchemy, the same query will look this way. We get that session object and make the request of the product class. In Pony, we would use the P variable in order to apply the conditions. But in SQL Alchemy, we use the product class itself. In order to get the year from product edit attribute, we need to use the extract function. Also, we have to put parts of our condition into parenthesis in order to keep the precedence of the bitwise operators. If we compare these queries, we look that they are pretty similar in the terms of length. Some people like Django and some people like SQL Alchemy syntax. But we like the generator syntax because it's easier to remember. It is the native Python syntax. You work with objects, which are stored in the database, like they were stored in memory. It makes the development easier. Also, using generators is more performant than query translation Django or SQL Alchemy. This happened because in Pony, the result of the translation is cached. The select function receives a generator as a parameter and the generator is a standard Python object. So we can use it as a key for getting the result of the translation of this query. In Django and SQL Alchemy, there is not such a key because the filter function just receives a set of parameters. And that is why we necessary to translate this query every time in Django and SQL Alchemy when we execute it. Pony makes the translation of the byte code only once. With other mappers, you can build query step by step. How is it possible using generators? Pony also allows building query step by step, adding conditions one after another. This is done with the help of the filter function. It receives a lambda expression as a parameter. This function turns a new query object, which with the applied condition. In this example, we add a couple of conditions, then order the result and slicing it. And you can see the result of the last applied condition of the slicing. Now let's see how Pony translates generators into SQL queries. Some people may think that it's complex process and it's too much magic in it. I want to show you how it works, so you can see that it's pretty fast and straightforward. The translation process consists of three steps. The first step, we get the generator and its code object. As you know, Pony Python doesn't provide abstract syntax tree for generators, so we have to restore it from the byte code. The second step, Pony translates this AST into abstract SQL. It is intermediate representation of SQL. It is almost SQL, but it's not a SQL query text yet because databases, they have some peculiarities in terms of representation of SQL queries. And different dialects can vary. So that is why we don't want to overcomplicate the translation part. We just put it as another step. So the first step is the de-compilation of the byte code and restoring abstract syntax tree. For de-compilation, Pony uses an object which implements the visitor pattern. It has a set of methods and each method name corresponds to a byte code command. We go through the byte code from top to bottom and call the corresponding method. While executing the byte code, we accumulate it on a stack. Let's say we have such an expression and now we are going to translate it to SQL. We get the byte code from the generator object and this is the stack where Pony will accumulate the AST parts. Now we process the first command, load global. We call the method of the visitor object the same name and this method pushes the name node to the stack. The next command, load fast. The name of this command is different from the previous one because it loads a variable from a different namespace. But for the translator, it does the same thing, just load a variable. Pony pushes the corresponding AST node to the stack. The next command is load other. This command we apply to the top of the stack. We wrap the existing node with a new one, get attribute. The binary add command pops two stack elements and then pushes the binary add command which wraps those two existing nodes. It combines the previous two. Then we load the X-attribute, the X-variable and get Y attribute of X. And finally, we pop two stack elements and push the compare node which combines them. As you can see, this process is very straightforward. It doesn't have too much magic and usually generator code is not that long. Also we don't need to build the whole decompiler here because generator just has a subset of Python by code operations. As a result of the first step, we get such an AST. It is a tree representation of the same expression. The second step is translation to abstract SQL. But which SQL should we build? Can we tell that just looking at this expression? It depends on variable types. For example, A and C can be strings or numbers. Y could be a string or a collection. If A and C are numbers and Y is a collection, then we should generate an numeric addition and a subquery. If they are strings, then we should generate the string concatenation. If Y attributes a collection, then we should use a subquery. If all of them are strings, then we need to use concat and like operators. If we analyze all these variable types inside the translator, we'll have a lot of if-then statements inside the translator and it will overcomplicate the translator itself. It will have to maintain and extend such code. So we should somehow structure the logic of our translator in order to keep the translator simple. And for this purpose, we use monads. A monad is a container which encapsulates the translation logic. Each node type has its own translation logic. The translator walks through the tree and delegates the translation to different monads. Each monad accumulates data and generates a part of a SQL query as the result. A pony has different monads for different types for different attributes. Each monad defines a set of permitted operations and also how it will be combined with other monads. And each monad generates a particular part of the resulting SQL query. Here I show you different monotypes. We have a lot of them, but just some part of it. String monads know how to make operations with strings. For example, this string utter monad can generate a join operation and string parameter puts a string parameter into a query. Using monads keeps the process of translation simple. We walk the syntax tree and we process each node when we exit from the node. We walk the tree all the way down using the depth-first strategy. When we enter the addition node, we don't have all the necessary information for generating SQL yet because we don't know types of nodes which lay lower. And we continue walking the tree all the way down. When we leave the node, we create a monad. Let's say that A is an external string parameter. Then we create a string parameter monad here. Then we walk further. Before leaving the node, we create another monad. In our example, B is an iterator variable. So we create the object iter monad. This monad knows on which object we are iterating in our query. Then we walk further. And then the translator processes this node. It doesn't analyze the node at all. It just delegates the get attribute operation to the previously processed monad. It says to the object iter monad, get the attribute C from yourself and create a new monad, which will be a result of this operation. And it creates a string iter monad because it knows the type. Then we walk further. And now the translator gets the left monad and says add yourself to the right monad. By this time we know all the types of operands and this string, and we create a string expert monad. And this monad can generate the part of a sequel for this green nodes of our tree. This way all the processing logic is encapsulated inside the monads. It helps to keep the translator simple and we can easily extend our translator by adding monads, which can handle new types, for example. So we walk further. And at the end we have the top level monad that has the generated sequel for the whole tree. Here the abstract sequel that we get as a result of the translation. It is stored by like a list by now and it reminds list structure. So the first element of this list is a command and then goes appearance of this command. For example, this like command. The first parameter is the column y from the table T1. Then goes a function concat, which is followed by four arguments that should be concatenated. By this moment the process of the translation is almost done. The last step of the translation is to translate it to a specific sequel, direct. This is a very simple step. Pony has a set of database providers and those modules keep the knowledge of the database peculiarities when it comes to sequel syntax. We walk our list structure using the visitor pattern again and combine the result in sequel into a query stream. Here we can see the result of the translation to my sequel and sequel line dialect. What other features? This is it with the translation. So this is the last step and we got our sequel query, which can be cached and sent to the database. By this time, mapping is what it is needed. And now I would like to tell you about other Pony feature. Pony keeps the objects in the identity map. It means that each object is loaded only once within the same database session. When we try to get the same object again, no query goes to the database. It will be returned from the map. Pony also has the Nplus1 query problem solution. This is when the map generates a lot of unnecessary queries. I'll show you in a minute how it works with Pony. Pony can optimize queries. For example, it can substitute a subquery with a left join in order to improve performance. Also Pony can work with the database using pessimistic and optimistic concurrency control. The pessimistic approach is when we log a row in a database in order to prevent its modification by another transaction. With optimistic approach, there is no luck. Before committing, Pony just verifies that no other transaction changed the value of that attribute, which it read. Pony also has online entity relationship diagram editor. You can build a diagram of your application online and get the code for your entities or SQL scripts for creating tables. Let's look at this example. Say we use Django and we want to select a couple of students from the database. Also we want to print out their names and their growth IDs. How many queries will be sent to the database and how many objects will be created after we execute this code? Let's see. After the first query will be executed, a student object will be created in memory. When we access the growth attribute, the second query will be sent to the database and the second object will be created in memory. Now we create another student object. Let's say that both students belong to the same group. When we try to access the growth attribute, Django will create another group object. It is a copy of the existing one. This happens because Django doesn't implement the identity map pattern. Each object exists independently and Django doesn't track if a similar object was already created. Let's see how it is implemented in Pony. The Pony syntax is a little bit different. As you can see, we use square brackets in order to get access by primary key. After we execute the first line, we have the following. A query went to the database and an instance of a student was created. Now Pony sees that there is a group object, which is associated with this instance. It means that this group ID exists in the group row in the group table, existing in the database. Pony didn't load this object yet, but it knows that it exists for sure because it's consistent database. Pony creates a seed object. This is how we call the object, which has only its primary key. The other attributes were not loaded to this object, it's just like a seed of an object. Using this concept of seeds allows us to make some optimizations. For example, if you don't need any other attributes, but just group ID, Pony will not send any other request to the database because the primary key of this group is already known. If we would like to get any other attribute of group, then the request will be sent to the database. But in our example, we don't need to send any request because the ID presents in the student table itself. Then we load the second student and Pony sees that this object has the same group ID, and it links it with the same seed. If we need to get an attribute of the group object for one or both students, Pony will send just one query to the database. But there is the probability that we don't need to send any other request. The concept of seeds allows us to solve n plus one query problem. Let's say we have an online store and we want to get customer orders, which have the total price of the order greater than a thousand. In this example, we use the order by method. We sort the result in the descending order because we want to see the last customer orders first. Also, we are getting the first page of the result. The page method, it's just a syntax sugar. We can use slice, but it's more easier to use the page because usually we want to show the results at the web page. And this is the SQL query, which will be generated for the first two lines. And when we start iterating over the order list, in this case, most mappers will run into the n plus one query problem. It is when a mapper will generate a separate SQL query in order to load each customer in order to show its name. And n here is a number of items in the orders list. In Pony it will work this way. The first query allows orders to the memory and Pony creates seeds for all customers objects. We can see what customers might need if we will iterate over the list. And when we iterate over this list, we get the first customer attribute. Pony allows all the seeds objects with one SQL query instead of n queries. This query selects all customers objects and the ID belonging to the list. In terms of query cost, it is not a big difference if we load one row from a table or ten rows. The performance degradation usually happens when we do a lot of database round trips. Of course, there is a probability that we don't need all the objects. But usually in web application we don't load thousands of objects. We just load some part of it in order to show it a web page. And that is why if we load all the objects by one query, it increases the overall mapper performance. In Django, of course, we can use select-related or prefetch-related something and other mappers also have some similar feature. But the thing is that a programmer needs to think about it himself. And sometimes newbie programmers they put select-related everywhere where it is needed and not. And if you put it everywhere, it hurts performance. But if you don't put it where it is needed, it hurts performance too. Having this concept of seeds allows us to avoid n plus one query problem automatically. And you don't need to think about where you need to put it. Actually, it's a smart way to do prefetch-related. Also, if you use select-related, it generates queries using join in order to join all the necessary attributes from other tables. And if you do a lot of joins in a database, it can be less performant if you just select data from one table. So when we select those customer IDs and customer objects in a separate query, we can join those records in Python and it can be more performant and more scalable. Another thing that we have in Pony is automatic query optimization. Here's an example. When we translate this generator to SQL, we get this query. It is called query-related because it uses values from the outer query. The query-related query should be evaluated for each row selected from the main query. And it can be inefficient. And there is a well-known technique of replacing query-related queries with left joins. Now let's talk about transactions. Let's say we need to write a function that transfers the specified amount from one account to another. If we use Django, we could start with something like this. Here we get the first account object by its primary key and check the available amount. If there is not enough funds, then we raise the exception. Otherwise we get the second account, save the object, increase the second account and save the object. Are there any problems with these functions? The problem is that these two account operations are not performed in the single transaction. We have two separate transactions here. And if we lost the database connection after the first save completed, we can leave the database in state. And we can of course solve this problem and add the decorated transaction atomic. Did it solve the problem? Not necessarily. Because this function can still override data if they were changed by a parallel transaction. When we do save it doesn't take into account if this data were changed by another transaction. And we can have the database in the consistent state again. In order to avoid this we can use a special F expression or lock the records in the database. And for this purpose we can use the select for update method. This way we lock the records in the database and no other transaction can change them until our transaction is finished. The inconvenience is that a programmer needs to specify the select for update method explicitly. Often an application consists of several tiers and in more complex application we can get data in one tier then pass it to another. And at that point we can just miss this knowledge and we might overlook the point where it should be locked in the database. And if we use select for update everywhere in order to avoid this problem it again will hurt performance. In Pony you can use the select for update method too, but besides this Pony uses the concept of optimistic locking. Here is how we can write our function Pony. The DB session decorator is mandatory when we access the database. And it wraps the database updates with a single transaction. We get the first account object and check the available amount. If there is enough funds we decrease our account and increase the other one. And you can see that there is no need to call the save method. Because Pony tracks the object which were changed due to using identity map. And all that changes will be sent to the database automatically when we leave the scope of the DB session. What will happen if parallel transaction changes the amount of any account? Pony tracks the attributes which were read and written during the transaction. And when we read the attribute amount of the account object Pony remembers the old value of this attribute. And now when we save the updated value to the database Pony adds additional where condition with this check. And the update query returns the number of rows which were updated during the operation. If the value was changed by a parallel transaction then the update SQL operator will return zero. And this means that other transaction changes the value and we have to roll back the current transaction in order to avoid the database inconsistency. This approach is called optimistic locking. We don't lock the object but we keep the old value of each attribute which we read and when we commit this object to the database we verify that this object holds the same state. This approach is more performant and scalable than locking the row in the database. It allows more parallel transaction to work simultaneously. Pony helps to avoid lost updates and keep database consistency automatically. Even if a programmer measures when this DB session decorator will lose the scope it will check if the database is in the same state. Another thing which we have in Pony is entity relationship editor. You can create ER diagrams for your applications online and this editor has several tabs. The first tab is where you can design your diagram. We represent entities with rectangles and also you have attributes, data attributes and relationship attributes. In Pony you specify relationship with both attributes at both sides. So here we follow the rule explicit better than implicit and it is easier to see what attributes the entity has when you look at it. So here you can see that relationship we use a line in order to depict the relationship and if it is a relationship too many it has fork at the end. Also you can switch the tab get the second tab Python code of your entities. And there are several other tabs where you can see SQL scripts for creating tables in the database. So those are main features which I told you today. We have generators and lambdas for database queries Pony implements the identity map It has a solution for nplus1 query problem It has an automatic optimization of query Optimistic transactions Entity relationship diagram editor Here is the roadmap of Pony RAM development At the moment we are working on adding Python 3 support because it is the most often asked feature Then we add Microsoft SQL server support Because at this moment we support only 4 bases SQLite, MySQL, Progress and Oracle We were asked about adding support for Microsoft SQL server After this is done we will add migrations and asynchronous queries support That's it, thank you very much Do you have any questions? Hello Can you return to the slide with db session decorator Oh, it's okay With db session This one? Yes, this one How it is done It is thread local So something like that thread local I didn't quite understand that question I hope I'm not asking the same question again If this now fails because the second So the update is not done because there was some other thing Will it automatically retry to do the thing or will it just fail If there is a parameter to this db session decorator or it can be used also as a context manager you can specify retry for example 3 or 5 and it will retry Okay In the nplus1 query solution how does pony know for which items in the second query to load the values Well when we execute a query So you do the first query to load the orders and then you have the second query for the customers Because order has a relationship to one each customer has a relationship to many let me show the diagram which I used for that example See when we go to orders Yeah I understand that there is a relationship but how do you know for which in which customers will be in the loop Do you just We don't know where we are going to loop over We just create seeds for those objects which it has a relationship to to one When we start iterating over these objects we understand that it might be needed all other objects So you show you load if there is one customer.name you load the name for all the customers Yeah when we send this request to the database it's not a big difference we load one row from this table or 10 not a big difference in terms of performance So then you load orders or customer seed objects that exist Yes we have all the seeds and then we load using this query the last line where CID in the list of IDs and then you load for all the seeds that exist It seems to me that after you have realized the seeds so they have become objects there is a lot more caching happening and I can imagine that that can also be very dangerous you are using weak references or how do you know that after you have fetched all these customers that they can be and you somehow globally cached them so that other queries Okay so for order one you select the customer one and you realize it and then for order three you have some global reference to it so that you can fetch it again Yeah I think I got your question but you know this identity map this cache exists within one transaction so when we start our transaction we use db-session db-session scope is over we just free the cache and usually you don't work with millions of objects when you built application right you don't use millions you can use bulk update if you want to update or work with millions of objects usually you load say 10, 200 maybe a thousand in order to show it a web page amount of objects Hey, comparing MySQL and SQLite for example MySQL has strongly typed columns and SQLite allows you to insert any data type that you want how do you handle these heterogeneous data types or do you just disallow them or what do you do How do we hold one? In SQLite you could considerably stick different data types into the same column SQLite allows you to do that How do you handle this in your mapping do you only allow insertion of specific data types or whether you filter them out or what happens really When we specify the type of object, sorry I didn't quite hear Okay, let me restate that In MySQL your column specifies what will be contained within In SQLite the column type is just a suggestion you can still have different data types whether it's integers, or text, or dates How do you handle that Well, in Pony we have different DB API providers and in terms of Pony all those types are exactly the same and this DB provider takes into account some peculiarities of the database but we use the Python notation of datetime and we represent it the same way in SQLite Maybe you are talking about the difference in microseconds for example with this type in MySQL and SQLite Pony takes into account using this a layer over the DB API driver on this particular DB API provider We handle that Hi, is it possible in Pony to iterate over results without having all the results in memory Is it possible in Pony to iterate over results without having all the results in memory To iterate over results You mean don't load all the objects to memory but iterate just in the database We need that if we want to update a lot of records at once bulk update For that purpose we have one method but recently we were asked about adding just a little bit more and we are going to add more functionality to that so you can update objects without loading them to the cache So I guess we have time for a last question Okay Hi, you mentioned on one of your first slides that it was fast this particular ORM so what makes it fast and how does it compare to others? Do you have benchmark data? Mhm We ourselves didn't create robust and good tests yet We definitely are going to do that but other users they tried to compare that and they said like 3-4 times faster Why it is faster? First of all it's because we can cache the result of the translation as I told because in Django and SQL Alchemy there is no way to understand that we execute the same query with Pony when our program is being executed we can see that this is the same generator, it has ID so we can immediately understand that we don't need to translate it once again we just can get the result from the cache and also when we develop Pony we are very picky in terms of working with references, objects we don't do deep copy a lot we just pay attention to details when we just use low footprint in terms of resources when we need to when we work with objects with cache we try to take into account the performance is one of the goals which we have in our mind Thanks a lot for your talk Аплодисменты


still seven o'clock tonight in this place a few years ago it was a house I'll see if I find a clip and they turned it into a little restaurant deal about those ice cream and more so there it is now that's good that you know didn't get torn down trying to close right here it was still like that that's how bad it got that woman said we're brave because you can't go in it's kind of like you know you stay in there and order they got places to sit over there but I've been empty for years this my sister telling me to take a break I guess that's not a crack guys


My name is Fan Zhang, coming from Zhejiang University, China. This is a joint work with many institutions, including DAS, NTU, AOAA, and SJTU. Let's start with an introduction. Phototag was first proposed by Dan Bonet in 1996. It is an active tag and has two stages. The online photo-injection stage and the offline photo-analysis stage. The pair of correct and faulty ciphertexts can be used to explore the secret key. The adversaries need some equipment to generate non-invasive, semi-invasive, and invasive injections. Possible injection methods can be clock glitch, logic glitch, EMFI, and laser FI. Most of the photo-injections that are started are actually non-invasive tags. When we talk about the photo tags, we need to address the so-called photo model, such as the photo width and the photo time. Also, we need to address the photo location and the timing. Photo location means in which byte or nibble the photo is injected, and timing means in which run and which operation the photo is injected. Those who experienced with the real experiment of the photo tags, you will know that it actually requires a very precise timing control. Most of the photos are transient, meaning a short time. In chess 2018, we propose a new type called the persistent fault, which can last for a couple of rounds or encryptions. Persistent fault attack in short PFA is to solve this problem of synchronization. Since the fault persists during the encryptions, it can be injected before the encryption starts, and it doesn't require a precise timing. A typical persistent fault for AES can be injected by modifying its esports, and then the key can be easily recovered with the statistics of the self-tax. In that paper, faults are injected into esports with the technique of low hammer on AES software implementation. However, at that moment, we didn't know whether such analysis can be applied in a traditional fault attack scenario, such as laser injections. In this paper, we conducted a persistent fault attack on an 8-meg microcontroller, a very typical target of classical fault attacks. To make the attack more practical and much easier, we improved our method in several ways. First, we utilized the maximum likelihood estimation to reduce the number of self-attacks that is required. Second, we proposed a method to verify whether the desired persistent fault is injected. Third, we improved the analysis technique to handle the cases when the fault in an esports is unknown. Along with these improvements, we extended the PFA to the lightweight block type present. And finally, our attack is verified through a laser-based fault attack. So we go over the PFA on AES first. We re-emphasized the fault model first. We assumed the adversary can inject faults before the encryption of a block cipher. We prepared an environment with the injected faults and then asked the victim to start the encryption. Second, the injected fault is positioned for multiple encryptions. Third, the adversary is capable of collecting multiple self-attacks output. The watchdog counter is not considered in this case. The core idea of a positive fault attack is that the previous tightly-coupled fault injection stage is now positioned into two stages. The loose-coupled fault injection stage and the subsequent encryption stage. In total, we have three stages for now. The interesting part of PFA is that the fault is a persistent in the esports. However, the 40 elements of esports, for example, 61 marked in red in this figure, may not be accessed. Some self-attacks are incorrect and some are incorrect. So how do we do the simple positive fault analysis? Suppose the correct element is V. After the fault injection, the value becomes V star, which is erroneous. For a specific ciphertext byte, V star will appear twice and you will never see the original V. The distribution of the values of the ciphertext byte is now becoming biased. V star is with a probability of 2 over 256 and V is with a probability of 0. The adversary can exploit three types of fault injection for the ligatures. For the zero probability and for the maximum probability, he can directly know the key. For other probabilities, he can still get some impossible values of the key and reduce the key search space. By the way, the values of V and V star are known to the adversary. Here is an illustration of the analysis result. Quite straightforward. Like the figures in DPA and CPA, we plot the probability of values of ciphertext bytes along with the number of samples. If you see the red curve, which is all zero, you know the value of V. If you see the blue curve, which converges to 2 over 256, you know the values of V star. That is the core idea of original PFA. With enough number of ciphertexts, the red curve can be easily detected. In this paper, we want to reduce the total number of ciphertexts that is required to find the red curve. The problem is that when the number of ciphertexts is not enough, for example, showing the green box, there will be multiple values correspond to the red curve with a zero probability. That means the red curve will have multiple candidates. To find the best candidates among them, we need a metric to compare these candidates. The metric is based on the fact that the red curve is bound to a fixed blue curve, given the fault in S-box. Since the blue curve should have a higher frequency, the candidate whose corresponding blue curve has the maximum probability will be chosen as the estimation of the red curve. Actually, what we did is equivalent to a statistic method called maximum likelihood estimation in short MLE. MLE is a method of estimating parameters by maximizing the probability of a given observation. In our context, the parameter to be estimated is the red curve, and the given observation is our collected ciphertext. And the estimation of the red curve can be performed with those equations at the bottom of this slide. The result shows that, with the technique of MLE, the total number of ciphertexts for the red curve can be reduced to 72%, compared with the origin paper in 2018, equivalently 28% less. Next, we will explain the practical problems of PFA. For real attack, we need to solve two main problems in practice. One is that the adversary may need to try for several times to inject a desired fault into the device, so he needs to know whether the fault is really injected or not. The other problem is that it is difficult for the adversary to know which element of the S-box is cracked and how it is changed. Therefore, before conducting a practical PFA, he had to recover these unknown parameters first, including the fault of location and the fault value. So how to identify the effective injections? For AES, the S-box is accessed 106 times during the inclusion. With a 40 S-box, the probability for a ciphertext to become 40 is calculated to be 53%. That means, if our injection is effective, about half of the ciphertext will become 40. However, the principle we judge an injection to be effective is whether both correct and 40 s-box exist. This is the key point. We do not require the ratio to be 53%. There could be some misjudgment, and we find that with 20 s-box, this misjudgment rate will become very very small. And how to find the fault value F? For the recovery of fault value F, the basic idea is quite straightforward. When sufficient ciphertext, F can be recovered by XOR, the blue curve, and the red curve in this figure. With insufficient ciphertext, these two curves are not that distinguishable. So we utilize MLE to recover the F in this case. Next, how to recover the fault of index I? This is sort of complicated, so please read our paper. But the key point here is that if the fault index is unknown, the adversary has to either do an exhaustive search or to find a tricky way. To find the correct fault index through the 256 candidates, the trick is that for the correct I, the original value of the fault element will never appear in the output of s-box, and this property holds for all the s-boxes in all rounds. With this metric, the fault index I can be easily recovered with hundreds of cipetags, and the misjudgment rate is still very low. In the next part, we will show the PFA on the present cipher. Present is a lightweight SPN block cipher. It uses a 4-bit s-box. It has a key size of 80 bits and a block size of 64 bits. To adopt PFA to present, we need to solve two additional problems. First, it uses a 4-bit s-box. So if the s-box is corrected, all the cipetags will be wrong. There will not exist a case that half are correct and half are 40. So we need a new method for identifying effective instructions for present. Second, the length of the mask key is longer than the run key, and the PFA can only recover the last run key. So additional analysis is required to recover the remaining key bits. Since the s-box only has 16 output values and one of them will disappear if the injection is effective, we can collect some cipher tags to see if there are only 15 output values. If yes, we believe that the injection is effective or quite simple. Similarly, there could be some misjudgment, but the rate is proved to be very low. The recovery of additional 16 key bits, which can be done in two steps. In the first step, we analyze the last round to recover the last run key and the photo value f and the photo index i. And in the second step, we trace back for one more round to recover the full key. The attack on the last round is basically the same as that on AES. The number of samples that is required is quite small, due to the lightweight feature of present. Roughly 25 and 98 cipher tags are enough for recovering f and c-mean respectively. Due to the time limit, I escaped this slide, which basically explains how to do the attack to the last run, last but run one round. And the final result shows that for full attack on present, only about one or two cipher tags are required. Next, we will verify our analysis through a practical laser photo attack. And we found some interesting observations for laser injections on SRAM. The victim device is an 8-meg microcontroller. It is decapped on the backside to allow the laser injection. And we use the high resolution camera to take a photo for details inside. The main components are labeled in this figure, and we can see the IO, the flash and the logic. One of the major contributions of this paper is that we identify that the target of PFA could be the SRAM. And we do put this point into the practice. We set up the whole systems and shoot the laser into the S-box, which is loaded from the flash when the microcontroller powers on. We automatically scan the SRAM area with laser poses. To reproduce the work, we mark the reference point, the start and the end point. The step size is about 5 micrometers in both x and y directions. Honestly, this is a very tedious yet time-consuming part. We injected a total of 55,000 laser poses and found 4,000 bit flips. As shown in this figure, the S-box and its inverse occupied half of the SRAM. And we also deployed the present S-box, which is only 16 bytes and attached at the end of AES S-box. With this experimental data, we can find the mapping between the logic address and the physical location. This mapping shows that in this SRAM, each row contains 8 bytes of data, and these 8 bytes are arranged by bits rather than by bytes. For example, 8 MSB bits from different bytes are grouped into one row, instead of putting 8 bits together. Finally is a conclusion. In this paper, we improved the PFA to make it more efficient and practical. It requires 28% ciphertext less than the original PFA, and it can utilize unknown fault in S-box. To demonstrate that our attack is quite general, we extended PFA to the present cipher. Finally, we tested our attacks with practical laser injections, and we found some interesting characteristics of the SRAM. So that's it. Thank you very much.