When Mexico sends its people, they're not sending their best. Do immigrants bring with them the worst attributes of the countries they left behind? That fear motivates populist nationalists and some free market economists, such as Harvard's George Borjas, Britain's Paul Collier, and George Mason's Garrett Jones, who speculate that mass immigration from countries with illiberal traditions will undermine Western culture. In her new book, Wretched Refuse, The Political Economy of Immigration and Institutions, the Cato Institute's Alex Narasta and Texas Tech University economist Benjamin Powell took an exhaustive look at the data and found that destination countries not only benefit economically from immigration, but that key markers of liberal democracy, such as support for the rule of law, limited government and private property rights, improve when newcomers arrive en masse. When Cubans leave Cuba and move to South Florida, they're not Cubans who want to recreate Cuban socialism. They're the most anti-socialist voting bloc in the United States. Similarly, but to a lesser extent, Californians who are fleeing Gavin Newsom's lockdown state there and moving to Texas are not the type of people who want to recreate California in Texas. Powell points to the example of Israel in the 1990s, which took in a massive number of refugees from the former Soviet Union. A massive flood of people coming from a country with a 70-year history of no rule of law, no economic freedoms pile into Israel with immediate voting rights because of the law of return. It increased the population of Israel by about 20 percent in that decade. Confidence and property rights didn't go down. It went up. Economic freedoms across the board, except size of government, but that recovered. Overall, Israel went something from like 90th in the world and economic freedom to 45th during a period of massive immigration from a communist country. Norasta stresses that the U.S. created its largest social welfare programs, such as Social Security and Medicare, at times when immigration flows were at historic lows. Immigrants coming in make native-born people in the U.S. less likely to support bigger government, to support welfare states because they don't want to give these benefits to the foreigners who are coming in. Despite or perhaps because of Donald Trump's anti-immigration animus, positive views of the contribution of newcomers are at record highs. Public opinion eventually affects policy. And one interpretation I think of the Donald Trump era is it's sort of like the temper tantrum before everything changes, sort of in the same way that in the mid-1960s, George Wallace and others sort of having their large nationwide temper tantrum against the end of segregation. And if you were just looking at what political candidates were saying, you'd say, wow, the segregation stuff is really on the upswing in the mid to late 1960s, but it's really the opposite. It's sort of like the death rattle of it. What you see amongst Republicans, amongst independents, amongst Democrats is either they like immigration as much as they always have, or the favorabilities are going through the roof. Narastas says that translating public opinion into pro-immigration policy is a slow and sloppy process. He was an outspoken critic of the relatively restrictive policies of George W. Bush and Barack Obama, along with those of Donald Trump. But he and Powell are optimistic that policy will eventually catch up to public opinion. We can point back to our Italian, Irish, Welsh, Persian ancestors who came here and faced sort of the same criticism that immigrants are facing today, whether it's about institutions like our book is about, or whether it's about economics or anything else. And these fears in the past turned out to be unfounded. And we can make that argument again and again in the U.S.


Welcome to the 6.30 talk of today. It's one of the many things I love Congress for is the bold programming. Normally, this is the arts and culture stage and society stage. And so I'm very excited that there's also a security talk today happening. And our next talk, let's break modern binary code obfuscation, is going to be translated into German. It's going to be translated into German. Under this address, streaming.c3lingo.org, which should also appear on the screen now. Wonderful. And from Bochum, I'm going to welcome now Tim, Placidko, and Moritz Kondach. And they're going to explain to us how you can de-obfuscate code without looking at the code, but only its behavior. Well, I'm welcome and a lot of applause. Thank you. First, can we enable the TV down here? Technic. Good to you. Well, hi. So welcome to our talk. So we are Moritz and I to PhD students and reverse engineers at the Royal University in Bochum, Germany. And we discuss and we, in our daily work, we do reverse engineering and things like that. And as part of one of our academic projects, we started with program synthesis for binary de-obfuscation. And then, thank you. And so this is basically the more technical version of our academic talk that we presented and publicated at Youth and Execurity this year. So in the first, Moritz will talk about code obfuscation techniques and de-obfuscation techniques. And I will later join with programs and thesis and how to apply that. Thank you. All right, thank you for the introduction. OK, first things first. Why do we want to obfuscate code in the first place? So to settle the scene, it's important to note that we cannot really prevent reverse engineering attempts, but rather we seek to complicate them at least to some degree. Reasons why we would want to do so are many intellectual property and the protection thereof.  Another reason why we want to obfuscate code would be malicious payloads. So we want to make them harder to detect. So that analysis are not easily able to create signatures for those. And the malware lives longer without being picked up by an AV. And the third, I think, most interesting case is digital rights management, where software, especially AAA games, larger games, are just obfuscated in order to prevent cracking attempts and illegal distribution of the game itself. And especially in the context of digital rights management, there's a very fitting quote which settles the scene as to what we can expect from code obfuscation. It's from Martin Slater of 2K Australia and was issued regarding to the release of Bioshock back in 2007. And he told us that they achieved their goals because they were uncracked for 13 whole days. So apparently, we cannot really prevent obfuscation. We can just make the software withstand cracking attempts at least 13 days, which is about the time in which the game distributor makes most of its revenue. OK, how do we protect software? So there are different approaches to protecting software, some better, some worse. For example, we can just take a look at the software that's been used to analyze the programs itself. Like already debug, disassemblers, and so on. And one idea that comes to our mind is just to abuse shortcomings of these tools. So if we know already debug crashes due to some code analysis part of a specific FPU sequence, we could just issue that and make already debug crash. Or similarly, if we get some process tamper, which is relying on fields of the PE header memory, we can easily confuse them and just render these tools unusable. Another approach that's very popular is just to detect the environment the program runs in and check if we are running an application in an environment that gives us information about the presence of a debugger. So there's some capability by the operating system. For example, the being debugged bit and the PEB, which is being said if an debugger is attached. Similarly, there are more low-level tricks we can abuse or some operating system internals, which allows to somehow detect the presence of a debugger and then just devolve execution and here to just prevent any reverse engineering attempts. However, both techniques have the drawback that first they are, once you know how they work, they're easily fixed. You can just patch your tool or you can just circumvent the anti-debugging tricks by just supplying the correct values. Also, if you go to Google and just search for game, doesn't start debugger detected, you get over 6 million people complaining that they cannot run the latest AAA game because the anti-debugging technique that you might have, which might have worked reliably on Windows XP, does not really hold up on Windows 7 and issues are false positive. So benign customers cannot really use the game, cannot really play the game because the debugger detection was faulty. So let's add up some requirements we need for code obfuscation. An important one is that we want the code to be semantics preserving. So the mere fact of protecting the application shouldn't change its observable behavior. So we do not want the game to break only because we want to protect it. A second point, we want to avoid external dependencies at least in the context of our discussion here. So there are various attempts to outsource data like on the internet, on the internet server, on a USB dongle or on other separate media. But we're mostly interested in techniques that protect the code only. So we got a white box attack scenario where the attacker has everything he needs to attack the application at his or her hand. And finally, the most important point probably is that we want to employ techniques that are easier or way easier to deploy for us than for the reverse engineer to attack. So the anti-debugging tricks we've seen or also the shortcomings of the tools which we can abuse, they are more or less effort one-on-one. Once you know how it works, you can easily bypass it. But we want to employ techniques that are easy to deploy for us, but they're very hard to attack by other parties. Okay, coming to code obfuscation techniques. One technique that's been used in commercial protection engines is what really is more known as OPAC predicates. So consider this rather easy CFG on the left side. So we got some application with a linear control flow graph. If we now insert what is known as OPAC predicates, the problem looks vastly more complex. So we got more branches and control flow which we have to track and we have no clue that the underlying program in fact is very simple. Let's zoom in on one of those predicates. Okay, so we've got a bit of code. We've got a true branch and a false branch, both branching to a different basic block. So if we're just looking at this, we might come to the conclusion, okay, we don't know which branch is going to be taken. Right? However, it turns out that this is what we call an OPAC true predicate. So in this case, the true branch is always taken irregardless of the behavior here in the predicate. So what's happening here is that you've got an OPAC predicate on top. This is the whole block which is just constructing a predicate based on an OPAC value, like the return value of the API called getCurrentProcess.  So by just issuing this predicate, we make sure that we always take the left branch. The right branch might point to that code or to other point to confuse, here confuse the reverse engineer, but at runtime we always take the left branch. Similarly, there are OPAC false predicates which just invert this condition and follow the false branch. And there's another flavor called random OPAC predicate in which branch upon a random value. This means that we can potentially at runtime follow both branches. So the challenge here is that we have to make sure that both blocks or both paths that follow have to be semantically equivalent because the program breaks otherwise. However, it is also a challenge to ensure that it's not easily detected by the attacker that both branches are in fact, semantically equivalent. Okay, recapping on the part predicates, obviously they increase the complexity of the application. Also, they can be built on hard problems, but what is most important is that they force the analyst to encode additional knowledge that either the analyst himself has to know it or he has to just extend his tool to know maybe about the Win API, know about FPU instructions, know about arithmetic identities or some other hard problems that he all has to encode in his analyst tool to provide reasonable results. So they are hard to solve statically. However, if you now opt to only look at concrete execution traces, so we just let the application run. I don't look at concrete values, we know that a part predicates are essentially solved for free for us. So this is good to keep in mind. Another very interesting technique that has been also been deployed in, I guess, every major copy protection out there are what you call virtual machines. So take for example, this native code on the left. We've got some loop here and some x86 code and let's just assume the loop here is our precious intellectual property we want to protect. Obviously, we can use our common tools like this assemblers like IDAR or Oli Debug to look at this code and reason about this code and get to know what this code does. So the idea here is to replace the code on the left with something our common tools cannot understand. So what we're doing, we're just getting creative and we're just making up an entire instruction set as you've seen on the right. So VLD, VPOP, instructions that are not known in this way by any other architecture. Full with new registers with new encodings and so on. And both the native code and the new instruction codes are semantically equivalent again. What we're now doing is just replace the native code by a call to what you call a virtual machine or like also known as interpreter, which is basically a CPU and software which just lets you run the imaginary architecture we've thought about. So if we now try to take our common tools like IDAR or Oli Debug or some other tools to just analyze this code, it's not really viable anymore because they don't know about our made up architecture but we still have to make sure that the transition from native code to our virtual instruction here goes seamlessly. And to this effect we have to look at the components. So there are three core components to a virtual machine. So mainly we've got VM entry and exit and what they do is just performing the context switch from native to virtual context and back. So the entry just copies the native context, let's say registers and flags of the native architecture to the virtual context and the exit copies them back to the native context. Usually the mapping of native to virtual registers is one to one which makes it a bit easier. Then we got a traditional fetch decode execute loop like in a traditional CPU and what it does is just fetches and decode is one instruction and forwards the virtual instruction point accordingly. Then it looks up the handler which defines the virtual instruction and what we call a handler table here on the right and just invokes this handler and the handler goes on to actually execute the instruction. So as we've seen the handler table is just a table of function pointers index by opcode and we have at least one handler per virtual instruction and each handler then just decodes the operands, operates on them and just updates the VM context accordingly. Okay, so this is an example of a unobfuscated version of a popular VM obfuscation and we might be able to make out these components here. So on top we see the VM entry. So this is, we're coming from the native code calling into the interpreter and here we're just switching the context to the virtual context, initializing the virtual context. Then we're at the VM dispatcher loop which just looks up the current virtual instruction in the handler table which in turn points to the individual handlers you see here below. So get direct reference to these handlers and the handler then update the virtual context and branch back to the VM dispatcher. Eventually we end up at the VM exit handler which just performs the context switch from virtual context back to the native one. Okay, taking closer look. In RSI we have the virtual instruction pointer and in RIP we got the VM context. So you see that the VM dispatcher all it does is just taking one byte of memory, increasing the instruction pointer and looking up the corresponding handler and jumping to it. It might seem to ignore handler as seen here and as you can see it just reads out of the virtual context, performs some semantics and then writes values back into the context and finally jumps back to the dispatcher to execute the next virtual instruction. Okay, so this is rather simple and reasonably understandable how do we harden this whole concept? For one, obviously as we've seen the handlers are simple. There are only a few instructions and they're easily understood. What we can do here is just apply traditional code obfuscation transformations to make analysis of them harder like substituting operations, inserting apart predicates, inserting jump code and so on. So on the right you'll see some slightly more complex assembly listing than before. Another technique, imagine you only got four handlers in your virtual instruction set. You want to make it more complicated, more work for the reverse engineer and what we're doing is just duplicating individual handlers to increase the workload for the attacker. So because the handle table is usually indexed using one single byte, we got up to 256 entries we can populate. So what we're doing just duplicate existing handlers to populate the full table. And then again use traditional code obfuscation techniques to hinder the attacker from easily finding out that two handlers are in fact similar. And again, yeah, we want to increase the workload to the attacker who is now analyzed up to 256 differently obfuscated versions of the handlers. Another technique you might recognize we here get the sample dispatcher and multiple handlers which all branch back to the dispatcher which executes the next instruction. What we can do here is to omit this single point of failure and just inline the dispatcher at the end of each handler. So what happens here is that we don't have a central dispatcher, but every handler branches to the next version. In summary, we inline the dispatcher into each handler because a central VM dispatcher just allows an attacker more easily observe what happens inside the VM. It's like recording every handler that has been executed. And the third technique we can also get rid of the handler table actually because the explicit handler table easily reveals all the M handlers as we've seen earlier because it points to every single start of each handler. What you can then do instead of querying the explicit handler table we've been lying around memory, we just encode the next handler address in the VM instruction set itself. So this might look a bit like this. We get the opcode, the operand, and then somewhere in the encoding, we encode in the next handler address. This has the effect that essentially hides the starting location of each handler that has not been executed yet. What the handler table would easily see where every handler lies and can geofiscate and analyze it but with these indirect encoding, we can only observe those handlers that have been occurring in the concrete execution trace. Okay, going on to Mixed Boolean EarthMatic, which is another obfuscation technique not so widely used in modern obfuscation yet, but to give you an idea how it works, just look at this instruction here or at this term. So it looks a bit involved and you might not be surprised when I tell you that there's a simpler version of this expression, which is a simple addition of the values X plus Y. You might guess that even for this more involved term, there's again a simpler variant. Especially here, it's the addition of X plus Y plus Z. Okay, you might believe me that it's easy if you throw the first term and the second term in your favorite SMT solver and you are able to prove equivalence. However, what is interesting, how do we get to the second term if we only have the first? So we can try to maybe apply Boolean identities, we know from school or something, maybe arithmetic identities, maybe we might even go so far as to draw a nice conic wedge map. However, it becomes evident that this doesn't really help us here. In fact, what we are using here is the concept of the Boolean arithmetic algebra, which gives us a ton of different operations that are in this algebra, like Boolean operators comparisons and even arithmetic operators. It's worth noting that the Boolean algebra also includes, sorry, that the mixed Boolean arithmetic also includes the Boolean algebra and an integer modeling. And it is worth noting that no techniques exist to simplify expressions that contain both. We know how to reduce expressions in Boolean algebra and in the integer modeling, but there's no underlying theory that helps us in easily tackling both at the same time. Okay, on to de-effication. In every de-effication scheme or in every de-effication tool we've seen, we get to a point where we employ a technique at some point which is called symbolic execution. So consider the handler here on the left. This is the lower handler we've seen earlier. And we now want to reason about this handler. So what we're doing is we execute it, but not with concrete values, but with symbolic values. This looks like this. So we're just executing this move symbolically. We assign to RCX the value of the memory cell index by the register RBP. We can continue to do so. And we've got the second assignment. Also, if we've got a not operation on RCX, we just assign to RCX the negation of RCX, which is the same as the negation of the memory cell pointed by the register RBP. And we go on. And what gets interesting is this case where we got a logical end on RCX and RBX, which is the same like the negation of the memory cell pointed to by RBP with a logical end and the negation of the other memory cell. But because symbolic execution is basically a computer algebra system, it encodes some well-known identities from the Boolean algorithm, for example. And in this case, it knows that this expression is equivalent to a know of both memory cells. We can then just continue with execution. And again, here, the symbolic execution engine recognizes the next know. At some point, this works rather well. And we see that the core semantics of our handler here is just a know operation on two memory cells and strongly result in another memory cell. So apparently this works fine for this handler. But what can we do or what is the result if we try to throw this whole concept of symbolic execution at a more obfuscated handler? Here's a rather simple example of an obfuscated handler. You might be able to make out some parts, but let's just throw symbolic execution at it. We see that we get a ton of information here. But the problem is we don't really want a ton of information. What we want is just the underlying semantic, which is rather simple. It's the know operation of two memory cells and the assignment to another memory cell. Also, let's try to throw this at mixed boolean arithmetic. So we have this rather complicated mixed boolean arithmetic expression. And I'll just simply compile it into a program just like the binary program and then run symbolic execution on this trace. What we get is this semantic and it didn't really fit on the slide, so it goes on and on. And you might be able to make out here the resulting values in RAX and we got this super complicated expression. And again, what we got here as underlying semantic is rather simple. So we do not want to have this complicated expression, we just want this more simple semantic here. So symbolic execution is nice because it allows us to capture the full semantics of the code we execute. Also, it's a computer-algebra system and as we've seen in the lower example, it allows some degree of simplification of the intermediate expressions. However, the usability decreases to some point if the syntactic complexity of the underlying code increases. For example, we can introduce artificial complexity by just substituting instructions or just using opaque predicates or other schemes we've seen earlier. Or we can also increase the algebraic complexity by employing techniques like mixed boolean arithmetic expressions. Okay, so it's obvious that we have a problem with syntactic complexity and we want to handle this somehow. So the interesting question here is what if we could reason about the semantics of the code only instead of having to fight about the syntax and just improving our tools to be able to cope with more complicated syntax. This leads us to the topic of problem synthesis which Tim will tell you more about. Yeah, thank you. So we have seen some limitations of syntactic complexity. So, but it comes in my mind. Obfuscation is semantics preserving. That means it has the same IO behavior, input-output behavior. So why not just using a function as a black box and observe what it's doing? So, for instance, we might for this just generate some random inputs, one, one, one, and observe three. And we note that down. And we do this several times more. So we store this one and this one and 20 others again. So, and then we don't look at the code at all, we just look at its IO behaviors this year. And then what we learn is that we learn a function that has the same behavior. So, we might learn X plus Y plus Z. And the goal of program synthesis is to automatically learn these things based on IO samples. So, how do we do that? So, we use an probabilistic approach. Basically, we have an optimization problem. We have a surface, something like that, and each, and this thing has some deep points, some large points, and we have a global maxima, top there. And the global maxima is a program that has exactly the same IO behavior as our black box. And we have a concrete value for each point on the surface. So, the closer we are to the global maxima, the higher is our score. And in probabilistic optimization problem, we basically start with a minor score and just increase until we find the global maxima. How we do that is an algorithm that is based on Monte Carlo research. Basically, Monte Carlo research is one of the main reasons why AlphaGo last year was able to beat world-class human Go players in computer Go. So, let's get practical, and let's just synthesize A plus B, Model 08. We first somehow have to define how we generate programs. Well, we define a grammar. We have a non-terminal symbol, U. Non-terminal means that we just can replace it with other symbols.  We say that A and B are our input variables. We cannot derive them any further. So, therefore, we have a candidate program, something as A, B, A times B, A plus B, B plus B, and so on. Contrary, an intermediate program is a program that contains at least one U. So, we can derive it further. So, on with that, as a foundation, we do Monte Carlo research. We start with an empty tree that has just the root, as root node, the U. And then we randomly apply the rules of our grammar. So, we derive A. A, in this case, is a terminal program, so it cannot be derived further, so we can give a score to that because we are in a probabilistic surface, we have to score things. And so, how we calculate the score, it doesn't matter now, we come to that later, just to give it a score. And then, we derive the next thing, B, and also there, we give it just a score. This time, we derive U times U. So, we cannot give it a score since we have an intermediate program. What do we do? We do something that is called random play out. We apply the rules of the grammar randomly to and replace the U until we get a finite program that we can evaluate. So, we have something, A as A plus A times B plus A, and give it a score. And then, we do the same with U plus U. Here again, we have intermediate program. We derive something, score it, and go back. Now, we don't have any further rules to apply. What we then do is, we choose the best child node in a probabilistic manner. In this case, it is U times U, and do the same thing again. We derive some expression, do a play out, give it a score, go back. Now, each score basically represents the average score of all the children's scores. So, in this case, we had a new score here, so we just update this one. And we go back. Again, we choose the best node, we do a derivation step, and so on, go back, update, choose the best node, play out, score, update, and so on. So, now here, U plus A, we have a really high score. U plus B, we have a rather low score, and we want to synthesize A plus B. This means that U plus B had a bad play out, and that U plus A had a good play out, because here, the score is better. So, we update this, and go back.  So, as you can see, we always explored this area more than that.  However, we just have some probabilistic behavior. That means we sometimes explore also different ways just to get to know if we might miss something. So, in this case, we would normally choose U plus A again, but we just decide to choose that. We do a play out, we give it a score, and well, it wasn't really good. So, because of that, in the next step, we go back to U plus A. Then, we derive B plus A, and so we have a final program. We cannot derive it any further, so we can score it directly. Okay? We give it a score of one. Why one? Well, because B plus A has exactly the same IO behavior as A plus B. So, in other terms, we are finished with our programs until this part. Okay, how do we score some values? How do we calculate something? Basically, what we do is we generate a random play out, we generate random inputs, and query our black box, and observe the output. So, two plus two is four. And now, we use the same input and query our intermediate program and observe the output. Then, we calculate the similarity of these tools and get a score. Similarity, I will come back to this on the next slide. So, to just, we compare somehow the similarity. We don't do this only for one input pair, we do it for many. So, we do this, we do it for this one. In this case, we have the same output. That means the similarity is one because it's exactly the same, and we do it several times more. And finally, our score for this node is basically the average score of all these similarities. How do we calculate the similarity? Well, we are operating in the bit vector space, so we compare the similarity of bit vectors. In other terms, we can compare if they are in the same range. So, we have a look at the trailing zeros or ones, and at the leading zeros or ones, and count how many are the same. Then, we can still compare how many bits are different. This is the Hamming distance. We use that, for instance, for something as overflows in terms of addition or XOR operations and end operation and things like that. And then, we still have A plus B or something like that without overflow, where we can have a look at how close are two values numerically, so basically the distance. And we use this matrix to tackle these different behaviors of the bit vector space, such as overflows and things like that, and we take again the average of all these matrix. Okay, how do we use that as a core to synthesize obfuscated binary code? So, basically what we do is that we have an execution path, perhaps obtained from an instruction trace, perhaps from static analysis, whatever you want, and we somehow emulate it and observe indirectly inputs and outputs. We say that everything is an input, which we read before I write to it. So, in this case, these are the two memory cells on top there, and everything is the output in red that we write lastly to. So, for instance, the RBX is not modified anywhere, so this is an output, the same for RCX and things like that. And then, we treat this again as a black box, generate random inputs and feed it into our black box and observe the output. In this case, RBX. So, we do this many times, so something about 20 or 30 times, and then we synthesize this output, and then we learn that RBX is not M0, and M0 is here, in this case, the first memory cell. We do the same for RCX, and learn that this is basically the knower of these operations. And finally, we do it for this one, and also there, we learn that this is the knower. To conclude, we learn the semantics of the two knowers and the negation top there. What we don't learn in this handler is the push F operation that is flag based, and the flags that are written back into the memory cell pointing at RBP. Why don't we learn that? Because we don't care. So, basically, we designed our grammar in such a way that it just abstracts higher level semantics, ignores bit level semantics, and just abstracts higher level semantics, or in other terms, we don't consider flags as any sort of input. Okay, we do random sampling about a code. What is if there's a branch that may be conditional, and we feed in random inputs? Well, we might trigger some different behavior, such that the emulator decides to choose another path. Well, what we do here again is we just ignore the flags and we force the execution to go the path that we observed. So, if we want to go to A, we just force it to go to A. If we want to go to B, we force it to go to B. So, how do we implement something like this? Basically, you have lots of different opportunities. What you need is some code base that you can somehow execute code. For instance, emulate it as in box or in Unicorn Engine, or you can do it with dynamic binary instrumentation as in PIN or DynamoRio. What you also can do is you can just translate it into intermediate language, symbolically execute it, and evaluate just the symbolic expressions while feeding it with concrete inputs. But normally, this is much, much slower, especially for large constraints, if you have seen it before. But in general, it is possible. What we did is that we implemented everything in our framework that you called Zyntia. Basically, Zyntia is a program synthesis framework for code obfuscation. It is written in Python. It performs random IO sampling for assembly code based on the Unicorn Engine. And it also implements MCTS, the Monte Carlo Research Base Program Synthesis, as a core. We published this under GPL version 2, and this is the link where you can get it. So we will just do a quick demo. So first, I will show something about the program synthesis itself. Basically, we define an oracle that is a function that we treat as a black box. That we use for IO sampling, and what we want just is to synthesize x plus x plus y plus y. So we just run it. And what you can see here is that we start with different nodes, that we try out different things, and always assign a higher reward to this. And you also see, oh, in this case, it somehow learned that there must be a lot of additions. And at some point, we get something like that. So this is basically v1 or v1, and v2 and v2. So this isn't the simplest form, but it is simple enough such that we can easily simplify it to something like 2 times the input plus 2 times the other input. So we can do that another time. And we might choose a completely different path because it's all probabilistic. Perhaps one play out was better than the other, then we choose another path. It might take up to five seconds, up to one minute, so it basically depends on the quality of our inputs, how we choose a path, and things like that. But at the end, we will mainly reach our goal. If not, we just start it again. So the first one, it took nearly 20 seconds. Now it took 24 seconds. And you see, now we have a much more less obfuscated version in our non-simplified form. So it's okay. How do we use it for simplified code to synthesize obfuscated code? Let's have a look at the source. This unobfuscated top there, this is the plain code. Basically, it takes five inputs, just performs an addition and a multiplication and returns the value. Note, this is a function that means our final value, the return value, will be stored in EAX. And the obfuscated is with Tigris and MBAs, and we get something like that. This is a little bit longer. So, and then we compile that and get some assembly listing that basically is about the 760 lines. So we don't symbolically execute it here because it would be really, really much of time. Instead, we just learn it. What we do is we just render sampling input. So we give it by basically a code file. This is our instruction trace. We define the architecture. We do, well, let's take 20 random IO samples and we write it to an output file. So you see this were only less than five seconds. So if you look at the file, what we see is that we have different outputs. Here, this is one output. This is another output. We basically have 17, 18 outputs and we start counting at zero. We are only interested in EAX, so we will just synthesize that in a few minutes. And you see we have here our five memory inputs, our parameters for the function, and also some registers that were treated as input. Okay. So what we then do is we just define in our sample synthesis. This is a wrapper around MCTS. This reads basically the input file from before. And here, I noted zero because we only want to synthesize the first output now. So we just started. It basically takes the sampling file as input and an output file. And this again, this might take between seconds and one minute. So it depends. So we are ready. We can have a look at the result. You see this is the output. The top non-terminal is some integer, some integer that cannot be further derived plus a concrete variable. The best top terminal, so the best program that cannot be derived any further is a memory cell times a memory cell plus a memory cell. And so this is our final expression. Basically, we learned that the whole semantics is the first memory read times the third memory read plus the fifth memory read. So, okay. Coming back to our slides. How can we use that to break virtual machine-based obfuscation? A quick reminder. The goal of VM-based obfuscation is was to introduce a new CPU scheme that you don't can analyze easily with your tools. You have to manually reverse engineer all the handlers and things like that. And, well, one simple thing we can do with that is just learn the semantics of arithmetic handlers such as if the semantics is an ad or nor or something like that. So, Moritz discussed four different hardening techniques and we will talk about how we can break all of these. So, the first one was obfuscating the individual for M handlers with more complex obfuscation schemes. Then just duplicate handlers and somehow transform them such that they don't look the same. Then we don't have no central VM dispatcher so we don't have an FDE loop. Instead, each handler inlines and concrete the calculation of the next handler and then we don't have any explicit handler table. Okay. What you see here is a handler of team IDA. It looks quite more complex and you don't easily see, also not with symbolic execution, what this is doing. Well, if we ask Zintia, it says well, the semantic is that it is an addition of the 13th and the 14th memory read and it is stored into a 64-bit value. Okay. Solved this problem. The other problem, duplicated VM handlers. Assume we have a handler table where we can see each handler or we have an instruction trace where we know where each handler is located. Given we know where handlers are, so how can we learn duplicated VM handlers? Well, at least we learn its simple semantics. We can learn based on our grammar if it's an ad, if it's an XOR, if it's a sub, if it's a shift left, things like that. And of course, we can find duplicate for free because we learn its semantics and if they are the same, we learn it. Okay. So coming back to our timida handler and no central VM dispatcher. Have a look at the end of the handler. Let's zoom in. Basically, this plus the code above there is the code to calculate the next handler address. So we don't... This calculation is a little bit too complicated for our synthesis part, so it doesn't tackle our semantic approach because we still learn the semantics of the handler. And since the semantics of the next address calculation is too complex, we just don't learn it. And one other thing, have a look at the jump RBX. One advantage or disadvantage depends how you see it, of inlining something like that is that we have a hard heuristic how we can find the end of VM handlers. Basically, they end with return or with jump RBX. So basically, if we split an instruction trace at indirect control flow traces, control flow transfers, we split it into separate VM handlers. This helps us for our fourth part. We don't have an expected handler table, so we don't know by static analysis where each handler is. So what we can do is we just execute it and we observe the instruction trace. And then we have something like that. We just then apply the rule from above. We split everything where we observe the control flow and we get something like that. And as it points out, each color is a different handler. So, and then we can take these single components and just synthesize it on their own. And in this case, we automatically learned large portions or large things of the instruction trace. And we have a built-in semantic disassembler for free for the new architecture if you want it that way. So, but we can say you a lot of things, just try it out your own. We also released our code and furthermore, we released all of our samples. So just feel free to use it and play it with the round. So, to conclude, we talked about obfuscation techniques, mainly OPAC predicates, VM obfuscation schemes and hardening, and mixed Boolean arithmetic. And of course, they all can be used together. And they all are mainly the same if we work on deobfuscation on the instruction trace level. So, then we discussed about symbolic execution and for syntactic deobfuscation. And we saw that it's really great, but it has some drawbacks if it is syntactical too complex. So, on the other hand, we asked us then what about not looking at the code level but instead looking at the semantic level, using the code as a black box to obtain IO samples and learn something different. So, this is program synthesis. And a final reminder, you find everything in our guide. Thank you very much. Thank you very much indeed for this creative solution to an existing problem. We now have about 10 minutes for Q&A. You know the drill, there are two microphones in the middle and one to the left, please line up. Also, signal Angel, do you have questions from the internet? Okay, none. And other questions from the audience here? One, okay. In the back, please. All right. Yes, I was wondering... And please try to go out silent. All right. I was... Okay, do you still hear me? I was wondering, when you take a look at these obfuscation techniques, wouldn't it be possible for a closed-source operating system to just prevent any debugging of code? So, say we could encrypt the code with some key that only the operating system has access to and only shovel it to a protected memory area. Well, what you might do is that you execute it inside a virtual machine or something like that. Assume you can do that and you can take memory snapshots and memory breakpoints at different points of execution. What you can then do is, if you know somewhere in combination with reverse engineering, that at this memory area now lies an de-obfuscated code decrypted code because you know it just was decrypted because it is used for execution now, you can take memory snapshot and dump the code and then feed it into something like that. Yeah, also to add up on this, there's also kind of a non-technical argument to make here because all the... like the argument we had on the slides, if you try to outsource your code, this is like a similar scenario because to have hard guarantees on that, you need some HSM or some other hardware mechanism to enforce this which might not always be feasible like imagine having a corporate environment where you need to supply USB dongles or something which might be in violation of some corporate policy. So we were looking only at things we can do in the white box attack scenario where the attack has everything he needs to analyze the code which is the most important thing here. Hello. I would like to ask these techniques also seem to be very useful for code optimization in compilers. Has any research been done in this direction? Yeah, lots of research. So basically there is one big project this is called Stoke. This is from the Stanford guys. They do stochastic program synthesis for super optimization and this was also an inspiration for us to use a stochastic synthesis approach. Thank you. Do we have a question on the left also? Yes. Okay, yeah, when you go. So if I understood you correctly then you focus primarily on aromatically functions or on aromatically expressions. So can't you use or can't you simply use techniques of numerical curve fitting? Well, this might be possible. We haven't looked into that but we also we mainly looked at that because we needed some something to evaluate our approach. So we designed our grammar to learn something like that but we are free to choose any more complex grammar or learn much more deep expressions. So this was just that we wanted to de-obfuscate rather easy from the semantic level here but the approach is much more powerful. Okay, thank you. I heard that the internet is also still awake and we have a question from the signal angel. Please signal angel. Yes, we do. Have you tried synthesizing intermediate representations? No. This is in general possible because Rolf Roles and others did some work on that and there's no reason why you cannot do this with that approach but we basically it depends mainly on the grammar what you want to synthesize and on your IO pairs. So if you design the grammar that way that you want to synthesize some IR, you can do it. Because we're moving so fast I think we still have time for one question in the back. Does this work? You've been using kind of fancy words but in the end I think what you're doing is essentially an optimized search for an expression that looks like it gives the same semantics. Now I'm wondering what is it that makes you believe that this is faster than just randomly trying expressions. So why do you think that the child nodes in this MCTS tree are somehow better if the metric of the parent node is better? Well basically we have a really large search space. So if you for VM handlers, if you have just A plus B, this is rather simple and semantics. But normally we have something about 20 to 50 inputs and several outputs and we have not only just multiplication or something like that we have much, much larger search space so we have 8 bit input variables we have 64 to input variables we have downcast, upcast 0 extends the whole grammar as bit shifts, left shift arithmetic shifts and XOR and also modulo and division and things like that. So we have lots of components such that we need. So for A plus B, something like that you are probably faster but if you take A plus B plus 4 plus C, you are not that fast anymore. So we really have large search space and if you use some kind of guided learning this helps much. Final question, Mike Wan. Hi. So it looks to me a very interesting work but my only question is what if the function you are trying to obtain maybe, I mean what if the similarity function does not respect what the code is doing what if for instance it's not the case that the similarity increases the more you get closer and stuff like that. In shorter terms, how would you break your own system as violating the assumptions of your similarity function? Well of course if you just make it semantically harder for instance it won't work at some level anymore but the observing so what you can do for instance is if you apply some form of local encryption or something like that this might break or this will break for sure but one of the observations we made is this isn't done yet so this was a really interesting fact and also one of the main things is how you choose the boundaries of where you start where you end with your window that you analyze and there can also be in this case we had a look on the level but there's no reason why not to combine several handlers or split into handlers in half or things like that so there might also be ways by choosing window boundaries to tackle this again. Thanks. Okay those who didn't get a chance I'm sure you can approach the speakers next to the stage once they leave again thank you very much for the interesting talk and let's conclude this with a round of applause.


Everybody forcing Jeff here. We got 2023 NT collegiate. This is four box case number nine Random teams. Good luck everybody five and three eight times two three four five six seven and eight George M down to Scott F and the teams here eight times One two three four five six seven and eight Cardinals done alliance Cookie not monster hits tonight, baby George M. Cardinals Colby S. Niners Ricky S. Saints and Jags Scott W. Ravens Adrian W. Jets Brendan Falcons Dusty B Chargers Mike W. Eagles Scott F Vikings Greg H. Colts Robert C. Steelers Chuck F Packers Edward P. Titans Brandon W. Bears Evan M. Chiefs Daniel S. Cowboys Richard H. Bills Eric J. Patriots Tom B. Bengals Dusty B with the Raiders Brendan M. Seahawks Edward P. Broncos Chuck F. Texans Light M. Dolphins Brendan M. Bucks Ricky S. Commanders Colby S. Rams Nicholas S. Giants Mike W. Browns Rob H. Panthers Scott F. Lyons You the variety packs run out at Target. That's where I usually go for like 20 bucks Here is a link for the results keeping minds for collegiates the player goes to their current team if they're active or the longest tenured team if they're inactive meaning free agents or Retired for to go and mash to work y'all that is our last break. We got to get it filled and we'll do a Promo random for some Father's Day packs the end of the night once we get it filled up Yeah, it's like 250 bucks worth of gibbies, right? It's a good bit.  You super bounties and everything man. Do a lot. Do it for the people. There's a lot Good luck y'all if you Probably Alright, I'm an again the tiebreaker for longest tenure. So we go by seasons After that it's games played if it's like the same so like Dion has Dion Sanders has like four years with I think a couple teams But he goes Falcons because he played more games in the Falcons coach Sean is back This is Sean's kitchen. Yeah. Yes chef. Yes chef Whoa Let's go Bobby. Oh nice. Let's go Bobby. Is this your first one big doll? Heck yeah, I know you're saying it earlier Ralph the smirker to 99 for the Steelers Good luck man and sleeve. I can't pick up the right size see the night. I Got him always What I need in my head 25 dual jersey Eric Gray Leave he is a giant Great yep Giants ever great It's an RPA K-Shop butte to 399 go to the Patriots Okay, Jersey Auto Kenny McIntosh for the Seahawks to 25 McIntosh to 25 Seattle Jersey card on TV on Wix to 75 These for Green Bay, okay Jersey Auto tank big speed of 49 for the Jaguars Bixby Redemption is Jalen Carter Kelly Ringo dual signatures blue. Isn't there aren't they both Eagles? I don't both This is like the prime Georgia. This is like the prime Philadelphia Bulldogs meme Dual auto goes same school and same NFL team Carter and Ringo. That's pretty sick. There we go Eagles It's like the epitome of that meme right there The Philadelphia Bulldogs and patch auto will be Jonathan Mingo for the Panthers here to 39 We had Mingo. We had Ringo. I'd be playing some bingo She was waving and like I don't know that I guess they both wave but They showed her waving more I Know where he is behind we're in the US, but it's a 49 Jalen Hertz for the Eagles Yeah, this was like a victory interview right here. She's the last one on the court so Jersey card is gonna be Elway for the Broncos out of 25 Max Duggan RPA that goes to the Chargers at 49 Colts on the rookie Jersey autograph to 49 John Josh Downs Josh Downs for the Colts. That was pretty good There Lawrence the 99 Jersey card for the Jaguars Yeah, he had some big games early on then it was yeah, and then weird year for the Colts though Very It's an O'Connell rookie Jersey autograph go to the Raiders at 99 College to the wet signatures That's is a Jameer Gibbs one of 39 a rookie patch autograph go to the Detroit Nice reminds me of all the hendon hookers who were pulling last night Come out late and this is gonna be random at the end between everybody Quinn Ewers Jersey auto to 75 current Longhorn Good luck everybody on that guard I'm back to school. She's kind of crazy. He for sure would have been draft I just don't know how maybe he thinks he can play himself into like the First round like the mid for high first round Would be that he's making a check And I oh, yeah, especially at Texas Texas has like the most NIL money You only have to get like ten recruits here because then the others to just get out of the portal, right? Yeah, a couple more boxes here. That is a That is an a-tape round that goes Eagles for his current team. You can use a pen if it's easier for you, right? Rogers to 99 for the Jets Sean uses sharp because he's Shawn He's the only one Rogers for the Jets Yeah, especially where he would get drafted he wouldn't get drafted super super high So you're gonna see a lot of good lot especially QB's play senior seasons and just everybody Ricky Giorgio auto to 25 case on boot day the Patriots Jersey auto rookie Cedric Tillman for the Browns out of 99 Eric Gray again for the Giants jumbo Jersey Rookie auto never to 25 chase Brown for the Cincinnati Bengals. Oh, whoa whoa Nike swoosh RPA Jamir Gibbs Gibby That's a big car for Detroit Going to the they're going to the championship game Scott F. Congrats Scott.  They crushed it. Oh Was a hooker swoosh, wasn't it? Yeah, exactly a lot of hookers Sean you missed out a lot of hookers last night. I'm all the jig So many Hinden hookers. I wasn't touching though There's a Levison 99 for Tennessee That is a Brian Dawkins, that's cool to 25 a Clemson Tigers Brian Dawkins goes to the Eagles, of course weapon X Cedric Tillman Ricky Jersey auto Ricky patch on it to 99 for the Browns Michael Vic auto to 99 for the Falcons Michael Vic Falcons Sean saw Vic play Vic was in college Probably tore him up, huh? Ricky dual Jersey to 25 Sean Tucker for the Bucks. Oh, this is sick card Patrick Mahomes the second jumbo patch to 10 that's going to the Chiefs Three-color red raider patch That is go Cougs die cut Jersey out of 49 Jaren Hall Vikings Good ring Vikings And the last part is a Mijon Robinson Team logo signatures gold redemption for the Falcons big Falcons redemption Everybody we're gonna recap here upper paws on top at all. All right, I'll master work for to go on master work Yeah, yeah. All right, let's random for the yours The you Good luck everybody Quinn yours to 75 Jersey auto Be nice when it gets a Seven or was up top gets it one two three four five six and seven Chargers Chargers all right recap here y'all Relics we've got Mahomes Sean Tucker Brian Dawkins. That's Eric Ray Aaron Rogers Trevor Lawrence John Elway Don Tavion wicks Eric Ray again all the autos now. There's Quinn yours Okay, Sean but a that's Jaren Hall Cedric Tillman Michael Vick Cedric Tillman Jordan Addison Chase Brown Aiden O'Connell is a nice one Gibby nice Gibby Javier Gibbs Max Dugan Josh Downs Jonathan Mingo tank Bigsby That's Kenny Macintosh K. Sean but a eels redemption Carter and Ringo do a lot of that It'd be nice when I get and then Falcons redemption B. John Robinson team logo signatures gold That's awesome And then a swoosh RPA two of two Jameer Gibbs The X Bama running back the lion now that'll do it y'all moving on a Star Wars


All right guys welcome back to the channel if you're new my name is Bobby guys before I start the video Yes, I've seen it in the comment section. Thank you so much for the well wishes. It is true I was a little bit sick the past week now slowly but surely I am recovering Alhamdulillah guys today We're gonna react to scholar paid 2 million to find mistakes in the Quran shocked by what he found Before we jump into the video guys support your brother Bobby here with a thumbs up if you enjoy my content Subscribe to the channel if you haven't already Comment down be low and share the videos if you can all right guys with no further ado Let's have a look. This is Professor Marin van Puten who received a whopping 2 million euros grant by the European Research Council What we need to linguistically take apart the Quran and figure out whether it lives up to its Extraordinary claims as a perfectly preserved book originating in the middle of the seventh century Let me stop this real quick and read this out five line researchers have been awarded a Consolidated grant by the European Research Council This grant up to 2 million euros will enable them to continue and expand their scientific research The ERC Consolidated grant is awarded to promising researchers of any age and nationality with between 7 and 12 years of postdoctoral experience They can use the grant of up to 2 million euros to fund a team of core Researchers and support staff over a five-year period So this is extremely impressive of course But we have to clarify the 2 million euros are not only for the one scholar But they gave him 2 million euros to conduct further research Which makes this whole claim even more grandiose because it means they really want to dissect the Quran from every possible Angle and engage a whole team into the meta. This is quite interesting entry Before we get to what his analysis revealed, it's worth quickly going over the standard Muslim timeline This gives us a frame of reference to compare the professor's scholarship against in 610 CE Prophet Muhammad Receives his first revelation in 632 CE the Prophet Passes away and all revelation ceases by now the Quran has been entirely Memorized and inscribed on various perishable material in 632 CE From various written material and men's hearts Khalif Abu Bakr Adil Talha Anhu gathers the Quran into a single book Musaf note the Prophet died this very same year on the 25th year of the hijra 647 CE Othman Radim Adil Talha Anhu Standardizes the Quran back to Quraishi dialect throughout the Muslim lands The period between the Prophet sallallahu alayhi wasallam death and standardization of Quran is about 15 years Now bear this in mind. This is the crux They are in mind that no other religion has anything that can compare to this according to the Muslim sources The Quran was standardized by about 647 CE by the third Khalif Othman Radir Talha Anhu and It is this claim that's being tested today Now one last important thing before we get to the professor's remarkable findings. What does? Standardization actually mean? Well, from the time of the Prophet sallallahu alayhi wasallam to the third Khalif Othman Radir Talha Anhu 15-year period the Quran could be recited in seven Arabic dialects called Ahruf Exactly, and this is what the Islamophobes use against Islam. They say that there are many different versions However, those are just dialects. Now, this doesn't mean seven different Quran's It means the seven readings of the Quran are the same But they don't get it minute dialectical differences in how certain words are pronounced and spelt this flexibility Existed to assist the non-Quraisha Arabs with their recitation What's important to remember is these seven readings are mentioned in authentic Ahadith And so they're a part of the canonical readings of the Quran They're not corruptions and they certainly don't impact the theology So the standardization process was basically Khalif Othman Radir Talha Anhu Restoring the Quranic recitation back to the main Quraishi dialect Always the most popular one that the Quran was originally revealed in Of course, because Prophet Muhammad sallallahu alayhi wasallam comes from the Quraishi tribe Aye Because by about 647 CE the different Arabic dialects were starting to confuse the new Muslims joining the growing caliphate Now to our academic a leader in the field of historical Linguistics who specializes in the linguistic history of Arabic, Berber, and Semitic Madin Manputan PhD 2013 of Leiden University who focuses his research on the textual history of the Quran and The early history is full number. I don't think that's a good idea of the Quranic reading traditions For your information, he's not a Muslim and his only motivation is to subject The earliest Quran manuscripts to the historical critical as objective as the 2 million euro question Has the Quran been faithfully preserved? Because that's the bold claim Islam makes right quote Verily we it is we who have sent down the dhikr and surely we will guard it from corruption You can sense the surprise In terms of what he's encountered with these manuscripts It was clearly a surprise Yes, of course it was a surprise because if you look into the Christian sources into the New Testament For example, the earliest gospel could be mark and that was 70 years after Jesus However, the manuscripts that we have are written in Greek and therefore they're not eyewitness accounts They're not written by the apostles of Christ. They're written by Greek philosophers Potentially the apostles of Christ were fishermen and therefore they were highly likely illiterate and even if they could have written Surely they couldn't have written Greek So therefore yet again, you see that there is absolutely no comparison to the Islamic preservation By way of comparison, he mentions the Hebrew Bible and the New Testament, but it's clear The Quran is an elite of its own And then you look at the Quran and it's just it's the same thing over and over again It's not just the same thing, you know, like in general lines No, it's down not just down to the words. It's down to the spellings right even the specific spellings And sometimes really random spellings are copied faithfully over and over again Sometimes a word can be spelled in two ways But I'll always write in one place in one way in the other place in another way And you don't get any mixing in that early manuscript. So really um Scribes took took the utmost care to really carefully copy these manuscripts The professor is so taken aback by the level of meticulous attention To the process of preservation and it's always amazing, of course to see somebody Objective or an outsider here that has no skin in the game He's not a Christian trying to debunk Islam But if you look at the Islamophobes, you look at the so-called Christian apologists on youtube You will see of course how they are taking Islam over and over again. However, those claims are false The professor is so taken aback by the level of meticulous attention To the process of preservation he observed in these early manuscripts He grudgingly juggles the idea of the early Muslims doing something extraordinarily anachronistic Like a postmodern interfaith textual critique Something unheard of until the post enlightenment landscape of modern academia You know, it's like well, is that because of an example of the text? I don't know That is putting a lot of Faith In knowledge of textual problems in the person who ever composed a Quran Which they may have, you know But how where were people of these issues? Now obviously being an academic working within the framework of the historical method He can't attribute this perfect preservation to a god No matter the extraordinary things he stumbles upon the story of the Quran He has to confine his answer to an academic one It really does not matter if he attributes the preservation to god or not We as Muslims of course attribute that preservation to god and nobody else However, that being said for me yet again The most beautiful thing here is that a somewhat Atheistic person looks at the Quran and can objectively quantify that yes This has been preserved from the first day out on Meanwhile, the islamophobes are coping and seething anybody with an objective mind would of course see right from wrong That's what he gets paid millions for Theology just doesn't figure i'm afraid But the Quran does take pains to say you know look, you know, this this text is in some way Protected from corruption and these previous texts were corrupted. So I think that that You know, that was a kind of self-fulfilling prophecy. You know, if the Quran says it has to be it has to be Preserved and it will be preserved. Yeah, obviously Followers are going to try really hard to do so and they do. I mean, they're actually very successful at it So now that we know that he has found the Quran to be faithfully transmitted between the earliest scribes Does he also find the earliest manuscripts go back to the Uthmanic recension when according to the muslim sources? It was standardized And then the question kind of becomes okay, so so when when was this text standardized? We haven't already standard text and so just to be clear We have hundreds of manuscripts and every single one of them are part of the same text I just standard text except for one, which we'll get to in a second as well But uh, I'll repeat it here as well But all of them are the same text type and all of them are, you know, letter by letter Basically identical small changes here and there of course like like it would always be But it's really really carefully controlled for Which suggests there was a common ancestor. So there was a single written text people Yeah, and moreover as you mentioned if there are slight differences maybe due to dialect or whatnot They're not as different as the gospels are to each other in john for example Jesus exalted as the alpha and the omega in the earlier gospels on the other hand You have no mention of that. So even the gospels themselves They're contradicting each other in terms of storyline and this cannot be said about the quran whatsoever Here in the quran recited and Writing down what they heard. No, no, they had a written copy and that copy was distributed across the empire And that was copied and copied and copied extremely carefully to the point that you know, there's barely any differences there The text is identical So the fact there are hundreds of manuscripts of the same text type quote Identical letter by letter suggests to him there was a common ancestor a master text He uses an interesting choice of words here Quote they had a written copy and that copy was distributed across the empire and that copy was copied and copied Extremely carefully. So the texts are identical The fascinating thing here is frankly the extraordinary thing That's exactly the journey the quran underwent according to the standard muslim narrative What do you know? Standardized the text in 647 ce or their abouts and Distributed this master version throughout the empire and then the master text was carefully copied thereafter Interesting. So we can safely say the professor does find the quran to have been faithfully preserved Now the professor will discuss when as far as he can tell from the data the standardization likely occurred Remember the muslim sources claim it happened in about 647 ce during the khilafah of ruthman Keep this date in mind as we dive into the next clip We have radiocarbon data manuscripts and radiocarbon data manuscripts give you know dates in of these manuscripts on say the late 7th century and mid 7th century that that kind of era And we have multiple of those. Well, all of those descend from a single original text So if they all descend from a single original text that original text must have been even earlier right because they've been copied from that Which brings us very close to a date say around the 650s and not much later than that earlier Technically possible. We have yet to see real manuscripts.  How can that be? That seems to be what we see. That really seems seems to be what happened. So subhanallah So professor marin van putten is now explaining that the sheer number Of identical texts and the fact that they've all been radiocarbon dated to a period between 650 and 700 ce Suggests they have a common ancestor text that goes back even further into history To know later than 650 or perhaps even slightly earlier The numbers are important Because if you have the one text carbon dated to 650 to 700 That might be an anomaly, right? But with hundreds returning the same date it makes it more likely and reliable Now the fact that these hundreds of texts are near identical also suggests they couldn't have been written randomly or in isolation Say from memory It signals they were handwritten and there was also a scribal system in place ensuring standardization Thirdly if you have hundreds of identical texts in a period spanning 650 to 700 It suggests their master text must have existed prior That's what it says period Exactly right. Well, guess what? This places the standardization of the quran remarkably at or just before 650 ce Which is almost Precisely the same date To the year the muslim sources the ones that apparently aren't reliable Claim for thman ready to learn who standardize the quran in 647 ce Wow, just wow Subhanallah That is a remarkable overlap between the muslim claim and modern scholarship It's kind of ironical of course that muslims were claiming this for hundreds and hundreds of years and now finally to the rescue The west comes pays a scholar two million euros and he simply confirms what we already knew he is Let's get something straight before we finish The european research council is a secular body governed by a scientific council has funded at a cost of 16 billion euros by some of the most liberal nations in the world in western europe Its president is maria leptin herself a molecular biologist Ideologically their mission is antithetical to religion But they're going to be more averse to islam because inside their paradigm Islam is the least reformed and most in need of intellectual scrutiny They don't exist to do any favors for religion Let's not beat around the bush Frankly to them the world is a better place without such superstition So this organization part of the european commission Headquartered in brussels Paying out millions of euros to intelligent people like our star linguist malin van putten Is coming with the assumption that science is the solution for pretty much every problem And baked into this bias Is the additional assumption that if enough clever people subject any religion to enough specialist scrutiny That religion falls apart and is inevitably proven a man-made enterprise So when the opposite happens and a 300 year strategy for science to take over the world is upended And a religion is shown in a positive light or somehow confirmed by a secular critical study Despite the vast amounts of cash and resources being thrown at it You know for sure there was just too much Evidence on the side of religion in this case islam to warrant the findings the study concluded with And Findings the islamic sources are reliable when it comes to the quranic narrative The quran was faithfully preserved And the uthmanic codex does indeed go back to caliph othman who standardized the text in about 647 ce Thank you for watching and please subscribe for more latest scholarship supporting the standard muslim narrative Guys, please do me the favor and do not call margin van puten here I'm sure he got a bunch of calls now from muslims congratulating him on his findings I'm sure it is well meant but please hold your finger still that being said guys We as muslims we already believe this and we know this to be true However in the west people do not know that and many muslims are seen discarding the west and saying We don't need their science to know that islam is true Of course that is correct for us. However for the western minds They are of course interested in science more over would say that for many people in the west Science is their god if science says it's true They obey it right away for them science is their quran astaghfirullah, but it's really the case Those people truly worship science and therefore if science confirms it it makes them rethink Therefore it is well needed as well and we should applaud the efforts of the west Of course to scientifically try to debunk islam because like that They're shooting themselves in their own foot and you see that islam prevails yet Again another common w for islam and moreover as i said throughout the video It is hilarious to see that islamo folks from the west try to debunk islam with false claims However, their own science their own communities their own intellectuals are debunking them All right, guys But this is it for today's video if you liked it leave the thumbs up if you haven't subscribed already guys Please do so and if you want to support this channel via patreon for example all the links are in the description box below Thank you so much for your ongoing support guys and as always may god bless you all much love and peace


What's going on everyone? I'm Joe for jaspyscasebrake.com. It's our last fill I think this is the only filler we had to do to unlock another flawless collegiate break right here So we're gonna do this pack break first and we'll give away the final three spots in the next video will be the break itself Big thanks to Chad and especially Brian Brian going big on this. So good luck sir and good luck Chad They're the teams right there We got to do the pack break first and then a different dice roll for the final three flawless spots But for the break four and a five nine times for names and teams one two three four five six seven eight and nine This is the first time you're hearing that that the fan Jilo four and a five nine times for the Teams to And it's our it's our heat actually a little bit of a for LA at least so we're having a little bit of a cold snap All right, Brian. You've got all the teams except for the bucks the gris and the jazz and they're in the nets All right. Now. There's no trade. So let's just get on with it It's alphabetized by a team. Let's print. Let's rip and let's see what we got in this 2122 mosaic basketball hobby pack Evan Mobley The soon move I've come to bargain at the end of Doctor Strange The soon move all right the Evan Mobley rookie card. Nice going to Brian and the cats Yeah, it was it was clear what did take some getting used to but I think we did some repairs on it that fixed the fans a Little bit for the AC heating unit over the years. I think we just gotten used to it And I think we now that we filled the store with stuff Dead ends the noise a little bit. All right, let's gather everybody's names here one through 30 and Top three after Six will be in the next break one two three four five and six Five and one six times so only the top three can get in so from four on down It is sad times After six I Think both of you might have gotten in actually Chad you might have stolen a spot from Brian You did Brian shot the next two he does Two of the three spots there you go After six we'll see in the next video you guys for the break jasmine's case breaks calm


عيد الزهراء لأشخاص الذين لم يكنوا مناسبين كثيرا منكم يمكنون أن يكونوا مناسبين مع عيد الفرد عيد الأضحة عيد الغدير لكن الثلاثة of ربيع الأول هو أيضا حالة جيبوليشن لأهل البيت لأشخاص الثلاثة عيد الزهراء is an iid of willaya and it's an iid of baraa on the ninth of ربيع الأول 260 years after the hijra marks the commencement the beginning of the imam of the twelfth imam الإمام صاحب العصر والزمان صلاوات الله يعليم الله أمّا صلّي علام محمد so how can we relate the commencement of the imam of the twelfth imam to lady falth im'a alaihi s-salam do you see brothers and sisters after the death of the holy prophet the umma of rasool Allah صلى الله عليه و آله largely ignored what was announced on the day of ghadir now you may say how could it be possible that all of the sahabah the vast majority of them did not support alim nabi t'alib how could this be if i recall Allah tells us in the Quran when mousa left bani israeel for 40 days they left tawheed if the ashab of mousa deviated in the absence of mousa why does it surprise you that history is repeating itself after the death of the holy prophet for various reasons امير المؤمنين عليه السلام was sidelined and the first defender of alim nabi t'alib after the death of the prophet was lady falth im'a alaihi s-salam she was the first defender of alim nabi t'alib and she did not support alim nabi t'alib just because he was her husband فاطنة الزهراء عليه السلام understood that yes alim nabi t'alib is my husband but more important than that he is Allah's حد جانر he is the imam of the time therefore brothers and sisters فاطنة الزهراء understood that supporting alim nabi t'alib and helping him regain the divine right that was given to him to rule over the ummah was necessary for the spread of justice you know when we speak about the individuals who usurped the خلافة from alim nabi t'alib this is not just a muslim problem this was a crime against humanity when you take the كرسي away from alim nabi t'alib you committed a crime against humanity because you deprived humanity from the justice of alim nabi t'alib from the wisdom of alim nabi t'alib you deprived the ummah of decades of leadership from the nefs of Rasulullah you deprived humanity from decades of leadership under the banner of imam al-Mujtaba imam al-Hussein can you imagine the world we would be living in today if Ahlu l-Bait actually ruled and people allowed them to rule so when Sahid al-Asli was the man who begins his imam this is something that brings joy to lady Fathima why? because this is the imam who will achieve what she tried to achieve after the death of the prophet we have a hadith that is recorded in the books of Ahlu l-Sunnah and in the books of Aroon Ulama where the holy prophet صلى الله عليه و آله he says لو لم يبقى من الدنيا إلا يوم واحد you know some people are always afraid that the world is going to come to an end if the imam has not appeared believe me the world is not going to end رسول الله says if there were to remain a single day left in this dunya only one day between dunya and day of judgment رسول الله says Allah would prolong that day حتى يبعث الله رجلا من والدي Allah would prolong that day until a man from my sons emerges لا ترو اسمه اسمي his name is my name our 12th imam he also has the name of محمد صلى الله عليه و آله يم لأول أرض أصطن وعدلة كما مليئة غلمن وجورة رسول الله says he will fill not just the middle east we would give a Nobel Prize to someone who solves the Israeli-Palestinian Comfort we will give him a Nobel Prize if you can establish justice in one region in the middle east this is a big achievement رسول الله says this son of mine يمان صاحب العصر و الزمان he will establish justice and equity in the entire world can you imagine the type of leader it requires to be able to do something like that it's difficult to establish justice in your house in your city in your country إمام صاحب العصر و الزمان he will be able to do something that NBA have been dreaming of which is to establish the kingdom of God on earth so عيد الزهراء is a celebration of the beginning the commencement of the imam of our imam you know we read about عليبنا بيضالب إمام الحسن when we address إمام الحسين we say إليتنا كنا معكم the 12th imam is with you if you want to know how you would have been with عليبنا بيضالب ask yourself what is your relationship with your imam your living imam so one side one aspect of عيد الزهراء is that it's a celebration of williah that the torch of imam has been passed and received by the final imam of عيد الزهراء the one who will establish justice secondly there is an aspect of براءة that we remember on this day إمام الحسين عليه السلام was martyred on the 10th of Muharram in the year 61 after the Hijjala yes indeed there is no tragedy there is no calamity that has transpired on earth that was more inhumane than this tragedy this is why you find the traditions say that the women of أهل البيت would not beautify themselves after the day of عشراء until the 9th of ربيع الأول 66 years after the Hijra so 5 years after كربلا news reaches al-Muhammad that one of the murderers of إمام الحسين has been killed عمار ابن ساعد brought a lot of grief to the Ahlul Bayt عمار ابن ساعد was one of the commanders of the army of يزيدا on the day of عشراء عمار ابن ساعد was the first one to shoot an arrow towards the camp of إمام الحسين عمار ابن ساعد was the one who gave the order for the bodies of the شهداء to be crushed under the hooks of the horses this is عمار ابن ساعد عمار ابن ساعد was the one who told حر ملا hit the neck of عبد الله الرضيع this man brought so much grief and agony to the family of the problem but Allah سبحانه وتعالى has a sunnah that has never changed and that is the one who attacks the people of God on earth Allah humiliates him in dunya even before Akhir you find on the 9th of ربيع الأول 66 years after the Hijrah 5 years after Karbala مختار ابن عبيد الله فاقفي kills عمار ابن ساعد you find that on the 9th of ربيع الأول when عمار ابن ساعد was murdered this was the first time in 5 years that إمام السجان عليه السلام smiled 5 years no smiling 5 years the Hashmiyat would not put corout on their eyes but this was a day of relief for them because the enemies of Allah were punished we call this day فرحة الزهراء which literally means the happiness the joy of Zahra but do you know what brings more joy to Fatima to Zahra even more joy than the defeat of the enemies of Ahlul Bayt it's for you and I to learn how to defeat النفس الأمار we have Allah has external enemies throughout the earth but some of us the worst enemies that we have in our lives is not external it's the nefs that you have that encourages you to defy Allah


Welcome to nursing school explained in this video on cardiomyopathy. Now keep in mind that we can always kind of dissect the actual word and so if we look at this cardio meaning heart, myo meaning muscle and then pathy disease. So this is a disease of the heart muscle. And risk factors to developing cardiomyopathy are all those chronic things that are caused by poor lifestyle such as diabetes, hypertension, hyperepidemia, obesity, but also coronary artery disease, bowel disorders, myocarditis, so infectious diseases of the myocardial, but that can also be genetic causes. And then cardiotoxic drugs can also lead to cardiomyopathy and those are mostly things like alcohol, cocaine or methamphetamines. Anything that speeds up the heart or chemotherapy drugs can also be toxic to the heart. So in terms of pathophysiology, the heart muscle becomes weak, it becomes enlarged, sick or rigid, which then leads to decreased cardiac output, decreased ejection fraction and eventually signs and symptoms of heart failure. There are three different types of cardiomyopathy, dilated, hypertrophic and restrictive and they are listed here in the order that they occur. So dilated cardiomyopathy is the most common cause of cardiomyopathy. It is mostly caused by myocarditis or alcoholism. And what happens here is that the left ventricle dilates and the chamber enlarges which then decreases the contractility because that chamber is not able to contract as effectively which leads to a decrease in cardiac output as well as ejection fraction and then eventually signs and symptoms of heart failure. So here in the drawing we have this very thin ventricular wall which then leads to this left ventricle to become enlarged but also the chamber itself becomes bigger and as the chamber becomes bigger more blood is allowed in but the heart muscle is weak so it can't contract leading to this decreased contractility. Signs and symptoms of dilated cardiomyopathy are fatigue, dyspnea on exertion, paroxysmal and nocturnal dyspnea as well as orthopnea. The patient might be complaining of palpitations. They might have a dry cough as the heart failure is starting to develop and fluid is starting to back up into their lungs. They might have abdominal distention meaning that maybe they have hepatospatomegaly that's developing. We might hear murmurs an S3 and an S4 as this heart muscle is becoming weaker and thinner and then it might lead to this arrhythmias that we can detect on an EKG and basically all those other signs and symptoms of heart failure like crackles in the lungs peripheral edema, JVD, hepatospinomegaly I already mentioned so all those things. In addition because now we do have this enlarged chamber here more blood has a chance to pull when then as it gets shaken around just like an atrial fibrillation this pulled blood has an increased risk of developing into clots and so we want to make sure that the patient doesn't have a stroke or pulmonary embolus from this dilated cardiomyopathy. Now the second cause is hypertrophic cardiomyopathy and this basically means that either the left ventricle or the septum enlarges and so now that chamber rather than being big as we seen over here becomes small as that left ventricle or the septum becomes thickened so now we have this enlarged left ventricular hypertrophy and now there's this outflow obstruction because we just can't pull or feel this left ventricle with enough blood and therefore the cardiac output again is reduced leading to all these signs and symptoms that we already discussed. Of note here is that men are more likely than women to develop hypertrophic cardiomyopathy and unfortunately it is the leading cause of sudden cardiac death in athletes because many times it goes undetected because the patient might have some underlying issue that they never get checked out for and then they exert themselves in physical activities and then they might have a sudden cardiac arrest and so signs and symptoms here are again this near on exertion because of this decreased cardiac output but this might also develop quite quickly and the patient might not have any symptoms and then suddenly die during activity but the patient might also have signs and symptoms of angina so decreased blood being pumped out to the heart they might have syncope or presyncope and again this rythm is as the heart is not perfusing itself really well. Now the third type is the most rare the least common which is restrictive cardiomyopathy and so now the ventricular muscles become stiff they just kind of lose their ability to contract which leads to impaired filling because the the muscle can't basically just dilate dilate it let that blood passively fill in fill in during the ventricular filling and um there is fibrosis and scarring of that hard muscle and again we're leading to heart failure here so because of this decreased elasticity of that hard muscle we imagine that rubber band um that I describe in one of the other videos that kind of allows for the heart muscle to contract and expand to produce that cardiac output but now if that rubber band has become less elastic we're not going to be able to produce the cardiac output with the pliable and more elastic cardiac muscle cells. Signs and symptoms of restrictive cardiomyopathy are again fatigued in dyspnea on exertion as well as angina syncope palpitations and then leading to signs and symptoms of heart failure. So as you can see although the pathophysiology the underlying pathophysiology might be a little bit different but eventually all three of these types of cardiomyopathy will lead to heart failure so signs and symptoms of heart failure are very important to recognize here. Now the other diagnostic tests that we might want to do whether we might see in patients with cardiomyopathy are chest x-ray so we can see the if the heart muscle is enlarged and also if we have signs and symptoms of pulmonary infiltration from the back and above the fluid here and echocardiogram to check out the patient's heart chambers as well as the valves and EKG to detect any dysrhythmias. They might do cardiac MRI to evaluate the structures in more detail. A BNP certainly is the cardiac marker that we use in the evaluation of heart failure and the patient might need an endomyocardial biopsy if myocarditis or genetic underlying disorders are suspected or they might need a cardiac catheterization to evaluate the ability of the heart to fill and the volumes that the chambers actually fill with to evaluate the degree of the cardiomyopathy. Treatment so because we have all these underlying signs and symptoms of heart failure we want to control these signs and symptoms with ACE inhibitors, ARBs or ARNIs which is the latest in the treatment of heart failure. Beta blockers may be used as well as calcium channel blockers to control the rates as well as the contractility of the heart. The patient might need diuretics if their fluid volume overloaded or nitrates if they have symptoms of angina and then certainly because we have all these underlying causes, diabetes, hypertension, hyperlipidemia the patient will be on a statin and anticoagulants to prevent these clots that can form. Another treatment is called an ALBAD which stands for left ventricular assist device which is an implantable device that will basically assist the left ventricle to generate that cardiac output and it's a very specialized device that takes specialized training for nurses to care for patients with ALBADs. Certainly if the heart muscle is so diseased that the ejection fraction is very low usually less than 30 or 20 percent the patient might be a candidate for a heart transplant or demanding the pacemaker with an implanted cardioverter and defibrillator if their ejection fraction is less than 30 percent because now they are at a high risk for developing dysrhythmias and if we don't have a pacemaker or ICD available then the patient might go into a lethal arrhythmia and suddenly die. Now other lifestyle issues are decreased sodium in the diet because we know that with heart failure patients tend to retain a lot of fluid and then moderate exercise is recommended but patients with cardiomyopathy should avoid strenuous activity because this disney on exertion might kind of put them over the threshold and then cause a dysrhythmia or other pulmonary edema and other signs and symptoms. Now as for complications cardiomyopathy the weaker the heart gets the less the ejection fraction becomes the more likely the patient is to develop dysrhythmias and this can be anything such as atrial fibrillation or even ventricular tachycardia and ventricular fibrillation and again the patient is at high risk for clotting which could lead to strokes and pulmonary emboli. So thank you for watching this video on cardiomyopathy and the three different types. Please also watch the other videos that pertain to all of these cardiac topics that you can find in my cardiac or critical care playlist. See you soon here on nursing school explain thanks for watching


Everybody Matt here for late in sports cards rip in 2022 panini Chronicles football hobby six-box break number 23 pick your team We have Anthony S. Chargers Bob S. Rams Clay S. Browns Edward E Ravens Niners Eric R. Saints Giants Evan S. Lyons Florent B. Bengals Cowboys Colts and Broncos Graham M. Panthers James O Eagles Jason L. Steelers Matt C. Bills Matt J. Raiders Matthew G. Titans Mitch D. Texans Nicholas S. Jets Nick V Vikings Nicholas O. Dolphins Stephen P. Chiefs Bucks Tom G. Packers Patriots Commanders Von B. Seahawks Will M. Falcons Will Z. Jags William S. Cardinals and Bears All right, let's do it Rick Wollin clear vision rookie on Walker On Walker and Steelers rookie on a red to 75 Kenny Pickett nice start congrats Steelers One pack in already getting a mag That's awesome. Let's stay hot There's Sam Howell to 199 George Pickens Malik Willis Christian Watson and Bailey Zappie. That is rookie luminance blue to 99 Montsos Gardner Tyler Alger Erod photogenic Sam Howell panini set Desmond Ritter and Cowboys rookie auto Blue 75 Sam Williams Red Iron Kings There's Christian Watson That is um prison black silver Aidan Hutchinson and Chris Alave Willis Wandao Aidan Hutchinson rookie silver Malik Willis dynagon rookie Zappie This is Falcons Jersey to 199 Cordero Patterson Photogenic red rookie Brian Robinson 199 Brian Robinson Score Chrome Aidan Hutchinson Walker James Cook Watson Emily Willis This is prison black rookie red to 99 Titans Nice one, Tennessee to 99 There's Tom Brady prison black Josh Allen Eveno Joppo Christian Watson rookie Purple or blue uh to 99 What's this way? Dynagon rookie Bailey Zappie Robinson Chargers Ascension auto purple to 25 Kenneth Murray Garrett Wilson Legacy rookie silver Pickens score rookie This is Patriots essentials rookie auto red to 99 Bailey Zappie Grats Patriots John Mechie Rookie blue to 99 Momentum Damian Pierce Prison black Chubb Kenny Pickett Luminance rookie Kenneth Walker And Sam Howell Dynagon rookie silver Kenneth Walker Cowboys Jersey to 199 CV land Justin Fields Photogenic to 99 Brian Robinson Jr. Prison black rookie Garrett Wilson Mahomes photogenic Mahomes Bailey Zappie And rookie orange Sam Williams Cowboys to 75 Christian Watson flux Box number three St. Forman Hutchinson and Cook This is Patriots Rookie Jersey to 240 Taekwondo Fornton Mr. Kwan Bricker Rookie to 199 Jack Jones Taekwondo Fornton Photogenic Malik Willis It's John Doxon Rookie to 149 Prison black rookie Chris O'Lave Kenny Pickett Clear vision rookie Nail and Raiders Gridiron Kings Rookie auto red to 99 Samir White Jalen Hurts to 199 Jordan Davis and T-Law Garrett Wilson Prison black rookie silver Drake Blundon Legacy rookie chrome and Dotson And Ritter Malik Willis And Redemption Nice that is Jets Prison black signatures blue Garrett Wilson Nice hit congrats Jets Am I wrong or the prison black blue Autos are to 25 right? I think it's either 25 Is it 10? Blue is to 25 or to 15 Garrett Wilson He's not listed as a shorter print So that's probably going to be to 25 Very nice Malik Willis That is legacy rookie silver You're strong Sam Howell Penisette And Trevor Lawrence Photogenic to 99 Janice Williams Score rookie chrome and Herbert Kittle Thubs And Sam Howell That is prison black rookie silver Kenny Pickett Legacy Update rookie Patrick Mahomes Zappy This is commanders to 49 At 27 of 49 Prison black rookie auto green Jahan Dotson There you go Nice one Washington Kenny Pickett Legacy update rookie chrome or rookie silver Drake London Dynagon rookie Amalik Willis Rookie one of 199 Chronicles rookie red Drake London Brady and Niners That's rookie auto to 199 Danny Gray Photogenic 49 Kenny Pickett Sam Howell Prison black rookie Jefferson Brock Purdy Luminance rookie Falcons Rookie jersey to 199 Drake London Jahan Dotson Rookie to 199 Sam Howell Score rookie chrome Fine Robinson This is Luminance rookie black to 35 That's one commanders Loftus and Shot white Jim Hertz This is Patriots Rookie jumbo jersey to 240 Bailey Zappy Kway Walker Rookie to 99 Matt Corral Flux rookie and Kenny Pickett Momentum Rookie Kenny Pickett Chronicles rookie Brock Purdy Panini set rookie Crystal Lave Panini red 149 Justin Herbert Prison black and Breece Hall A clear vision Photogenic Tom Brady This is Ravens Auto 75 David O'Jabbo Mods sauce gardener to 199 A-Rod magnitude Christian Watson Dynagon rookie silver Patrick Mahomes Prison black Drake London This one Ritter This is Chargers to 75 Prison black Auto orange Justin Herbert Here you go nice hit Chargers Mag that one for you Desmond Ritter Score chrome rookie Silver Beyond Pierce From Rodriguez to 199 Son Haskins Sauce Bailey Zappy Drake London Dynagon rookie silver Hutchinson and Zappy Purdy Photogenic Patrick Mahomes And Saints to 50 That is legacy Rookie Auto red Crystal Lave Here you go nice one Saints Rookie Auto red 50 Drake London Score chrome rookie silver Garrett Wilson Kenneth Walker Tom Brady Drake London Photogenic Breece Lions Rookie Jersey to 240 Aidan Hutchinson Kenneth Walker Clear vision That's rookie to 25 18 of 25 Now from Rodriguez And to Coyote Walker Kobe Dean Rookie to 149 Prison black rookie Garrett Wilson Jets and Pickets Kenny Pickett Photogenic rookie Patriots This is Rookie Auto I guess orange to 25 Taekwong Thornton Orange Disco Is that orange? Aidan Hutchinson Rookie Orange just 75 Malik Willis Legacy rookie Kenny Pickett Rookie Magnitude Walker 99 Malik Willis Photogenic Devin Lloyd And Brian Robinson All right Let's do a recap Relics we had Patriots 240 Rookie Bailey Zappy Lions Rookie to 240 Aidan Hutchinson Patriots rookie To 240 Taekwong Thornton Cowboys to 199 CD Lamb Fountains to 199 Cordero Patterson Fountains rookie To 199 Drake London Autos Niners rookie To 199 Danny Gray Raiders rookie To 99 Samir White Ravens rookie To 75 David O'Jabbo Cowboys rookie To 75 Sam Williams Saints rookie To 50 Chris Olave Commanders rookie That's Prison black Auto Green to 49 Johan Dotson Chargers to 25 Kenneth Murray Patriots rookie To 25 Taekwong Thornton This is Jets Prison black Signatures blue to 25 Garrett Wilson Patriots as elements Essentials Rookie Auto Red To 99 Bailey Zappy Chargers prison black Auto Orange Justin Herbert to 75 Steelers rookie To 75 Kenny Pickett Great Iron Kings That'll do it for the break Thank you everybody Number 24 We'll close this out next