For more videos on People's Struggles please subscribe to our YouTube channel. Hello everyone and welcome to the new issue of People's Health Dispatch, the health publication by People's Dispatch and People's Health Movement dedicated to the struggles in health and struggles of health workers. Recently governments from around the world met at the WHO and agreed to move ahead with plans for a new binding treaty to address future pandemics. Countries will now meet over the next two years to decide the details of this treaty. Right now we're still very much in the middle of the COVID-19 pandemic for which the global response has been extremely inadequate. In this discussion we're going to reflect on utility of a binding treaty at this time and the global dynamics that we're seeing playing out in these discussions. Here today with me I have Preeti Patnaik who is the founding editor of Geneva Health Files. Preeti thank you so much for giving your time and being home with us. So I wanted to start off by asking you to just outline for us what is the pandemic treaty, why are we discussing it and who has been driving it. Thanks so much for the invite and I'm happy to be a part of this conversation also based on our recent reporting on these issues. So essentially the term pandemic treaty has become a shorthand for something wider which is that that is expectation that WHO member states feel the need to come up with new rules to govern health emergencies and there are a bunch of different motivations of who's driving this conversation and where we are today. This week we saw that WHO member states adopted a decision to actually start negotiations for new rules to govern health emergencies. Given the kind of inequities we have faced not just in the access of vaccines but also other medical products disruption and supply chains and so on and so forth. I think many different sectors of society feel the need to not lose the momentum and use this crisis to actually redraw how some of these existing rules function and now it is clear that we need something more than what we already have. So I think the genesis of the idea that we should have some kind of international agreement to govern health emergencies was first let's say incubated in the West particularly the European Union and over time this happened sometime in late 2020 and earlier this year about 25 to 30 countries came together and started talking about formalizing the conversation around the pandemic treaty and earlier in the year at the World Health Assembly in May member states agreed to actually set up a working group that will work on WHO strengthening and preparedness and response to health emergencies and one of the tasks of this working group actually was to also prioritize and assess the need for a new instrument. So that's where we are and following the May Assembly it was also decided that a special session of the World Health Assembly should be convened in November. This was convened this month this week and where it was decided that yes there is a need to launch negotiations for new rules. The thing you must keep in mind is that during the summer between August and November a lot of progress was made by countries. There were a lot of divergences between countries but they arrived at a somewhat difficult consensus that this is the way to go. Having said that I will you know it is still too early to conclude the shape and the form that any new rules that's going to come up will take. I think I'll leave it at that for now. Thank you. So then moving on as you've mentioned about the meeting that we saw happened this week. Member States, Governments came together and made this decision to move forward on the treaty. I wanted could you just outline a bit more for as anybody mentioned a decision but sort of what happened at this meeting and whether there was any particular moments or particular interventions or things that happened over this week that you think are worth highlighting. Yeah I think this week was a reflection of all the discussions and dynamics that we witnessed over the last few months and weeks. So like I mentioned earlier initially they were only about 25-30 countries you know that let's say early endorses for the idea of a treaty or an agreement. Eventually as the you know weeks and months passed the decision that was adopted by the World Health Assembly this week was endorsed. The decision text was endorsed by more than 100 countries and eventually of course all the 194 Member States adopted the decision. So all Member States stand by this decision as it were. So some of the you know dynamics that we witnessed was over the last few months leading up to this week was you know these were highly highly contentious and highly political discussions and there was a lot of unease among not only many developing countries who had yet to sort of formulate national positions on these issues because they're busy fighting the pandemic but also other developed countries who were you know some of whom were not comfortable with signing with already committing to binding nature of these rules and so on. Having said that I think there were a lot of discussions on equity on the strength of existing rules. Do we actually need new rules or do you know or can we rework existing rules? So all those dynamics came to the fore even at the World Health Assembly and what was you know the couple of things were striking. One is that as we reported earlier as well that a lot of developing countries are interested in taking this conversation forward in committing to these negotiations because they truly believe that these negotiations are a unique opportunity to address concerns on equity. They see that any new rules will have to have binding commitments on equity whether it's access to medicines, intellectual property issues, you know addressing long-standing issues in research and development and a whole host of other issues related to equity and I think country after country at the World Health Assembly this week you know presented equity as a central goal and motivation for their involvement and commitment to these negotiations so that was striking and what also sort of came to the fore is the importance of existing rules and these you know there are a range of rules that actually govern health emergencies among them central to this process are international health regulations and in the lead up to these discussions countries were divided over whether they must trend in these existing rules or whether they need you know they need a completely new approach and it appeared to me that for a number of countries the international health regulations or the IHRs as they are called you know they continue to be important you know from Brazil, China and many others who sort of made statements that there has to be a coherent coherence and you know and there has to be a complementarity in the process of how we address these you know different approaches to tackle health emergencies in the future. I think although there was a lot of heat and dust on the specific legal routes that new rules should take but frankly there was some mentions some countries did mention that we must take a particular route you know on how these rules should be framed but not so many and this actually also goes to show that you know some of these discussions are sort of premature something that some countries were insisting on meaning that let's talk about what these rules should be and not so much about how they should be framed and you know specific instruments that should be used and so on. I think overall this is a very significant moment and as the decision stands now there is still a lot of latitude for countries to actually you know draft these new rules according to their own needs and as I told you these needs are very diverse the motivations of different countries are very different for developing countries equity is a major issue for some of the countries in the north you know they want to see new rules on sharing information on pathogens for example just to give you an example and also you must understand that the special the special session of the assembly is you know took place in the backdrop of a new variant and in the midst of a raft of new travel restrictions for affected countries that also contributed to the you know overall overall climate at these discussions and some southern countries also suggested that maybe we should have binding commitments on addressing unfair travel restrictions for example so these were some of the you know elements that came up repeatedly during this week. Thank you that was really interesting and I wanted to focus particularly on sort of elements that you raised for example about several countries highlighted the need for stronger equity and I was just wondering then how could we make that a reality in terms of how can we go forward what sort of things do we see do we need to see what sort of commitments do we need to see to try and make these themes become a reality moving forward that both perhaps in the way that discussions are being had and in terms of what commitments do we want from countries. Right I think that this is going to be you know the the million dollar question as it were and the way I see it is that this is an opportunity and maybe it's going to be the ultimate fight to actually code norms on on on equity and it's going to be very difficult because of the kind of entrenched interest that we have seen which has resulted in the inequities that we are witnessing today. I think before answering your question on equity you to just take a step back on on the motivations for for these new rules and as I mentioned earlier I think you know developed countries have certain expectations of these new rules you have the industry as you know civil society organizations and other scholars that have certain expectations of these rules and then of course we already discussed that equity is central to all developing countries. You have to keep that in mind that we have a whole diverse group of actors wanting a treaty but a treaty that will address you know different concerns as it were. A number of proposals on equity have been discussed and have been put forward by different countries but notably South Africa that actually proposed that you know equity is something that has to be seen across the board not we're not just about vaccines but about you know access to treatments, access to diagnostics and equity in the way we think about trade and travel measures in the way we share information and the benefits that arise from sharing this information. So I think that there are a number of sort of concomitant legal regimes that already determine various aspects of equity but the expectation is that one new international agreement on future health emergencies will govern you know across all of these components and that hasn't really happened before so to that extent it's a significant and a real opportunity and therefore this has been seen as a legitimate moment as it were. For some of the civil society organizations and the very strong and influential access to medicines movement for instance sees this that this is the moment to create norms on access you know have rules on financing and licensing of R&D on technology transfer on regulatory standards on governance and transparency so on and so forth. So I think you know there are a lot of these blue sky approaches as to what will be addressed under the overarching theme of equity but it really depends what kind of deep concessions are some of the players willing to make you know whether the countries in the north are willing to actually consider you know very deep seated beliefs about let's say protection of intellectual property and we see this fight currently sort of unraveling at the World Trade Organization in the context of the chips waiver so there are some indications on how difficult this fight you know to ensure provisions and equity could be. So having said that I think at the end of this week I believe that this is the moment for optimism for many countries and we do hope that developing countries will actually be able to use all the right bargaining chips as it were to ensure that their interests are actually eventually interest and you know are made legally binding as it were for the industry, for other countries and so on. Thank you and I saw reaching to an end so wonder if you had any final remarks or any final thoughts or perhaps particular global dynamics that we all need to be kept aware of and to be really lucid about the linkages between certain dynamics and the processes that we're going to see in sort of the discussions and you already mentioned sort of about these deep-seated ideologies certain countries have around intellectual property restrictions for example and I know you spoke earlier on about how it's particularly in the EU who are pushing your need for a treaty and now we're having the convergence around this from different countries so I just want to round in that general topic is anything that you'd like to share as we brought to our close. Sure I think it is important to recognise the legitimate need of developing countries that they do feel that this is the moment of opportunity for them but having said that you know what the last few months have shown is that in all of these discussions there is a perception that there is a kind of a forced multilateralism and there was a perception that you know this is like this was like a straight jacketed consensus on like this is the way we have to go forward despite the fact that you know many many countries especially developing countries with smaller delegations find it very hard to negotiate you know rules and treaties across different platforms and now we will see a number of different parallel discussions and negotiations happening. We have to keep in mind that there are very serious capacity issues especially for smaller delegations and these are very very contentious and difficult negotiations going forward we can expect them to be really difficult and the fact that many of the countries are still fighting the pandemic and may not have the kind of capacities and resources to really ensure that their interests will be protected. I think this is something that must be kept in mind. There is a very real risk that if you know if it is quite possible that they might end up committing more than they should as far as protecting their own interests as far as developing countries go and I think that this is something we have to keep in mind but this is how it has been a playing field that is not that is not level and I think that the pandemic actually exacerbates these inequalities even in decision making and the kind of latitude that that member states have at the international level. Perfect thank you so much Priti. So yeah thank you so much for your time and sharing your thoughts with us. Yeah I think it's very clear from the discussions and what you shared with us today that there's a lot to reflect on what we've seen in negotiations and the drivers of it so far and which the dynamics are of course going to persist as they do in the whole sort of global health governance and international society so I think you've highlighted some really key points that we can also keep in mind as we continue to watch these negotiations. Yeah so thank you so much. Thanks so much.


Hi, this is Roger McGuinn and you're listening to KDRT in Davis, California. Well, welcome back to Davisville. I'm Bill Buchanan and we're back on the air this week after taking a week off to adjust to the temporary closure of the KDRT studio because of the COVID-19 pandemic. This program today, by the way, might sound a little different because I'm recording it with my computer from home over the internet without the benefit of the studio or the sound engineer. But we'll keep the spirit of the show intact even if the sound is a little different and we don't have our usual music for a while. As always, thank you for listening. Well, my guest today is Wendy Weitzel. She is the Cummings and Goings columnist for the Davis Enterprise. She has been writing about merchants in Davis for many years and has lately, just say the last few weeks, been focusing on how they're faring amid the coronavirus pandemic that has curtailed or even closed businesses throughout the town. She's joining us remotely today from her home. So Wendy, thank you for talking with us today. Thanks for having me. All right. So you write about merchants in Davis and I should mention your writing is also available online. I read it in the enterprise but people can find it on Facebook and elsewhere. Anyway, obviously, this is a tough time for everybody. Today, we're focusing on the merchants in Davis. They bring life to the town. They make downtown attractive. They bring revenue to the city and most of all, of course, they're friends and neighbors who are trying to get through the pandemic like the rest of us. I'd like to start with just an overall question. You talk to a lot of them. You write about them. What's your overall sense of how they're doing? Well, I think they're all struggling. Every one of them, whether their business is open or temporarily closed and worrying about the future, I mean, we all are. But it's a really tough time to have a small business and trying to pay rent and keep your employees paid and that kind of thing. I really feel for them. Yeah. And I get a sense that it probably changes week to week like it is for all of us. Something that seemed, I don't know, unusual at first starts to seem a bit more normal even if it's sort of fundamentally weird. You're writing mostly about retail, right? Right. Retail and restaurants for the most part. And in fact, I think you said we were talking about setting this interview up that you focus more on the restaurants these days, I suppose, because that's one of the big questions people have is if they're open or not. Yeah, that's why I tried to start doing because really only as far as retail, only the essential businesses are open and I do talk about them when I can. But it's trying to spread the word of what restaurants are still open and so people can go support them. That was my main focus and has been for the last three weeks. Yeah. And in fact, you're writing your column more frequently. I understand temporarily. Yeah. It was cut down to every other week a couple of years ago, but now I'm writing every week and the enterprise gratefully is supporting that effort because they think it's important to support businesses and let people know how they can do that. Yeah. So how do you do you work? Do you check in with the businesses each week or I imagine some contact you probably if they want to get word out about something? How do you go about your job? Well, I mean, I live here and I work here and I shop here. So that's my key advantage. But I also, since I've been doing this column since 2001, I get a lot of tips, which are super helpful. And then I just when I see something, I take and make note of it and I do, you know, quite a bit of emailing and calling and checking in and just walking around if I can, which is less lately, but calling and checking. That's how I get my information. Yeah. So one of the questions, of course, is how to help businesses in a time like this. One of the obvious ways is to patronize them as much as possible. You've written about this. Do you have a sense of how that's working or are there other ideas, maybe things that people could do to help businesses through this, the ones obviously that they want to support? Well, if my suggestion is to call and check to see if they're open. And if not, you know, or check their social media, check to see if there is a way you can support them, even if their brick and mortar store is closed. There's so many stores like, you know, the wardrobe, women's clothing store just started offering Zoom, personal shopping. So you can meet with the owner and kind of almost virtually try things on and she will help you pick things and deliver them in a clean way. Avid Reader is really launching into an online operation where they're selling a bunch of puzzles and toys and books and things like that. So they're adapting to the situation. Fitness centers are doing online. Classes, but you can also support them by buying gift cards. There's some different methods. You can do that. There's a Dapit app that allows you to buy gift cards to local restaurants and all kinds of different stores. You can buy downtown Davis gift cards that would go to, you know, folk, any of those downtown merchants. So in a variety of different ways, you know, in your column in early April, and we're talking on at least track of days, we're talking on Wednesday, April 8th, I think, we're recording this in advance to air. But in your column in the enterprise a few days ago, you wrote about people scolding merchants for staying open. You mentioned someone even calling the police on people at the farmer's market. I don't know if it was, you know, on the market itself, but of course the market's considered an essential business. It can stay open. You know, I've been there. I've seen the Lions. I've seen people keeping distance and all that. You know, I'm wondering, are you hearing about a lot of things like this or is it mostly just a few cases or what's your sense of that? I'm seeing a rise in trend and I think other people are too, whether it's against businesses or just in people in general, people are agitated and they're nervous and they're anxious. And so naturally it's hard not to lash out and jump the gun. But I think we've got to dial back on our judgment and shaming and worrying about placing others. We need to have some empathy. And, you know, we don't know the story, everybody's stories. You know, somebody might be at the grocery store just buying a few things, but they might, and that might be their second or third time this week, but maybe they're shopping for an elderly person or, you know, we just, there's all this negativity right now on social media and elsewhere. And I think we need to be a little more forgiving each other, less judgmental and stop. It's just adding to our own anxiety, I think. You know, I mean, there certainly is a lot of anxiety out there. And of course, I suppose if someone sees something that is, you know, genuinely countered to the spirit and the law of the ordinance, but that's not really what you're talking about here. No, I was getting a lot. I'm getting a lot of emails even or talk on my Facebook, Cummings and Goings Facebook page with people trying to shame businesses for being open or such and such shouldn't be doing this and that. And they're probably, and they're talking about like essential businesses. And that, yeah, that we, the Davis Farmers Market got a message from the chief of police saying, you know, they had multiple reports of people wanting to shut down the farmers market and the farmers market's taken all kinds of precautions. So, and it's an essential business. It's, you know, so I just, yeah. In fact, I think that was farmers markets in general are called out specifically and at least a lot of the orders I've seen that say that these are essential businesses because they sell food. And well, in certified farmers markets that they've, that's actually been laid out by the governor and the health departments that they are exempt. I've seen as someone who, you know, lives in shops and Davis myself, it seems to me that in the last few weeks I've seen businesses being more, I don't know, sort of deliberate people probably getting better at their game in terms of, you know, clearly delineating where you can step, you know, the plexiglass shields going up at grocery stores, things like that. I mean, it strikes me that people are trying to work within the system and, you know, make it, make it function the way it needs to. The hours for senior shoppers at the grocery stores, you know, another example of that. I've been trying to list those, those special kind of hours in my column as well, because they sometimes have been changing or stores have been adding them. So, yeah. I mean, there's a lot of creativity, I guess, is part of the point at a time like this. People find ways you're mentioning businesses, finding ways to do things online, you know. It has occurred to me that in some respects, maybe we're fortunate that this didn't happen five or 10 years ago, because the online connectivity is a lot better than it would have been. Well, if you go back farther, I can't imagine doing this with dial-ups. You know, you wouldn't be able to, well, even what we're doing, talking over computers. This is for a radio show, but it's entirely outside of the radio station right now. And we're, you know, we're used to maybe getting delivery of more than just pizza these days of food and groceries. And so it's nice that there's that system already built in already. You know, I imagine merchants would be like anybody else. Most of us are thinking pretty short term these days just trying to get through the day or the week or maybe looking ahead a little bit. I do wonder how much they're thinking about what lies ahead. I mean, there's this thought that the change that we're all going through right now, learning to do things online. Well, this will take it out of retail altogether, but I've heard people talking about, well, with so many people working at home, it sort of changes the view people have about working at home, you know, that maybe that there are ways that more people could work remotely and still be productive and so on. You know, an employer or an institution that might have been more suspicious of that idea before maybe is less so once they have to send their workforce home and find that it's still is performing. Although I've always been working from home or no wealth for the last, you know, 10 years or so. And now that my whole family is at home, it's not as conducive, but that's all right. Well, that's true. I guess there's a couple of things there. One's just the tactic and then one is the conditions.  But I guess my point is this may reset some things. And, you know, you've got retailers now who are doing more things online at the moment. That's kind of their, their lifeline for some of them is, you know, selling things online for curbside delivery or delivery in person or take out meals. But I think people, although we naturally were used to shopping online and Amazon is so popular, I think we need to take a breath and look at if we're buying something on Amazon. Is there a chance that maybe we could support a local retailer? We actually have the time to do the shopping and the research and right now. So we know that I mean, I can easily predict that Amazon's still going to be around when COVID quarantine is over, but many of these local businesses might not. So anything we can do to help them, even if it's buying their products at the grocery store or ordering directly from their website or buying them a gift card or whatever, buying a gift card to support them. I think that's an important thing we need to acknowledge. Be really thoughtful of where we're spending our money. Quick station ID. This is Bill Buchanan. The show is Davisville on KDRT LP 95.7 FM in Davis, California. We're talking with Wendy Weitzel, who is a freelance writer. Well, she's a variety of things. Used to be managing out of the Davis Enterprise back in the day. And we're talking about basically retail merchants in Davis because that's something she writes about in her column. Well, yes, to your point about online, I would imagine that maybe to the degree that we've thought online is Amazon, online is somewhere far away, maybe it changes a little bit now if people can think about local merchants also being online. I guess I'm not sure where I'm going with this. It just strikes me that there is a reshuffling going on and maybe that creates opportunities for local merchants either out of necessity or simply out of insight. And I don't know if you're hearing much along these lines. Again, it's early. We're all, I'm sure they are too, still in the coping stage. But at some point people are going to start looking ahead. And I think that might be interesting to see what ideas emerge. Right. I was part of the Downtown Davis Business Associations Marketing Committee meeting last week. And one of the merchants Shu Shu, who owns Shu Shu's clothing, it's a women's retail boutique. She says, the changes she's making are ones, aren't just knee-jerk reactions. They're ones that are going to help her later. Setting the things she's trying to set up online will help her later. And she's trying to think of it in that perspective, that there are investments in the future, not just investments of saving my skin right now. And so that's one of the things she was doing is trying to really push this local app called Nitch that helps you shop locally. It helps you, like if I wanted to buy a white sweater and I was looking to buy it locally, I could put it out on this app and basically other local merchants would almost bid or show what they have available in my size or something like that. That sounds creative. That sounds like a creative response to it. Well, and if people are thinking more deliberately now about shopping in Davis, in other words, you start to value what you risk losing. And maybe that'll be part of the change too when the whole thing is over. I've been waiting for people to do that with newspapers as well. Well, yes. I have a newspaper background as well, of course, as you know, and they're a whole different category. And then of course, the enterprise is facing all this too. They're not strictly speaking a retailer, I guess. If I recall, back in the day, they used to be considered factories because they produced newsprint. I might be wrong about that. I might not remember that correctly, but they're obviously in a struggle too. I wonder, students of course have been a big part of the business in this town. And I don't have a sense for how many students are gone right now with the campus being remote learning only for spring and possibly after that. But of course, if they're not in town, they're just gone. I mean, they could still order some things online, but it wouldn't be food, wouldn't be restaurants. I know.  So I think a lot of them are doing that. A lot of students have left if they can. And I guess on my point is that it's got to be a particular challenge for some of the merchants particularly or the restaurants that have been very student focused. And that observation has been made before that a lot of the restaurants in Davis really aim at the student market. It's a large market. And it's a different market perhaps somewhat than the folks who live in town year round. And I would imagine that's probably an area at greater risk. Yeah, I think what we can do is try to keep up our habits of if we went and got coffee or if we went and got sandwiches at Zia's all the time or whatever it was, we should try to keep that up. And even though we can't go relax and sit in the restaurant and eat it, if we can maintain that we're at least doing our part of what supporting how we did before. I'm wondering, you've mentioned actually something that could answer this question already, but I'm wondering if you're seeing any positive trends among the city's merchants. You had mentioned a moment ago about the shop owner who said, you know, I'm going to build things for the future. Other things along those lines. I do think they're adding more on it's forcing them to take the time to have a more online presence and delve into things like delivery. But they're also just trying to survive. And hopefully, you know, they can do that. There's some pretty strict, there are, there's a lot of things available to them with these, some of these new loans, but there's a lot of restrictions tied to them. So I don't know how. Yeah, I was going to ask about the loans. You know, I think I'm by no means expert on them. I think details are probably still emerging. But if I understand the part of the idea of the small business loans that will be coming out of Washington is that they're forgivable if, you know, the recipient meets certain conditions. I take that to mean that basically it's a grant if you use the money in a way they consider, you know, supporting the economy and responsible, I guess, as opposed to somebody running. And if you're not, if you don't lay off your workers, but if you don't have work for them, you can only string them along for so long.  And, you know, his bank was, was trying to sell him or saying that there were these other benchmarks that they had to have a, a credit card with that bank first and all these, you know, and also contractor, he can't, you know, there's, he can't start new projects right now. And so he's, it's, so he wants to be able to do one of these forgiven loans, but he's not sure he's going to be able to qualify if, yeah, anyway. It's tough. So the help might be available, but not necessarily in a format that actually works for some folks. But I'm wondering if there's anything maybe we haven't talked about yet that particularly alarms you with regards to what you write about in Davis. Anything that we haven't covered yet that people want to know? I think we've covered a lot of that is, you know, I think what alarms me is the negativity and the automatic, everybody's automatic mindset to just go to the big businesses that they know, like shopping on Amazon. And I mean, I shop on Amazon too, but, but, you know, I try to be deliberate and it and I'm trying to be stay positive and empathetic to the situation.   What do you, what's your own experience in that regard? What are you hearing maybe from, you know, some of the people that you work for or do work for? Well, I've, I've actually been busier for a little while. I do, I do some work for the Davis Farmers Market doing press releases. I do, so right when this started, there was a lot of press releases for that. There's press releases about events changing. I'm doing work for the Davis Pride Festival and the Terry Blossom Festival. And those both had to be postponed, so had to write press releases about that. So I've been actually busier than usual, putting in more client hours than usual for those type of things. That eventually might not be the case, but it's... Well, yeah, I guess that's the question is, I mean, so much of the impact of this will depend on how long it lasts and then what happens afterwards. And I don't, I haven't seen anything that strikes me as reliable. You know, you hear things like, well, the peak might be in mid-May, but, you know, in terms of the effect here, but then what does that really mean? Do you then loosen up a little? This is getting way beyond what I know, although I will say, if it KDRT has the COVID report twice a week at noon and five with Automobile Renault, and she's putting a lot of information out about that as it goes, and I'm sure they'll be more there. Yeah, I think it's encouraging that well, the UC Davis has, you know, put out an announcement that it's not laying anybody off, but it's, it sounds really good, but it's only through the, through this fiscal year. So it's just through the end of June, that's not a very long promise. So my husband is a long time employee of over 30 years employee of UC Davis. So that's... I've seen the note as well. In fact, it says career staff. And of course, anybody UC Davis knows not all the staff are considered career. That's right. Contract and things like that. So, yeah, well, that's, that's part of the conditions that we're all in right now, which is frankly, one of the reasons I wanted to talk with you about this piece of it, because it matters in Davis, right? It matters if our local businesses and retailers are doing okay, or how they're doing. No one's really being doing okay right now. A general question, I wanted to ask and put a pandemic aside for a minute. There's a lot of things you could write about a lot of subjects. Why, why do you write about business? Why do you make this your specialty? Well, back when I was managing editor at the enterprise, we, I'd see new businesses open and I'd tell, I'd try to assign it to a reporter. Hi, can you just write a quick brief at least or something that, that this new business is open people, you know, should know about it. And they're like, yeah, yeah, I'll get around to it. And and then it just sat there. So I, I realized that this is something that needed to be that, that people wanted to know and or I did anyway. And so I was naturally curious. And so I just decided to start collecting them in little bits in it. When I first started it was just sort of whenever I had enough and I put them together as a column, you know, once a month or something like that. And it kind of took off and in popularity and I got more and more tips and that kind of thing. So that so it's been fun to write. It's more, I mean, it's my I've always wanted to be a journalist and I always have been in some way. Right now I'm more of a, it's more of a hobby almost, but because it's just this column once in and now right now it's once a week, but it's not my livelihood by any means. But, but it is my where my heart is in it and the feedback I get from people is really valuable. And so that feeds me more than anything. My parents owned a small business. So I it's in my heart as well. So yeah, it's a subject that just called out to you. And that sounds like a lot of newsrooms I've worked into where, you know, journalists can seem like, you know, we're all think the same way, but not at all. I mean, there's some really drawn to science or sports or business and a lot of others who aren't and you're one who's drawn to business. We're very near the end. I did want to mention you've got it's also visible your show, your columns also available online. Where can people find you on Facebook? It's just Cummings and goings on Facebook. And if people want to contact you, they can contact you through that or also at the end of your column in the enterprise. Right. Yeah. Email's preferable. The best is the best way to reach out to me and the best way to keep track of what for me to keep track of what I get. But yeah, and subscribe to the enterprise. We'll have to end it there. Wendy White-Sola has been our guest today. Thank you very much for appearing on Davisville. Wendy, I appreciate it. Thanks. I'm Bill Buchanan. This is Davisville. Again, it's a different kind of recording, so we don't have music at the end, but we will be back. Thank you for listening.


Welcome to track one, Noontalk. This is uh Isaac Kotler and Amit Klein. So please give em a welcome to Defcon. Thank you ladies and gentlemen and uh welcome to the uh presentation about process injection techniques. Uh some words about uh Itzik. You can see on the screen there. And also a few words about myself. And let's, let's begin. So why do we do, why do we even care about process injections? Uh so they don't see the slides. You'll have to believe me on that. So when we started researching process injection back in late 2018, we obviously wanted to first understand what other people already did in this area. And to our surprise we couldn't find any comprehensive collection or catalog of process injection techniques. We found it all over the internet in write ups, in proof of concept codes, and in blogs. Uh also we didn't, we didn't find any, we didn't find, okay. We didn't, we couldn't find a text that described the, the solely true process injections as we like to call them. And the text uh often uh took a bit of a liberal approach to what process injection is. Uh and uh lumped into process injection as some related but not true process injection techniques like process hollowing and spawning. Uh also we couldn't find uh uh categorization around the, the sub, sub techniques of process injection, namely memory allocation, uh memory writing, and uh code execution. And also we, we, there was a lack of analysis and comparison between process injection techniques. Um finally uh we couldn't find any update for the all the uh techniques that sometimes were developed for in the Windows XP days to Windows 10 uh with its latest security uh mechanisms and the 64 bit architecture. Before begin uh I want to uh extend kudos to Adam of Hexacorn, Ojan, and the Insilo team, and Xaba Fitzl of the uh also known as the Evil Bit and uh many others that uh have no uh no space here to mention. Uh for their research uh then they're in uh invention, in inventions in process uh uh in process injection techniques uh development, documentation, and proof of concepts uh of many, of many techniques. And of course head tip to end game for providing the first compilation of injection techniques, although that compilation uh did lump together some non-true process injection techniques. So let us first define what true process injection is. Uh we're talking about injection from live user space process uh typically malware to another live user space process which is the, the target for injection which is typically benign or legitimate process. It can be a system process like Explorer.exe or a Microsoft office uh process, your browser, your messaging software, your email software, whatever you. Uh this is in contrast to it which is out of scope for this uh project. Uh process spawning and hollowing uh and also some pre-execution techniques that require uh the malware to install or to configure things before the target process starts running like the little hijacking, upsert, up-in-it, lsp providers and image file execution options. Um so what's, what's important and interesting about Windows 10 and about 64-bit architecture. First uh Windows 10 introduced several security mechanisms such as a CFG, the control flow guard uh which prevents uh indirect calls to non-approved addresses. And uh CIG, the code integrity guard which only allows modules all uh as we call them DLLs to be loaded if they are signed by Microsoft, uh Microsoft Store or WHQHQL. Uh what's interesting about the 64-bit architecture as opposed to 32-bit architecture is that with 64-bit architecture the calling convention is different. Uh the first four arguments of a function are passed through the uh four uh volatile registers uh that would be uh R6, RDX, R8 and R9. So that if, so that in order to invoke uh successful invoke a function in the target process you need to control at least one or in, depending on the number of arguments in the function up to four registers as opposed to on, as opposed to only uh cooking up the stack which was the, the uh uh which was the way to invoke functions in the 32-bit world. Also in the 64-bit world there's no uh pop all registers uh in op code and that prevents us from uh uh elegantly populating all registers with uh desired values. The pro, there were, there are a lot of pro, good pro, excellent proof of concepts out there for uh injection techniques. Uh but the problem is that, that is that exact definition there, excellent proof of concepts uh in, in that what I mean is that they uh prove they handle, they have proper error handling and exception handling uh they are uh tailored for both 32-bit applications and 64-bit applications and they also lump together uh in this case uh the uh uh uh uh uh the novel memor writing technique with an execution technique in order to demonstrate a full end to end uh process injection. And that makes the uh source code uh uh blow into 1500s line of code, I don't know if you can see that. Uh and I, and as a researcher I was, I found it very difficult to focus on exactly what the novelty of the technique is. Whereas what I wanted to find or wanted, what I searched for uh is uh those, those three lines that are, that are wrapped into five lines at the right hand side of the screen where you can see the exact uh technique that is uh the exact technique that is used, in this case it's atom bombing. So what I, what uh uh what we could not find uh in many cases uh is uh concise three, four, ten lines of code that the, that describe exactly the technique and nothing more. So we set up to fix this situation and to fill this gap uh and to document all those uh process injection techniques. And the scope of our project was a true process injection running a sequence of logic or commands in the target process. So we're not talking about just uh forcing a system uh function call and, and spawning another process. Uh the focus was on Windows 10 version 1803 on the above. So we're talking about uh pretty recent versions of Windows 10. Uh X64 injection injecting process and X64 target process, both medium integrity. We only look at techniques that do not require admin rights and we evaluate all the techniques against uh recent Windows 10 protection, specifically CFG and CIG. Few words about CFG strategy. The attacker that wants to uh inject into a CFG protected target process has several options uh to choose from. The first one obviously is to disable CFG and this is possible for a standard Windows API set process valid call targets. Um however if you think about it, this is a pretty suspicious action in itself and can be flagged by security products. Also I uh speculate that it may be disabled or restricted in the future by Microsoft. Another approach would be to allocate or set executable memory uh which uh as a side effect makes all the allocated uh memory CFG valid. Uh this can be done with virtual ALOKE X or virtual protected X. But then again if you think about it, this is extremely suspicious. We all know what happens next.  Obviously we know what's going to happen. So this is extremely suspicious. The third option and I think this is the future of process injection techniques is to play by the rules that is writing a non executable data which is uh can be a ROP chain and then using a CFG agnostic execution method to run a stack pivot gadget and start running, start executing the ROP chain. Uh unfortunately or fortunately depending on your point of view only very few execution techniques are CFG agnostic and I will touch on this subject later in this presentation. With respect to CIG and other defenses they used to be, they used to be a technique to eliminate those defenses using set process mitigation policy in the target process invoking that with NTQ APC thread because that function has only three arguments uh that NTQ APC thread could cover them all. We'll see that in uh later slide. However this technique no longer works as of 1809 uh and I want to mention that CIG is most painful because it prevents us from loading a arbitrary non-Microsoft signed DLLs. So what are the typical process injection building blocks? We have memory allocation and when we are, when we are looking at uh such techniques we need to consider uh whether the allocation is implicit like a cave or a stack or explicit where we actually allocate the memory ourselves. What page permissions are there? What control do we have over the allocation address and whether the target addresses will be CFG valid or not? Then we have memory writing, populating that uh memory area with our desired values. And the questions are whether the, whether a memory writing technique allows us to write arbitrary data or are there restrictions on size or character set? And whether the writes are atomic or not? Finally there's uh there are the execution techniques and they need to be evaluated against whether the target has to be CFG valid or not. What controls do we have over the registers and what limitations and prerequisites are there for the execution methods and there are a lot of restrictions and limitations for some techniques out there. Without much ado let's go over some process injection techniques. I'm going to go over very quickly the uh uh very known ones and focus a bit more on the lesser known ones so I'm going to uh go quickly now. Uh there's the virtual alloc EX uh memory allocation technique that we're all familiar with. It can allocate executable pages so those pages become CFG valid automatically by Windows and of course we can only, we can allocate to just read write and later uh add the uh page executor privileges with virtual protect EX. Um then we have the classic memory uh writing technique of, of using uh write process memory. Again no prerequisites or limitations. The address is fully controlled uh with regard to CFG. If the allocation is set to executable privileges then there are no problems. Uh CIG is of course not uh relevant because they are not handling DLLs here. And finally there's the creator mode thread execution technique uh in which CIG has no impact because we're just, we're not talking about DLLs here. And with respect to CFG the target execution has to be CFG val- uh valid target and this is very val- uh this is enforced by uh the operating system. Uh we only have controls over RCX so we can only safely invoke functions with a single argument in this way. Then we have a classic DLL injection execution technique using again create remote thread but this time assuming we'll use the writing technique to write the DLL path into the uh target process already. We invoke create remote thread uh we invoke load library A with create remote thread and the argument of library load library A would be the the path to the DLL already written to the target process. Uh in this case uh the prerequisite is that this DLL on disk. And uh please note that DLL main this is the what uh the loader executes in such case is restricted to the load with the loader lock. CIG however blocks this technique so it no longer works if CIG is turned on in the target process. And uh I just mentioned that uh a variant of this technique can use Q user APC or NT Q APC thread instead of create remote thread. Uh another well-known next classic execution DLL injection technique is uh using set windows hookax in which case uh the DLL is loaded to the target process when the target process receives an event of a certain kind. And uh after we we uh invoke set window hookax uh we uh artificially send such event to the target thread and execution ensues. Again the prerequisite is that the DLL is on disk and again CIG blocks this technique. Uh one other classic execution technique is APC. You can use a Q user APC the standard windows API or NT Q APC thread which is the internal function and more uh flexible function and more useful one. Now the prerequisite here starts but starts getting interesting because the thread must be in an alertable state I'll talk about I'll talk about that in the next slide. CIG has no impact we're not talking DLLs here.  Um Q user APC grants us control over RCX NT Q APC thread grants us control over two and a half registers RCX RDX and the lower half of R8. This can be quite useful for functions that uh accept up to three arguments. Now what is an alertable state? It means that uh uh that the thread is executing or is hanging in one of five functions, sleepy X, wait for single object X, etc, etc. And uh in in all five cases it means that the actual uh internal function executed uh uh executed when the thread is hung is NT delay execution, NT wait for single objects and so forth. They all follow the same pattern, they all follow the same template of code in which case the RIP is in uh at the entry point like NT delay execution plus hex 14 so therefore very easy to uh discover whether a thread is in an alertable state if you know it's RIP. So this is one handy uh uh handy byproduct of our research. Moving on to another pretty known technique, the suspend inject resume thread execution uh as the name hints we suspend the thread and then we set the RIP using set thread context to our desired execution location and then we resume the thread the thread starts running in the new location. Now with respect to CFG amazingly there is no impact uh there's no check in Windows anywhere that this is a CFG valid uh address because there's it it it does not represent a callable function in the first place. Um there is a bit of a restriction on our speech should be within the stack allocated region. Uh as for control over registers there is no guaranteed control over the volatile registers. Uh this is a bit of a puzzle as in some processes uh we can control those volatile registers in others we cannot so we assume the worst we assume we cannot control the volatile registers. What if we can only write uh read write memory no execution in the target process? Well we can use the right primitive uh to write a rope chain to the target process and then set uh RIP to a stack pivot and start executing the rope chain for this mechanism. Now here is an exotic uh technique that's uh not too well known it's called ghost writing I believe it dates back to 2007 and it's a monolithic technique in the sense that it carries out both uh memory writing and execution uh together. So it's quite similar to thread hijacking but without the need for memory writing uh uh primitive. The idea here is that memory writing is achieved in steps using set thread context to set the register to set registers and at the each at at the end of each step the thread is running an infinite loop which will be our success marker. Once the uh the malware sees that the thread is in the in the in its infinite loop marker it knows that it's safe to move to the next step. So we need three rope gadgets for this uh a sync gadget is simple simply an infinite loop uh JMP minus two which will be the marker of a successful end of execution. I believe it's just two bytes of uh op codes. And then we have a write gadget something like uh move into the uh uh set by RDI the value of RBX followed by a return and then a stack pivot or something equivalent. So the first step is to write on stack the uh address of the infinite loop and the br- and using the write gadget and then finally the return from the write gadget will branch into the infinite loop and uh this will mark the successful end of this step. Moving to step two we write our arbitrary keywords uh so we repeatedly execute step two until we have all the memory that we need uh written to the target process. And the idea here is to use the right to to start the registers uh and to point at the right gadget so that the right gadget will write this keyword and then its return will branch right into the uh uh infinite loop. So marking the successful end of writing a single keyword and repeating this process as of as many times as needed to write all the arbitrary memory we need. Finally we just set RIP and RSP uh to desired values to start uh uh stack pivot or something similar and to start running over the ROP chain. One uh one lovely location for uh for the new stack is the unused part of the existing stack and here are some tips of how to do this right. Uh first you need to maintain some distance from the official top of stack the RSP value in order to provide some space for stack for natural stack growing as as the stack is used by Windows API calls. But on the other hand you can't go too far because the stack is limited by one megabyte. So something like 64 kilobytes is probably in the in the in the right neighborhood. Now you need to grow the stack uh uh one page at a time one guard page at a time in order to get from the TOS to where you really want to start writing your own stack and you do that by touching the memory page size intervals so that the uh the guard page would will keep uh uh so the uh kernel will keep committing new pages uh as as as we follow this algorithm. Finally you need to mind the stack alignment which is set to 16 bytes and it's uh really uh observed by some functions. So the uh the prerequisites from ghost writing is simply just a place where you can we can write some some data. There's no impact from CFG except uh what we already know about RSP. No of course no impact uh by from CIG because there's there are no DLLs involved and we have control over some registers which is nice. Now moving to um shared memory writing technique. Uh in this case uh the prerequisite is that we know that the uh target process uh has a shared memory section. We know it's name and we know it's size and now it's pretty uh predictable if we know the exact software that we are targeting and it's build we know whether there are uh uh whether it uses shared memory and and or forth size. So this is uh we assume that this knowledge is available to the attacker. So the attacker first maps this uh shared memory to its own process writes the payload at the end of this uh shared memory. Hopefully it's an area not used by the legitimate software. And then uh opens the target process and starts looking for uh scanning its memory uh region by region. Trying to find a region that matches the attributes of the shared memory uh uh section. And this and so we are comparing we're looking for a map memory uh map and committed uh with page read write attributes and exact uh size that we expect the shared memory to have. Once we find we also do a read memory to make sure that the payload is at the at the end of the shared memory. And once we know that we can start using this as memory written to the pro to the target process. Uh so the prerequisites obviously is that the target process has a read write shared memory and the attacker knows the name and the size. Uh with respect to CFG uh it's probably irrelevant because this memory is typically uh read and write only not executable. And CIG of course is irrelevant. Now we move to the atom bombing writing technique. So Navy speaking uh assuming the payload is small and it has contains no null bytes and except for terminating null byte uh what we have here is the uh the uh essence of this uh writing technique. We define a global uh uh an atom object in Windows that uh contains this payload for in this in the malware process in the injecting process. And then we use NTQ APC thread uh to invoke the function get global get atom name A in the target uh process asking it to copy the value of the atom that we just created uh into the designated address. Now uh this is uh pretty uh pretty neat. The original paper uh doesn't try doesn't provide uh uh doesn't support writing null bytes. It simply assumes that the target memory is zero doubt which is the case because they chose to use a code cave. Uh we devise the technique to write null bytes and it's it's in our paper. The prerequisites are again that the third must be in an alertable state and that the target payload is allocated and writable. As for CFG and CIG there's no impact of course. Um and then we have another uh interesting uh allocation and writing technique combined uh using NT map view of section. Uh in this case the uh malware process forces uh a section to be mapped in the target process. It does so by first uh defining a section, populating it with the desired values and then uh opening the target process and uh doing running NT map view of section of the target process of the section into the target process. It's uh uh and we can also control the uh uh page attributes. You can ask for executable and and read execute and read write. So this cannot be used for already allocated memory. So for example we cannot write values on the stack using this technique. Uh and uh the the nice thing is this CFG wise is that Windows once because we requested the page executable Windows will will mark the whole region as a CFG valid. This is a uh a quite fascinating execution technique the unmapped plus rewrite and it works like this. We we look at a DLL used heavily in the target process. NT DLL is of course a prime choice. And then we first copy all the region of this DLL into our own process. Uh we suspend the target. So first we suspend the process then we copy the existing NT DLL and entire module space into our process. We make a copy of it. We patch it this copy locally. For example we can uh patch NT uh NT close which is heavily used function. And then we un-map the original NT DLL section from the target process and use any uh writing allocation and writing technique to map and and write the uh the patch the patch the NT DLL copy uh to where the original NT DLL uh used to reside in the target process memory. And finally we flash the instructions from the CPU so that it will not it will forget everything it know it it thought it knew about those uh addresses um and we resume the process. Now this is uh quite elegant. And of course with with respect to CFG it's a bit tricky because there are many all the entry and all the entry uh uh uh uh uh addresses in NT DLL must be also uh uh be CFG valid uh now after this uh switch. Uh however fortunately uh when using NT map view of section and virtual al- aluki x uh it is guaranteed guaranteed that Windows sets the whole reach and in fact to be uh CFG valid so this is taken care of. Um and there are some uh tips regarding how not to destabilize the process. Uh first we need of course to do a process wise suspend because we can't know which thread will use NT DLL and when. And then the whole thing about copying the complete NT DLL memory and then uh copying it back instead of just say uh uh copying parts of NT DLL is because we need to make sure that some uh variables inside the NT DLL space are consistent. And if we just copy code and not the uh some uh uh variables that are part of the static variables and such that part of NT DLL will bound to get in into inconsistency which will immediately crush the process. So if you do that copy the whole region.  The idea is that uh we write, we write some code into the target using any writing technique. Then we find or obtain a memory object with a virtual table or a callback uh table. Uh this may be tricky because uh it's not uh not all processes uh have all objects like uh ALPC or some sometimes some objects only exist in console application, some objects only exist if the uh application has a private clipboard. And this finding or obtaining uh can be done via a standard API like get window long PTR or via memory search like as is the case with ALPC. Then we replace this object or callback uh to point at our desired execution point which must be CFG valid target because windows will check each and every of those uh uh execution techniques in each of every one of them CFG is is checked. And it may also require some adjustments to the object on to the code. We trigger execution which may be tricky because some uh techniques are not uh um deterministic and we cannot really force uh the execution uh uh upon them. And finally we restore the original object and callback so the process can resume normally. This is an example a control inject uh in which uh we uh encode a pointer to our desired address and then we copy this pointer uh to where to the control C uh handler in the target process which is uh the address of kernel base single handler. And finally we trigger execution by uh first uh simulating uh pressing the control key using send input and then uh sending the C character to the target process. Now we move to a nice technique that we developed uh we used uh uh a nice writing technique we developed based on Memset on Memmove in which uh the idea is that we write uh arbitrary data to the process uh uh by uh uh byte at a time. And we use NTQ APC thread uh with uh the target function invoked being Memset. This is a classic uh NTDLL function so it's uh there's no CFG problems here. And since Memset takes three arguments the destination address, the byte to write and how many copies we simply use it with the address we desire, the byte we desire and the constant one. And we can loop through our buffer and copy it to the destination address. Uh by the way along Weinberg uh we will be presenting here at today at 4 p.m. I believe they develop a similar uh technique. The prerequisites are that the thread must be in an alertable state we already discussed that. And CFG is not affected because as I mentioned NTDLL Memset is CFG valid. Finally there's this the execution technique we developed we call stack bombing. Uh in this case uh the idea here is that we override uh a thing uh the return address on stack to point at our desired uh destination address. Now if the thread happens to be in an alertable state it becomes pretty simple. The code for an alertable a classic alertable state internal function is this. As I said uh the the code the the thread is hanging right after syscall at uh at entry point plus hex 14. And as you can see what will happen next is an immediate return without touching the stack or the registers. So that if we modified the the value pointed to the value on stack pointed to by RSP we are bound to get execution. Of course the implementation is much more uh sophisticated and complex. There is a nice proof of concept uh in our paper and in our uh uh get uh the repository. Uh and the beauty of this uh technique is that uh there's no impact on CFG. Uh and so we can use ROP chain and start executing even if CFG is enabled in the uh in the target process. There are two techniques that we could not uh make um we could not implement uh successfully for Windows 10 the set win event hook and the desktop technique. If you manage to run them on Windows 10 X 64 version 1903 please please contact us we would be delighted to know. To summarize we looked at sick uh sorry five writing techniques and you can see the compassion here and in our paper. We also looked at over 20 execution techniques and uh you will see that uh techniques that are CFG agnostics marked in the yellow uh at the uh right hand side column are pretty rare. There are uh one two three and ours is the fourth and I we believe this is the future of process injection. Uh quick bonus if you need to load a DLL a system DLL into an arbitrary process maybe and you don't have a writing technique to write its path uh into the process first maybe a whole ROP uh maybe your favorite ROP gadget is there. Uh we have good news for you. KernelBase.DLL contains uh the names of uh more than a thousand system DLLs including some things like MSHTML.DLL shell32.DLL and wininet.DLL and you can use that uh to load uh the DLL using load library. And with that I hand it over to you Itzik. Thank you Amit. So as Amit mentioned our research was not only theory there's also the practical implementation side of it and as we went through and scraping different proof of concept trying to compile together we decided to take it to the next level and create Pinjectra. So in a nutshell Pinjectra is a framework that allow you to combine mix and match style. Different elements as Amit presented writing and execution and obviously the payload in a mix and match style. And we're gonna sit in the next few slide feel free to go to the GitHub right now and download your copy. Okay so once you'll go to the GitHub you will see that the Pinjectra solution is basically made from four major projects. As Amit mentioned some of the injection techniques requires an artifact a DLL. We already provided it for you. So the first two projects here are DLLs that are implementing certain interfaces so they can be easily used for the purpose of the injection. The other two is the Pinjectra itself which contains the library of the knowledge as well as the implementation and also for your convenience we also released a test process. This is a dummy program that puts itself into an alertable state as Amit mentioned it's a prerequisite for certain attacks techniques and so this will do the job for you. Now let's step a little bit outside and understand what's the philosophy. As I mentioned Pinjectra is a mix and match it's using object oriented so we leverage the CC++ static type system to create different classes from different types and so it's very easily kind of mixing together into a full attack. And how does it look like? Pretty much like that. So what you can see right now is the implementation of our new technique the stack bombing in Pinjectra. It's very easy, it's very clean, it's very elegant. We're looking on three major classes here. The first one code via which provides the actual execution so that's a class of an execution technique. Then we can see the net queue APC thread that's the writing technique and then at the end we can see the rope chain that's class representing of the payload. The mix and match philosophy means that you can now play and try different techniques, different primitives and see how they can combine together. You can obviously create the new ones and then explore different avenues. And now all this wrapped up in a very nice model. At the end of it there's a method for this class called inject that expects the process ID and thread ID and there you have it. And now let's go into a demo. No. Some technical difficulties. Okay. So what you can see here is two CMD consoles. There's a red one which will be the attacker and the green one which will be the attack key or the victim. So right now we're just going to run the test process. Again as I mentioned that the purpose of that was to be the victim of the process injection. As you can see running it will conveniently print the process ID thread ID as well as we'll put it into unrotable state. Going into the Pindjectra we will run it once without any parameters that will give us the usage of all the different attacks that are possible within the demo. Now finding the right combination with the process ID and thread ID will invoke the actual injection. In our payload by default we're using a very nifty low box word so that's the process that you will have if you have a successful injection using Pindjectra right now. Okay. And as a bonus which we've seen for the last second there the process itself continues to run as interruptively. So again the process doesn't crash it keeps running. Moving on to a few other techniques that Amita has mentioned and how they can be implemented within Pindjectra. Here's the ghost writing technique. So as you can see we're using conceptually the suspend inject resume design pattern not to be confused with the set thread context technique that Amita has presented for the classical sear. Then we have the ghost writing as the actual writing primitive and then that accepts the payload. So again a pretty fairly simple way to combine different techniques into one fusion process. So let's check this demo as well. Okay so the same idea applies we're creating a green process to be injected to. And then we're going into Pindjectra. Again running it without any parameters we will see the different usage that contains the different options. Giving it the process ID and predate ID. And we pop the box. Thank you. Okay uh again continuing with the series of demos that we have planned for you today as Amita mentioned the uh very exotic and uh interesting technique of the unmap and map which includes many different steps in the way. Again with Pindjectra we've broken down into these three different classes. For the people here that were uh keeping notes on the actual class names you can see that the code via suspend inject and resume underscore complex was already actually used in our own implementation of the stack bombing. This is just one of the features of using these libraries the ability to reuse existing code and logic. And so we do not have to re-implement the uh conceptually execution technique we can then just focus on the create file mapping map file map view file NPN map and map of the of the section. This is the combination that essentially identifies these technique. And of course the payload that has been accepted as the payload comes on top of it. So the idea again is we're creating a green process and a red process. In this case as Amita mentioned our test process was not complicated enough to include all the different uh results and APIs and so basically we also provided this very small batch file to simply return the uh feed of the explorer. So in this case we're going to actually attack the explorer itself. So that gave us back the PAD of the explorer process. And now going to Pindjectra we're going to use that as the destination of the process injection. Takes a little bit of a time. And here it is. Okay uh the set window long pointer is quite an interesting implementation. As Amita mentioned we need to retrieve the actual structure and then change the callback within it. So for here it's actually a mixture of an execution technique which stands on its own. That's the code via set window long PTR. And then what we actually did is within the framework we refactor one of the most primitive techniques which is a combination of virtual uh allocation and write memory in conjunction with the payload. And the connector that actually brings them together is a metadata that calls complex demutable advanced memory writer. As you will dive into the framework you will see there's different types of classes to accommodate different types of attacks. That is an actually a converter that we created for the purpose of this attack. So let's jump into the demo. It's important to mention that since this attack requires retrieval of a specific structure it's much easier to find to implement the discovery of finding off explorer within the attack itself. And that's what you're going to see right now. So there's not going to be any green screen right now. It's only be contained within Pinjectra. So we'll pass zero zero as an indication that again Pinjectra method will come out with the PAD and TAD of explorer while using the set long window PTR API. And here it is. Okay. And last but not least let's talk about the atom bomb technique and how it's implemented again within Pinjectra. As you can see the Q user APC is used as the code execution technique and then the sequence of open thread, open process, virtual allocate and global add atom A are the actual writing sequence. And again you can see you can control the different parameters and you can control the function that retains the payload. And having said that let's see how it looks on our platform. So here again we will be using the repeat of the actual explorer to perform the actual testing. Again we need a much complex process providing the PAD and TAD of explorer. Takes a second there and boom. Excellent. Thank you. And with that back to Amit. Thank you Yitzik. So what have we seen today? We have actually three deliverables through our project. One is a mapping of the vast territory of true process injection. And together with that we provide an analysis and comparison.  It's part of the DEF CON deliverables from our side which so it's a PDF document for your enjoyment and pleasure. It's also on our website. We also provide this library that Yitzik demonstrated called the pinjectra for a mix and match generation of process injection attacks. Now this is extremely important because a lot of the POCs out there will couple a single new say memory writing technique like in atom bombing with a single execution technique just to demonstrate that. And this becomes the atom bombing process injection technique. So if you want to test your environment against or your system against atom bombing you may as well test that with not just a single execution technique but the all the array of possible execution techniques that can be coupled to atom bombing. And that's exactly what we provide with pinjectra. The ability to couple or to match any almost any writing technique with almost any execution technique. And thereby we allow red teamers, blue teamers, security researchers to cover almost all the possible all possible combinations in this in this universe. Finally we also describe a new CFG agnostic execution technique and I remind you that this I believe that this is the future of process injections. The ones that are based on the CFG agnostic execution techniques which we call stack bombing. And with that and coupled with that we also describe a new memory technique using a memset and memmove over APC. So that's our three deliverables. Thank you very much. Ladies and gentlemen.