Okay. Welcome back everybody to BC 308, our class on Revelation and Daniel. We are in Daniel 7, we have a little bit more to complete in this chapter. I see Abhishek's question. I have a question regarding the iron and clay. Does it also represent the mixture of AI technology and human? Okay. Right. Abhishek, every time we study scripture, we must always interpret scripture within what scripture is telling us. When the scripture is giving us the interpretation, then we shouldn't superimpose or bring to it a different meaning. So if you go back to chapter 2, Daniel chapter 2, the meaning of every part of the image is already given to us. For example, in Daniel 2, he clearly says verse 38, you, he's telling Daniel 238, end of the verse, he says, you are the head of gold. That means he's saying, King Nebuchadnezzar, you are the head of gold. That means gold represents the Babylonian kingdom and it represents the kingdom. So everything in Daniel 2 in that image is representing a kingdom. So silver represents a kingdom, brass represents a kingdom, iron represents a kingdom. So we cannot therefore bring in something of our own and ascribe it to what the Bible has already interpreted for us. So I cannot say, oh, gold represents the United States. I can't do that. The Bible already said here, Daniel said, you are the head of gold, Nebuchadnezzar, your kingdom, that's gold.  And he explains everything. So therefore, when he says iron mixed with clay, he's already told us what iron is. Verse 40, iron is a fourth kingdom. Iron is not AI technology. Iron is not anything else. It's a fourth kingdom. He told us what iron is. That's in Daniel 2, verse 40. And therefore, when he continues in verse 41, and he says iron will be mixed with clay. Hey, he already told us what iron is. Iron is the fourth kingdom. The fourth kingdom is now going to be mixed with clay. And then he tells us what clay is in verse 43. He says the clay represents the seed of men, meaning all the other races, people of all other kingdoms. So the scriptures have already interpreted this for us. What is iron? What is clay? It's already interpreted. So it'll be wrong to ascribe a different meaning to iron than what is already given to us in scripture. Does that help, I'm sure? Yeah, okay. So let's go back to chapter 7. So we have looked at all the... Srikumar, you have a question? Yes, I just want to know. Can we see that iron and clay also... Can the democracy represent iron and clay? Nowadays, now the kingdom is not there, as you said, the weakness. Can we consider that? Let's see. So iron is mixed with clay. Now what you're trying to say is, can that represent democracy? See, democracy is a form of government. So here, what Daniel is telling us in chapter 2, he's saying iron, which represents the fourth kingdom, which we know as the Roman Empire, that is mixed with clay. And he's basically talking about how people of that kingdom are going to be mixed with the seed of men, which is people of all other races, what has happened or is happening throughout Europe. And everywhere where the Roman Empire was, people are all mixed, everything's happened. Can we say that is democracy? My response to this is... See, the answer is no, because he's not really talking about... the form of government. That's not the emphasis. The emphasis on the fact that there's an intermingling of what was part of, what was previously part of the fourth kingdom, the Roman Empire, with all the other human races. So that is the emphasis of Daniel chapter 2. And what was that? Verse 43, right? So that's the emphasis. And don't see any indication that he's trying to imply a form of government. I think the focus of verse 43, Daniel 2.43, is more of the intermingling that's happening, as opposed to a democratic form of government. Because, I mean, yeah, that's my response to your question. Yeah, I wouldn't infer democracy from Daniel 2.43. Yeah, I'm taking a little time to answer your question, because first time somebody's asking me this question. And I'm just thinking through on it. Yeah, I wouldn't infer democracy from Daniel 2.43, because I feel the emphasis is more on the mixing of races and people as opposed to the form of government. Thank you, sir. Thank you. Yeah, okay. Yeah, so Daniel chapter 7. So we have looked in Daniel 7 at the beasts, the four beasts, the ten horns, the little horn, all that's going to happen. Now we need to look at what else Daniel saw. This is from verse 9. So after he sees the beasts, the four beasts and all that, suddenly you can say the scene changes in the vision. And there's a fresh scene. Something completely different. He's seeing verse 9, he's seeing thrones in place and he sees the ancient of days. And he just describes it.  So remember, Daniel is seeing a vision and he's describing in the language that he could what he's seeing. So it doesn't mean that God's throne has wheels and God is in a wheelchair moving everywhere around heaven. That's not it. Though he says the throne has wheels.  Now you and I may use different language if we see the same vision. We might see somebody, we might say, he is so bright and we may express or capture what we see in different words in language of today. Daniel captured it in the language of his time.  Don't think the throne has wheels and so on. He's just speaking, just describe what he's seeing. And we're standing, there's a stream that came forth. I mean that the glory of God, the presence of God just streaming out of that where God is and he's seeing thousands and thousands and tens of thousands of people ministering standing before and seemingly he's saying the court was seated, the books were open. So it's almost like a great court, heavenly court scene. Like God is there, thousands of people are there and it's like God is sitting as judge. So that's the thing. Now we don't have to say okay there's a little court and you apply for your case and then you stand in queue for your turn to come and then you appeal your case.  No, he's just communicating that fact that God is sitting as judge over all mankind. That's what God is, right? So don't add to that picture of a court scene and God being judge. What we do on earth, these kinds of things do that court. Some people have done it and come up with all kinds of crazy theology. So don't do that. Basically what he's saying is this ancient of days is God is judge over everybody. Everybody's standing before him, okay? And then what happens? When this whole thing is happening, basically that's the time, basically he's saying verse 11 and 12, that's the end of this little horn who was speaking pompous words. Hey, he's just out of the picture. Verse 11, you know? That little horn and in verse 11, he uses the phrase in the New Kingdom, the beast, the beast in verse 11 is in the context of little horn. Okay, so that little horn who is the beast taken out of the picture, put into flaming fire. Verse 12, the rest of the beast, okay, he saw four other beasts, right? Earlier. They were also gone, but he says their lives are, yet their lives are prolonged for a season at a time, meaning those kingdoms are all gone, but the people from those kingdoms continued for some time, which we know that could happen because when the saints inherited the kingdom and that kingdom is set up here or not, they're going to rule over the world, which includes all of these kingdoms that were covered by these four beasts, the Babylonian, the Medo-Persian, the Greeks, the Romans, and then the whole mix of people. So the lives, the kingdoms are gone. Nobody remembers Babylonians, Medo-Persians, and Greeks on that, but those people are there. They are continuing on the earth for a season at a time, meaning that we know it will be the millennium, all those people will be on earth and the saints will rule over them. Okay, that's verse 11, verse 12, that it goes back to seeing what happens in heaven. Verse 13. And I was watching the night vision. That means, look, I'm continuing to look in this vision that I'm seeing at night. And I see the one like the son of man coming in the clouds of heaven. He came to the ancient of days. They brought him near before him. So the son of man, this is the Lord Jesus Christ, or we could say the eternal word, God the Son. He's coming in the clouds of heaven, meaning that, you know, you can imagine that there's huge, glory, white clouds all around him. So he's entering this awesome vision. That's the ancient of days, God the Father. Thousands and thousands of people are all around him. He is sitting as a judge. And here comes God the Son into the presence of the Father. Now, this is very significant in helping us understand the Godhead, the Triune God. So what do you mean? You see two persons, God the Father, God the Son. Right? Then we can therefore say, okay, God the Holy Spirit is also a person. So the Godhead spoken off in Scripture is one God in three persons. These are distinct persons. God the Ancient of Days, the Son of Man. That's what he's seeing in the vision. Right? So it gives us clarity in understanding the Trinity or the Triune God of the Bible. Right? Distinct persons.  Distinct persons. Because the Son of Man is walking into the presence of the Father. The title Son of Man, as I mentioned earlier, I think last week or I mentioned earlier, that title is very important because Daniel is using this title here, Son of Man. Of course, we saw it used in chapter four. I mean, we didn't see it. It is in chapter four. When Nebuchadnezzar sees, he says, I see a fourth man in the fire. So this title, the Son of Man is very unique. And it is what the Lord Jesus used for himself. And this is what made the Jews very angry. How could he, this acupuncture from Nazareth, how dare he self-reference himself as the Son of Man? I know many times we interpret Son of Man in the context of his humanity. There's nothing wrong with that. But correctly, the Son of Man is a title used by Daniel to refer to this eternal being, God, who came into the presence of the ancient of days. And Daniel is using that title, Jesus is using the title for himself while he was here on the earth.  And then verse 14, to him was given dominion and glory in the kingdom and all people to serve him. And his dominion is everlasting dominion and his kingdom will not be destroyed. So the kingdom was handed off to the Son of Man. Now we skip to the latter part of chapter seven. Verse 26, 27, the gold proceeded. They shall take away his dominion. That is the beast, that little horn. And he'll be destroyed forever. And verse 27, then the kingdom and dominion and the greatness of the kingdoms under the whole heaven shall be given to the people, the saints of the Most High. His kingdom is everlasting kingdom and all dominions shall serve him. So what's happening? Daniel saw the ancient of days. He saw the Son of Man coming in and all authority dominion was handed to him on the earth and then he turns it around and he gives it to the saints. So that's the setup. That's what's going to happen in the millennium. The saints will rule the earth with the Son of Man, Jesus Christ. So this is Daniel chapter seven, beautiful chapter. It's just amazing details. But more details are to come in chapter eight and nine. He's going to explain further and further, give us more details. Okay. Let me pause here and just take up some questions. And let's see, Kennedy, where was Daniel when Shadrach Mission and Abednego were in the fire? I'll just ask a side question. Yeah. So they were all there in King Nebuchadnezzar's, in Babylon. Daniel was working in King Nebuchadnezzar's palace. So he probably had a senior position. And remember when Daniel was elevated, he also requested that Shadrach Mission Abednego be given some important position in the court. So we don't know what their positions were, but they were also serving in the court, given some position, some work to do. I don't know what work was. Because Daniel requested, right? Make sure you give them something. And they were all prepared for that. So maybe Daniel had a more senior position, a more prominent role. Shadrach Mission Abednego had some sort of role in King Nebuchadnezzar's court. Later on in chapter four, when this image, when Nebuchadnezzar made this image and said, everybody must bow to it. Shadrach Mission Abednego refused to bow. Daniel must have been in the court, or we don't know, but he was not singled out at that moment. Be assured that he would not have bowed to the image. But these three boys, young men, sorry, were singled out or caught, not bowing to the image. Therefore, they were dealt with. So Daniel must have been around. And the Bible doesn't record anything. Tell us what he exactly did. But we can just use our imagination. Daniel must have been praying. And he must have been saying, God, deliver them or something. And yeah, so we know he was there. What exactly was doing? It's not recorded for us. Elisha, in the present, who has dominion over the earth? So that's interesting. Because the Lord Jesus said in John 12, now is the ruler of this world cast out. I'll give you the exact verse, John. Yeah, this is verse 31. All right, John 12, 31. Jesus said, now the ruler of this world is cast out. And in John 16, Jesus said that the ruler of this world is judged or condemned or he's sentenced. This is in John 16 and was 11. So when Christ died on the cross and did finish his work, Satan was dethroned. Satan was condemned. Yet when the apostle Paul is writing later, he refers to Satan with this language. He refers to him in 2 Corinthians 4, verse 4.  He refers to him as the prince of the power of the air. Jesus said, Satan is cast out. Satan is judged. We know Colossians 2. Jesus disarmed prince buddies and powers Hebrews 2. Jesus destroyed the one who has the devil. Matthew 28. Jesus said, all authority in heaven and earth is given to me. Then how could the apostle Paul refer to Satan as the God of this world? Isn't it contradictory? How could the apostle Paul refer to Satan as the prince of the power of the air? Isn't it contradicting what Christ did? It's not because Jesus represented the human race over through Satan and all his demonic powers, but Satan is disarmed. But he's given time to continue doing whatever he's doing here on earth until Revelation 20, verse 15. I mean, sorry, until Revelation 20, verse 4, which is the beginning of the millennium, then he'll be taken out for a thousand years and then he'll be given again a brief period of time.  But until Revelation 20, verse 4, Satan has continued to give permission to continue operations on the earth. But remember, in Christ, he, Satan, and all his demonic powers are actually disarmed before those who are in Jesus Christ. So in one sense, he's still the God of this world because he's continuing to hold sway over the people who are in darkness, influence them, work in them, so on. And in another sense, he is completely powerless before the believer because all authority that Christ has is now exhibited or is now being exercised through the church. So to answer your question, who has dominion of the earth? It really depends on which side you are on. If somebody is on the side of darkness, then for that person, Satan is exercising control. Well, those of us who are in the kingdom of light, we are in control. We are in charge because we have authority and power over Satan and his demons. And this will continue till the millennium when Satan is removed, the beginning of the millennium when Satan is removed from the earth. So did I answer your question? Is that clear? Yeah, Kennedy. I wish we did the historical part of this book. Yeah, so I kind of presented that in the very beginning, the opening introduction chapter we went through the history. And so if you go back to the very first lesson in the notes, the entire history starting from Abraham from the very beginning all the way till when, till from the Assyrian Empire all the way till the revolt of Maccabees is outlined for us. And so the history is available. And also I could refer you back to what we did last year in the end times where we looked at the history of Israel. We started off from Abraham all the way till the establishing of Israel as a nation. And then that covers a lot of, you know, what happened in terms of history in the context of which Daniel 7 comes in. Okay. If you want a lot more detail, then I would refer you to one of the PDFs that I've shared by David Woolford. And there's a lot of content that you could read there, historical content that you could read through that PDF. Now, you know, it's a huge book and there's a lot of content. So if you're interested in the historical part, you can definitely read through that. I'm just presenting it in the context with some background. Okay. All right. Very good. Any other questions on Daniel 7? Go ahead, Asha. Sorry, that's too much. Here in the Denims of Jerusalem, you're speaking about the descent of men, right? So, like, is it considered as one of, like, the prophecy of, like, oh, Jesus is going to, like, how the Book of Isaiah is mentioned? Okay. So your question is, is Daniel 7 a prophecy of who Jesus is going to be? Like how Isaiah foretells, for example, about the birth of Christ and so on. So you're saying, is it a prophecy of who he is going to be? That's your question. Is that correct? Yes, that's your question. Like, how he, like, like how I know, I know kind of understanding because everything plays things in the Book of Matthew and words about who Jesus is, like he was born physical and all this stuff. And the Book of Isaiah talks about his death and all this, how he was martyred and all for us. Like, he was martyred and crucified for us. And here, how the nation and what the Son of Man. So I'm just wondering, like, all this, how it is connected. So. Okay. Okay. Here's a simple explanation. Everything we read about Jesus in his glory as after his resurrection, that is the same and equal to everything we read about Jesus, who he was before the incarnation. That means the Jesus after his ascension is the same as the Jesus before the incarnation with only one difference. The only one difference is that Jesus after the ascension has a glorified body. That means the Jesus before the incarnation, the eternal word is the same as the Jesus after the ascension. He's still the eternal word. But when he ascended, he ascended with a glorified body, a spirit body. Now, but in terms of deity, the same. It's not like, you know, so Daniel is Daniel 713. He's seeing one like the Son of Man, to whom the kingdoms are over-given. Well, the Son of Man, the Daniel sees in Daniel 713, is the same at the time Daniel was writing this, which was before the incarnation. He's the same person. Same glory, same deity, everything. Except that now when he ascended, he ascended with a glorified body. So in our minds, we should be very clear that the eternal word who became the Son of God, Jesus Christ, and when this Jesus ascended, he became the same as he was. How do we know that? John 17 and verse, I think it's verse 5. Let me give you the exact verse. John 17, verse 5, says, Father, John 17, verse 5, Jesus is praying, says, Father, glorify me together with yourself, with the glory which I had with you before the world was. So imagine this. Jesus is on the earth in a physical body as the Son of God. He's praying to God the Father. He says, Father, glorify me. That means give me something I don't have right now. Glorify me. What's he asking for? The glory which I had with you before the world was. That means in the eternal past. So after Jesus' ascension, what happened? He was given the glory that he had with the Father before the world was. So the Son of Man, Daniel C. and Daniel 7, verse 13. Oh, sorry. Yeah, verse 13 is the Jesus who has the glory, the same glory that he had before the world was. Does it make it clear? Yes, Pastor. Thank you. Okay. All right. Any other questions from Daniel 7? So let's go to Daniel chapter 8. Now, Daniel chapter 8 is again very interesting. But in Daniel 8, he focuses in on certain things. It's like, you know, if you're looking at a magnifying glass, if you see it from a distance, you're seeing the full picture. Now you bring the magnifying glass a little closer, you're zooming in on certain parts of the big picture that has been presented to us from chapter 2 and elaborated for us in chapter 7. So once again, we need to read the entirety of Daniel chapter 8 and then, you know, start getting into it and seeing what is there. I see we have 10 minutes, I think. We should be able to read Daniel 8 in 10 minutes, I think. So let's do that. Let's try to do that. I want to encourage everybody. You know, let's go through it three verses at a time. Let's try to read Daniel 8, please. Daniel 8 verse 1 to 3. In the third year of King Dorsher's reign, I, Daniel, had a vision after the one that had already appeared to me. In my vision, I saw myself in the citadel of Sousa, in the province of Elam. In the vision, I was beside the Pulae canal. I looked up and there before me was a ram with two horns standing beside the canal and the horns were long. One of the horns was longer than the other one. The other one grew up later. Thank you. I saw the other one charging westward and northward and southward. No beast could stand before him and there was no one who could rescue from his power. He did as he pleased and became great. As I was considering behold, a mere goat came from the west across the face of the whole earth without touching the ground and the goat had a conspicuous form between its eyes. He came to the ram with the two horns, which I had seen standing on the back of the canal and he ran at him in his powerful wrath. I saw him come close to the ram and he was enraged against him and struck the ram and broke his two horns and the ram had no power to stand before him but he cast him down to the ground and trampled on the ground. He came to the ram with the two horns which I had seen standing on the bank of the canal and he ran at him in his powerful wrath. He cast him down to the ground and trampled on him and there was no one who could rescue the ram from his power. Then the goat became exceedingly great but when he was strong, the great horn was broken and instead of it, there came up four conspicuous horns and four wings of heaven. Out of one of them came a little horn which grew exceedingly great toward the south, toward the east and toward the glorious land. Daniel 8 from 10. It grew great even to the host of heaven and some of the host and some of the stars it threw down to the ground and trampled on him. It became great even as great as the prince of the host and the regular burnt offerings was taken away from him and the place of his sanctuary was overthrown and the host will be given over to it together with the regular burnt offerings because of transgression and it will throw truth to the ground and it will act and prosper. Then I heard a holy one speaking and another holy one said to that certain one who was speaking, how long will the vision be concerning the daily sacrifices and the transgression of desolation the giving of both the sanctuary and the host to be trampled underfoot and he said to me for 2300 days then the sanctuary shall be cleansed then it happened when I Daniel had seen the vision and was seeking the meaning that suddenly there stood before me one having the appearance of a man. And I heard a man voice between the banks of the Ulai who called and said, Gabriel make this man understand the vision so he came near where I stood and when he came I was afraid and fell on my face but he said to me understand son of man that the vision refers to the time of the end now as he was speaking with me I was in a deep sleep with my face to the ground but he touched me and stood me upright and he said, look I am making known to you what shall happen in the later time of the indignation for at the appointed time and ends shall be and the ram which you saw having the two horns they are the kings of media and Persia and the male goat is the kingdom of Greece the large horn that is between its eyes is the first king now that being broken whereas four stood up for it four kingdoms shall stand up out of the nation but not in his power and in the later time of that kingdom when the transgressors are come to the full a king of fierce continents and understanding dark sentences shall stand up and his power shall be mighty but not by his own power and he shall destroy wonderfully and shall prosper and practice and shall destroy the mighty and the holy people and through his holy, through his policy he shall cause trickery to prosper in his hand and he shall magnify himself in his heart and mind and in the security he will corrupt and destroy many he shall also stand up against the prince of princess but he shall be broken and that by no human hand the vision of the evening and the mourning which has been told you is true but seal up the vision for it has to do with and belongs to the now distant future and I Daniel fainted and was sick for several days afterward I rose up and did the king's business and I wondered at the vision but there was no one who understood it or would make it understood thank you guys thank you, thank you so very interesting Daniel again he has recorded this vision which he had earlier previously during the time of Belchazar in this vision he is seeing two different animals he is seeing a ram and he is seeing a goat now as before the interpretation is given to us in this same chapter so let me ask you what does the ram represent what does the goat represent the male goat the ram represents the king of media and pleasure and the goat or shaggy goat represents the king of priests perfect, thank you so right there right there in verses 20 and 21 the angel Gabriel speaking to Daniel has told him Daniel you are seeing these two animals fighting but these two animals the ram and the goat they are actually representing these kingdoms now remember he saw this vision at the time of Belchazar that means in the Babylonian while he was still under the Babylonian kingdom so God is showing him ahead of time and saying hey you know the Medes the Persians the Greeks so Daniel is being a given vision ahead in the time of coming world empires and Daniel is in the time of the Babylonians the Belchazar and the meaning of these animals is given right there so he sees verse 3 he sees a ram that is moving westward so that means Medes and Persia basically is covering in today's map would be the region of Iran and Iraq the Medes and the Persians he is seeing this ram it has two horns one is small and one is big the small one represents the Medes who took over power but then they lasted just a short time and then the Persians took over and were in power longer and more powerful but this ram with two horns represents the Medes and the Persians the Persian being the bigger horn the higher horn and they moved westward so obviously they are moving from the region of Iran and Iraq and they are occupying Turkey and all of us those regions around the Mediterranean they are moving westward which is exactly what happened how they expanded their empire or their kingdom now after that comes a male goat and he says that's the kingdom of Greece interesting and he is moving eastward that means from Greece he is moving in the other direction and he went all the way so there was a very prominent goat horn horn represents a leader which was Alexander the Great and he moved all the way he came up all the way to India so from Greece he moved eastward he overpowered the ram that is the Medes and the Persians I will pause here we will get into the details of chapter 8 next class so take some time to read chapter 8 and look at all the details because here we see he is talking about Alexander the Great he talks about his 4 generals who came after him he talks about the fact that Alexander the Great died very suddenly that's in verse 8 and then he tells us where the antichrist will come from he says in verse 9 he tells us where the little horn will come from a lot of additional details here in Daniel 8 which we will get into next week okay alright let's close and we will please take a break and I will see you in the next class okay thank you everyone God bless see you soon thank you messengers see you


Good evening everyone In a few minutes the Nintendo hacking 2016 talk of start This talk will be translated into German and there are English subtitles available Anyway, we've had much further do These are Derek near Wirt and that will the three students have been working on hacking Nintendo platform for a while now And please give them a warm applause Welcome to the translation for the lecture of Nintendo hacking 2016. We are Siri and We are always looking forward to feedback on Twitter. Our hashtag is hashtag C3T and we'll jump right into the translation So welcome to Nintendo hacking 2016. I'll introduce the other people. This is Derek And I can speak to all three of us and say that we are very happy that we are here today That we are allowed to be here and tell you what we have done the last one and a half years I will start with the state of the Wii U I'll start with the ad with the state of the Wii U Failover flows console hacking talk have you maybe seen in 2016 that it doesn't happen so much Until 2015 There was an public exploit And we just wanted more access than just to use That also worked on a ppc with the kernel And use so mode and kernel mode we don't talk about today Because the kernel exploits are a lot more fun We'll just start with the power pc kernel very quickly Has louder standard security things no aslar what does it do to us all for simplicity has 140 syscalls We can't really name them can't really name them at the beginning, but there's a nice thing But it's the nice thing is the The the PL mechanism from the view for dynamic Bibliotheca RPL this is very simple and we can all syscalls are very easy to name It's really important that all the syscalls and save copy in copy out Mechanism to use So we just looked at the syscalls and looked for what we can do What we found That's called an eye control v-hacks or why indirections are difficult It's just a bug in the pck drivers that request syscalls That Means that we have requests from user mode to translate over there speaks to me later So you submit these kind of requests and the kernel We'll use copy ends and the to name from you from user mode to kernel mode And there's just a certain art from requests and like a second in the interaction Inhalted well, they just ignore that for the second time. I'm just going to read it for the second level and just the best Let's look at the relevant part Relevant part I couldn't sorry that we didn't go to the site, but that's not so much more It's called I us packet in the second line. It's kind of pecker in the second line The tiler and ganz oben is this special request entry Buffer size virtual address and what we find would be something like this That's the biggest and the virtual address Ausfilling and the kernel was ganz angenehm is for us Changed the virtual address to the physical Address to the physical address So It's copied and then it goes to user mode and then goes through all the entries and Changed then the physical address Repair it for us. That's just no safe security mechanism. That's the whole system. It doesn't matter that gives us just a writing approach to everything we want. It looks heavy We're going through this conversation, but we also only need one byte to exploit the whole kernel We notice that K effective to physical Inversion function that's just zero input for every mill that we're going to give It's a pretty big chance That there's garbage coming in If we show that on another part of the kernel strategy is that we This is curl handler address And that's one of the last byte We hope that the new address actually So we hope for the best use a lock in site and it's best to go off The other is this It's a jit area No, and it's Mandi, I'm also carl mode ausfilling khanos. That's nice, too. That's it. Look at the Let's look at the relevance for it. That's the relevant structure. Let's see. That's the kernel So we're from under home lesen Okay, the last line in the bottom This entry to K loader call this entire K loader call by there. It's a hex FF 0 What we're doing is the last bytes to overwrite the last seven and what's happened is that now this is called The cisco on these This thing goes on site register 24 28 and we can this is control here and that's Bring it somewhere to spring so I thought it's like this. We exploit it as a k-mode function We can just call iocontrolV to this shifted address and it's all just, and we have one, the assist call ever goes anywhere we want. So, we start out with full four hearts. So the view, it starts with four hearts. It's a remote code execution. There's code output, it's one and a half less. It's quite nice. It's quite nice. We can and need to. But we have to go even deeper and we can do that. Let's look at the IOSU architecture on. IOSU is present as one big L file. It's a big L file, there's a kernel, all the services in it. It's running on Starbucks. It has a hardware thing that doesn't execute around and doesn't have an ASLR either. It's a micro kernel with about 146 cores. What we can see is that the kernel, all the services just spawned at once. Before we actually exploit it, we have to exploit one of these user-mode processes first. We do that too, but we don't talk about it. And to look into the kernel, we again reverse all the assist calls and look for bugs. And what we came up with is called MQhex. What we found out is MQhex, so message Qhex. And apparently it never dies in the two overflows. And it just doesn't fit in the overflows. Let's look at the code again. There's the assist call, it's called createMessageQueue. It's called a buffer. And the number of buffer entries is four bytes. And every buffer entry is four bytes. If you check the address with four bytes, then you see the number of entries with four bytes. The other nice thing is that it just used the number of entries for the maximum number of entries for the maximum number of entries. That's why it's called MQhex. And then we send it to the assist call. So iOS should be reporting that no executable memory is writable. And if you look at the kernel section flex, where you see the kernel text, then you see read execute in kernel. And with this data, you see read write, but that's all over it. Our exploit strategy looks like this. If we look at the relevant parts in iOS kernel, then we see it starts with this low-end address. And it's very convenient for us. There's a system on call. And the addresses before are all valid. So we put a message queue on that starts with minus eight bytes. And this magical hack brings us to the point where we just send two messages and a ARM instruction. And what that does is it ensures that this section is overwritten. And we look at the integer overflow, four times this value, four bytes short, and then you think the kernel is the message queue of eight bytes, but we can put every message in there. That already gives us the iOS kernel mode execution, second heart. And with that, we have complete control over the console. That's very pleasant. That's all the keys except for boot one. We'll look at that later. These keys are unfortunately excluded, as we've already seen. Now we want to make things persistent. The content is only verified during the installation, but not during the booting. So now the binary is verified shortly before the execution. So that we can change the content with the JIT permissions. We basically describe the ROM for a DS game, exploit it with the emulator and get code execution. Also, there is this configuration section that basically says which part should be booted. We can describe the title ID. And if you describe the DS emulator title and the console is restarted, then you just boot it directly into the game. That gives us persistent code execution by a cold boot with complete control over the console. Game over? Yes or no? Half-heart is still left. So as we just saw, the kernel is broken in the meantime. What is missing? I just copied this slide from a slide from another talk. You can see it with the same theme for our slides. Basically, this Stage 2 bootloader with the Boot1 key, this key is still unknown to us. We tried to get it through a side-channel attack, but it didn't look good. So it would be nice to have this key. And the first thing we did was to connect a NAND tracer. Basically, all the traffic was there between the NAND and the Boot1 reads to see what this process reads from the FlashSpeaker. So we see a few nice addresses there. We can compare these with the data system on the FlashSpeaker to see which data is read there. We just played around with a few data on this data system and found out that Boot1 has passed a system.xml file. It doesn't look so safe to pass an XML file in such a temporary part of the boot process. There's a lot of stuff that can go wrong there. So we tried to get it through a side-channel attack. We tried to use a few exploits there, but it didn't really work. So we tried something else. There's Boot1. Sorry. We have Boot0. And this booted Boot1. And we found out that it's the boot that you can re-activate virtual remodeling again. So we can see that it's... We can then see that it reads the boot1 key from the OTP and connects the boot1 key again. And that happens very, very quickly in the process. But it's kept in memory until the things are done, until Boot1 is successfully launched or when a mistake happens. And that means we have to exploit Boot0 to get to the boot1 key. Unfortunately, Boot0 is pretty safe. That's a bit surprising because it's a VU. And the question is, how can we exploit something that doesn't have a bug? The answer is, we have to plug in our own bugs. We're doing this by using the fault injection. Maybe you heard of it. Basically, you introduce an error in the device by playing around on the clock or on the clock or by changing something with electromagnetism. Basically, what you want to have is a mutated instruction or broken register. What you don't want is just a lockup so that the system crashes. That doesn't help that much. So we want to plug in a glitch in Boot0. And to do that, we have to find a nice goal for us. Just a really nice weak point. So let's take a look at what Boot0 actually does. The first thing is, it copes itself in a frame because we don't understand it. And that's nice for us because it's in the frame and it's taken out from there. It copies the Boot1 key in the storage. It switches out the OTP slot. It does a few other things with the flash controller and then reads the Boot1 header or BootOn image. It reads the header to this address first. And then it reads the size of this header field. You do at least a check for the maximum size. And be careful, the header itself is not locked. They don't do any testing of a signature or anything like that. So they use the size and they just use the size and then do a signature verification in Boot1. They check that this image is not broken. They remove this Boot1 code, they remove the key from the frame, they remove the key and then they jump to the entry point for Boot1. So what's the weak point at this point? I mean, if you look at this, you can already say what it is. It's, of course, this size check of the size of this field is there. What we can do is we just write our own modified version of Boot1 in the flash frame with a pretty remarkable size in the header. It reads the header, then it's supposed to do this size check exactly where we want to glitch it. And that's exactly where we want to add the glitch. Finally, we just skip this instruction and basically the size check is by path. And basically the size check is by path. So if we read the Boot1 image with this size, then we have a buffer overflow in it and then we have a few jump instructions at the end so that when it returns from the function, it will finally jump to our own code. Yeah, that's our Boot0 code execution, as we do it. Good. So we have Boot0 code execution in there. We can just dump the Boot1 key out of the frame. We don't actually need an exploit for that. Boot0 is actually pretty safe, right? It's actually pretty safe, but by glitching, it tries to behave properly. But the Boot0 code is then customizable. And the Boot1 image buffer is actually where the Boot0 buffer is so that you can add an overflow. And that works surprisingly stable. So the half of the cases we can work like this. So let's take a look at Boot1 now. Boot1 understands the VU data system. It then loads a firmware image. And the first thing we did is we'll take a look at this XML parser. But unfortunately, it looks pretty safe. But maybe we found a bug. We're not really sure, and we haven't really tried to exploit it yet. After all, it's just the VU. It's just the VU. So that's it for VU. Okay, so much for VU. And I'm going to go over to the network that's going to get out of the 3DS. Hi, everyone. I'm Ned. I made it with the 3DS last year. I'm going to be showing some of the Homebrew side of 3DS where that's at right now. I'm not going to show you how it looks with the Homebrew side because the 3DS last year these people broke the userland kernel and the security processor. They broke the hardware key scrambler and since then they've been kind of mad about this. They released a lot of system updates. And they started bug bounty programs and they've got a lot of bugs patched. But because of the level of exploitation we got last year and we need to find some new exploits. What I want to emphasize here is that what I want to emphasize here is that because we have a game because we have a customer game and because there's more difficult bugs we're going to be able to exploit more bugs. So starting with user space we're going to start with our Homebrew comes from. So already it's pretty good. This is already a huge focus for our community because it's kind of where user space is where you want to run your own custom games and so on.  But there's a couple limitations and game cards cost money and they cost pretty frequently like the games that are exploited but the games that are somewhat rare and unusual price goes way up and it gets pretty expensive when the browser every time you release a new browser exploit or Nintendo can just just patch it out because if we have a new page the system's on the latest version so they can kind of prove that the system is the latest version so it's sort of looking at this I thought I'd like to look at to see if some titles could be exploitable but I found sound hacks and the basic, like the two probably most obvious things to look at is because it's got JPEG processing and the music player I saw that they're processing actually a lot of formats even their own custom playlist format if they make a single mistake anywhere then it's over I'm not trying to compare with open source optimization to compare so it was pretty promising it was pretty close to about a month I found a bunch of bugs and I was trying to chain together a little logical it really worked really critical so I'm going to demonstrate that here so I actually studied MP3 for like the whole month MPG was like the last day so MPG was the last thing I saw they actually malloc and 256-byte buffer for the song and when they're loaded they see a Unicode they just memcopy they just memcopy the one so that's it so this is pretty great This is pretty cool, this is a pretty big exploit, it's a bit difficult, so it looks like this. We have our name chunk, with which we just want to overflow. We just put A's in, A's in. The next thing that happens is that this gets freed, and this victim chunk that we've overridden, and we're going to write it over here, and it's working again. It's a link, it's a list, I'll show you where everything is right now. And at this point we have a four-bit rate, and we want to get out of there. We'll probably do a stack pivot, so we're going to pivot the stack, there's only one pivot gadget, and I looked at the thumb pivots, they're actually hard, but the thumb pivots didn't support the wide instructions that were all the way up there. Unfortunately, that's one of the arithmetic conditions on it, so basically it was that in order to load all your registers from the condition flags, the condition flags had to satisfy the list. And I remember where we returned from the function there, and I just checked that, like if this pointer is not number three, then in any sense, it wouldn't ever be satisfied. So basically it was that in order to load all your registers from the condition flags, there was a lot of work arounds. The CTF work arounds can always get the heap free list head with a stack address. And on the next one, we're going to just read into it. There's a couple of constraints on this, and the first one is really normal, like this is pretty normal to stack. You have to make sure you keep the stack on the stack. Luckily, this is actually pretty easy, because all you need is a size followed by two null pointers representing a previous result. And now it goes to look there. If one of them goes to look there, then I don't have anything else in the queue, so just write it down on this work. So we mem copy the next stack to the stack, the next stack to the stack against my mem copy. And then Meloq is there for us. And then we're done, because we can do a little, we can mem copy the shell, but then we use an existing exploit that's been around for a long time to overwrite the text section and then the tag section to overwrite. So there's the first heart. So you can't really talk about homebrew without talking about kernel. We want to get access to the most calls, like the three ones actually, like the three ones actually, like the last ones called away from you. So, I guess, the goal is to call some calls that are restricted. And then it would be a memory for like a demo layer. So, it's kind of a, It's kind of a situation here inside the sandbox, you want to find bugs in like pretty restrictive, so it's a lot easier to talk and like what had been done so far, and I learned a lot of attacks on that memory mapping. I didn't see much about memory mapping or anything related to news after free, and I had just got a pretty bad grade on my OS project, because I had a really bad note for it. So I noticed a design flaw when I was working on it, so it's not so much that they couldn't possibly get this right, but when you're designing an API, it's really true for how you do ref counting, so basically whenever the user fetches, a kernel object holds a kernel object on it, and you can use this call that does the correct in-gref, and then it does the right in-gref, and then it does it for you. I was looking at it, and I was thinking, well, like a long time ago kernel actually is using these objects internally. I mean, I spoiled it, but like, I mean, it was like a way back from the user fetches, and they're all following the same thing. I found three of them, and that's all the same. We're now maintaining the reference count, and then some people asked me like advice on kernel hacking. For kernel hacking at home, I definitely said, okay, look here, there's definitely something to get. I'm going to talk a little bit about the timer object. It's a pretty simple kernel API. You can ask the timer there, you can set this timer, you can ask it, it's just a normal synchronization primitive. Like I said, I was looking at it, and I saw it there, and I thought, oh, that's interesting. There's one called Pulse. There's one called Pulse. Because what's happening with this, you set the timer to Pulse, like every year, you're going to get this pulse every year. Everything that's waiting on it gets a signal. And when you get a signal on it, you get the next signal. And it definitely does things with this object that are a bit more complicated than the other modi and the other kernel objects. So I looked at how they did this, how they did this Pulse story. What's actually going on in the code? If you take a look at this, you can see they're doing some pretty good locking. And then what happens here is when the signal goes through these waiting cycles and gets rescheduled, at the end they reset the timer state and just say, okay, we're waiting for the next cycle. And then this also looks pretty good. It looks pretty good. They're locking the scheduler there, but nothing's preventing you from doing this from having a asynchronous close handle. So we take fast tags. And that's it. That's three syscalls. There's a whole bunch of set ups where you don't want to go in, but you put the timer on, set it up, close the handle, close the handle. And if it was in Pulse mode right now, what's nice about this is you can lose the race. It's just a race condition there. And then it happens quite often. And once it was within a second, I didn't think it was optimal. So let's take a look at how we can exploit this whole thing. Basically, it's a little bit more complicated. I'll show you in a second. Here is what happens. So R7 points to my timer object and then it's set free before we get to this chunk here. Then it loads this R0 history there and jumps there. So that I call this use after free. And that's pretty exploitable. When I look at these objects, that's the normal situation. The table shows the real timer table. And wants to call this KTimerReset function. But when we call it free, then the table pointer goes to the next timer object in the kernel. So it's going to point to the next free timer object in the kernel. And what's nice is that it overlaps with the initial timer value. We totally control. But that we have total control. So after the initial value is set, we should be pretty fast in the user space. Because what's actually calling this is in a kernel thread? What it calls in a kernel thread, we have no guarantee that the user process is actually memory mapped. And even if you open the kernel thread, you can't get more than 25% of it. So that's very unstable. Also because it's a kernel thread, we don't want to crash it. But this will just totally break everything and sink thread dies. As long as we return a function to something defined, as long as we're actually in the dry. There's actually another problem. And the kernel commode is mapped to a higher address. And they're negative. And this set timer syscall actually checks if these values are negative. So we need a pretty strict trick that I didn't find. If you set the timer, you can say, one second from now, the pulse should start. Then it adds the current time to the one second. So set timer is the one that does the add for you. Timer actually does this addition. And this overflow is not checked when the timer is set. So we can actually overflow this and then with a schedule that shows back into the past. Here is my eclipsed setup for that. In the middle there, that's the beginning of this place. And then that region on the right side is what the 3DS allows to survive there. That's the pulse period times that we can use. And so what I do is I just put it right there at the end. I set it right there at the end. There's an overflow and the next pulse that I can also control that range. So then I get exactly where I want to go. That's pretty good. That's pretty good. But unfortunately at this point it's pretty solid. At this point it's pretty stable, but we don't know exactly what to give back, what to call. There's no simple function for that. Our negative scheduling stuff is pretty difficult to do for different calls. So I try to find a call that gives me this control. And that's where it gets really, really tricky. If we look at how the memory mapping in 3DS looks, then we can see it in the user space, where the FC RAM is just in the control area. And the kernel also has a view of the heap. So it's a shared mapping. And that means if we can write in there, then it ends up in something we can see as the user. So it's something we can see as the user. This is actually a common instruction on the ARM architecture. And at this point we just put a view table call with an argument. And that means that R0 just contains the address of the object and R1 the address where we want to go. And this B65C is where R1 shows up. We can see the random link list. And when we go down to the add instruction, then we write it to the object. And in this way it looks like this. It's pointing to something in the user space. And we do an alloc twice. We can look at the user space. There's the object. We control the view table. And then we're actually at standard methods that we can use. There we go. OK. There we have the user space and kernel. And this is almost game over. So we have already knocked on different parts of the 3DS. Including the kernels and the software that runs on this security processor. What we didn't look at are the 3DS boot ROMs. Basically there's one boot ROM for every processor. For the ARM 11. And I think there's probably more boot ROMs than the 3DS system on the chip. But we're focusing on these 3DS boot ROMs here. What we know for sure is that this firmware image from FlashSpeicher is something. We also know that this ARM 9 boot ROM does all the interesting things. Because only the ARM 9 boot ROM has access to this entire crypto hardware. And we also know that the boot ROM initializes the key slots. We would like to get those key slots. Unfortunately the boot ROM is disabled before the firmware launches. And the 3DS... They also give a very nice error screen if something is broken. Then you get a error screen. So let's look at how these boot ROMs are protected. Basically there are two registers that we call ConfixusRoot 9 and ConfixusRoot 11. And the boot ROM writes to these registers. And of course it's a one-shot. You can't turn them on again. That's not the VU. And basically if this boot ROM is disabled, then the only half of what you get are two parts of the boot ROM. There's the unprotected part and the unprotected part. You can just dump the unprotected part and you can see the unprotected part. But you can't see the protected part. And all the interesting codes have been stored in this protected part. And if you look at the reset vector, it just jumps directly into the protected part of the boot ROM. So you don't really know what happens there when the 3DS starts. But what you can do is you can look at the unprotected boot ROM code. Who knows, maybe we'll find a bug in there. So first of all, let's see, there are no keys in the unprotected part. All the keys are stored in the protected part. There's a whole bunch of driver codes in there. There are some hardware stuff in the AS Engine, which is kind of interesting. There's also the SPI, which is quite interesting. Because it's a very small chip that's soldered on the Wi-Fi socket. And it's useful for Wi-Fi settings. Other settings that are in there. And when we're used to it, it's interesting for us. And it also includes the ARM exception vector table. And that's a design that you actually have from older or other generations of Nintendo DS. If you don't know the ARM architecture, basically there's an exception vector table there. It's a hard-coded address in the boot ROM. And basically every time something weird or something special happens on the CPU, it jumps to these exceptions. And the reset vector that we just saw, when you're trying to reach from an address, if you're trying to jump to an unprotected board or a data board, then the corresponding vector is triggered. And even if you interrupt it, it jumps to the interrupt request vector. So those are the exception vectors that are hard-coded in the boot ROM. And there's a problem with that. Because as a developer, you don't want to have an exception handler routine in the boot ROM. You want to change the code, after all. What they do is, as a result, they drag all these exceptions out of the boot ROM into another jump table that is in the ARM 9 RAM. It looks like this. What you can see here is that the boot ROM vectors basically just a jump instruction to the actual firmware handler that just jumps into the firmware handler. And when the firmware is running, that's how it looks when the firmware actually runs. But what about the cold boot? You get this. And this looks kind of interesting. It looks pretty interesting, because we have these boot ROM vectors in the ARM 9 RAM storage. But because it's a cold boot, nothing is initialized in the RAM. So that's interesting for us. It's not really a bug, because at some point these things are initialized. But let's shuffle a little bit here and say, let's take a look. We can solve a pretty time-consuming exception, even before the boot ROM is able to solve the whole thing. Yeah, it's probably just crashing. On an exception, it would just jump to an initialized memory. On an exception, it would just jump to an unused memory spring, and there would just be no instruction there. So that's not really useful. But that's a really nice hardware flow. There's a whole bunch of hardware errors in there. That's what we see when we have a memory reboot. And then we looked at what happened. We also found out that some of the RAMs actually weren't really solved with a reboot, and that's in the ARM 9. What we're going to do now is we're going to do a few custom exception vectors in the RAM, and we're going to do an execution flow in the Dharma code. And then we're going to do this here. And that's very interesting. When we're going to need to do that, all we're going to have to do now is to trigger an exception from the chunk to our exception. How can we trigger an exception? How can we trigger an exception? If you look at the exception vector tab, there are a few exceptions that we can trigger. A few hard coded ones. They won't jump to ARM 9 memory. And you can't use the interrupt vector because interrupts were reset, deactivated, and that won't work. What's left over are these four interesting exceptions. They normally don't work. And the fine destruction is pretty rare. It shouldn't really happen. I don't know. It's a really nice use case to do a fall injection again. You can't compare that, and a few modified structures get out, and then it's very likely that there will be an exception output. That's the vector glitch hack. We have a few vectors in the RAM set up, rebooted, glitched, reset it again, let it boot again, and hopefully the damper code was executed and then wrote a copy of the boot ROMs on the memory. It's not so stable, but it works for me. Okay, we got boot ROMs, and Nintendo is losing their life there. Before we look at boot ROMs, I have something for you. A little prologue. In 2014, a FCC document was published. It says that the CPU in Nintendo 2DS changed. That's an interesting sentence. It just says, they changed the security function of the initialization program. That's in the modern installers. The initial ROM is probably the boot ROM, and obviously a huge bug had to be in it. Let's take a look at the boot ROMs. There are a few boot methods. You can download it from NAND. It usually does that. Alternatively, it's also from spy flash. That's wireless, of course. It only starts with signed and encrypted images. It's not a weird development sector that we can exploit. There are two different keys for NAND and not NAND boot methods. Even when stuff is leaked, you can't use it on your console that you bought. Take a look at a small boot walkthrough. It's pretty normal. It looks for a boot device from a company header and an RSA signature. It's just one block. Then the header is hashed and pulled out from the signature and then it's compared. It's a very simple signature verification. The header is safe and loads the company header. It's a pretty simple format. You have a few entries in the header. Take the data from this offset. There's a section that says load this size to this address. We know from Nintendo's past that they like to break RSA signatures. Let's look at how it was done in the last three years. They use RSA signatures in the PKCS standard. It's a standard that says how your signatures look like. They want to use 2048, so 2084 bit version of RSA, which is safe. In the signature we have SHA2 hash. It's coded with ASN1. It's a pretty complex structure. It's similar to the MP3 structure. You have small chunks of data with small headers and the headers have tag bytes and length bytes. It's all ASN1. It tells the parser which hashing algorithm is used. Since SHA2 hash is only 2048, SHA2 hash is just a little bit bigger than SHA2. PKCS says padding and this padding should be deterministic. If we try to forge signatures, it's really hard to forge because this padding is very long. If you compare signatures of different companies, you'll notice that only the hash changes. The rest of the data is always the same for all signatures. For some reason they decided to write a signature parser. The first thing it does is try to read the padding and it's totally messed up. There's a flag byte that tells you if the padding should be checked and if it's checked, it's checked. But if it's two, it just skipped the padding. It also has some really weak and sure that it will not out of bounds. But it doesn't really fit in there. So the next thing they do is this really complicated parser. It's also really simplified. So we know S and 1 have some length fields in there. There's no bounds checking. So eventually we add this length to the signature and then they can also say we passed all the data and that should be the hash. They don't check this length and this pointer is then used to compare the hash to the hash at the end. What you can say is it only checks a few bytes in this signature and this parser is really pretty simple. The ASN parser is really simplified. So what we can do is we can create a perfect signature pointer when the padding is passed the ASN1 data. This last pointer corresponds to the pointer of the calculated hash of the boot ROM. What it actually does is it makes a mem copy or a mem compare with the calculated hash of the boot ROM. This calculated hash will never fail. It will always give a success and that's the CX. So CX is the boot ROM exploit of the 3DS and basically we can signature our own firmware based on all models because the boot ROM can't fix it. That's pretty nice. There's one heart remaining. Something is missing. What we haven't done yet is we have the ARM 11 boot ROM. We would like to have the full capacity but we would like to have it. Theoretically we can do a vector glitch hack because it's based on the same weak point. But now that we can sign our own firmware let's try something. If you look at the unprotected part of the ARM 11 boot ROM you can see that there are a lot of references between our own firmware and our own firmware. Maybe we can overwrite some boot ROM data. The boot ROM they were kind of clever. The ARM 9 boot ROM that actually checks these firmware sections. And they have a blacklist. Unfortunately you can't just overwrite these data sections. But for some reason they forgot to blacklist the boot 11 data region so that we can write on there or on the exception vectors. And with that you can simply dump the boot 11 boot ROM out. That was pretty easy. Now I can tell you something about all these things about the boot ROM. We did that in summer 2015. We could have talked about that last year already but because we are quite friendly hackers we have held back for so long. Nintendo should be grateful to us. Okay, so that was 3DS game over. Here is a picture of Nintendo Switch. Our bodies are ready. Thank you very much. We have 5 minutes for questions. Are there any questions from the internet? No? Hello? Yes, that's one question from the internet. The internet wants to know if we can get DSP code executions soon. Can you repeat the question? It's very hard to understand here. Okay, the internet wants to know if we can get DSP code execution. DSP code execution. Well, the DSP of the DSP has its own firmware and that is a kernel module and basically if you can get your own firmware then you can also get the kernel so that another DSP firmware can do that. Yes, basically you can do that. Okay, people are leaving. People are quietly leaving. There was a question on the microphone 3. Not longer. Does the internet have more questions? Yes, it does. The internet wants to know how you managed the Wii U to get the execution. Well, I don't want to detail how I did it in detail. But there are a few full detection attacks on it. My setup looked like this. It was rather complicated. I had to modify a lot of things on the Wii U Mainboard to get it to work. I guess you have to figure it out yourself. Sorry. Okay, there's a question upstairs. There's a question on the bottom of the page. Well, you said that you broke all the 2DS. Did you show that the 2DS didn't change the boot process? Did you verify that for the first version? Yes, we did. The new 3DS came out. The 2DS came out after the 2DS and the new one is also usable. Basically, all Nintendo DS consoles are the same. Well, we verified that. We don't know what this FCC document means in detail. We got a few really new 2DS from the store. Basically, there's no difference in the boot. Good to know. Thank you. The last question from Microphone 3. Why such a device? Did you want to play it? Or do you just want to see if you can hang it? Personally, I don't have a game on the Wii U. But I don't have any co-op games.


If you need to remove subscribers, you can choose as many as you want to remove by selecting the check mark next to the user or users, and then clicking Delete. You can also use Shift-Select to remove a selection of subscribers by clicking the check mark for the first user, then selecting the Shift key on your keyboard, and then selecting the last user in a list. Then click Delete to remove the subscribers. You can delete all the users by clicking the check mark at the top of the list to select everyone, and then click Delete. Subscribers added using Azure Active Directory groups will need to be removed from the group in Azure AD and can't be removed directly in the Visual Studio Subscriptions Administration portal.


An environmental group has filed a complaint against Lulu Lemon with Canada's Competition Bureau, accusing the yoga-athleisure wear retailer of greenwashing by misleading customers about its environmental impact. How bad was it? Well, in the 39-page application, Stand.Earth took particular issue with Lulu Lemon's own reporting, showing that the company doubled its emissions from 2020 to 2022. John Paglia, the executive director of Stand.Earth, says Lulu Lemon needs to start putting its money where its mouth is. They are telling customers that buying their products is restorative to the earth. Buying products that are made from fossil fuels in factories powered by fossil fuels, transported with fossil fuels, and then telling people it's good for the earth is just something that we could not let stand. And we're asking Lulu Lemon to either stop saying that or make it true.


This is why the narcissist is about to come back. That is what we're going to be talking about in this video. So for many of you, the narcissist may have come back already or they may be on their way about to come back. And there is a reason for that. There is a reason why they're having to come back. So let's talk about it now. At some point they were very unfair to you. They weren't treating you right. It was like they just didn't care about you anymore. And the reason for that is because they had someone else on the side. And that may have been someone that you were not aware of. And that's it. When they get someone on the side, they become very arrogant, very careless and reckless and they just put you down. Because they feel like they've got the power in that relationship if they can just go and do all of these things to you and there's nothing you can do about it. And they don't really care about what happens because it's like they've got a backup option. They've got something else there ready for when you go down. There's someone else there to take your place. Which is why they just get worse and worse. There's all of these arguments. They keep disrespecting you because they've got this new person. So they feel like they don't need to worry about you anymore because there's nothing you can do to them. They can just move on and forget about you. So they don't really care what happens. They might have been hiding it before but now it's out in the open. You can see exactly what they're like and they are not afraid to show you because in their minds there's nothing you can do about it anyway.  They think they have a better deal with them and they're planning to leave you anyway. So why do they have to care? They don't care about the consequences of their actions because they're not planning to stick around longer to have to deal with those consequences. That's going to be all in you. You're going to be the one who has to deal with that, not them. So that's why they don't care. And this new person makes them feel very confident in themselves. Confident enough to betray you. But here's the weird thing. They're doing all of this and yet they seem to go back and forth. They might leave you one minute but then they come back again. And you may be wondering why do they keep coming back? I'm such a bad person. If there's all of these things wrong with me and I can't do anything right, I can't do enough of them. They don't want to be around me. Then why keep coming back? Why keep watching me? Why keep checking in? That is how you should already know that everything they said is a lie. They have just made up some issue to do with you. There's something wrong with you. So then they have a reason to move on with someone else. Because remember, they care a lot about their image. They want to look like good people. So that's why they need this excuse. They need to say that you've done something and that is why they have to move on. They're not moving on because they're looking for something better or because they have issues with relationships. Nothing to do with that is what they want you to think. It's because of something you've done. When in reality they were just looking for the next shiny new toy and now they've found something that they think is good enough. Something that they think is better than you. So that's why they have to mess everything up. They have to confuse you. They have to blame you so that they can get rid of you because that gives them the reason to move on. And maybe this other person they're with is making them leave you too. That could be another reason. So they get rid of you because they think things are going to be better and when they move on, yeah. Maybe in the beginning things are a little bit better for them with this new person because all these problems they don't have to deal with that anymore. Now they get a fresh start with someone else. There's no responsibility. They don't have to worry about anything and all of this that they should have been giving to you while they were with you, they give that to someone else. So of course it's going to get better with the new person in the beginning. Of course it is. When they're giving them everything and they gave you nothing, of course it is. But that's only because this new person doesn't even know what they're dealing with and maybe the narcissist doesn't know this new person well enough too. So there's no problem in the beginning only because nothing has gone wrong and of course that is why narcissists always leave. They always find someone else. They always start again because they have an addiction. They love the beginning of a relationship when a person doesn't know who they are, what they're about. Then they can just do whatever they want and they don't have to be held accountable. They don't have to think about the things they've done in the past. They can just forget about all of that. That's why they're always looking for new sources. But because of that, they don't appreciate anything they've got. They don't appreciate anyone who already knows them. And that is why they were never satisfied with you. No matter what you did, it was never enough. It was never good enough for them. But it's not because what you're doing isn't enough. It's not enough for them because they can't be satisfied. They need constant entertainment and one person can never be enough for them. They always get bored. So it wasn't exciting for them anymore but that has nothing to do with you. That doesn't mean you're not exciting. That doesn't mean you're boring. It doesn't say anything about you. If they're bored of you and they need someone else, that says everything about them. Why can't they function in a normal relationship like everyone else? Why? Because there's something wrong with them. It's not you. You gave them everything you got. You tried everything you could. What more can you do? What more can you do? But yeah, that's what they do. They look somewhere else for someone else because they cannot function in a normal environment, a healthy environment. So they always have to have something new and in the beginning, when they first move on to someone else, it can be quite fun for them in the beginning because that's what they like. They like the start of the relationship as we all do, but we need to mature and appreciate the person that we're building with because that's really what our relationship is about. And recognizing that the value of what you have built with this person and no matter how small what you've built with them may be, that has so much more value than anything else outside of the relationship which is new. At least that's how you should see it. But as we know, that is not how the narcissist looks at it. That's why they can move on so easily and just forget about you. So yeah, that's why they just move on because they think they've got a better deal with someone else. They think things are better for them but they're not. And soon enough, they do begin to realize that after some time, the excitement wears off just like it does with anything. I think someone said in the comments there about a new car. It's like when you buy a new car, it's great in the beginning, give it a couple of weeks, it gets boring. And that's the same with the narcissist as well as objects. And that's when you see them start to slide back in again. Suddenly, they're liking your posts on social media. Maybe they're leaving a comment. You see they're still watching you. They want to see what you're doing. They want to see if things are getting better for you. Because they already know what they've done to you. They know they've affected you. They know they've brought you down. Pick back up after that. Because things aren't going well for them in their new situation. And then they want to come back. They want to come back because they have failed with someone else. That is why they want to come back. Because things aren't going well for them. Which is funny, because after everything they told you about this new person doesn't do this or that and they're so much better. And then they want to come back to you. So it doesn't really add up their narrative. But yeah, they will come back because they can't deal with the consequences of their own actions. That's what they're running away from. And they just need something to make them feel better about themselves. They need someone to make them feel wanted. And you may not know, but it's quite possible that a new person they're with that could have been a narcissist too. And maybe they got rid of the narcissist. Maybe they left them for someone else. And now the narcissist wants to get revenge. They want to show that of the person that they're not a fool so they come back to you. Because they re-idealise you. They start to see you as being better than the new person. That's just what they do. Eventually, things go wrong with whoever they're with. And when that happens, sometimes they do go back to their ex. And they come back apologising. They come back with all of these lies, all of these fake stories, false epiphanies. And if they have to, they will even bring in their family members, their friends to make you think that this time is going to be different. This time they have changed.  They will say that I was never really with anyone. I only saw them one or two times. I didn't cheat on you. I didn't really leave you. I just needed some space. They will tell you whatever they think you want to hear, whatever they think you need to hear, whatever they think will get them back in. Back into your good graces again. But it doesn't mean it's true. Whatever they say, it's all a lie. They just keep lying. They just keep trying to get away from whatever they think is not going to be favourable for them. So if they have to lie to get away from that, that is what they're going to do. It's as simple as that.  They just want to see if they can manipulate you again. And that's really all it is. And some of you may be surprised to find that if you do let them back in, you may see that they are still talking to the other person again.  You may find it in the messages, maybe a missed phone call. You will find that they are still talking to them. While they're telling you that things are going to be better, things are going to be different, truth is, as long as they think that they can take advantage of someone, they're always going to keep that person in their life. They're always going to keep them there if they think they can use them for something. Because that's all we are, it's just objects, we're tools. It's just things to be used. It doesn't mean that they care about us. That's why they come back just to hurt us even more. Just to do the same thing again, the same thing that caused the problem in the first place. They do that again. And that's never going to change because they are quite comfortable with how things are. They don't mind laying in their own filth. So they don't really want things to change. They don't care if they have to go again, that's fine for them. But just know that whatever it was, the person, the reason why they left, clearly that didn't work out for them, that's why they want to come back. And do you really want to accept them back now knowing that reason, knowing that they tried to replace you for something they thought was better and they moved on to find out that it wasn't better. So now they want to come back to you. Now they want to come back to you. But I know it's hard.  Remember that time when you were holding hands, walking on the beach. Maybe it was a really sunny day maybe the moon was shining late at night and it just seemed like everything was perfect in the world. Like there was no problem. Like the only thing that mattered right then was you and them.  Yeah, these things bring back memories. Makes you think about how things would have been, could have been. But the truth is that, yes, as Amy says there in the comments, fakey days. The truth is that none of that was real. None of that was real. The person you thought you knew never existed. That was a false character that they gave to you that they were not attached to and that's why it's so easy for them to pull away. They abandoned you along with a character that they have created for you. And how do you know? How do you know that that character was not real? How do you know that that wasn't really them? It's quite simple actually. Because if they were real, if they were really that kind, caring person that you thought they were, that you hoped they were, if they were really that person, where are they now? Where are they now? While you're watching my video, where are they? Are they with you? Do you know where they are? Are they in someone else's bed right now? Are they kissing someone else? Are they on a date with someone else? If that person was real, they would be with you right now. They would be by your side, supporting you, taking care of you just as you took care of them. They wouldn't have left you. They wouldn't have entertained someone else. They wouldn't have let you go through everything that you went through while they were gone. All of those nights you spent alone and I was driving you mad. You were thinking, where are they right now? What are they doing? Who are they with? You were laying in bed alone at night, thinking in your mind, are they in bed with someone else right now? Maybe you were crying yourself to sleep. And how many nights did you have to go through that? And they didn't care. If they weren't doing nothing, all they had to do was just send you a text message, video call. Put your mind at ease, they could tell you. Don't worry, I'm still here. No, no. The narcissist doesn't do that because the character was fake. All they really want to do is hurt you. That's all they want to do. You may feel for them, but they do not feel that same way about you. It doesn't matter what they said. It doesn't matter what you would do for them. They would not do the same for you. If they would, then they would have done that by now. Just look at how much time has passed. Why aren't they there for you? If they care about you, why aren't they there for you? It's time to wake up. Just don't let these memories dominate your mind because that's what it does. You start remembering the good times and it affects you. It makes you want that again. But none of that was real. I respect that it may have seemed real for you in that moment. But it wasn't real for them. Just look at how they're behaving now. That's how you know it wasn't real for them. And they're never going to have anything real like that. You can. You can move on with someone else. You can experience something real. Everything you thought you had with them, you can have that. But they are never going to have that. They're never going to experience a deep, meaningful connection. And the reason why is because they only care about themselves. All they care about is getting what they want at your expense. Or at somebody else's. And that is never going to change. It doesn't matter how bad you want it to change. It's not going to make a difference. If you take them back, I can promise you they're just going to do the same thing again. The same things that caused the problem the first time, they're going to do that again. Because now they know that it hurts you. They know that it gets under your skin. Whatever they think you want, that's what they would hold from you. Whatever they think you don't want, that's what they're going to keep doing. You may feel lonely right now. You may feel like you don't have anyone. And they understand that it's normal. It is normal for you to feel that way. When you consider what you have been through, of course you're going to remember the good times. And even just silly things as well. Maybe you were just watching a funny movie together, sitting on the couch. Or even the times when you just lay on the bed and you just... You're not even doing anything.  At the time it just seemed so peaceful. And you may have wondered, why can't every day be like that with them? Or even just five or six days out of the week, then everything will be fine. But you need to understand that none of it was real. That's why they always come back to who they really are. You can try and be something else, but you're always going to go back to who you are. And that's what they always do, no matter how many times you try and lift them up. Or try and show them a better way. They just keep going back to who they are. But you may remember the good times. And you may wonder, they could just move on when things were so good. It's like you just don't understand what was so bad about me. Don't understand what you did wrong. You thought you were doing everything right. You thought you were doing everything that they wanted you to do. And then you're left alone and confused. You're waiting. Days go by, weeks, maybe once.  They pop up back again. And then you think things are going to be different. You think things are going to get better.   When they're coming back, and you think that things are going to get better. No, they're not going to get better. They're going to get a whole lot worse. And they're not coming back because they miss you. They're not coming back because they're sorry. As I said, the reason why they come back is because it didn't work out with someone else. And they're just using you to pick themselves back up. They're using you to free themselves from what is hurting them. You're just a tool to make them feel better. And you're never going to know the truth. You're never really going to know where they were, what they were doing, who they were with. You're never going to know any of that. They're never going to tell you the real reason why they left. They're just going to come back with excuses, lies. They always have some reason, or they will just come back. Like they never did anything wrong. Like nothing happened. Like they just went to the shop and now they're back. And that's how you should know that they really don't care. They really don't care about you at all. Because a normal person, if you have empathy, I feel it myself. You know, when I walk in the street and I see homeless people, I can see they're going through something. I feel their pain. I just want to help. I just want to do anything I can to make them feel better. Because I can't feel better unless they do. And even if I see a cat, a straight cat on the street, many of you may know, if you follow me on Instagram, my Instagram is Nax5 on YouTube, you may know that if I have some of Nala's food in the car, I will go and give some to the cats on the street. This is normal. This is what we do because we have this... I don't know what it is. It's just like some kind of feeling in our stomachs, in our chest. It's like a sinking feeling. You feel like something is not right. And it compels you to take action. This is empathy. Unfortunately, that's something they don't have. It's quite complicated. The reasons how we learned it, we developed it, but they didn't. The truth is, when they look at you, and you're going through it, they really don't care. They don't feel anything. And you need to know that. You need to remember that. They might feel a little something, but they override it. Because what they want... Remember, these are very selfish people. What they want is more important to them than how you feel. Even though they may have a little bit of empathy, they may have a full range of emotions that just don't pay attention to it. That's the difference. We've been trained. We've been taught from a young age. Remember all those times when you were a kid? And maybe you were just sitting at home with your parents. I don't know, maybe your parents were divorced. Did you just constantly hear your mum complaining about your dad? She's always crying or shouting about something.  You might be a kid, but you feel like... You're like their personal therapist. Constantly listening to all of their problems.  You become hypersensitive to everyone's issues. And it's like it's your duty to help. Sometimes I guess that's why I do this. Because I do feel like it's my duty to help people. Maybe that's why I had to go through everything that I did. It's about at least something good comes out of it. When I can put this information out there. But you know, it's really their loss. You know, these people, they only care about themselves. They only think about themselves. That's no way to live. When I look back at my experiences and my life, there's no better feeling than when you care about someone. When you have that unconditional love. And I think that's also what helps us to appreciate these moments. Like these beautiful views. Connection. It's very important. Narcissists may get ahead of us in some ways, but you really can't put a price on that connection. It's everything. And I do believe that it's normal and it's essential to our survival as a species. Because I think that people must have cared about each other if we made it this far. If everyone was just going ahead on their own and it's just every man for himself, I probably wouldn't be too many of us left. Just rambling on. Just these random thoughts on my head. But I think some of you like it when I do this. I don't really like to open up to too many people. I mean, I don't think people really want to hear it in my actual life. So I guess that's why it's so easy for me when I come on here. I'm able to express myself to the fullest. Okay, I'm getting hungry now, so I'm going to go out and get something to eat. I hope you enjoyed this video. If you did, please give it a thumbs up down below. And as always, I will talk to you in another video very soon.