Hi, I'm Zor. Welcome to Unisor Education. Today we will talk about differential, not differentiating, which is basically finding the derivative. But what is differential? Differential of the function. Well, this lecture is part of the course of advanced mathematics, which is presented on Unisor.com for teenagers and for high school students. It's basically a very comprehensive and advanced course, which contains many problems, because I consider actually solving problems as the main point, actually, of studying mathematics. All right, so, and by the way, the site is free and it has certain functionality, like taking exams for instance. Okay, okay, differential. Well, let me start first from the definition of the derivative, which we are familiar with. So we take a point x0, make some kind of an increment of the argument and take the difference between value of the function at incremented value of the argument and original value. And divide by increment and the limit as this increment goes to zero. So that's the definition of the function and we assume that this limit exists. So the function is smooth, differentiable, and whatever else. Now, there is a very important notation, which is attributed to Leibniz. It looks like some kind of a division. And at the end of this lecture, I will tell you why this is justified, basically. Okay, so let's examine basically what this is all about. Well, first of all, this limit makes the whole formula a little bit more, I would say, involved, too bulky, if you wish. And mathematicians prefer to have as short notation as possible. So in this particular case, delta x is basically implied as some kind of a variable, which is converging to zero. Now, if we do not use the limit here, then it would be just a particular fixed value of delta x. And that would be a particular value of difference of the function divided by difference of the argument. And this is not a derivative, right? It's some kind of a concrete value, which obviously depends on the point x zero, our base point, which we started from. And it also depends on delta x. So the first step towards simplification of this formula, so to speak, is to imply this limit. So it's not like we are saying, okay, we don't have limit, but we kind of assume this is a limit. But we would like to have another notation, which implies that some kind of an increment of the argument is not actually a concrete number, but a variable which is converges to zero. And the invention was, instead of using delta x, use dx. Now, in some way, it's the same thing. But at the same time, you have to understand that if you are using this particular notation for increment, you actually assume that it's not just any increment, it's a process of increment converging to zero. You can consider it as a sequence which is going to zero. You can consider it as a function of time. And as the time goes by, this is becoming smaller and smaller. So this is an infinitesimal variable. Now, this is a concrete increment. And without the limit, it's really just a particularly fixed number. This is an infinitesimal variable. That's very, very important. And if we are using this, we actually can skip the notation limit here, because it's assumed in this notation that this is what it is. So that's number one. Now, number two, let's just write it down a little bit differently. f of x, zero plus, well, I will use dx right now if you don't mind. Minus f of x divided by dx. Now, we are assuming that dx is an infinitesimal variable. Right? So basically, we are talking about this limit. So what is this? Is this a derivative at point x, zero? No, because this is an infinitesimal variable. And this is a difference between two infinitesimal variables. So it's some kind of a variable. This is a number. So we cannot put equal sign among them, right? So what I have to do, I have to add an infinitesimal variable. So we assume that this limit exists, right? Which means that this thing is actually equal to its limit plus infinitesimal variable, because that's actually the meaning of the limit, right? If this is a limit of this, so this is equal to limit plus infinitesimal. So the difference between them is supposed to be infinitesimal variable, right? Okay.  Now, what is interesting here is that this is a difference between two values of the function at point x, zero and an incremented point dx, x, zero plus dx. Now, and this difference is, oops, supposed to be derivative. Now, this difference is actually, bulk of it is proportional to the increment of the argument, right? And the coefficient of proportionality is the derivative at point x, zero. Now, then there is a little bit extra. And what is this a little bit extra? Now, we know that dx is an infinitesimal variable. Derivative is a constant. So this is of an order of dx. How about this? Well, don't forget that dx is infinitesimal, but epsilon is also infinitesimal, which means that the whole member is of the order little o of dx. I hope you remember this notation. It means it's an infinitesimal of a higher order of decreasing. It goes to zero faster than just dx. Why? Because dx goes to zero and epsilon goes to zero. So they are independent, two independent variables. And that's why this is, this can be considered as a major component of this difference. And this is considered to be an infinitesimal of a higher order than this one. This is of an order dx. This is of an order infinitesimal epsilon times dx, which is a higher order of decreasing of infinitesimal variable. So this is the major component. This is a minor component. Okay, we've done that. Now let me put some kind of a graphic of the function and illustrate this graphically. So let's assume that this is your function. Now this is x zero. This is x zero plus dx. And again, we're assuming that there is certain process when this point is getting closer and closer to this point because dx is infinitesimal variable. Now what is derivative at point x zero? Well, that's actually the tangent of the tangential line, right? Now this is f of x zero. This is f of x zero plus dx, right? Okay, this is dx. Let's put points A, B, C, D, E, okay? Now, so the difference between this point and this point, A, B is actually dx, right? This is a dx, our increment. A, C is function of x zero. And B, E is function of x zero plus dx. Now, this is f. Now what is EF? EF is the difference between an incremented value of the function and its original value at this point. So this is actually, you know what, let me just change my pan of x zero plus dx minus function value of x zero, right? That's what EF is. Now let's look at this. So this is EF. Now what is this? It's dx times the derivative at this point. dx times tangent of this angle between tangential line and horizontal line of this angle, if you wish. So this is basically df, right? So what's interesting is that on the left of this is EF. On the right, there is a df plus something. And this is something Ed, which is epsilon times dx. Now what's interesting is as this point B is getting closer and closer to A, my df segment and EF segment are actually getting closer and closer to each other. And the difference between them, Ed, is an infinitesimal of a higher order than each of these guys. So that's what it means. Now this is something which I would say delta f of x, point x zero. df is, by definition, is a differential of function f at point x zero. So this is a definition. So this piece, which is almost the same as this one, when our points are getting closer and closer. And this is a major component of increment of the function. So this major component is called differential. So this is a differential of function at point x zero. So what is the differential? It's not a function because it contains, obviously, x zero, x zero can be anywhere. So it's kind of a function of x zero, but it's also a function of dx. And dx is a variable which is a completely different thing. So it's basically a function of two things, initial point where the whole thing is basically considered at x zero and an infinitesimal increment of this. So that's what differential of the function is. It's a product of differential of the argument which is an infinitesimal variable with coefficient of proportionality equals to the derivative of this particular point. So that's how we are approaching this concept of differential. Differential of the function is a major component of its increment. So EF is an increment. DF is a major component of the increment. And that's what differential is. Now, why is it better to deal with differential in many cases than with the increment of the function? Well, increment of the function is kind of a difficult thing because you have to really compute the value of the function in two things. So it depends explicitly on how big your increment actually is. The differential depends only on the value of x zero because dx is any variable which goes to zero actually, any infinitesimal variable. So what's most important actually is in the differential is obviously this coefficient of proportionality which is a derivative. And this component is just any infinitesimal variable which goes to zero. It can be, for instance, a sequence one second, one third, one fourth, one fifth, etc., one nth. It can be. It doesn't really make any difference from the differential standpoint because any variable which is converging to zero can play the role of dx. The coefficient of proportionality is obviously the most important things. So this thing is called a differential at point x zero. Well, now you can probably skip the zero because it doesn't really matter. Zero can be anywhere. So we can just skip this thing. And now it's quite justifiable to write, this is also zero, to write something like this that f derivative of x is equal to differential of the function divided by differential of the x. So we divide this by this. So this actually justifies this Leibniz notation. It can be considered as a division if you understand what differential of the function actually is because differential of the function is always proportional to the increment of the argument. And the coefficient of proportionality is exactly this type of a thing. So whatever you choose, you can define derivative first and differential from there or you can start from differential as a linear component, linear component of the increment of the function and then go to the derivative. It doesn't really matter. But anyway, these are conceptual ideas behind a differential of the function. Now, let me do a little bit. Well, it's a recollection of something which we have already covered before. Let me just remind you that we have covered something which is called a Taylor's series. Now, let me just remind you that function, let's say x is incremented value from x zero. So it can actually be represented as a value of x zero plus first derivative at x zero times x minus x zero divided by one plus second derivative at point x zero x minus x zero square divided by one point two plus etc. And common member would be f nth derivative at point x zero x minus x zero to the power of n divided by n factorial etc. It's an infinite series. So this is a Taylor's series. We have covered this at one particular lecture before. And I would like you to look at this. Well, obviously x minus x zero can be changed to delta x in which case you would have x plus delta x is equal to x f at x zero plus f at x zero delta x divided by one plus etc. So what's important here that let me make another transformation. This minus this is equal to, all right? So this is a Taylor's series basically or a little bit transformed Taylor's series. It basically tells you exactly the same thing as I was just talking about that increment of the function has certain major component where the increment of the argument is proportional to this increment about increment of the function is majorly proportional to increment of the argument with the coefficient of proportionality being a derivative plus something which is delta x square delta x cube etc which are little o of delta x, right? Because they're all starting from delta x square. Obviously they're all infinitesimals of higher degree of decreasing, right? So all of these are decreasing much faster to zero than this one. So this is actually a major component and this is just another justification for considering this to be a major component of this and that's why again it's called differential of the function at point x zero. Okay, so that's just another kind of a considerations which basically gives us exactly the same thing. So let's just talk again about the difference between increment and the differential. Increment is a concrete number differential like this one where delta x is a concrete number, right? By the way it's supposed to be zero. Now when we're talking about differential, differential is an infinitesimal variable always. So it's a process of converging to zero. Question is how is it converging to zero? Okay, the differential of the function is converging to zero proportionally to infinitesimal variable of increment of the argument. So it's differential, it's not an increment, it's basically a process. It's a limit if you wish is implied and the coefficient proportionality is first derivative. So what you can actually derive from this is that increment of the function divided by differential of the function at this point if limit of the argument goes to zero. This is what? This is basically this, right? Now obviously you can just reduce this and you will get one. In limit this is negligible relative to this. So whenever you divide by delta x as it goes to zero is the same as dx, right? dx is implied actually that delta x is going to zero. And this thing is an infinitesimal of the higher order than dx. So it gives the infinitesimal as a result. So we have one plus infinitesimal and since it's a limit it's just one. So this is very important that the, on the graph again, let me just do a little graph here. So if this is delta f but if you have a tangential line on this side you have df because it goes proportionally to dx. So the ratio between this and this is getting closer and closer to one as we approach as this point is converging to this point. Because the difference between them which is basically encompassed here is a higher order infinitesimal which we can just disregard. So this is basically about what is differential. For whatever reason I don't know why I myself had certain problems in the beginning to understand the conceptual meaning of that differential. So what actually differential of the function is. Well again you should consider it in a limit kind of a reasoning approach. It's a variable which is converging to zero and this converging is implied in the word differential. So you don't have to use the word limit etc. So basically that's it for today. I do suggest you to read everything whatever I said about differentials on the website on Unisor.com. You just go to calculus and derivatives and then there is a differential topic. It might just you know put a little bit more light into whatever you've heard right now. Other than that that's it for today. Thank you very much and good luck.


Soundcheck 1-2. Soundcheck 1-2. This is good with this. Thank you Peter. Guys, if anybody's going live, we'll give you enough of a morning so you can go live, alright? That surrounds this building. These are put up when construction is being done on buildings. They are put up. They are removing it again. They've resumed that work. You see them removing their sheet of metal. They have been dropping planks of wood. Of course, the main question is how in the world did this building turn into a house of parts this afternoon and suddenly collapsed? We have new information from the fire department that all people have been evacuated from this partially collapsed building at 1915 Billingsley Terrace here in the Bronx. The building has 47 residential units and 6 businesses. The search for potential victims is ongoing, but their initial search did not turn up any victims. Again, the entire building has been evacuated. And you can see the work is ongoing at this hour. It is now close to 6 o'clock. Firefighters are standing ready to continue moving the debris out after these firefighters are finished up from the ladder tearing down the shed that surrounds this building. Billingsley Terrace here in the Bronx. It has 47 residential units, 6 businesses. All have been evacuated from this partially collapsed. We're coming to your picture. It's out here. Councilwoman Sanchez and also my agency heads are here as well. Nice information at this school to give us an overview of what happened and where the residents are. FNY Commissioner Kavanaugh will give you the answers. We're taking place right now on the scene and what the procedures are. And DOB Commissioner Otto will give you the history of the building and if any, open violation. This incident took place approximately at 3.30 p.m. There was a partially collapsed residential building there. In the modernized high section of the Bronx, our first responders responded immediately and because of video observation, we're able to have a preliminary review, the communication with the owner of the store. Our preliminary information with the owner of the store that everyone that was in the store is out at the time. Lefty and Y, we'll give you an overview of exactly where we are, if there are any other people who can leave according to the government's add-ons. So I want to turn it over now to our nice Commissioner Kavanaugh. Thank you, sir. Thank you all for being out here tonight. The building, we had a partial building collapse here at approximately 3.30 p.m. this afternoon. Fire departments were on scene within a minute, 36 was their response time, and almost immediately we started the intervention process.  We have Red Cross that is out here helping us to assist individuals. And my PD is on the scene, keeping everybody safe before to name off the area. Buildings, HPD is doing their preliminary investigations into the partial building collapse. From residents of the building, we're directing them to the service center that we have set up at Public School 390 just up the block. We will have a service center there. We also have the MPA out here with four warning buses for residents who need it. So there's a real collective effort that's taking place out here to serve the needs of the people who live in this building and this community as we go through this process. But again, any residents that need a place to stay tonight, please go to PS390. We will have teams there to help find you a place to stay for your issue of this event. I'm now turned over to Commissioner Cavanaugh and we'll discuss some of the search and rescue operations of life safety and part of this operation. Thank you very much. Thank you, Zach. Thank you, Mr. Mayor. I think it's really important to enforce that this is an ongoing operation. So our members behind me as we speak are still conducting search and rescue and they will do so until we either find someone or confirm that there is no one under that rumble. So as Zach mentioned, our units were here under two minutes and all of our specialized training and resources that we have for an incident like this have gone to work. We have our drone up, serving the area, seeing if we can find additional information about potential patients and areas of potential instability. We have our canine unit here helping us search for potential victims. And we have all of our specially trained firefighters, tactical units, Blacks units, and our EMTs and rescue medics who are trained specifically to train someone in a go out. So this is an ongoing operation. It has chief cautions to add just a little bit to that. This is going to be ongoing for a few hours until we find someone working from there. As the commission has stated, we arrived in one minute and 36 seconds. We immediately vacated and evacuated the building, got all the residents out and started to concentrate on the debris pile in front of the building. Working that and trying to search for any victims. We had dogs through searches and at this time we are, that is our main objective, is to get to the bottom of that pile. We'll be here until it's down to the street level just to make sure if there are any victims under there. Hopefully we can get to them in time. But it's an ongoing operation. It's this type of operation we train for every day at our training facility. Our specialized units, we have a pile of debris at the rock and we train exactly under these conditions for this day that hopefully doesn't happen too often. This is a 1927 building with seven stories. Any building that's higher than six stories falls into the jurisdiction of Al Fasado in New York City. These folks, the owner of this building submitted their most recent report in March of 2021. That report did find unsafe facade conditions, seven of them. Mortar that was deteriorating, cracked bricks. There is an active permit, a permit that's valid until the next summer. Work was being done on this building as recently as a few days ago. I know you'll be interested in the history of the building in terms of violations. There are seven, right now we see seven open violations, five sweet two DOB, but they are not structural violations. It has to do with the sidewalk shed, the fact that it didn't have proper lighting, etc. There are drawings that were submitted as part of the process to pull the permit that speaks to the part of the right lower corner that is collapsed. Obviously, we'll take a strong look at that. Our engineers and our inspectors hope to be able once given the green light from FDN light to get in the building and the second part of the each building to do an inspection and we'll have more answers after that. We have a few questions. Just let us know. Certainly can't speak to what the drill is about. Again, we're taking a look at the drawings that they submitted as part of the permit. And I want to be clear, unsafe facade conditions is not the same as an unsafe building. But we are taking a good look at the paperwork, the drawings that they submitted and we'll have some answers as soon as we have answers obviously we'll share. We don't believe that there were folks working on the facade work today. So far, as of now, we think the most recent work on the facade was several days ago. We have other questions. You need to read your hand if you have any good questions. Yes, in front of the building where the building collapsed was a large debris pile. And we don't know if anybody is trapped under there. Hopefully not. But what we're doing is we're tunneling it to that debris pile as safely as we can. Firefighters right now are in a dangerous position. We don't know what course is for another building to come down. We don't know if any more of it's going to come down. But we're searching for life and that's our main objective at this time. We will search the whole debris pile until every piece is picked up and we can see whether there's anybody there. Exactly right about it. Grease high, firefighters have started walking on top of the pile again.  Why? Because they want to get to the bottom of all this debris. They are not going to rest, we heard from the news conference, until they get to street level. Until they see the sidewalk again. They know no one is inside the building. They have evacuated all the apartments. They have confirmed nobody is in the store. So all that is left, the mystery here is that mound of debris. Is there anyone underneath it? Their initial search did not turn up any clues of people under there. But they are not stopping. You see the firefighters down there removing this debris as carefully and as quickly as they can. They will not stop, we're told, until they get to the bottom of the rubble. Even if it means they are at somewhat risk to themselves. Because we don't know what caused the collapse. We don't know if more of the building will fall as well. But they have to make sure that there's no one underneath there. And Fire Commissioner Laura Kavanaugh spoke to this primary mission just a few minutes ago. Practice for this. How they have a mound of debris. They practice going through that. Learning how best to remove the debris. How not to hurt possible victims underneath. And this is what they strain for. And what you're seeing on your screens right now are heroes. Part of work. We're live in the Bronx. I'm Lucy. And for Channel 7, Eyewitness News. Truck, you see the truck at work there taking down the scaffolding. This mound, what's left for them to go through. You see the firefighters lined up in a perimeter around it. They're waiting for clearance for the green light to go back in and dig by hand. This is what all the firefighters focus. This is what their focus is on right now. They will not rest until they see the street, the sidewalk under this pile. They can confirm with their eyes there are no bodies underneath. We know that the entire building has been evacuated. 47 apartment units in this building. Six businesses. They have evacuated everyone. The preliminary search did not turn up any victims. But they are not resting until they clear all this debris as quickly, as safely as possible. We heard from the fire commissioner for Kavanaugh just a few minutes ago. Degree that they work on, they practice on, and they drill on. So that when there is a real life emergency, as we are seeing unfolding before our eyes right now, no one is startled by it. They know exactly what to do. They know the protocol. They know how to advance and how to do it quickly and how to do it safely. The million dollar question of course is why did the corner act like a house of cards? That is for investigators to tackle. Right now it is for firefighters to tackle this mound of debris and ensure they can see the bottom of it and determine that indeed no one is underneath. It is the image of heroes watching this scene unfold all evening. From this hand between the firefighters that work down there, we can see the truck screen. One fire truck was pulled back. A lot of trucks pulled back a little bit. Other bulldozers have come in in the last few minutes. We see the firefighters lined up on the side waiting to get on top of that debris pile again through the evening. We have seen them on the pile, on the pile, on the pile as they go through the rhythm of going through this pile keeping these firefighters at least as possible. On the fourth floor, we have seen them up as long as we can in view of all of the various levels of this building. You have to know that they are watching this to make sure there isn't further collapse. You have firefighters underneath this collapse around the side of the debris pile so they have to be very careful that there isn't a further structural collapse from this building. You see the floor there just dangling.


Good afternoon everybody. My name is John Heesman. I work for NGS software in the UK. If you've seen any of my other presentations over the last year, you know I've been focusing on root kits, and specifically root kit persistence. Today I'm going to talk about EFI, which is Intel's replacement for the BIOS, currently available in Macbooks, and likely to be available on most operating systems. I like to support it within the next year. So this is what I want to get through today. To give you some background on EFI, I'm actually going to start by talking about a legacy BIOS. I've got quite a lot of slides to get through, so I'm going to move quickly through the early ones, where I'm going to talk about what the BIOS actually has to accomplish, how we can attack a traditional BIOS, the limitations, and basically the motivation for Intel developing EFI, and then we'll talk about some EFI specific attacks, and also the relevance of the attacks against legacy BIOSes. Then I want to talk about UEFI, which is the kind of successor to EFI. It's the next version that the consortium is working on. I'll summarise and draw some conclusions. Firstly, I want to make a few caveats here. As I said, I'm interested in talking about rootkit persistence. I'm not really interested in what the rootkit does. So essentially I want to persist a rootkit on some device in some firmware. I don't want the rootkit to be on disk. However, I do want it to be able to load automatically. My rootkits have no bootstrap component on disk. They persist in firmware and they're able to load themselves into the kernel, typically before the operating system has finished booting up. I'll show you a few ways of doing that. I'm not going to talk a great deal about trusted computing in this talk. When we talk about UEFI, I'll mention it, but the EFI spec certainly doesn't mandate that you have a TPM, for example. Many MacBooks, some do have a TPM, some don't. Some of these attacks require physical access depending on whether you're able to flash the firmware, for example whether you need to flip a jumper. All of the attacks are likely to require root access and or kernel access. The kind of threat I see for this is a blended attack whereby stage one is we compromise the user system. We then carry out some information gathering to work out exactly what chipset they have and then we actually go ahead and deploy our rootkit in firmware. I'd also say that parts of this work are definitely very much work in progress. Moving on, the role of the BIOS. The BIOS is probably one of the least understood parts of the system today. You guys know a great deal about how the bootloader works, how the operating system works, but the BIOS is a bit of a grey area. When you turn your system on, the CPU starts executing from a fixed address, and ultimately it knows pretty much nothing about the hardware in your system. It actually doesn't even know how to access RAM on your system. One of the first things it will do is start issuing read cycles for the reset vector, the firmware address, and those will go to the north bridge, which will basically direct it to the firmware device in your system, so for example the firmware hub. The first few instructions executed by the CPU will actually set up the north bridge so that we can then access memory. We'll then go ahead and set up the south bridge so that we can then start querying devices and see what hardware we have in the system. Another key part of the BIOS is to set up PCI devices. In this talk, when I mention PCI, I'm actually talking about PCI, AGP and PCI Express, because essentially the area I'm interested in, the expansion ROM mechanism is common to them all. The BIOS will scan the PCI bus and will attempt to locate option ROMs. Option ROMs are simply x86 code that needs to be executed during the power-on-self test in order to configure the device. The BIOS also provides the familiar setup screen so we can configure the boot device priority and we can persist those settings to non-volatile RAM. Finally, the BIOS will then hand off to the bootloader. Here are four ways we can attack a legacy BIOS. Here are four ways we can persist a root kit. Firstly, we can reflash the firmware device itself. We can just reflash the BIOS. I'm going to go into these in detail in the next slide so I'll just run through them quickly now. A second attack is that we can modify the option ROMs on PCI devices themselves and then reflash the device. The third attack is different to the first two. We're not interested in modifying code as such. We're interested in modifying some of the data modules that are stored in the BIOS. This attack modifies the advanced configuration and power interface tables. The fourth attack I want to talk about is different to the first three in that though the majority of my talk is about persisting in firmware, this attack shows how we can persist in memory and survive across reboots without touching firmware or disk. The first attack, patching the BIOS, we have a huge amount of freedom in what we can do. Ultimately, the job of the BIOS is to get the bootloader going. If we can subvert the bootloader, which loads the kernel, then we can likely deploy our root kit. Bootloader has to rely on a set of services exposed by the BIOS. These are exposed through the interrupt vector table. You'll probably know that when we're executing the BIOS code, this is 16-bit real mode assembler. If we can subvert the interrupt vector table, if we can hook and interrupt that the bootloader will rely on, then ultimately we can get our code executing in the bootloader, and then we can basically patch the kernel as it loads it. Quite simply, we find where the BIOS calls in 19 hex to pass off control to the bootloader. Before this call, the IVT has hopefully been constructed at this point, and we can simply hook the required interrupt. I'll talk more about which interrupt we might go for on my next slide. Some caveats, we may require physical access, as I talked about. Some vendors in Telan Phoenix, for example, have secure flash these days, which means that we can't necessarily update the firmware with an unsigned update. Of course, if we have a TPM in the system and it's linked into a secure boot process, for example BitLocker on Vista, then we may not be able to update the firmware and get the machine to still boot correctly. Simply having a TPM in your machine, but not using any of the secure boot process, then we can go ahead and flash the firmware. The TPM is simply a device to measure things like the hash of the bias, for example. Simply having a TPM in your machine doesn't offer you any protection. You have to have the whole secure boot process. The second attack is Option ROMs. As I mentioned briefly earlier, Option ROMs are simply ROMs on a PCI card that holds some initialisation code. They can actually be for any architecture, but ultimately they're likely to contain X86 code. Option ROMs are copied to RAM during the system post, and then simply executed. They're just blobs of X86 code that are taken straight off your card, put into memory and executed. They'll be stored in an EEPROM or an EEEPROM, the difference being whether we have to actually remove the chip off the card to flash it. Here's an example. If you have a PCI Express graphics card, it will likely have an EEEPROM, and the initialisation code will basically install a handler for Int 10 hex video. That handler will implement the VGA and the VBE functionality. To attack an Option ROM, attack a PCI card, ultimately we need to dump the Option ROM off the card. Alternatively we can go to the vendor's website. For example, if we're talking about a graphics card and you've updated the BIOS on your graphics card, you know how easy it is to download a tool to do it and the BIOS from the website. We patched the Option ROM. Again, we're interested in subverting the bootloader, so we simply hook and interrupt. Which interrupt to hook? Well, EI released a proof of concept boot sector root kit in 2005, and they demonstrated that if you hook in 13 hex, as in the disk interrupt, when the bootloader starts loading some of the key device drivers in the kernel itself, then essentially we can see that flow of data and we can look for a byte stream and patch it on the fly. The approach I took when I was investigating putting root kits on PCI cards was actually to hook in 10, the video interrupt, though this was a window-specific technique. I noticed that the Windows kernel actually called Int 10 hex during the boot and it's a relatively involved process because the Windows kernel is obviously 32-bit protective mode and these are 16-bit real mode interrupts, so I found that the Windows kernel actually switched the processor into V8086 mode and I was able to influence how it returned back to 32-bit protective mode. I guess my point here is that there are likely other candidates. The key takeaway is that the bootloader in a legacy BIOS relies on services exposed by the interrupt vector table and if we're able to execute code during the power-on self-test during the running of the BIOS then we can simply hook one of those interrupts that it depends upon. Pros and cons of option ROM attacks. Most PCI cards don't have any jumpers so we can flash them pretty easily. The flashing process itself simply is doing IO to the card so we just need root access in both Linux, Windows, OSX for example. We don't actually need to get into kernel. Network cards also have option ROMs and the option ROMs on network cards implement pixie, so the network booting. This is a kind of nice idea that we could make use of their network stack so that we could actually do things like pre-boot updates of our root kit before the bootloader kicks in on phone home, covert channels. Plenty of opportunity. One of the disadvantages is that we're limited by space on an option ROM. We can't simply dump the code that's there because your graphics card probably won't work. At least it won't work while the bootloader is working. By the time the operating system is loaded, we no longer rely on things like the 10 handler so the graphics card will work but ultimately we want to shoehorn our code into some slack space. I played with distributing my root kit across multiple cards but then obviously we're increasing our chances of detection or somebody removing a card and us losing some code. Detection is fairly easy. It's very well documented how to dump option ROMs off the PCI cards in the PCI spec and then we just apply some heuristics to analyse the ROM and if, for example, we see that it has protective mode code and as I said we're interested in we're expecting the option ROM so I have come up with some ways of detecting the of subverting the detection process as I'll talk about later using system management mode it's possible to trap IO access and basically give wrong results back. Moving on to the third attack against legacy BIOS and as I said many of these attacks are going to be applicable to EFI which is why I'm going into them now. This attack targets the advanced configuration and power interface that replaces the advanced power management and this handles all the power management in everything from your notebook to a big server and the way ACP works is ultimately the BIOS contains some data tables and these data tables hold virtual instructions that are interpreted by the operating system ACP device driver and ACP is a standard and consequently there's ACP implementations for pretty much every operating system so the kind of nice thing here is that we're because we're using these virtual virtual instructions we can actually make a root kit that's seemingly platform independent so the way an attack would work against ACP as I said the BIOS holds these tables containing ACP machine language the device driver interprets these instructions so for example if you press one of the hot keys on your laptop and ultimately that will result in the ACP device driver interpreting some of the AML instructions that tell it what to do when you press that button and the key thing is we can take the existing ACP tables for a system and we can append our own virtual instructions into these tables and this allows us to pretty much exert full control over the system so for example from the ACP machine language we can modify system memory so we can patch the kernel we can we have full access to the IO space as well so ultimately we would take a BIOS crack it open into its code modules, its data modules locate the ACP tables disassemble them into the ACP source language, the high level language that the platform designers use to make them modify them to put our root kit in there recompile them and put the BIOS back together and reflasher benefits as I said the ACP machine language is platform independent its these virtual instructions that are implemented by the interpreted by the device driver and as I said the ACP source language is a high level language vaguely object oriented and its easy to disassemble between the ACP machine language that you find in the BIOS and ACP source language the ACP device driver is in obviously that the kernel is loaded so this attack allows us to very easily patch the kernel and also the fact that we've got this virtual machine gives us an abstraction so we can make some smart decisions and we can future proof our root kit so at Black Hat DC in 2006 I talked about a cross platform root kit that had some logic that said are we running on windows are we running on linux and did a series of tests so we were absolutely sure it knew what the target was before then actually patching the kernel limitations we need to modify the system BIOS so again if we have to have a signed update then this attack is mitigated also the operating system must have an ACP device driver basically if we can get hold of the raw ACP tables to then perform some analysis on them then we can spot our root kit and if we can stop the ACP device driver from interpreting our instructions we can stop the root kit deploying and if you turn off ACP your system performance is likely to suffer but your operating system will work and finally this is one thing I noted that when I demonstrated this on windows ultimately I was getting a load of event log messages that were warning me that the ACP device driver was doing things that could compromise stability because I was patching the kernel and so ultimately you could come up with some mitigations in the ACP device driver that sandboxed what the interpreter was allowed to do because quite frankly you shouldn't be patching certain areas of memory you shouldn't be patching kernel code pages for example the last attack I'll talk about on legacy BIOS is warm reboot attacks so the last three attacks require us to make modifications to firmware which kind of makes detection easier and if we think about if you take the case of a web server or a database server they probably have SLAs that mean that these things aren't turned off very often they might be warm rebooted say once a month to install some patches but the only time you might actually remove the power is to replace some hardware for example so it may be sufficient for us to try and persist in memory alone without touching disk or firmware so it's pretty easy to do this because what we actually find is that when the CPU when you first call boot the system those first few memory accesses that go to the firmware hub get cached in RAM for speed and when we warm reboot ultimately we'll actually just execute out of RAM so basically all we need to do is modify this shadow RAM it's called shadow RAM because it's obviously shadowing the contents of the firmware device so ultimately we can remove the right protection on the shadow RAM modify it we can carry out a similar attack to the other attacks where we'll look to patch the interrupt vector table and I guess the only unfortunate thing is it's kind of chip set dependent on how to do this so Intel have a concept of programmable attribute maps and AMD has MTRRs memory type range registers but it's actually fairly easy to do this just download the specs and if you have some code running in actually I was going to say ring zero but again you don't need to be you don't need to be ring zero you just need to be root to be able to remove the right protection and modify these pages okay moving on so why do we need to replace the BIOS with a new technology well the BIOS is written in 16-bit real-med assembler who writes that code these days not very many people and the BIOS just doesn't expose clean interfaces an example of this is interrupt 15 hex the so-called miscellaneous interrupt and you'll find that the subfunctions for this interrupt just totally vary from vendor to vendor and the few interfaces that there are defined are pretty clunky for example I'll show you some documentation from the post-memory manager spec which is a spec for if your code from another code module for example an option ROM wants to allocate some memory we have to jump through a load of hoops to actually get there we have to scan for a particular four-byte string then we have to check some structure to make sure we've found it and then we have some optional stability checks and then finally we're allowed to actually call through a function pointer so it's basically a lot of work so one of the key some of the key design principles of EFI were extensibility one of the other things the designers of EFI kept in mind is that they didn't want to implement a whole new host of technology so they want to use existing technologies there's an EFI system partition any people that have a MacBook will probably know about that I believe it's about 200 megabytes and it's just an empty partition and it's a fat partition that's the EFI system partition that could potentially contain extra EFI modules executable images in EFI are basically PE files and EFI essentially doesn't mess with any of the existing interfaces that the operating system might use so ACP and SMBIOS for retrieving information about your system both of those are there and by and large untouched another key design principle was modularity so the core EFI implementation is stored in firmware but the idea being that and this is really the key idea that we can have third party device drivers so we have just enough just enough implementation in the firmware itself to be able to read the EFI system partition for example and then third parties can drop drivers in to actually bootstrap other hardware you can create EFI code in C and you can compile it you can download a development kit that will let you compile it on any mainstream compiler and EFI is a spec it's not an implementation it simply defines some interfaces to solve the option ROM problem of option ROMs simply containing x86 code the Intel came up with a concept of EFI byte code so essentially their own virtual instruction set so that we can now create cards that have option ROMs containing byte code that's then interpreted by the EFI driver so here's a high level diagram of what EFI really looks like ultimately we start with firmware platform initialization which as I said is just enough to get the thing going and then we iteratively load drivers and you can kind of think of EFI as almost like an operating system in that we have the concept of drivers and we have the concept of applications and eventually we end up choosing a bootloader which is simply an EFI application and there's plenty of tools out there for investigating the EFI environment so for example I suspect many of you that dual boot on a MacBook use something like refit or efi basically a tool that will also let you drop to a shell and type commands as if you're at a prompt and actually refit is pretty flexible and it even uses network stacks to actually connect to sites on the internet for example so some EFI definitions the concept of a protocol protocol is basically an interface that exposes some functions contained in a driver each protocol has a GUID which ties in with the extensibility unlike the interrupt 15 hex in a legacy BIOS where vendors of just kind of redefines sub functions or other hopefully with a GUID there will be no collisions so each vendor generates a GUID and embeds it in the driver and the driver can implement multiple protocols when you launch an EFI application or driver it's passed the pointer to an EFI system table or the EFI system table and this is a pretty key data structure that basically allows an EFI application to locate protocols and therefore functions within them the EFI environment is actually a protected mode but it's a flat memory model so we can simply pass around function pointers to things in other drivers or applications EFI defines boot services and these are services that are available for any application or driver to use and they cover the kind of handy things that you might need for example memory allocation how to locate other protocols that we can actually get stuff done and how to actually query EFI images themselves so we can find out like file paths to things that kind of thing we also have the concept of runtime services and this is quite interesting in that these services are available after the environment has finished so once the bootloader is executing runtime services are still available and the kind of idea of this is that ultimately EFI can provide device drivers that the operating system can also use right now people aren't really using this but it's an interesting idea that you could expose some services in the EFI environment that are still available when the operating system is booted up the final definition is the framework and this is Intel's reference implementation and this is what's actually used by OSX and the interesting thing is that it's actually partially open source so if you're interested go to tianocore.org and have a look at it and perhaps unsurprisingly Intel views the framework as the implementation of choice if you're looking for an EFI implementation so what about EFI and security well the 1.10 spec isn't really focused on security the framework itself the framework spec docs remember that's Intel's implementation actually starts to elaborate and says you should have a security phase the security phase is where you set your core roots of trust and basically you should make sure it's secure so the security phase in Intel's implementation for handling restarts as I said it also serves as a root of trust and it's responsible for handing off to the pre EFI phase the pre EFI phase is basically the phase in which the environment's brought up so we have to get the hardware going so for example this is where the north bridge would be configured and the south bridge would be configured and the PEI phase invokes the driver execution environment which then means we can load drivers and load our applications so this is kind of what it looks like with the various phases so how can we abuse EFI the first objective is we need to get our code running in the EFI environment there's a few different ways of doing this we could modify the bootloader itself the bootloader for ISX is just simply an EFI binary on disk we can simply patch that binary the next stack I'm going to talk about and I'll go through these in detail on the next few slides is modifying envy RAM variables so if you're familiar with open firmware in the way that worked ultimately you have some global variables stored in some non-volatile RAM that basically tell you what bootloader you want to use thirdly we could patch the framework itself and reflash fourthly we could go for an implementation floor in one of the EFI drivers once we've actually got code running in the EFI environment then how do we subvert the bootloader we could hook one of the runtime services or a boot service that we know the bootloader will rely on we could modify the ACP tables as I said EFI basically doesn't really mess with them and it needs to keep them there because the operating system needs them it's an existing spec we could load a system management mode driver and that's probably the most interesting attack so I'll spend time on that or we could carry out an attack that's kind of similar to attacks against the legacy BIOS if we know that there's a compatibility support module bootcamp for example the first attack and the simplest is we modify the bootloader so on OSX that's stored at that path OSX doesn't actually use the EFI system partition but carrying out this attack is kind of unstealthy simply because we could detect it pretty easily with anything like tripwire unless our root kit is aware that those tools are going to be looking for it and if you're patching a file on disk why don't you just patch the kernel directly instead this last point is not really applicable to OSX implementation sorry, Intel's implementation of EFI the one that OSX uses but it will be applicable to the UEFI implementations where basically we can enforce driver signing and so simply trying to get an unsigned bootloader working won't work modifying the non-volatile RAM variables as I said these specify which bootloader we want to use there's an interface for us to do this from EFI if you run the MV RAM tool from OSX it lets you dump and modify the variables we can create a custom bootloader we can set the EFI boot device and tell the system to use that and what we actually do in this bootloader will typically do one of the attacks that I'm going to come on to shortly where we will shim one of the services that's available, the boot services or the runtime service and then simply call the original bootloader is this stealthier than the previous one well probably not because we are modifying MV RAM and if I was doing forensics on OSX I would definitely be interested in what's in MV RAM code injection attacks these are going to be pretty important when when people actually implement UEFI properly ultimately we'll be looking for some kind of overflow stack overflow, heap overflow or some kind of bug in verifying digital signatures and when we talk about the possibility for this and people might ask well what kind of user what kind of data do we control in this environment there's actually some good targets so we could target the file system drivers we could mouth on the file system in some way so that we cause an overflow P passing code is always a good one in my work as a security consultant looking at antivirus vendor software for example the number of bugs I found in their code relating to P passing that ultimately lead to code execution is huge so I'd be really surprised that if there aren't any bugs like that crypto code again we'll obviously be verifying digital signatures on binaries so we've got some good targets here the data itself in the certs or we could go for ASM1 decoding and any data coming off the network so how might we actually support the bootloader once we've got code running in EFI well the spec says that when the bootloader exits sorry when the bootloader is ready to transfer control to the kernel it must notify the EFI environment by calling exit boot services so this is a great place to hook because we know at this point that the kernel is going to be loaded so if we hook exit boot services when the bootloader actually calls exit boot services we get control and we can patch the kernel it's fairly easy to actually carry out this attack we can create a runtime driver that simply locates the EFI system table and replaces the function pointer for exit boot services I also looked at shimming runtime services but not many of them are actually called by far the exit boot services seem the best place to hook this is what elilo booting Linux looks like so we see that loads of the kernel free some resources and then calls exit boot services and then it calls the start kernel function so you can see that obviously if we're getting control when it calls exit boot services it's pretty easy for us to locate the kernel in memory okay this is probably the most interesting attack against EFI system management mode has been on most processes since the 386 and I know virtualization root kits are getting a lot of press these days but actually I think system management mode is scarier than virtualization and it's been on most people's processes system management mode is a kind of get out of jail free card for platform designers so pretty much any time they need to do something that the hardware doesn't let them they can probably do it in system management mode so basically things like the century rollover bug was fixed by vendors putting some code in system management mode and ultimately system management mode very similar to virtualization in that the operating system doesn't know that we've gone into system management mode so in the same way that in virtualization the operating system shouldn't really know that a hypervisor even exists in this scenario the operating system won't know that we've executed code in system management mode and we can get into system management mode a number of ways ultimately we need to get a system management interrupt fired and these can be triggered by external events so for example plugging a USB device into your laptop probably generates an SMI we can also set these up to be triggered periodically every few seconds and we can also trigger SMIs on IO access so this is quite interesting if we do IO access to a particular port then we can track that and jump straight into system management mode how might we abuse system management mode well the only presentation I've seen that I actually discussed this was Luke Defloir at Cansec and he used it for subverting BSD secure levels and in his paper he hinted that system management mode would be pretty bad for malware why is that exactly well things like hardware breakpoints just don't work in system management mode so if we had some detection software and we were using hardware breakpoints and we went through system management mode they don't fire the operating system cannot get access to the RAM allocated for system management mode if the system management the SMRAM config register has been set to not allow access so there's a lock bit that some vendors set some don't in fact Luke Defloir's talk basically only concerns systems where the lock bit wasn't set so once we've actually set that lock bit the operating system cannot see system management RAM SMIs can't be interrupted by anything even non-mascable interrupts and as I said SMM can also trap IO reads and writes which is kind of scary so this is a kind of perfect fodder for a root kit that is seemingly undetectable I say seemingly because ultimately if you're looking for it you could probably find it timing attacks for example but why haven't we actually seen a SMM root kit considering that it's been on processes since 386SL well the barrier is pretty high for entry ultimately to debug system management mode you need a logic analyzer so it's not going to be too easy to develop and there's actually not much code out there that shows you how to get into system management mode and what to actually do how to write system management mode handler there's limited opportunity if the vendor has set the lock bit for malware to use it ultimately if we compromise somebody and the biases set the lock bit then we'll have to wait for the next reboot to actually we'll have to carry out one of the warm reboot attacks for example to then try and get a code into system management mode and also system dependencies make it less attractive that's to say that you don't really know what your vendor is using system management mode for so you probably don't want to go blindly trashing system management ram with your own code because you're probably likely to make something stop working so why do I mention system management mode in the context of EFI well EFI actually provides some very clean, very easy to use interfaces for system management mode they actually take all of the hard work out of creating a system management mode driver they provide us with a protocol for registering our driver an access protocol so we can toggle the lock bit they provide a protocol for triggering system management interrupts and the child dispatch protocol for setting up things like periodic callbacks they even go further they give us some functionality to use when we're in system management mode so the SMST allows us to allocate memory it also gives us access to the CPU context through a nice interface so for example the way it might work is we'll load our driver into system management mode we'll set up a periodic interrupt and every time our callback in system management mode gets executed we might want to use one of these protocols to examine the state of the CPU so we have a context structure when we can see exactly what code was executing and we can modify things appropriately the only kind of warning about the power of system management mode in the specs that I read basically said that you have to preserve the chain of trust that you've already set up which is kind of a pretty vague statement if you don't have a chain of trust set up then ultimately we can trifily write a driver and get it into a system management mode which is what I've been able to do on OSX actually and if anyone's interested I'll show them just the amount of code required to do this it's actually pretty small next thing I want to talk about is compatibility support modules and these provide legacy compatibility so for example you want to install an operating system on an EFI system that requires a BIOS basically all you need to do to implement a compatibility support module which is simply an EFI application or it could be a driver the majority of the work is you need to implement the interrupt vector table so that when the bootloader fires an interrupt ultimately you can actually carry out the same functionality so most compatibility support modules the two I've looked at XP on Mac and Bootcamp will thunk to 32-bit protective mode so they'll execute the bootloader in 16-bit real mode and then when it calls the interrupt there'll be a thunk into 32-bit protective mode it'll then carry out the equivalent EFI function and then thunk back so really if we have code execution at this point all we need to do is hook the interrupt vector table or we can patch the handlers UFI UFI is basically the next version of EFI so Intel developed EFI and version 1.10 is theirs they then gave that to the UFI consortium which has all the major players you'd expect in it and they're up to version 2.1 of the spec and they've started to flesh out security now so for example the trusted computing group have also released specs to say how EFI is supposed to link in with the TPM and how we can actually start doing a secure boot process for EFI kind of I put this in just to demonstrate the point about complexity this is what the UFI spec says this is how you have a PE file that you have to sign and ultimately I'm sure there's going to be code execution bugs as I talked about implementation flaws so some summary and conclusions here EFI is interesting it offers a pretty large attack surface versus a legacy BIOS the fact that these high level development tools are available the fact that you just need to be able to write C code is basically now making it a target for much more of a target than the original BIOS was I will expect that in the next few years we will see some attempt at malware that runs in the EFI environment the third party driver model presents an easy target you can download the development kit and write your own EFI application or driver pretty easily the EFI spec is pretty vague on security it's an interface sorry, it's the interface, it's not the implementation but I would have preferred to see some more concrete information on what they're expecting for example the actual framework so Intel's implementation doesn't go into a great deal of detail about how the sec phase should be implemented UFI is starting to make things a lot clearer but I really believe there will be code injection attacks so that's pretty much as far as I've got on EFI right now if I was to say what the key kind of take away from this talk I think it would be that we should all be concerned about system management mode I don't necessarily think it's a threat that we're going to see any malware like run of the mill malware that tries to get into system management mode but it's something to keep in mind when people are talking about virtualized root kits I'd actually be more concerned about system management mode because that's probably on your processor whereas virtualization it's obviously not on all processors right now so thanks very much


This episode of HCC 788 brought to you in part by The Dicast Enterprise. Join us each week as we discuss the sexual proclivities of Commander William T. Riker. The bravado comedy of Lieutenant War. And the adorable monkey shines up one Wesley the Sweater Crusher. Or maybe we'll just talk about the golden girls. Or hairstyles. Or cartoons. That's equally likely. We also like G.I. Joe. There. We tied that in nicely. Well done everyone on that. By all our play sets and toys. Commander 788 here. Back. Here. So. Great. Top. Here. Love. G.I. Joe. Swatter. Rising. March. March. Raid. Ready. Ready. Ready. Silence. Kill. Commander 788 here. It's time for another vintage G.I. Joe toy review. But before we get started, I have to do something special in this video. Mr. Philip Hanks is supporting this channel on Patreon. And at his level of support, he gets a code name to be provided in a special segment of a video. So here it is. This is the special segment for Philip's code name. Mr. Philip Hanks. You share a last name with a famous actor. Maybe you've heard of him. Tom Hanks. And one of my favorite Tom Hanks movies is Joe versus the Volcano. And since it is Joe versus the Volcano, I think your code name must be a Cobra code name. So that makes this decision easy. I think your code name is obvious. Mr. Philip Hanks, you shall forever be known as the Volcano Viper. Volcano Viper is ready to explode. Ooh, yeah. For this week's review, I'm going to look at the Dragonfly helicopter and the Pilot Wild Bill. Now this is one that I have reviewed before. But when I reviewed this vehicle before, it was one of the first videos that I ever uploaded on this channel. And that video was pretty primitive. There's essentially no editing at all. I think I can do a little better at it now. So this is one that is due for an update. Oh, but before I do that, I have an idea. Hey Susan, do you want to play Airwolf with the Dragonfly? Oh, yes, please. It's the Dragonfly. Okay. I'll be Jan Michael Vincent. You be Ernest Bortnight. What? I do. I want to find the helicopter. Well, you see, I have to be Jan Michael Vincent because I have the sunglasses. The sunglasses too. So I should get splot. My dear wife, I love you dearly. That's why it pains me to say I have dibs on the pilot seat. Get you for this. You'll have to catch me first. This is the Dragonfly Helicopter and the Pilot Wild Bill. They were first available together in 1983 and they were on the shelves all the way through 1985. They were discontinued for the year 1986. There was a replacement for the Dragonfly in 1986, the Tomahawk Helicopter. And the Tomahawk is a pretty awesome helicopter in its own right. Some of you have been urging me to review the Tomahawk and I'd really like to. Scheduling it has been a bit more complicated than I hoped it would be. But in the meantime, here is a look at the Tomahawk for your viewing pleasure. The Dragonfly is based on the Bell AH-1 Cobra. The AH-1, which is sometimes called the Huey Cobra, has been in service since 1967. So it was a well-known military aircraft by the time this toy was released in 1983. It has been noticed by other Joe fans that Wild Bill may be loosely based on Robert Duvall's character, Colonel Bill Kilgore, in the movie Apocalypse Now. And there are some visual cues that do call back to that character, especially the hat. There were later versions of Wild Bill in the vintage line. In 1992, version 2 of Wild Bill was released as a single-carded figure. He was not included with a helicopter. Yojo.com says there was a third version of Wild Bill released in 1993. But I consider that to only be a color variation of version 2. This version of Wild Bill has a removable hat. That's kinda cool. There have been some adaptations of the Dragonfly as well. In 1988, it was recolored and used as the Tigerfly for Tiger Force. It was also re-released a couple times after the vintage line. I'm gonna take a closer look at Wild Bill and his file card later in this video, but I'm gonna set them aside for now so we can take a closer look at the Dragonfly. The Cobra equivalent to the Dragonfly helicopter in 1983 was the Fang helicopter. But as you can see, there is quite a size difference between the Dragonfly and the Fang. This isn't even close to a fair match-up. It wasn't until 1987 that Cobra had a really large helicopter to go up against the Dragonfly, the Mamba. But by then, G.I. Joe had the larger Tomahawk helicopter to go up against the Mamba. Let's take a look at the Dragonfly and let's take a moment to look at the color. It is mostly green with a few spots of dark gray. It looks like it's designed to be a ground attack helicopter. And this color scheme is absolutely perfect. It really gives the vehicle a sense of military authenticity, which I love. Let's take a look at the parts and the features of the Dragonfly starting in the front.  Also here in front, we have the chin turret and that can rotate. It doesn't turn all the way around. The turret has two types of weapon. It has this. The blueprints call it a 25mm Vulcan Gatling Cannon. And this is based on the M61 Vulcan. The M61 is 20mm, not 25. And that weapon has been in service since 1959. Next to it is what the blueprints call an M34 grenade launcher. And an M34 is a type of grenade. It is a wide phosphorous smoke grenade, also called Willy Pete. The M34 was a hand grenade, but it could be adapted to fire from a rifle. So this launcher apparently is designed to fire M34 grenades. There is an early variant of this chin turret. The earliest releases of the Dragonfly had a chin turret that would allow the gun and the grenade launcher to elevate. Those were separate pieces in there. They were able to reduce the cost of producing these by making this just one solid piece and the gun turret would turn, but the gun would not move up and down. Sculpted onto the side, there is yet another gun. The blueprints call this an X551 60mm Mini Cannon. Next we have the canopy, and the canopy does open and it will hold open, so that's nice.  The cockpit is pretty simple. It has two seats. It has a couple sticker instrument panels for the front and the back seat. And it really has no other cockpit detail at all. The blueprints specifically state that the front seat is the pilot seat and the back seat is the gunner's seat. In fact, that's how it appears on the box art for the Dragonfly. However, on a real AH-1, the gunner's seat is in front. Let's put a couple figures in the cockpit and let's do it in what I consider to be the right way. I find it's best to bend Wild Bill's legs and just slide him into his proper pilot seat. He sits all the way down in there. There's no back peg or seat belt or anything like that, but he does fit in there very securely. Now let's add a gunner in the gunner's seat and we'll use the figure that I think is the right gunner for the Dragonfly, Airborne. I usually find it best to partially bend his knees, not all the way, and slide him in there. He will sit all the way in the seat. You can close the cockpit and they both fit in there very well. No need to force them in or anything. They fit just perfectly. The name's on the side and this sticker is worn, but what it used to say is Lieutenant W.S. Hardy. And this does refer to Wild Bill, whose real name is William S. Hardy. However, that's the wrong rank. Wild Bill is not a Lieutenant. He is a Chief Warrant Officer 4. This other name here, Master Sergeant W.C. Colbert, is not the name of any G.I. Joe character. In fact, this is a reference to Bill Colbertson, a Hasbro designer. So this is just a little wink and nod to a Hasbro employee. This really nice Dragonfly logo on the side here was designed by Ron Rudat, who designed a lot of the G.I. Joe action figures in the early days. This is a nice design, I do like it. To me, this looks like a high school football mascot. The Fighting Dragonflies. We have landing skids and on each side we have a foot peg, but these foot pegs I think are a little thick and so I would not try to put an action figure on there. It has a risk of breaking the heel. There's an unintended feature with these skids. They are spaced just far apart enough to fit Doc's stretcher, which had these little feet here at the bottom. And so you can slide that in and kind of attach the stretcher to the Dragonfly. Then you can airlift your wounded Joe's to the nearest mash unit. On the port side of the helicopter, we have this, which the blueprints call Laser Guided 160mm Cannon Pod. It connects to the Dragonfly by a pin that goes into the landing skid and a couple hoses that connect to the side of the helicopter. If there is a weak point on this vehicle, this is probably it. The pin that goes into the landing skid can break, but honestly I find most of these intact, so I guess they weren't that easy to break. There is a little play in this, so you can turn it a little bit, but this is supposed to be a fixed forward-facing cannon. We're not done talking about armaments on the Dragonfly. On the sides, it had these weapons pylons, and each of these held three missiles. The missiles are the same on both sides, so we'll just look at one side. Each side had one of these Sidewinder HE missiles for a total of two, and they fit on with this universal dumbbell slot and peg. This is a very unique looking missile. Each E stands for high explosive. It has this bulbous front end which is hollow underneath. I have not been able to identify a real-world missile that looks like this. It almost looks more like a guided bomb. Each side has two of these Sidewinder air-to-ground missiles for a total of four. These look like the real-world AIM-9 Sidewinder air-to-air missiles, but those were not air-to-ground missiles. Those missiles were used to attack other aircraft. The slots on these missiles are the same size, so you can interchange them on whichever peg you want. I can figure them really any way you want. Next, we have a couple removable engine covers. Best removed by pulling down from the top. Then we have some engine detail, and we have the same on each side. There's some nice detail in there. Of course, it's all green. The same color as the body of the helicopter. There's no paint in there or anything like that. Then, of course, we have exhaust in gray plastic. When we were kids, of course, we would pretend these were jet engines, which would make the helicopter go super fast. Over on this side we have an important feature. We have this white trigger, and if you push this trigger forward, it causes the blades to spin. And if you time it just right, you can get those blades spinning pretty fast. The blades themselves are green, and they are susceptible to drooping, but they have some excellent detail on them. And on the tips they have these orange caps, which you can remove. I assume these were added for safety. But what I like about them is that they have some sculpted lights on them, a little bit of sculpted detail. And that is nice. They're not just plain orange caps. They added a touch of detail there when they didn't have to, and that really is going the extra mile. Working our way back, we have a long tail with a couple stabilizers. Then we have this really interesting V-shaped tail fins. They're kind of in a V-shape with this one going off to the side like that. There in the back here we have what the blueprints call a counter-rotating turbine. And this performs the function of a tail rotor. There's no tail rotor on here, so whatever this thing is apparently does that job. It may seem like we have looked at endless features on this vehicle, but we're not done. There's one more left, last but not least on the bottom. There is the rescue hook and winch. This is a working winch. You can just spin the wheel and play the line out. And it has a good amount of black rope, and pretty thick and solid. And it has this hook at the end, which you can wrap around the jose that you want to rescue or connect to a vehicle. And of course, you just spin the wheel the other direction to reel that hook back in. One thing you might use this hook and winch for is the 1982 flak cannon, which unfortunately didn't have any wheels or any other way to move it to the battlefield. So you can use the dragonfly to airlift it in. Let's take a look at Wild Bill. Wild Bill did not come with any accessories, so we can skip that part. So let's look at his articulation. He had the articulation that was standard for G.I. Joe Figures of 1983. His head was on a swivel, so he could turn his head from side to side. He could swing his arm up at the shoulder and swivel at the shoulder all the way around. He had a hinge at the elbow, so he could bend out the elbow about 90 degrees. He had a swivel at the bicep, so he could swivel his arm all the way around. The figure was held together with a rubber o-ring that looped around the inside that allowed him to move at the torso a bit. He could move his legs apart about so far. He could bend his leg at the hip about 90 degrees and he could bend at the knee about 90 degrees. Let's take a look at the sculpted design and color of Wild Bill starting with his head and on his head he has a Civil War era Union Cavalry Stetson and this is almost identical to the hat worn by Robert Duvall in Apocalypse Now. It has the rope braid that goes all the way around and instead of having the crossed sabers it has what looks like Captain's Bars. However, Wild Bill is not a Captain he is a Chief Warrant Officer 4 which it has a different rank insignia. So this is the second time they got Wild Bill's rank wrong. There's a rumor that this head sculpt is based on Robert Redford and I can kinda see it. It's not a perfect likeness. He's wearing silver sunglasses and he has ginger hair and a mustache. This Union Cavalry hat, in addition to possibly being a reference to the movie Apocalypse Now, is also probably an allusion to the Air Cavalry. This refers to the use of helicopters as troop carriers, medivacs and aerial rocket artillery. This was an innovation started by the first Air Cavalry Division in Vietnam. Moving down to his chest he has a green shirt with an open collar looking very casual. He has dog tags which are unfortunately unpainted. Over his green shirt he has a brown vest, kind of a western style vest, not very military looking. He does have a brown knife and he has this brown strap with a device on it that is probably supposed to be a radio but honestly to me looks more like a TV remote. The arms are entirely green. Long green sleeves with green gloves and there's no paint application on the arms at all. Honestly the arms seem a little bit lazy like they went with green gloves the same color as his shirt just so they wouldn't have to paint anything. They really could have used a little bit of color. His waist is also green. His entire uniform is this green color. There's a little bit of detail on the belt but he does have a white long horn belt buckle. His legs are a little bit more interesting even though they are that same green color on each thigh he has a brown holster with a white pistol grip and these grips are facing forward so they would be cross drawn while Bill would reach across and draw them that way. These are probably 45 Colt single action army revolvers based on the information in the file card. These look like ivory handles. His lower legs have pockets and then he has these brown boots and these are probably cowboy boots. They don't look very military but that fits with his overall cowboy motif. Let's take a look at Wild Bill's file card. It was printed on the back of the box that the Dragonfly came in. There's nothing on the other side. His faction was G.I. Joe. It had a nice portrait of Wild Bill here. It said he's the helicopter pilot and his codename is Wild Bill and Wild Bill is named after Wild Bill Hickok who was an Old West folk hero. His file name is William S. Hardy. His primary military specialty is helicopter pilot. His secondary military specialty is fixed wing pilot and aircraft armorer so he can fly an airplane as well. His birthplace is Brady, Texas and Brady, Texas is a tiny town in central Texas with a population of less than 6000. It is referred to as the heart of Texas because of its central location in the state. His grade is CW 4 or chief warrant officer that would be a chief warrant officer and so finally we have Wild Bill's correct rank. Here is Wild Bill alongside a couple other G.I. Joe warrant officers, Flint and the pilot of the Tomahawk lift ticket, but Wild Bill was the first. This paragraph says Hardy served as a combat infantryman and participated in L.R.R.P. Long Range Reconnaissance Patrol operations during Southeast Asian debacle. This is a reference to Vietnam, of course and I have scoured G.I. Joe file cards from 1982 and 1983 and this is the first reference I can find to L.R.R.P. Long Range Reconnaissance Patrol would play an important role in G.I. Joe history, but it was first introduced to the G.I. Joe universe through Wild Bill's file card. Re-enlisted for flight warrant officer school and has since remained in service. Specialized training classified. Qualified expert M1911A Autopistol in parentheses prefers single action 45 long-cult revolvers and that's probably what these are then of course the XM16 attack rifle. This bottom paragraph says amiable and slow talking fancies himself a country western singer so he has both types of music country and western totally honest in personal dealings but not beyond spinning a tall tale for the amusement of comrades. Wild Bill and the dragonfly made many appearances in G.I. Joe media. Both the dragonfly and Wild Bill first appeared in the G.I. Joe cartoon in the real American hero miniseries part one. He had numerous appearances in the series. He was voiced by Frank Welker with a high pitched voice and an exaggerated Texas accent. The uniform for Wild Bill in the cartoon was totally different from the toy. He had a blue jumpsuit and an orange vest. In the G.I. Joe comic book series Wild Bill first appeared in issue number eleven but he wasn't flying the dragonfly. His uniform was miscolored there too. He appeared again in issue number fourteen. Again not flying the dragonfly but at least he was wearing the right uniform. The first appearance of the dragonfly in the comic book that I can find assuming I'm not missing anything was in issue number sixteen. The issue in which Cobra attacks the U.S. Treasury building at night and the baroness is seriously burned while trying to save Destro from assassination. Both Wild Bill and the dragonfly made many appearances in the comic book. He wasn't central to the main storyline but he was an important role player. He had a story arc in issues number sixty nine through seventy one in which he, Crazy Legs and Maverick cooperated with Zarena and the Dreadknocks to escape the fictional South American country of Sierra Gordo. Looking at the dragonfly overall it is a nearly perfect vehicle. It is the right color. It's based on a real world vehicle. It has plenty of weapons and it has a well functioning action feature. It was in my list of top ten vehicles and it will probably stay there. I can't see how anything would not get out of that list. I can't even talk about a lot of fragile parts. It's pretty solidly built. The realism adds to the sense of power around this helicopter. It isn't just a cool toy. They gave us a replica of something that really existed. The dragonfly has reality behind it. There is a contrast between the dragonfly and Wild Bill. Whereas the dragonfly is realistic Wild Bill is stylized. He's a cowboy, complete with a big hat, boots and belt buckle. There are a few problems with Wild Bill. His head is a little oversized and his arms without any paint on them look kind of blank. Despite the drawbacks, Wild Bill has a lot of character. The figure is distinctive and well loved. I consider him a middle tier figure but one for which I have a lot of affection. That was my review of the dragonfly helicopter and the pilot Wild Bill. I hope you enjoyed it and I hope you all enjoy your Super Bowl Sunday. Thank you Phillip Hanks and I hope you like your new code name. Thanks everyone for watching. We'll be back next week with another vintage GI Joe toy review and until then remember only GI Joe is GI Joe. Go Pats! GI Joe Dragonfly Copter comes with Wild Bill figure. Major Blood Gun Ho and Cobra Copter each sold separately from Hasbro. There's always got to be one in there. Okay. Alright. Deep breath, deep breath. Why it pains me to say I have dibs on the pilot seat. You almost made it through that one. You almost made it. You almost made it. We can do this. We can do this. You need to stretch first. I think it's because you're dramatically slicing it. Hey Susan. I'm done shooting. You still want to go out to dinner? I just have to shut everything down.


The Grand Hotel in Scarborough has been open since 1867. It's a beautiful and enormous hotel that overlooks the North Yorkshire Towns South Bay. It was in its early days the largest hotel in Europe and today it is a Grade 2 listed building. This means that it is regarded as something of a special building deemed worthy of preservation. So why am I talking about the Grand Hotel in Scarborough? Well it's been in the news recently and as you can probably guess it wasn't good news. The top two floors of the hotel have been hired in their entirety to house Afghan refugees. There are around 150 Afghans now in residence at the hotel and let's just say the reviews from other guests have not exactly been glowing.  What else? One review on Trip Advisor was from a woman who told of her experience at the hotel. She said that she waited an hour to check in because the place was so busy. It was mayhem. When she and her partner finally made it to their room after pushing their way through busy hallways they were shocked at what greeted them. There was urine on the walls, no quilt on the bed and Afghan children running in and out of rooms unsupervised. She then decided to go back down to the reception area having understandably decided against staying there and here's what she said. I overheard people talking angrily about the kids and people just stood about. They were refugees and more buses were just parking up. I don't have a problem with this. I just felt we should have been made aware that the hotel would be this hectic. Then we could decide if the noise would be a problem for us. Even though her holiday was entirely ruined, isn't it interesting how she felt the need to say I don't have a problem with this? Of course she has a problem with this. But she's afraid to make her feelings known less should be called racist.  So rather than just tell it like it is, people jump up and down to make sure everyone knows they don't have a problem with this. It's ridiculous when you think about it. It's comical. Anyway she continued by saying this. I spoke to the man at the desk and asked for a refund and explained why. He then started shouting at me calling me a racist. I am no racist. She continued. I booked the break when the school holidays had ended. So it would be quieter. He flatly refused me a refund. So we left. We went on to pay 150 pounds to get a room for one night. Then went home a day early as we were both worn out. As I was at the desk getting insulted, at least three others were demanding a refund for the same reasons. So to summarise, a couple go away for a weekend, pay for a hotel. The hotel is a mess. They ask for a refund. They're called racists. They pay 150 pounds for another hotel and go home a day early having had a miserable time. Despite all of this, they still insist they have no problem with the migrants that caused it all. This is not the sole example. Another couple tried to get a refund through their holiday operator because of all the negative reviews they'd read online. They tried to cancel their 338 pound booking in advance but to no avail. They too were called racist by the hotel. One of these guests said the following. Our concern is about safety and leaving things in our room because of what we read about theft and kids running wild. Naturally enough, that was racist. Here's what she said in response to that. By no means are we racist. I've worked with refugees and it is not their fault. Not their fault. Whose fault is it then? Exactly. This is such an interesting way to describe it. Not their fault. Of course it's their fault. But how patronising to say that it isn't. What this person is saying is essentially that many Afghans are simply too uncivilised, too different to us. What we find appalling, they find OK. And the irony is, she's right, at least partly. We are dealing here with vastly different cultures. And in Afghans, we're dealing with people who overwhelmingly have zero respect for our culture.     It's ridiculous. We're tying ourselves in knots, eating our own tails, chasing ourselves round in circles, aiming only to not be called racist. It's our primary concern. Even when our holiday is ruined. That's what matters. To be fair, though, it's understandable.  It terrifies people. People have gone to prison for apparently being racist. It's one of the most powerful words in Western discourse. But of course, it no longer has any real meaning. Now, in the West, if you complain about illegal migration, cultural differences, crime, and if the offender is not white, you'll be a racist. The reality of the illegal immigration, the cultural differences or the crime are apparently irrelevant.  End of story. But let's be fair on all this, though, because there is racism here, there is actual racial hatred. And it is against the British majority. If an Afghan had complained about another Afghan, would they have been called racist? No, they definitely would not. My guess is that even if a black person complained, they would not be called racist either. It's only white people that are given the label. And that is actual racism. You can't make this stuff up. It would drive you mad. But here's something else that would drive you mad. The cost. It too reflects racism. Anti-white racism. As an aside, hatred of whites isn't even considered racist. That's how racist it is. So let's get on to the cost. Apparently, the government is paying £250 to the hotel per room per night. Imagine how much that's adding up to. Then we have the refurb. At the end of the Afghan culturally enriching visit to the Grand Hotel, the government will foot the bill to have the place entirely refurbished. They know they'll have to. That's telling, isn't it? Here's something else that's rather telling. Homelessness in the town of Scarborough has more than doubled since the coronavirus crisis began. There are hundreds of people in this fairly small town who need accommodation. But guess what? The government isn't housing them in grade two listed hotels. There's no money for that. Plenty of money for Afghans, so ever. Once again, the British are at the bottom of the heap in Britain. Millions of pounds are being spent housing migrants in the UK at the moment. But the thousands of Brits living on the streets must stay there. 13,000 military veterans are living on the street in Britain. No hotel for them. Meanwhile, record numbers of illegal immigrants continue to arrive. A lot of people are tired of this. I'm one of them. The injustice of it is nearly unbelievable. So here's the reality. British people have been abandoned by the British government. They are only required to pay taxes, to foot the bill. That bill is to pay for all and sundry from all over the world to come to Britain and take, take, take. It's the truth. And everyone knows it's the truth. Racist and art. This can't last. At some point, there will be a backlash to avoid violence. I sincerely hope that backlash is political. Political change is essential now. A great reset is needed, if you like. Both Labour and the Tories must go. And their fate is in our hands. If we don't vote for them, they won't be in power. If we do, they will. And this will just continue. Stop voting for this nonsense. Start voting for your own rights, your freedom, your taxes to be spent wisely. Start voting for your children and your country. To put it simply, start voting for Britain. Thank you for watching. If you would like to stay updated with all of our latest videos, please like the video below and subscribe to our channel. As you probably know, for Britain is shadowbound on most social media. So it's really important to like and share our videos in order to get our message out. Thanks again for helping us to fight back. Thanks again for helping us to bring back Britain.