How to write sales pages that actually convert. Now this is part one of two. Have you been struggling to write sales pages? I mean sales pages that actually convert that get you sales now without tons of experience. It's really hard to do That's why in this video I'm going to give you the exact process that you'll need to write sales pages that convert and get more sales We're starting right now First off this is part one of a two-part video series So make sure after you watch this video in the link I have the link to part two of the series Make sure you watch part two I'm going to cover part of the things you need to do in this video and then the other half in the other video Now if you're new to my channel, my name is JR Fisher, and I appreciate you showing up But you've got to subscribe make sure you go down to that subscribe button click that button and don't forget Turn on the bell turn on the notification bell that way you'll know every single time I do a video And you'll want to turn on all notifications. You will have a choice for that Now I've been selling online since 2009 sold millions of dollars of both physical and digital products And it's been a lot of work, but I've learned a lot of things So I started this channel to help you guys start run and grow your online business to give you the tips tricks and Secrets that I figured out over the years. We actually have our products sold on thousands of websites including Walmart So we've learned a few things along the way, and we can pass them on to you now writing these sales pages This is a tough thing to do if you haven't had experience writing sales pages I'm going to give you all the steps that you're going to need to go through in this video in the next video So that you can actually have high converting sales pages Before we get started, I do want to let you know that I have a $97 e-commerce course that I'm giving away for free Go down into the description area And I've got a link where you can click on it and just click and learn no credit card required $97 course absolutely free. Okay. Let's jump right on this and let's talk about number one Number one know your audience You know, it's really hard to sell somebody if you don't know who you're selling to we like to kind of develop Avatar how old is this person? Where do they live? What are their motivations? What kind of job kind of car the closer you can get to who your avatar is the better Your advertising will be and the more sales you'll get now There's a lot of ways of doing this you can actually do customer surveys You can survey people out there who have bought the particular product or service that you want to sell and Kind of figure out a little bit more about them. You could do it through web analytics You can look at the analytics and see what's going on. You can use audience insights inside of Facebook That's another way to do it There's a lot of social media analytics out there that you can use and you can use any other type of research you want to do by pulling your customers or sending out emails, whatever you want to do But try to figure out who this buyer is first once you put all this information together You've got this customer avatar and you're gonna know their pain points and what their needs and desires are and it's gonna be a A lot easier to write your ad copy. Okay, the next thing you want to do number two is set up your value Proposition what is your value proposition? So a value proposition would be we help x to y by z So let me give you an example of that We help marketers and business owners to build their email list and boost their sales by providing high Converting marketing campaign software so that would be a value proposition people can hear that people can see that And they know exactly what you're all about they need to know these things because what you will is you will speak to the people who? Really buy into that and then the people who don't buy into that you'll kind of push them away Which is exactly what you want to do number three is get the price right price is so very important now You may have your product price too high or too low or just right But you got to figure it out You got to figure out what's gonna work and the best way to do that is go out into the market look at your Competition, what are they offering? Can you offer it at a better price? Can you give more value than they do offer more than one price point too? Because you're gonna have different levels of people an example would be in our digital marketing training and online training You know, I've got courses that are seven dollars. I've got continuity courses that are twenty seven dollars I've got big courses, which are nine hundred ninety seven dollars I've got coaching which cost thousands of dollars an hour and the reason you want to do this is because Your audience is not made up of one income. It's made up of many different incomes now Your main customer may be between, you know, forty and seventy thousand dollars a year or whatever you determined in your avatar But there are outliers there There are people in your group that have a whole lot more money than everybody else There are people in your group that don't have near as much money as the Median people in your group So if you have all these different price ranges and all these different price Points and different product values you can obviously sell more of your products. So it's gonna be very helpful So here's a really good example For WordPress form builder if you look at here it says without the high cost So the first one we've got here is an agency, which is four hundred ninety nine dollars, okay And the next one is a pro which is one ninety nine the plus is ninety nine dollars and then the basic is thirty nine dollars So they're speaking to four different levels of people by these different price ranges And number four is determine your page length now I've seen pages that just have a button on there in two or three sentences and I've seen pages that go on You know forty fifty pages long so you got to determine what's gonna work for you now What do you do? Do you do a short page? Do you do a long page? Here's the length of page you want to do it needs to be as long as it needs to be to get the job done Okay, and they get the job done is have it an opt-in or buy or whatever So in order to really figure that out you're gonna need to do some testing all online sales require testing And I think a lot of people don't want to do that because they say well gee I've got to do four of these pages instead of one of these pages Yeah, you do if you want to be profitable and you want to make money now ideally if you can do shorter copy That's the better way to go if you can get your pointer cross now Here's an example right here for cyber Monday on Groupon for example Groupon explains its purpose in a sentence And takes you straight to the deals it says up to 80% off of tech home apparel and much more Here's another great example from muck racks landing page if you look it has a simple sentence on here Says is your public relations? Collaborative but as you go further down the page as you can see here There's a whole lot more detail if you want to get into the detail part this page also includes Testimonials and of course more call to actions to get the person to opt-in or to buy number five Is nail the headline and sub headlines now This is so important because you only get one shot at this that headline has to be action oriented It has to be some type of result. It has to refer to some pain point It's got to ask some question if you get this wrong They're not even going to read the rest of your page the best headlines are actually short and directly to the point now Let's take a look at this one by social media Examiner if you look at it It's a little bit longer of a page But in this example in the social media examiner it says discover the best social media marketing techniques from the world's top Experts that stands out over and above everything else But it does give you the opportunity to read more if you choose to do so number six Some like to call it show the benefit of the benefit. I like to call it features and benefit But actually you need to list the benefits of your product to the customer and the features So a feature is something that your particular product has and the benefit is going to be what they receive now Your benefits really should be listed as bullet points on the page I want to show you an example right now this particular one is for enchanting marketing enchanting copywriting e-course and Coaching program then it goes on to say learn how to write persuasive content and win more customers And this course you will learn how to write persuasive content that tells you what they're going to do And then they actually list what you're going to get they talk about a eight-week Intensive program here. They talk about personal feedback or weekly assignments And then they say write the most important pages for your website and get them edited by a pro and The next course starts and then they get the date of what that is there Of course, this is a little bit older But it tells you everything about the course that you would probably want to know now think of it think of the benefits of the benefits or the features and the benefits and Things they're going to get so for example if you're selling diet pills The benefit is weight loss and the benefit of the benefit could be that you're more confident you feel better There's a reason you want that weight loss and that's what it's going to get for you But it's to help your confidence to make you feel better about yourself So that's the benefit of the benefit now James Wedmore who I've actually followed for years uses this on his sales page showing Not just the benefits of free training, but how the training will affect the user's businesses, okay? So the training is what you're getting but what benefit are you getting from doing training because nobody really wants to do training? They want to get the benefit of the training number seven some of us forget to do this Describe your product describe it some people may not know about your product near as much as you think they do We have this assumption because we work with a product every day that everybody else knows all the buzzwords They know the things it's going to do and they know the things it won't do but they don't we need to put that detail in there Because you're going to have all levels of people hitting this page some that do have some education about your product and some that's never heard of it Before the more descriptive you can be about your product the better off you are now check out this example here of this sales page for Monster insights showing how it provides the key features that people want it goes into detail quick and easy setup E-commerce tracking ads tracking real-time stats Universal tracking and file download tracking so it covers each one and then each one has a sub headline that goes into just a little bit More details number eight get the language right so when you're writing your ad copy You may want to use words like you and yours and when you're trying to accomplish something You may want to use words like we are going to work on this together That way they feel like they're actually part of stuff It shows that you can actually empathize with that particular customer and you understand what their feelings are also Telling a story is really good. I mean telling a story is super important If you can tell a story in your copy You will lead the person to want to finish it because there's always a beginning middle and into a story And if it's written properly you're going to keep them on the page the longer They're on that page the longer they read the more chances that they're going to opt in or buy your product You can also use power words in your ad copy and these power words can literally be very powerful And now this is kind of in story form, but look at this from cpi It says i'm about to share something that might sound familiar to you whether you work with kids or adults And in any setting working with people in your care is tough number nine handle Objections anytime somebody comes to your page. They're going to have some objections that are pre-programmed into their brain They're just there. Okay, so to give you an example of maybe you're giving away a free report And the people look at and go free report Well, if it's free it can't really have any value must not have much value to it And I found that actually when you're giving away free stuff It is more difficult to give away free stuff than to sell them a 20 dollar item Because when they look at free they think it's worthless So I would first off say attach a value to that you want to make sure you say, you know, it's free But it's normally worth 29 95 or whatever it is And then you need to really sell it You probably need to sell the free out of more and show all the value that actually is going to give to the end user Now something else you could do is you could talk about a limited time offer And you could do this by having it on your page. You could have a pop up on your page This is grab this now opt in now and you get 10 off or you get five dollars offer Whatever it is you want to offer, but that creates that sense of urgency and makes them want to buy the product Right then instead of just waiting to another time when they feel like it. Okay, so that's the first nine steps of this There's more steps in video two. So I want you to go over to video two now I'm going to put a link in the description down there so you can go over to video two now If you enjoyed this video and you got some value out of it, give me a thumbs up, right? Make sure if you haven't done so if you haven't subscribed if you're a subscriber I appreciate it, but if you haven't subscribed yet go down there to that subscribe button click that button right now and ring The bell the notification bell is right next to the subscribe Button and you need to turn on all notifications. Make sure you set it to turn on all notifications What this is going to do is it'll make you part of the fisher family You'll be part of the vip's I can actually notify you as soon as I do a video when nobody else is going to know about it But you will because you're at the IP now also don't forget I have a free e-commerce course in the description down there to $97 value. You can get it absolutely free There's no credit card required. Nothing like that. You just click on the link and you can learn Now which one of these steps have you actually tried or what problems have you had with your sales pages converting? Put your comments below. I'd love to hear them. If you have any questions, I'll be happy to answer them Thank you so much for listening this video, and we'll see you in the next one Hey, thanks for watching my video Don't forget to subscribe to my channel and click that little bell right there so you can be notified every time I do a new video Also, click on one of those videos there. Keep watching on my channel


Warning! This video will contain spoilers up to chapter 1046. You've been warned! Hello Manaka Matachi, this is Joygirl. Let's discuss some of the recent developments that we've seen in the series. Now for me, I'm reminded each week what a masterful storyteller Oda is. But before we get into all of that, I do want to remind you that Oda's son is taking a well-deserved break, which does mean that unfortunately for us, we won't be getting a chapter this week.  It really only makes sense for you to press that button. Okay, now that that's done, we can move on. So I've set this on a number of occasions now, but I seriously feel like each chapter this year has been filled to the brim with excitement and huge developments. I mean, even if we take chapter 1046, the most recent chapter for example, the majority of the chapter was spent providing us with updates and showing us snippets of other characters around Onigashima. But even still, Oda still used that chapter to also unveil some new connections between the relationship between Joyboy and Luffy, as well as to show Luffy utilizing his newly awakened powers in a truly epic way. So again, I just can't help but feel that every chapter lately has been huge. Whether that be because of a lore reveal or massive power-ups or just general hyper-action sequences, it really feels like it's been quite a while since we've had just a solely update general transition type of chapter. And as I've been experiencing this, something that I've become more and more appreciative of is of Oda's ability as a mangaka. It's something that I touch on in essentially every chapter review, but it's become increasingly apparent to me that it's something that some may take for granted or lose faith in. And I don't mean to tell anyone that the way that they're enjoying the series is wrong by all means, it's your experience. But I just wanted to share my thoughts on this because I really think that One Piece is not only the greatest manga, but is actually the best fictional series that I've ever encountered. And so it's a topic that I just wanted to talk about because, well, I keep alluding to it in bits and pieces, so I figured I might as well gather my thoughts and delve into it a bit more comprehensively in light of the comments and the discussions or the reactions that I've been seeing in response to the recent developments. Because although on the whole it seems like One Piece fans are really enjoying and really excited about the latest couple of chapters, I have also seen that there are some who are very vocal about not having enjoyed the latest developments or at least very apprehensive about how the series would continue. And let me explain what I mean. As early as last year, and probably before that too, as soon as we received a tease from Who's Who as to the importance of Luffy's Gomu Gomu no Mi, as well as the introduction, the official introduction to the sun god as Nika, there was quite a lot of apprehension as to what this would mean for Luffy's character arc, namely that he would just become the embodiment of fate and destiny and the reincarnation of Joy Boy or Nika. And I have to admit as well that I too have cautiously expressed my feelings in the past that I wouldn't like it if Luffy was solely the result of fate and reincarnation, that it's a trope that I've seen hasn't been executed very well in other series, but I did always maintain that I trusted Oda to tell his story in a way that he saw fit. But this apprehension seemed to grow for some people, especially when it became more apparent to us that it was indeed Luffy's devil fruit that the Gorosei were talking about in chapter 1037, when they were talking about a legendary devil fruit whose true name and true nature had to be concealed from the rest of the world. And then adding to that, the recent development of Zunisha recognizing Luffy as Joy Boy in chapter 1043. And although the general mood surrounding this was a lot of hype and excitement about such massive reveals, there was also some increased fear as to how Oda may be playing around with fate and destiny and reincarnation, and how all of this would take away from Luffy's growth throughout the series. But then we actually got the confirmation in chapter 1044 that the true nature of Luffy's devil fruit is in fact a mythical Zoan, the Hitohitonomi model Nika, and in my opinion, Oda handled and delivered this really brilliantly, really cleverly. Because if we assume that the previous Joy Boy also had the same Nika devil fruit, which is plausible given the connections between the words and the meanings of Joy and Nika, which in Japanese can mean grin or smile, and from what we were told from who's who that Nika was the God that slaves pray to for liberation, and then Zunisha associating Joy Boy with the drums of liberation. So then it's also fair to assume that Luffy now being recognized as Joy Boy has a lot to do with him not only just obtaining his Nika devil fruit, but also awakening it. And then in which case, this isn't just a simple case of fate and destiny or reincarnation, because it's rather something that Luffy has achieved and accomplished through and through. During the Gorasei's conversation, it was revealed that the fruit hasn't been awakened in centuries, meaning that even if someone else had consumed the devil fruit, no one was able to awaken it. And from what we know of devil fruit awakenings, we know that it happens when the user really understands its true capabilities, meaning that it requires a higher level, a higher degree of skill and knowledge and capability, something that's worked for to unleash that awakening. And so this in my opinion satisfies that Luffy has still worked for this power and that this isn't something that was just given to him via fate. Because also the way that Oda has really crafted his writing and delivery suggested that it really wasn't just fate that Luffy encountered the devil fruit and ended up consuming it. And it also doesn't seem like it was just a mere coincidence, because the Gorasei in that chapter also revealed that Zoë and devil fruits have a mind of their own. And it's almost as if the Nika devil fruit had been eluding the world government on purpose. So in that case, the fact that Luffy was able to consume the devil fruit, it's almost as if the fruit let him, as if the fruit recognized Luffy and found him and chose him as worthy of its powers.  From the very first chapter, we see the very paradoxical nature of Luffy as a reckless and free-spirited and yet simultaneously an extremely determined boy when we see him go to the extent of stabbing himself to prove that he's ready to go out to sea. And this personality, this will of Luffy is something that we've seen continue to see throughout the rest of the series. The will that the Nika devil fruit recognized. And so again, for me, this has been wrapped up and explained beautifully. But then let's actually go to Luffy's powers and his awakening. When Gear 5th was revealed, I was ecstatic. Now, maybe that's because it was the first gear reveal that I had witnessed since having caught up with the series, but I was elated. But the next concern that seemed to pop up for some fans now that Luffy's devil fruit powers were comparable to a sun god was that Luffy was too strong and would become too OP. But for me, there's actually two layers as to how and why Luffy's powers make sense. On one hand, I think I have to repeat that this is something that Luffy has worked for and achieved in his own right. So the fact that he has become that much stronger doesn't really diminish anything in terms of his character development for me. At the end of the day, Luffy is our protagonist and he has been getting steadily stronger throughout the series. I mean, that's to be expected of our main character. And we're really inching towards the end game of the series now. So it only makes sense that his strength would also develop accordingly. But then simultaneously, I felt that Oda had brilliantly injected some goofiness, the goofy fun aspect of One Piece into Luffy's power by not making Luffy have that automatically super strong, super OP abilities. We have characters in the series who are literally known as the strongest, whether that be the strongest man or the strongest creature. But when it comes to Luffy, the fact that he has the Nika Devil Fruit doesn't automatically make him the strongest of anything, but he is made the most ridiculous, which in my mind fits Luffy and his character perfectly. The fact that Luffy has this Devil Fruit fits so well in line with the original Gomu Gomu no Mi, where the rubber fruit in and of itself wasn't super strong, but it was the way that Luffy used his imagination and creativity to make it a combative advantage. And so the way I see it, giving Luffy the most ridiculous powers via his Nika Devil Fruit, it feels more or less along the same lines, but just intensified. But then there are also some complaints about the very nature of his Devil Fruit. Not everyone was happy to see Luffy's cartoon powers. And I did see a number of complaints about Luffy's goofy fighting style and how it didn't fit the serious tone or reflect the high stakes of the nature of this battle. And I think this was especially the case after Oda not just introduced us to the Toony Powers when we saw Luffy's Devil Fruit awakening, but then continued it in the next chapter in Chapter 1045. But then, as I said in my chapter review for 1045, I personally didn't see the lighthearted fighting style of Luffy's take anything away from the actual seriousness of the battle itself. It was pretty clear in the chapter that despite the fact Luffy was having fun with the fight, he was still the same very determined warrior. During that chapter, when Luffy's strength seemingly runs out and Kaito suggests that he may as well die now, we saw Luffy quickly summon back his Gifith form again and continue to fight. He even says the words that this can't end yet, and he called out the names of those whom he made promises to or those whom he knows entrusted him to bring about the new dawn. And so from this, I interpreted it to mean that Luffy truly hasn't lost sight of his mission and he hasn't lost sight of what exactly is at stake. And so again, for me, this chapter was a perfect example of Oda knowing how to balance his storytelling to give us the fun entertaining moments while still maintaining the heart and the heavy meaningful serious things which then now brings us to chapter 1046. Because after some weeks of complaints or fears about Luffy just being too goofy and not fitting with the tone of the battle, Oda went ahead and showcased his skills and his understanding of his own story by just showing us the pure hype of Luffy wielding lightning and the contrast between the Tooni fighting style that we've seen in the last couple of chapters to now. I mean, I had no doubt in my mind that this is what Oda was going to do to balance and mix in the goofiness and fun with also the epic hype. And so this chapter really only reaffirmed for me that we just have to wait and let Oda do his thing. And this isn't the first time that we've seen this and I don't think that it'll be our last. But again, I just wanted to share my thoughts and my experiences with this because especially as someone who also expressed my thoughts about how I wouldn't like it if Oda went down the reincarnation road I'm really glad that I maintained throughout the whole process that I would just trust in Oda to deliver the story that I know he's going to deliver. And so I hope my explanation has clarified things somewhat and maybe even helped you appreciate Oda's story telling more because in my opinion, it really is something deserving of appreciation. And that's not to say that he's immune to criticism.  But I just have to say that in my personal experience, I have maintained my belief that Oda would pull through and deliver his story whichever way he plans on taking it in the best way possible. And I just have to say that I really haven't been disappointed so far. And that's not an experience that I've always had when it comes to other series. But anyways, those are just my thoughts. Let me know yours by leaving a comment below. Don't forget to like and share the video. Please do subscribe for more One Piece discussions. You can also join our Joyfleet Discord server or even become a Patreon member. And I want to thank all my Patreons for help supporting the channel. This is Joygirl and I'll see you again soon.


In the previous two videos, what we did was take a look at the two different interpretations, two different ways you can look at infinity, right?  The other way you can look at infinity is basically where you got, when for a certain input, when it comes to the unknown, right, where the universe explodes, for a certain X value, we have no Y. We don't, we don't know what f of X is, right? We can't comprehend what that answer is. What we're going to do right now is take a look at what infinity, you know, try to visualize infinity in a different way, right? And this is something that I've used with a lot of my students and for me as well, it was a, it was a wow moment for me when I looked at this thing, when I can't remember who initially introduced this, this to me, someone in some teacher that I had many, many moons ago, right? Or something that I read in the book, I have no idea. But it was, it was one of those things that made me go, wow, wait a second, what? You know, it blew me away. And that's what infinity is, right? It should, it should really blow you away. So for this, just to visualize infinity, just imagine us traveling from point A to B but only going halfway every time. So we're going to travel from point A to point B, but we're only going to go halfway every time. Every step we take is only going to take us half the distance, okay? So from here, half the distance comes out to about here, right? So for our first step, we end up being here. Our second step is going to take us halfway between here and here, right? Which is around here. So we're halfway between this guy and that guy. And again, we're only going to go halfway between here and there. And we're going to continue this forever. We're going to go halfway every time, right? So we're just going to go halfway, halfway, halfway, halfway, halfway, halfway, halfway. Now the kicker with this, with this problem is, with this concept is that we'll never reach B. Theoretically, we'll never reach B, right? You can get very, very close if you only go halfway between the two points every time, but you'll never, ever hit B, right? We always say, you know, okay, we ended up at B, right? Because our feet are only a certain, certain, you know, our feet have a, have a width to them, right? So as soon as we get like an inch closer, the next one we're basically touching B. But in reality, if we only go halfway every time, we'll never hit B, right? So you're going to get close enough that you're maybe a molecule away from B and you're going to cut that in half, right? Now you've got half a molecule and you're going to continuously cut that. You're going to hit the atom length, right?  Now you can only travel half the distance. So you're going to cut an atom in half. And then after a few more cuts, I have no idea how many cuts you got to do because most of the atom is empty space, right? And you're going to continuously do that and you're going to go to subatomic a particle size, but you're never ever going to get to B, right? And when I thought about this, initially when I was introducing, I was like, well, it doesn't make sense. You're going to get to B anyway, but you're only going halfway every time. Now later on, a few years later, the one, the next level of this that really blew me away. And again, this was a, you know, it wasn't an epiphany. It was just like a wow moment. Like, what does that mean if we never reach B? That held until I got to a concept called Planck's length, Planck's distance. And what Planck's distance tells us is, and this concept in physics, Planck basically introduced the quantum mechanics to us, right? He introduced the concept of quanta, which is basically telling us that information comes to us in packets and the smallest packet of information that could come to us is a ridiculously small number, right? And basically what that meant, what his theory says is that you can never go smaller than a Planck length. So just imagine doing this thing for ever and ever and ever and ever, right?  And according to Planck, according to this theory is we can't go any smaller than a Planck length. Now what happens, right? And that sort of introduces the other concept of infinity, which is we don't know. It's an unknown to us. We have no idea what that means, what it means for us to go past that limit of mathematics that we have, right? Anyway, this is one way of looking at infinity that really blew me away. It really, it just, it took me to another level in mathematics where I was trying to understand what all this infinity and zero and nothing and everything and end of time and all this stuff meant. This one gave me a really good appreciation for it, right? And it encompasses both infinities, right? To a certain degree. The infinity that goes on forever, cutting in half, half the distance every time. And the infinity when you hit the Planck length, the Planck, a Planck distance, a quanta away from B, you can't cut that in half. What does that mean? We don't know. Our ability to understand that is limited. We haven't gone that far yet. I hope you like this. We'll talk a lot more about infinity and zero in future videos. For now, this should be a nice second level of teaser for what we did initially in, I guess, video number five in 2007. I'll see you guys in the next video. Bye for now.


Hi everyone, and welcome back to JSA TV and JSA podcasts where we're covering the latest stories trends and innovations from leaders in global connectivity Real estate and the networks within. I'm Barb Mitchell from JSA and I'm joined here by Paul Everett of Everett mission critical. Paul. Thank you so much for joining us Tell us a little bit if you wouldn't mind about Everett mission critical. Yeah, absolutely. And thank you so much for having us So Everett mission critical were an MEP engineering firm who focus specifically on the data center market We're based out of Dallas, Texas, but as you may be able to gather from my accent I'm actually Canadian so based in Toronto and very happy to be here missing a bit of the snow, right? Yes, I know we both left a little bit of snow behind but and I believe Is this am I right to say this is your first PTC first time attending and so far It's been fantastic to collaborate and connect with peers in the industry So I have been enjoying the weather and the conversations amongst colleagues such a great way to kick off the year and so many great Conversations and people to meet Starting let's start with this conversation here today So, you know, I think when you told us a little bit about the company But when we think about just the massive growth that the data center and data center industry has experienced globally Tell us about how virtual design and construction is really helping to revolutionize the industry Yeah, absolutely and happy to and as you mentioned the data center industry is really just exploding and the Demand that AI is now placing on the industry is taking that to a whole another scale So the growth of projects we're seeing it felt not that long ago that a project that was 10 to 20 megawatts of IT Load was considered a large project. We're now the norm for our campuses in the hundreds of megawatts So the scale is astronomical in terms of what we've seen in recent years And then in terms of delivering these projects the schedules that our clients are looking for us to Adhere to are the same as they were previously and in some cases even shorter And then no matter which market we're operating in we find resources are constrained to some capacity So our goal with virtual design and construction technology and how we implemented into our engineering practice is really just to improve Communication and leverage the expertise of all stakeholders on the project We work with really qualified project teams and as engineers we want to factor in all of their knowledge right at the onset of design So we're factoring in Constructability and maintainability which are often not thought of until later on in the process We're really looking to bring all that teams information right up to the beginning One of the main ways we're doing this is They're called 4d models where we tie our traditional 3d building model to the project schedule And it allows us to sequence the the project and visualize how the project is going to be executed a Dry rehearsal of the construction process to see how we can improve our designs to accommodate construction and operations factors right and I mean There are so many factors right I mean it's so many different Things that need to be considered and in the construction process and and the inputs and outputs and connectivity and all the different things But but one of the things of course is the electrical systems and such a major part We talk about you know the the energy in and out of data centers, you know all the time But how are these electrical systems being designed to really ensure optimal performance? Yeah, so absolutely and I find as power demands are exponentially increasing One the complexity and the completion of our designs is having to evolve to match kind of the demand of the centers We're working in so I think traditionally we saw engineers completing designs to a schematic level Where we find we have to go into a lot more detail now in order to ensure the efficiencies of our electrical systems are maintained So whether that's construction level detailing on some components or working with Manufacturers to really make sure we're getting as much efficiency as possible because any percentage saved On a project of this scale is is massive and then also as well What's really important is that we factor in safety into our designs So whether it be doing coordination studies or arc flash studies as a part of the design Not only do we want to make sure that our electrical designs are efficient But that there is safe as possible for our operators and end users So efficiency is nothing without without safety as well, right? And I mean another thing that's important I believe for data centers is just the the continuity and Reliability and uptime and all these different things But when you think about that from the mechanical systems and how you ensure that they are just operating Seamlessly can you talk about that? Yeah, of course. So I think a lot in the mechanical design We do a lot of simulations whether it's computational fluid dynamics or hydraulic calculations on the piping side a lot of Simulation goes into the early stages of our designs And we're doing that kind of same level of detail That I mentioned kind of previously with the modeling and the sequencing to make sure our mechanical designs are as efficient as Possible and then naturally as we're moving to liquid to chip and our cooling strategies are evolving Because the only way we can really deal with the heat especially these AI demands are producing is a completely new Mechanical strategy, and I know some of my colleagues and peers here today are speaking about it but really developing that next level of mechanical cooling strategy and a kind of departure of the traditional air-cooled Methodology and the level of detail and coordination and design that is involved in that direct-to-chip cooling Well, it requires a lot more coordination in detail It's ultimately necessary to ensure optimum performance and efficiency, right? So I mean Paul, thank you so much for giving us this this quick flyby introduction And I think there's so much more that people will likely want to hear from you. How can they find you? How can they connect? Well, I will be here I'll be on the beach, but make sure you look for me with a shirt on if I'm out there But otherwise I'll be around and looking forward to I have some meetings set up with colleagues But looking forward to connecting at social events over the course of the event or whether it's just in the conference hall So thank you so much for having me today and looking forward to speaking with everyone here at PTC Yeah, thank you so much for joining us. We really really appreciate you pulled yourself away from the beach to get here So we appreciate it and thank you to our viewers for tuning in today to JSA TV and JSA podcasts happy networking


Good morning DEF CON! How's everyone doing? Right So hope you got a good night's sleep because today We'll embark on a journey, a journey into the realm of ring hopper But first we'll tell you the story of how we almost zero-dade the world So usually a timeline is presented towards the end of the talk, but we'll make an exception It all started on June 1st, 2021 when we initially reported the findings we'll be talking about today on January 19th 2022 Third CC started working on the coordinated disclosure. We'll soon see why this disclosure had to be coordinated By the way, I'd like to use the stage to send a big shout out to VGI and the folks for mastering the challenging disclosure Right about now a year ago. We should have presented our findings in the blackhead and DEF CON conferences But unfortunately we were notified that the issues will not be fixed in time So we had to withdraw our talks, but we did it rather close to the Conferences themselves. So our abstract was still printed in the booklet in DEF CON's booklet Which might have caused some confusion By the way, from the bottom of our hearts, we appreciate the concern Fast-forward to November 8th, 2022 when the last embargo set by Third CC has expired And a note was published which cleared pretty much everything up And now that we're out of the old-day danger zone where we couldn't talk about our findings. Let's dive in So at the beginning there were four privilege rings The most notable are the user mode user land user space ring three it goes by many names and the kernel The lower the number of the ring the more privileges it has and it works in a manner that is a pack to all the rings above it For instance The user mode has no notion whatsoever of what's going on the kernel Over the years new additional rings were introduced for instance the VMM ring minus one is usually where your hypervisor runs and SMM ring minus two. So let's talk about SMM. It started It stands for system management mode and it started as a small and humble processor operating mode That's mostly provided low-level system functionalities such as power management System hardware control and OEMs ran their proprietary device specific code there Over the years the SMM got bigger and bigger and turned it to a huge monstrosity that performed all kind of operations For instance it exposed and in exposes an interface to the SM BIOS Does PS2 mouse keyboard emulation handles USB events and boot and runtime and the list is long Together with the SMM grew the attack surface and it has become so much more interesting for the attacker But this is fine because numerous Registers and MSRs along with some pretty awesome mitigations were created with the sole purpose to keep SMM safe So in order to switch to SMM The kernel has to trigger a special kind of interrupt called system management interrupt or SMI for short Once an SMI is triggered the processor switches to running SMM and the kernel is no longer active And just like with any other interrupt there is an interrupt handler that corresponds to the interrupt number that was triggered and In our case it's aptly named the SMI handler once the SMI SMI handler is done running The processor switches back to running the kernel and the SMM is no longer active SMM resides in a special well guarded Polish portion of the of the RAM called SM RAM system management Tram while all the other entities have no access to the SM RAM whatsoever For instance if the kernel tries to read a bunch tries to read from the SM RAM. It'll get a bunch of a fifths Overall looks like a worthy target target, right? so in our research we Started with an agent running in user mode Escalated to the kernel and from there we hopped to the SMM and We did all that on this Intel knock But as we'll see later on our research goes way beyond this recently discontinued little fella So this is a good time to dive into our findings But before we do so we need to understand what is a time-of-check time of use vulnerability in SMM context So let's say we have an SMI handler that provides the awesome service of Overriding a buffer with the with the value of coffee Since we are SMM we do not trust the operating system so the first thing we have to do is to validate the input and Basically make sure that the output buffer points to a valid location. This will be the time-of-check Then once it was validated we can use it and override its content with the well with the value of coffee This will be the time of use if an attacker can modify this output Buffered the pointer to lead to another location in between the time of check and the time of use It will be basically gain a right primitive of the value coffee So let's see how it works in SMM context So in the normal scenario, we have an input buffer which would lead to an OS owned memory and The SMI handler we simply override the content of it with the value of coffee However, an attacker may try to modify this output buffer to lead to the SMRAM in Between the time of check and time of use and by doing so gain a right primitive of the value coffee to the SMRAM By the way, this is exactly what a validation function does It makes sure that the output buffer is not located inside the SMRAM So let's discuss how we exploit such an issue In a classic time of check time of use exploitation, it will work as follows Let's say we have a system with four different cores and let's assume that the first core does the critical SMI handling It does the validation and usage steps. So between the other cores We will try to corrupt the data Sometimes we may do this before the validation and if so, it will simply will not pass the validation phase Sometimes after the usage and in such scenario, nothing would happen But eventually with some luck we may corrupt the data exactly in between the validation and usage and exploit this issue However, when an SMI triggered all the other cores are going idle and we cannot use them to corrupt the data So how did we do that? The answer was DMA. DMA stands for the direct memory access and this is the way for your peripheral devices to talk with the CPU the operating system and In in precisely those those devices could be your Ethernet adapter or your graphics card and etc So to test this hypothesis we took something that is called PCI-LH It's a cool tool by Ulfresk. This is the small red FPGA device that you see here, which is connected through the M2 bus and Basically, it allows you to initiate arbitrary read and write DMA transactions to the RAM and using it we were actually able to exploit this time check time fuse issue, which was amazing But as some of you may say, it's not good enough. It requires physical access, right? And we it could be considered only as an Evil-made attack or supply chain attack at best and we thought so as well and we wanted to make things even more powerful We wanted to operate them remotely so to do that we utilize something that exists on any platform utilize the storage device and We did it using a cool technique by Rafale that was presented a couple of years ago Which allows you to generate DMA transactions using a storage device So let's see how it works now Remember the previous diagram? Now we had another component into the equation We had your storage device and on top of it we place some malicious file which contains our payload or basically the modified address so Once again We will start by generating a DMA request due to the asynchronous nature of the storage device It will take it some time to process the request Then we will also hook this request such that it will be redirected back to the input buffer and We will trigger an SMI Once we trigger an SMI all the cores are going idle Remember then eventually the SMI handler will enter the critical validation and usage steps And with some luck the data or the file will be returned exactly in between the validation and usage and Will allow us to exploit this time of check time of use issue Okay, so we talked a lot and it's probably a good time for a recap So we discussed what is SMM and how we can communicate with it We also discussed how we can turn those time of check time of use issues into right primitive study SMR and We also discussed how to manipulate DMA transactions to exploit exactly those time of check time of use issues and We also discussed how to execute code inside SMM. Oh well not exactly So yeah, we don't currently have the ability to execute code in SMM But we have something pretty powerful. We have a right primitive to the SM run So let's put that to some good use one of the modules we analyzed was the SM bios DMI edit Dixie driver And our analysis was not in vain. It bore fruits fruits in the image of potential right primitives It's worth noting that this list is not exhaustive and it's far from being the only Vulnerable module However with a bunch of right primitives in a classic scenario you would probably try to find an executable memory region, right and We thought that it would apply to SMM as well but as we discovered SMM has page paging mechanism of its own where all pages containing code are read only and all pages containing data are Non-executable then you would probably try to forge some arbitrary payload out of your right primitives and Even though we have quite a few of them their variety and number does not let us craft anything decent and Lastly you would strive to get unrestricted memory access and Here once again the paging mechanism In the SMM hinders our exploitation so for starters Most of the non SMRAM RAM is simply not mapped to the page table and if that's not annoying enough and it's annoying The page table resides in read-only pages meaning no new pages can be allocated and all attributes are permanent Meaning that if we do manage to execute code in SMM It would be pretty hard not impossible, but pretty hard to do something for instance to the to the OS So as you all probably agree, I hope by now The classic approach might not be very applicable here So let's try to think out of the box and leverage some mechanisms that are unique and internal to SMM so at this point we Jonathan and I Turned to reading some works from the past and one of the works we we found was by Raphael Washtuk and Corey Coneberg from 10 2015 where they write By forcing at three suspend resume cycle and the Tucker can run an arbitrary code and take control over SMM Sounds promising, right? But what's S3 suspend resume and what is S3? So well S3 is a sleep state where the CPU is idle, but the memory keeps on working and Simply put when you put your machine to sleep. It usually enters S3 Let's continue with some more background So a normal boot process is rather time consuming But when we come back from S3 some of this process can be skipped because well the machine has already booted once however, some configuration still needs to be restored and Here the S3 boot script comes to our aid During the normal boot the configuration of the platform is encoded into the S3 boot script And then when we the machine wakes up There is the the code boot and the code boot engine simply executes the The script and restores the configuration and this boot script consists of rather primitive Opcodes like reading writing to IO to memory to PCI, etc. And here's the interesting bit Previously it was stored in a location that it was accessible to the OS Which is exactly the fact that the That the paper with earlier abuses they modified the boot script from the kernel put the machine to sleep Woke it up at this point their malicious S3 boot script was executed and eventually they ran code in SMM So as you could probably guess this This paper was from 2015. So it's already mitigated and nowadays the S3 boot script resides in a container aptly named a logbox and the logbox is a data structure that provides integrity of the data It is located in the SMRAM has a pretty standard Implementation and there is a rather convenient API for reading writing and updating it from ring zero So let's have a look at the update procedure so here we see the function that updates the logbox and It either returns access denied error or some internal status The only way we do not get access denied and well We don't want to get access denied is if the M locked global variable is not set which is kind of nice way of Of me of preventing the kernel from updating the logbox and This global variable Unconveniently resides in the SMRAM, but hey, we have a right primitive there, right? so let's Let's utilize all the information we got and try to execute unauthorized code in XMM So the plan is as follows we use a right primitive to zero out the M locked global variable Then we invoke the update procedure of the logbox and by that Modify the s3 boot script with our malicious version of it We put the machine to sleep wake it up and At this point the s3 boot script will be executed and will be eventually running code in SMM So it's a great idea, but it doesn't it doesn't really work because Right after the machine wakes up and just before the s3 boot script is executed The code will close and lock SMRAM and only then jump to the boot script meaning that if Even though we managed to execute code a rather primitive rather privileged code At a rather early stages of s3 resume We the SMRAM is locked and most of the RAM is simply not mapped to the page table Yeah, we should have read the documentation all right, so our quest continues and let's take another attempt and Let's Take another attempt where we emerge victorious, but as usual some background So each core has its own region of the SMRAM Pointed to by the SM base MSR model specific register each core has an MSR of its own Each each of these regions contains a lot of interesting things, but we'll be focusing on two The SMI handler entry point which is the first code that will be executed upon entering SMM and the safe state Which contains among other things the value of the SM base MSR and As a matter of fact the proper way to modify the SM base MSR is by changing its value in the safe state and This whole operation is pretty special. How special is it? You might wonder it's so special that it has a name SM base relocation from a developer's point of view SM base relocation is pretty straightforward They modify the value of the SM base value in the safe state and some magic behind the scene relocates it or relocates the whole region to the new to the new address Which leads to the following attack idea? So let's allocate some user controlled memory that is accessible to both kernel and SMM There will craft our own SMI handler entry point the first code that will be executed upon entering SMM and Now we'll simply use our right primitive to modify the SM base value in the safe state this will trigger an SM base relocation and Eventually we'll execute code in SMM, right? Yeah, it's a great idea, but it doesn't work It doesn't work at least out of the box and it doesn't work. Thanks to these MSR and in particular the SMM code check enable bit So when this bit is set and the machine is running in SMM If someone tries to execute code outside of SMR, it will simply trigger an exception You can think of it as some sort of a SMAP mechanism But that's not all there is a log bit here that if said this MSR cannot be modified or Changed in any way until the next reboot and while rebooting the machine or cutting power to the CPU Kind of defeats the purpose. So at this point Jonathan and I Said and thought what could be the closest thing to rebooting the machine without rebooting the machine? And then it hit us. We'll just put the machine to sleep and in particular to s3 sleep Recall that the s3 sleep state is a process a state where the CPU is idle, but the memory keeps on working and As the CPU loses power all the entries stored on the CPU are cleared when going into s3 So if you care about all these entrants for instance the MSR we just saw All the data should be copied to the To the memory prior to entering s3 and after the machine wakes up It should be restored to the CPU So let's have a look at our beloved MSM SMM code check enable bit In normal execution it is set When going into s3 it is still set when the machine wakes up and we come back from s3 as the CPU lost its power It is cleared and at the very early stage of the boot process There is some initialization code that initializes This bit. So let's have a look at the initialization code So clearly we we see the right MSR over here With a certain value you'd have to believe us that it comes from the memory And here's the interesting bit This right MSR happens only if the condition in the if statement holds meaning the MSMM feature control supported global variable should not be zero and Remember we have a right primitive to the SMM to the place where this global variable is stored This leads to the full recipe of unauthorized code execution in SMM from kernel So first we use our right primitive to annul the MSMM feature control supported global variable Then we put the machine to sleep Wake it up at this point the function you saw earlier is executed the condition in the if statement does not hold and The SMAP like mechanism is not enabled hooray Now we create our own SMI handler entry point the first code that will be executed upon entering SMM And we use a right primitive once again to modify the value of the SM base MSR in the safe state And thus we trigger an SM base relocation and We trigger an SMI and drum rolls, please We have code execution SMM All right great success So frankly and humbly speaking this method is pretty awesome But it gets even better So the SMI handler entry point starts running in real mode meaning that the page tables Enforcement have not kicked in yet because well, there's no paging and as we crafted our own SMI handler entry point We have full and unrestricted memory access to all of the RAM So for instance, we do not mind the non executable or read only pages or The fact that the paging mechanism is static or the read only Or the fact that the page table resides in read only pages or the non executable stack or any of these mitigations This is pretty awesome however, your mitigations do hinder our exploitation in particular the s3 and SM base log bits when these bits are set The as the CR3 register and the SM base MSR cannot be modified until next reboot So while those mitigations are not fully adopted yet in all platforms we wanted to deal with them as well and To do that we had no lead at this moment. So it decided to dig dig up once again through the pages of history and We stumbled upon this cache poisoning attacks that was presented in 2009 by Rafaela and Joanna and using the cache poisoning click link you're basically are able to arbitrarily read and write to and from the SMR So let's see how this mechanism works. So When we try to write to the SMR from the kernel, we will stumble upon a barrier which Basically makes sense, right? We are not allowed to write to the SMR. So the memory transactions will be discarded However, this was a little bit misleading in practice when we try to write to the SMR We'll go through the cache first and the data will be stored there first and only then it will be written back to the SMR so what if before we before the data is written back to the SMR we will trigger an SMI and CPU will enter SMM it's SMM state the barrier will be removed And with some luck only then the read the write back will occur and will modify the content of the SMR So this would work, but Obviously, this is already mitigated and this is due to a special web MSR That is called SMRR the system management range register and it has a simple thing It basically disables the caching of the SMR But we already know how to disable MSRs, right? so let's see at the code that restores it from the sleep state and this is probably looks familiar and This is why so this is the line of code that actually restores the MSR and Once again, it is dependent upon a global So what if we are now this global set it to zero using one of our write primitives We'll put the machine into sleep. We'll wake it up And when we wake up, we will be able to write to the SMR directly by Resurrecting from the dead the cash poisoning attack. So once again success and we can deal with even those newer mitigations So this is a great time for a demo and Let's hope it will work Okay Perfect. So before we begin, please notice that Intel NUC logo this logo Okay This logo is stored on the SPI flash along with the UEFI firmware So if you are able to execute code inside SMM We will be able to modify this logo The reason for that is because only SMM is accessible to the SPI flash It is the only ones that is able to write to it So now it's time to elevate our privileges We'll begin by crafting a new write primitive of the value of zero Remember, we had a rather complex write primitives and none of them was an actual zero So by changing a couple of them and modifying a couple of globals inside the SMR we were able to craft the value of zero and This will help up in the in the next step of our attacks so now we will try to anal that MSMM feature controls supported global which is responsible for the MSR restoration and If you are actually able to disabled when we return from sleep state the MSR will be annulled so now That we have annulled this global We will read the MSR before we go to sleep state We will see that the value of the MSR is five Which stands for two enabled bits both the enable bit and the lock bit and we'll put the machine into sleep So at this moment we count on the user to return from the sleep I guess no one was ever concerned that is being SMM mega-bridged when his machine suddenly went to sleep and Now that he is back. We will leave the MSR once again and it is zero so now we are able to execute code outside the SMR but How we will do it using the SM base relocation attack so at this point we'll execute the SM base relocation attack and Execute our own shell code it's out the outside the SMR so what the shell code actually does it simply replaces one of the SMI handlers and Now we are only left with triggering it so Now that we have triggered it We will reboot the machine and see the result of what our SMI handler actually did and Voila, we managed to change the logo So to better understand the implications of the issues we have found we need to understand the UEFI ecosystem first So everything begins with the TianoCore project or what some of you may refer to as the EDK2 or Practically the source code for any of your modern UEFI fingers Then comes the IBVs the independent BIOS vendors. They take this source code EDK2 and Practically add the major portion of functionality. They add all the different SMI handlers along the way Then they deliver it to the OEMs to the original equipment manufacturers such as Acer, Asus, Dell, Gigabyte, HP, Intel in the case of the Intel NUX, Lenovo and MSI Then those OEMs deliver it to you guys the end the customers So in the attempt to understand how many devices are vulnerable to ring hopper We found out that only in 2020 they were manufactured more than 200 million devices that are vulnerable to our attack Which is absolutely crazy and probably results in a couple of billions devices that are vulnerable and Obviously means tons of CVs So if things were not bad enough, we want to make things even worse up until now we Attack the machine from kernel to SMM aka ring minus two But we want to make our attack work work from ring three as well from user space and to do that We require three different things. We need to be able to generate DMA transactions We need to be able to trigger SMIs and we need to be able to write a specific physical memory So let's begin by generating DMA transactions So remember the previous diagram where we hooked inside a kernel the DMA response and we made some very complicated DMA generate very complicated DMA and request So figure that it is way way simpler in order to generate DMA request You only have to read the file the data will be returned to us with DMA directly and to make sure that it is Being redirected to the input buffer. We do not need a hook. We simply read it into the input buffer So this was it and how we generated DMA transactions from user space It was rather simple, but triggering SMIs is way complicated And this is because we need to execute a special opcode out B2 that can be executed only from kernel and At this point we got very frustrated and like every frustrated millennial we went on a social media and In specific the ones that if you trip or its name by way free it may free you'll probably get the wrong results So anyway and We stumbled upon one of Alex Matrosov tweets which says that practically Any bias update tools that you'll find there out there probably has some low-level functionality that can be reused for offensive purposes and indeed there was So we am I provides to driver a Linux driver and assigned Windows driver and both of them Exposed an API for triggering any arbitrary SMIs that we desire basically a yachtal So Now that we have done with triggering SMIs we are only left with writing to specific physical memory and I remind you we wanted to make it work both from Windows and Linux So let's start with Windows So the communication with SMM is a little bit more complicated it has a special structure that is called a mailbox which has a Description of all the things related with the communication with SMM and the one address it contains Physical address of a row buffer, which would actually contain the input So in order to access it from SMM we require a physical address Which is basically the virtual address within SMM context and to access it from user space We require a virtual address that maps exactly this physical memory region So let's look at the buffer mapping yachtal inside one of the Windows drivers So it begins by triggering SMID 9 which basically populates the mailbox and along the way the the raw pointer to the buffer and Then in order to access this mailbox It needs to map this physical address So the next thing that it does it basically map this physical address into an accessible virtual address Then at offset 8 it access the pointer to this physical buffer the row buffer and once again map it into a user accessible virtual address and Then returns everything into a user accessible memory. So the user will be able to access those virtual addresses So some of you may notice there is a race condition here in between the time of that the SMI is being triggered and the mailbox is being populated with the Pointer to the to this row buffer and the time that is being mapped to user virtual address So what if we change this physical address in between the time that the mailbox is being populated and the times that this Physical address is being mapped will be AC basically will be able to map any arbitrary physical address that we desire So let's see how it works. We will trigger the buffer mapping yachtal twice on the first attempt We will get an access to the mailbox virtual address So we will be able to modify the mailbox at offset 8 with our own desired physical address And then we will modify the mailbox to exploit this race condition and basically Change this address with our own arbitrary physical address and we will get the corresponding virtual address So this looks great But reality makes things even harder in order to avoid the remapping of the same physical Addresses over and over again. Those globals are being checked which basically makes sense, right? We do not want to map the same address over and over again So at this point we decided to look at the cleanup yachtal and We noticed that the cleanup yachtal only does it is to annul those globals and I will repeat it It only annul the globals. There is no end mapping of this virtual address once or ever So it is still accessible to user space So we will use this fact and we'll make the following exploitation So we'll trigger the buffer mapping yachtal to get a mailbox virtual address. We will trigger the cleanup yachtal to annul the globals We will exploit the file and then we'll exploit the following race condition From two course we will do as follows on the first score We will trigger the buffing yet mapping yachtal once again to populate a mailbox and to map the physical address inside it From within the other course We will use our previous virtual address of the mailbox to modify with our own to modify the top state with our own desired physical address Then we'll check if the newly mapped physical address is the ones that we wanted If not, we will simply repeat the entire process We'll trigger the cleanup yachtal repeat the entire process once again until we succeed so you folks are pretty tired by now, I guess we presented a lot of info but Let's but do you have a moment to talk about Linux? Am I does some pretty let's us do some pretty amazing things from user space Here we open the Linux module at the kernel module, sorry and trigger the M MAP syscall with the Yeah, with the kernel modules file descriptor to map any physical address Which is pretty awesome at this point. We'll have to somehow be able to to generate DMA Transactions for our exploit to work. So just as we did on Windows will simply open a file Read it to the previously mapped memory and hope for the best from the Linux modules side they They initialize the M MAP attribute of the file operations Struck with their own with their own function, which does which actually does the Virtual to physical to virtual mapping using the remap pfn range, which is pretty straightforward It gets a physical address and returns a user accessible virtual address But there are some bad news When we execute this code we get an e-fold and the reason for that is In the way remap pfn range works when running this function Page ranges are managed without struct page. Just pure pfn simply put This will not work. No DMA transactions will be generated here However, we have the ability to map any physical address Any physical address So let's take the code from before and instead of mapping some arbitrary physical address Let's map for instance the address of the Linux kernel or a kernel kernel module At this point that we have the user accessible mapping We will be able to patch ring zero code and gain code execution in kernel and Which is pretty awesome, but it sounds kind of familiar right do we remember how we generated DMA transactions from kernel? So now that we have all three bullets Working from ring three. We have a full exploiter exploitation chain from userland to SMM Which concludes our journey? We first Got the ability to write to the SMRAM then we try to leverage it into code execution in SMM using the S3 boot script and we failed spectacularly and We successfully ran unauthorized code in SMM using and abusing the SM base relocation technique And lastly we elevated the attack to work from userland and thus we managed to hop From user space to SMM We were Jonathan and Benny. Thank you so much for taking part in this journey


Ever felt the need to record an important office meeting so that you could clearly communicate the minutes to the missing team members? Sure, you must have. TweakShotScreenRecorder is an easy and effective way to record meetings. Download, install and run TweakShotScreenRecorder from the link mentioned in the description below. You can now select the region that you want to record. For instance, you can choose to record the complete screen by clicking on the full screen. Or you can choose the select region option where you can drag the crosshair arrow and select a particular region on your screen. Apart from that, you can even choose to record a particular window or your webcam. The choice is entirely yours. Once you have chosen your desired screen region, click on the red color record button. Once the recording starts, you will be able to see a play-pause bar at the bottom right corner of the screen. Using this, you can play or pause your recording. Stop your recording once you're satisfied and done with your recording. Not just that, you can even take screenshots of your important moments during your meeting by clicking on the camera icon that is next to the running time. To access the recording, click on the stop button, after which the main interface will open again. Here you can click on the recordings where your recorded meeting will appear. From the same dashboard, you can play the recording of your meeting. Open the file location of the recording or even delete the recording. Easy peasy, isn't it? Do give TweakShotScreenRecorder a try and let us know what you think.


From Austin, Texas, it's theCUBE, covering Pure Storage Accelerate 2019. Brought to you by Pure Storage. Welcome to theCUBE, the leader in live tech coverage, covering Pure Accelerate 2019. Lisa Martin with Dave Vellante in Austin, Texas this year. Pleased to welcome a couple of guests to the program. Please meet Charlie Boyle, VP and GM of DGX Systems at NVIDIA. Hey Charlie, welcome back to theCUBE. We've been on a long time ago, and we have Brian Schwartz, VP of Product Management and Development at Pure. Brian, welcome. Thanks for having me. So here we are, day one of the event. Lots of news this morning. Pure is just about to celebrate its 10th anniversary, a lot of innovation in 10 years. NVIDIA partnerships about two-ish, two and a half years old or so. Brian, let's start with you. Give us a little bit of an overview about where Pure and NVIDIA are, and then let's dig into this news about the AI data hub. Cool. It's been a good partnership for a couple years now, and it really was born out of work with mutual customers. We brought out the FlashBlade product. Obviously NVIDIA was in the market with DGX's for AI, and we really started to see overlap in a bunch of initial deployments. And we really realized that there was a lot of wisdom to be gained of some of these early AI deployments of capturing some of that knowledge and wisdom from those early practitioners and being able to share it with the wider community. So that's really kind of where the partnership was born. Going for a couple years now, got a couple chapters behind us and many more in the future. And obviously the AI data hub is the piece that we really talked about at this year's Accelerate. Yeah, Aries about been in the market for what, about a year and a half or so? Almost two years now. Almost two years. All right, tell us a little bit about the adoption, what customers are able to do with this AI-ready infrastructure? Yeah, and as pointed out, the reason we started, the partnership was our early customers that were buying DGX product from us and they were buying Pure Storage, both leaders in high performance. And as they were trying to put them together, they were like, how should we do this? What's the optimal settings? They'd been using storage for years. AI was kind of new to them and they needed that recipe. So that's the early customer experiences turned into Aries' solution. And the whole point of it is to simplify AI. AI sounds kind of scary to a lot of folks and the data scientists really just need to be productive. They don't care about infrastructure but IT has to support this. So IT was very familiar with Pure Storage. They'd used them for years for high performance data and as they brought in the NVIDIA compute to work with that, having a solution that we both supported was super important to the IT practitioners because they knew it worked, they knew we both supported it, we stood behind it and they could get up and running in a matter of days or a week versus six to nine months if they built it themselves. When you look at companies that you talk to, customers, let's narrow it down to those that have data scientists, at least one data scientist and you ask them where they are in their maturity model. Kind of, if one is planning, two is early, three is they got multiple use cases and four is they're enterprise-wide. How do you see the landscape? Are you seeing pretty aggressive adoption in those as I couched it or is it still early? So every customer's at a different point. So there's definitely a lot of people that are still early but we've seen a lot of production use cases. Everyone talks about self-driving cars but there's a lot behind that but real-world use cases say medical's got a ton. We've got partner companies that are looking at reconstruction of MRIs and CT scans cutting the scan time down by 75%. That's real patient outcome. We've got industrial inspection, we're in Texas. People fly drones around and have AI models that are built in their data center on the drones and the field operators get to reprogram the drones based on what they see and what is happening real-time and then it retrains every night. So depending on the industry really depends on where people are in their maturity curve but really our message out to the enterprises is to start now. Whether you've got one data scientist, you've got some community data scientist, there's no reason to wait on AI because there's a use case that will work somewhere in your enterprise. So what are the key considerations to getting started? What would you say? So one thing I would say is to your stages of maturity any good investment is done through some creation of business value and an understanding of what problem you're trying to solve and making sure it's a compelling problem is an important one and some industries are farther along. One of the ones that most everybody's familiar with is the tech industry itself. Every recommendation engine you've probably ever seen on the internet is backed by some form of AI behind it because they want it to be super fast and customized to you as a user. So I think understanding the business value creation problem is a really important step of it and many people go through an early stage of experimentation, data modeling, really kind of, I'll say a prototyping stage before they go into a mass production use case. It's a very classic IT adoption curve. Just to add a comment to the earlier kind of trend is it's a mega trend. Yes, not everybody is doing it in massive wide scale production today. There are some industries that are farther ahead. If you look forward over the next 15 to 20 years there's a massive amount of AI coming and it is a new form of computing the GPU driven computing. And the whole point about AI is getting the ingredients right to have this new set of infrastructure, have storage network compute and the software stack all kind of packaged together to make it easier to adopt to allow people to adopt it faster because some industries are far along and others are still in the earlier stages. Right, so how do you help for those customers and industries that aren't self-driving cars or the drones that you talked about where the use case we all understand it and are excited about it but for other customers in different industries how do you help them even understand the AI pipeline and where do they start? I'm sure that varies by customer but give me some favorite examples. It does vary a lot but the key point is start an AI project that you have a desired outcome from not everything's going to be successful but AI projects aren't something that it's not a six month IT project or a big CRM refresh it's something that you could take one of our classes that we have we do a lot of end user customer training with our deep learning institute you can take a half day class and actually do a deep learning project that day and so a lot of it is understanding your data and that's where Pure and the data hub comes in understanding the data that you have and then formulating a question like what could I do if I knew this thing? That's all about AI and deep learning it's coming up with insights that aren't natural when you just stare at the data how can the system understand what you want and then what are the things that you didn't expect to find that AI is showing you about your data and that's really a lot of where the business value comes and how do you know more about your customer how do you help that customer better? AI can unlock things that you may not have pondered yourself. Yeah, the other thing I'm a huge fan of analogies when you're trying to describe a new concept to people and there's a good analogy about AI data pipelines that predates AI around data warehousing like there's been an industry around extract, transform and load ETL systems for a very long period of time it's a very common thing for many people in the IT industry and I do think there's when you think about a pipeline an AI pipeline there's an analogy there which you have data coming in ingress data you're cleansing it, you're cleaning it you're essentially trying to get some value out of it how you do that in AI is quite a bit different because it's GPUs and you are looking for turning unstructured data into more structured data it's a little different than data warehousing traditionally was running reports but there's a big analogy I think to be used about a pipeline that is familiar to people as a way to understand the new concept. So that's good I like the pipeline concept one of the counters to that would be that when you think about ETL it's complicated process enterprise data warehouses that were cumbersome do you feel like automation in the AI pipeline when we look back 10 years from now we'll have maybe better things to say than we do about EDW and ETL. And I think one of the things that we've seen obviously we've done a ton of work in traditional AI but we've also done a lot in accelerated machine learning because that's a little closer to your traditional data analytics and one of the biggest kind of aha moments that I've seen customers in the past year so it's just how quickly by using GPU computing they can actually look at their data do something useful with it and then move on to the next thing so that rapid experimentation is all what AI is about it's not a one and done thing and lots of people think oh I have to have a recommender engine and then I'm done no you have to keep retraining it you know day in and day out so that it gets better and that's before you had accelerated AI pipelines before you had accelerated data pipelines that we've been doing with GPUs it just took too long so people didn't run those experiments now we're seeing people exploring more trying different things because when your experiment takes 10 minutes two minutes versus two days or 10 days you can try it you know your cycle time shorter businesses can do more and sure you're going to discard a lot of results but you're going to find those hidden gems that weren't possible before because you just didn't have the time to do it isn't a key operationalizing it as well I mean again one of the challenges with the analogy that you gave on EDW was fine reporting you could operationalize it for reporting but the use cases weren't as rich and robust and I feel as though machine intelligence is I mean you're not going to help but run into it it's going to be part of your everyday life your thoughts on it it's definitely part of our everyday lives you know when you talk about you know consumer applications of everything we all use AI everyday you just don't know it it's you know the voice recognition system getting your answer right the first time you know there's huge investments in natural language speech right now you know to the point that you can ask your phone a question it's going through searching the web for you getting the right answer combining that answer reading it back to you and giving you the web page all in less than a second you know before you know that'd be like you talk to an IVR system wait then you go to an operator you know now people are getting you know such a better user experience out of AI back systems that you know over the next few years I think you know end users will start preferring to deal with those base systems you know rather than waiting online for a human because it'll just get it right it'll get you the answer you need and you're done you save time the company save time and you've got a better outcome so there's some definitely some barriers to adoption skills is one obvious one the other and I wonder if Pure and Nvidia have you know attacked this problem I'm sure you have but I'd like some color on it is traditional companies which a lot of your customers their data is in pockets it's not at the core you look at the AI leaders you know the big five data they're data companies it's at the core they're applying machine intelligence to that data how has this modern storage that we heard about this morning affected that customer's abilities to really put data at their core you know it's a great question Dave and I think one of the real opportunities particularly with flash is to consolidate data into a smaller number of larger you know kind of islands of data because that's where you can really drive the insights historically in a disk driven world you would never try to consolidate your data because there was too many bad performance implications of trying to do that so people had all these pockets and even if you could you probably wouldn't actually want to put the data on the same system at the same time the difference with flash is there's so much performance at the core of it at the foundation of it so the concept of having a very large scale system like the 150 blade system we announced this morning it is a way to put a lot of data and be able to access it and to Charlie's point a lot of people they're doing constant experimentation and modeling of the data you don't know how the data is going to be consumed and you need a very fast kind of wide platform to do that which is why it's been a good fit for us to work together now follow up on that data by its very nature however Brian is distributed and we heard this morning is you're attacking that problem through you know an API framework that you don't care where it is cloud, on-prem, hybrid, edge at some point in time your thoughts on that well and again the data to be used for AI I wouldn't say it's going to be every single piece of data inside an organization is going to be put into the AI pipeline in a lot of cases you can break it down again to what is the problem I'm trying to solve the business value and what is the type of data that's going to be the best fit for it there are a lot of common patterns for consumption in AI speech recognition image recognition places where you have a lot of unstructured data or it's unstructured to a computer it's not unstructured to you when you look at a picture you see a lot of things in it that a computer can't see right, because you recognize what the patterns are and the whole point about AI is it's going to help us get structure out of these unstructured data sets so the computer can recognize more things you know the speech and emotions that we as humans just take for granted it's about having computers being able to process and respond to that in a way that they're not really capable of doing today hot dog, not a hot dog you know, the Silicon Valley fans it's the streetlight which one of these is not a streetlight so you prove you're not a bot I want to ask you about distributed environments you know, customers have so much choice for everything these days on-prem, hosted, SAS, public cloud what are some of the trends that you're seeing I always thought that to really be able to extract a tremendous amount of value from data and to deliver AI from it you needed the cloud because you needed a massive volumes of data the purest legacy of on-prem what are some of the things that you're seeing there and how is NVIDIA and Pure coming together to help customers wherever this data is to really drive value, business value from these workloads I'll have two quick comments then I'll turn it over to Charlie so one is we get asked this question a lot like where should I run my AI the first thing I always tell people is where's your data gravity moving, these data sets are very large tens of terabytes, hundreds of terabytes petabytes of data moving very large sets of data is actually still a hard challenge today so running your AI where your data is being generated is a good first principle and for a lot of folks they still have a lot on-premise data that's where their systems are they're generating these systems or it's a consolidation point from the edge or other opportunities to run it there so that's where your data is run your AI there the second thing is about giving people flexibility we've both made pretty big investments in the world of containerized software applications those things are things that can run on-prem or in the cloud so trying to use a consistent set of infrastructure and software and tooling that allows people to migrate and change over time I think is an important strategy not only for us but also for the end users it gives them flexibility so ideally on-prem versus cloud implementations shouldn't be different it'd be great if they'd be identical but are they today? so at the lowest level there's always technical differences but at the layers that customers are using it we run one software stack no matter where you're running so if it's on one of our combined ARI systems whether it's in a cloud provider it's the same NVIDIA software stack from our lowest end consumer grade GPUs to the big 350 pound DGX2 you see back there we've got one software stack that runs everywhere and one that Ryan was making it's really run AI where your data is and while a lot of people if you are a cloud native company if you started that way I'm going to tell you to run on the cloud all day long but most enterprises they're you know some of their most valuable data is still sitting on premise they've got decades of customer experience they've got decades of product information that's all running in systems on-prem you know when you look at speech speech is the biggest thing you know they've got years of call center data that's all sitting in some offline record what am I going to do with that that stuff's not in the cloud and so you want to move the processing to that because it's impossible to move that data somewhere else and transform it because you're only going to actually use a small fraction of that data to produce your model but at the same time you don't want to spend a year moving that data somewhere to process it you know back the truck up put some DGXs in front of it and you're good to go someone's going to beat you to finding those insights right so there is no time so you have another question I have the last question so you go ahead so in video you got to be Switzerland in this game so I'm not going to ask you this question but Brian I will ask you why is Pure different I know you were first you raced out you got the press release out first but now that you've been in the market for a while what are Pure's competitive differentiators you know there's really two I would net it out for FlashBlade on why we think it's a great fit for an AI use case one is the flexibility of the performance we call it multi-dimensional performance small files, large files metadata intensive workloads FlashBlade can do them all it's a ground up design it's super flexible on performance and but also more importantly I would argue simplicity is a real hallmark of who we are it's part of the modern date experience that we were talking about this morning you can think about these systems they are miniaturized supercomputers and yes you could always build a supercomputer people have been doing it for decades you use PhDs to do it and like most people don't want to have people focused on that level of infrastructure so we've tried to give incredible kind of capabilities in a really simple to consume platform I joke with people we have storage PhDs like literally people at PhDs for storage so customers don't have to and Charlie, feel free to chime in on your favorite child if you want you know a lot of it comes from our customers that's how we first started with Pure it was our joint customer saying we need this stuff to work really fast they're making a massive investment with us in compute and so if you're going to run those systems at 100% you need storage that can feed them Pure was our first in there they're our longest partner in this space and it's really our joint customers that put us together and to some extent yes we are Switzerland we love all of our partners but we do incredible work with these guys all up and down the stack and that's the point to make it simple if the customer has data we want it to be as simple as possible for them to run AI whether it's with my stuff, with our cloud stuff with all of our partners but having that deep level of integration and having some of the same shared beliefs to just make stuff simple so people can actually get value out of the data have IT get out of the way so data scientists can just get their work done you know that's what's really powerful about the partnership and I imagine, I know we're out of time but I imagine to be able to do this at the accelerated pace, accelerated I'm going to say pun intended it wasn't but cultural fit has to be pretty aligned we know Pure's culture is bold last question Brian that's what we bring it home here talk to us about how the cultural cultures of Pure and NVIDIA are stars aligning to be able to enable how quickly you guys are developing together you know we mentioned the simplicity piece a bit the other piece that I think has been a really strong cultural fit between the companies is just the sheer desire to innovate and change the world to be a better place you know our hallmark, our mission is make the world a better place with data and it really fits with the level of innovation that obviously NVIDIA does so two Silicon Valley companies with wicked smart folks trying to make the world a better place it's really been a good partnership yeah I'd echo that and that's just the rate of innovation in AI changes monthly so if you're going to be a good partner to your customers you've got to change just as fast so our partnership has been great in that space awesome next time we're out of time but next time come back and talk to a customer really want to understand and kind of dig into some of the great things that they're extracting from you guys so Charlie, Brian, thank you for joining Dave and me on theCUBE this afternoon thanks, thanks, thanks for Dave Vellante I'm Lisa Martin you're watching theCUBE, y'all from Purexillary in Austin, Texas


We have one 2S-19 in the open. Great it is. Good ring back. Requesting one low L, target line is 090.