Sign-in 1 was due yesterday, don't have any stats yet, so I need to wait until everyone's submitted because they can submit today for 80%, tomorrow for 60% is the day after the recording. So we'll hold off any burning questions on the assignments until then and then I can tell you as much as I can tell you. Sign-in 2 will be on Wednesday. We're going to keep it a topic. You guys are here to work in the program. This is what you're going to have again. Do you think it'll be like an equivalent amount of time? This is a longer shorter, what do you call it? Hopefully you've gotten better, right? So hopefully it'll take less time, but then maybe it's more worth it still. I don't know. Any other questions? Yes? Hey! No. What is the second assignment you're going to do? You'll have two weeks for the second assignment as well. Keep the pace going. There'll be another assignment after that. We'll have, I think, three weeks on that one and three weeks on the last one. So four assignments in total? Yes. Four homework assignments. Why is it not? I'm curious. It could be three really difficult ones or four medium-sized ones, right? This one's not going to be difficult. This was the warm-ups. All right. So let's get here and eat. So remember what we're talking about now. We've done the networks. Now we want to focus on applications and binaries specifically. So we really need to study how our binary is made. Folks, if you want to talk, go outside. So we're talking about how do we actually get binaries. So we're talking about two different ways. Interpretation and compilation. And we're still in the reviewing phase.  So when we're compiling and the main thing we want to think about is C code. We have C code. We first have a fruit processor that runs on our C code that operates on all the pound-defined and the pound-includes, expands all the macros out, and then turn that code into architecture-specific assembly code. Right? So here, what are some of the architectures that we've talked about? MIPS. I'll throw out MIPS since you guys like to look at them. MIPS. XA6. ARM. ARM. AMD64. AMD64. Spark. And all kinds of other stuff. So you guys can hear this. So you can actually, one of the interesting things that I didn't learn, or I didn't really learn throughout the start of the program, is mainly you think like GCC just takes in a C file and outputs a binary that you can run an execute. But you can actually, with various flags in GCC, you can have it give you the different stages of the output. So this is actually going to be very handy when we look at shell code, is GCC-CAPITAL-S will output the assembly code of what GCC will eventually output. So this is kind of a cool debugging step that you can run around the C program. You do this on your back door web server to see what's the assembly code that actually, it's not great. The other important thing for this class, the N32 flag, is going to be all important because we are going to be exclusively focusing on XA6. So we're going to ignore 64-bit and AMD64. But if you're on a 64-bit system, you can also compile a 32-bit application using this flag. So the high-level goal of a compiler is to turn the source code into an executable file, into some kind of executable binary. So the assembler, and so the high-level goal of a compiler, so we saw that GCC will output assembly, and there's another step, the assembler, which on GNU legs is the ASC command, which will take in a .s file or some assembly language and we'll turn that into an ASC executable. So this is what is really important to think about. Remember, we're trying to dispel all the myths and get rid of magic out of the different layers, right? So what is the actual output of these things? It's not just the binary code itself, and why not? Yeah, so maybe, so you have 32-bit and 64, right? So you may need some metadata to try to tell the operating system what kind of file is this, what kind of code is this. What other kind of metadata might we want? A location where the program can write into memory. The operation will probably lock it down on this one specific range of RAM. Yeah, so we may want to specify metadata about where should the program expect memory to be, right? Where can it write to memory? Where can it read from memory, right? Additional types of things, oh yeah, go. What permissions following that, too? At what level? Like, do you change files? Which files is allowed to change? Depending on the operating system, maybe, in Linux that's outside of the executable itself. But there are some permission-type things. What about what code to start executing that? What instruction should be the very first instruction on this program? Yeah, so that, but where, right? You have a whole chunk of code. What do you want to be the absolute first thing that gets executed, right? These are all metadata that helps the operating system load and execute the code. And also we'll see relocation information. So there's, we'll see some binaries are written so that they can be shifted around and executed in different types, not different types, in different locations in the address. So every time it's not executing, they're always at the same place. We'll study this more when we look at SLR and those kinds of techniques. Symbols, so debugging information, right? So there may be symbol information, like which, what assembly instruction corresponds to the start of the main function in the C program? Or the variable foo, where does that correspond to? So that information can be in there.  So now that we've assembled our program, can we run it? 50-50 shots. Why? Let's go to the problem and ask you why. If it matches the architecture of the machine, if it matches the architecture of the machine, it shouldn't just be able to run. Yeah, so the other alternative would be what about libraries, right? Do you call into libc, any libc functions? So that actually, the process of translating from assembly to a binary object is what the assembler does, but that's still not enough to actually execute because you need to link up with other libraries that you're going to use. So this is why you have to specify .so files on the command line you're trying to compile everything. Or if you've done this with C code, you can individually compile a .c file if you use the .c flag, which will output just a binary. And then if you want to compile the entire thing into an actual executable, you specify all the object files and I will link everything together. So the linker basically says, okay, the assembler basically kind of has a placeholder that says, okay, you're calling function foo that's somewhere else. Great, I'll just put in a placeholder here. And now when I actually know where function foo is, I can link that up so I can make the call be to that actual memory address. So the linker is the very last stage that resolves all these references of either libraries or other object files that we're trying to use. So that'll be the linker file there. The other important thing, this is going to come up really important later, there's two different types of linking. So one is static linking, which is essentially your library is included in your executable. So if you statically link the libc library, you will generate about a 20 to 30 meg file even for a simple hello world because the entire code of libc is included in your binary. So why is that good? Why do that? Yes, it'll still run on a computer that doesn't have this library. Libc, everything has libc, but maybe it's a special library. What else? In what way? So maybe we're using a special version that maybe we've added some security features. It could be faster if we do some kind of wholesale optimization, we could be able to maybe optimize that down. One of the main reasons is portability. That's one of the huge reasons. So that I can ship this binary to any system and now it doesn't matter what libraries they've installed or even worse what versions of which libraries they've installed.  What's that in there? Huge file size. What else? Huge. Yeah, so this is the flip side of the security coin is what if there's a security vulnerability in that library that I've just included in this execute one given you. Right? If it's a shared library, you can just update the library on that system and now every program that uses that library will get updated. In this case, I have to recompile your application using the new updated library to get those security benefits. Any other pros there? So the other type is dynamic linking which essentially when the process starts, every time you first try to call a LIMPSE function, the system, the dynamic linker will then look for where is LIMPSE on this system will load it into your process space and then do all the linking already. So we'll see exactly how that works on this level. But these are the two main differences between these two cases here. So the most common executable file formats are L and PE for Windows. So the important thing about executable file formats, remember we have to think we are looking at a program that just exists, it's a file, right? It just exists as bytes on disk. Yet somehow the operating system needs to properly load that code into the proper locations, set up memory in the proper way and execute that program so a new process can be started. So these file formats, L and PE, must contain all the information in order to do that. And so the L file format is the main, it's the most commonly used binary object format. It's architecture independent which is nice, you can use it on MIPS, x86, x64. There's four file types, either it is real capable, which means that the linker has to be involved before it can actually be used. It can be executable, which means we are ready to go, we can execute this binary right out from the back. Shared means it's an elf-shared library, so it's not executable at all, it is a library that can be used by other files. And finally we have core dumps. So these are any of the program crash on them and then have like a core.sum number. Yeah, so that is actually a specific L file format. What's really cool is you can use GED to debug your program right at the memory, like what the memory was right at that state. So you can see, so that core dump has the entire layout of memory of your program at that specific point that your program crashed. Very handy tools. So actually the most used tool that I use when doing any type of security setup, especially for like capture of live hacking competitions, is the file command. What does the file command do? It shows you the type of the file. Yeah, it shows you the type of the file. How does it work? What was that? Chica file hater. Second? Chica file hater.  All it does is look at the first couple bytes of the file and it has this huge database of, if it starts with these three characters, that means it's a JPEG file. If it starts with these other characters, that means it's an EMP file. If it starts with these characters, that means it's an L file. So file command is really good to run any kind of thing that you don't understand what it is. And it won't tell you exactly what it is, right? It'll tell you what it thinks that file is based on the magic numbers of the file format. So super handy. I run this on anything unknown that I don't know what it is. The other program that's really good is the Read ELF program. So I would look at this, look at the documentation. This allows you to query a lot of information about an ELF executable file or if it's executable, it won't be any of these formats. So it can tell you what exactly are the symbols, where is the code going to be loaded, what are the permissions on all the different regions of memory, all really important things about your binary. That especially will be helpful when we get into exploitation. So the ELF file format, first step header, like most other things, we have a program. So at high level, we separate up the program into a series of segments. So then we have our special ELF header, which has a little detail showing in a second. Then we have a header table which says which of all these sections where they are in the binary and what are the offsets and any other important information. So the header has like a magic number, an addressing info, which says exactly how the addresses work, which will, oh no, sorry, that's 64 bit versus 32 bit. Another one is the file type, which shows you what specifically, what type you're using, the architecture type, what architecture you're using, and so on and so forth. The other important thing is the entry point. So this is what address when the program is loaded in memory should we start executing from. So this is an incredibly important one. The program header position, where the program header table starts, the section header position, the size, the size of the number. Is there any information you need in order to parse the rest of this file format? I thought you said it was architecture. It is. It tells you which architecture it is. So it's defined as whatever architecture type. So there's two different things in here. The addressing info tells you if it's 32 or 64 size addresses, which you need to know to read the rest of the addresses. The file type tells you, I believe, which one of the four types it is, and then the architecture type tells you which architecture it is. It's Spark or X86 or whatever. But that's just convention defined in the header standard, right? So some number would map to one of those. So then each section defines what the type of that section is and the permissions on this section. So we've got to think about this is part of the binary file, right? This is some section of the binary file. And so there are big steps telling you is this data or is this code, right? What is this section? If some sections actually have no part in the file. So let's say we want to pre-allocate a gig of memory in our program space, right? Because we know we're going to use at least a gig of memory. We don't want to actually have just a gig of zeroes in our program and say load this into a certain memory address, right? So we can actually say, hey, at this memory location in the program, allocate a gig of memory, but that doesn't actually exist in the file. We have symbol tables for static linking and dynamic linking. We have string tables which shows us the strings, relocation tables which helps when we're moving the file around. And so these are the important bits of permissions on memory. So yes, that's right. So allocate, if we're going to actually allocate what this section is in memory, write if we can write to this memory location. Why do we want to have sections of memory that the program cannot write to? Defensive programming measure. Do you ever use anything in your programming languages where you can't change the value? Yeah, constants. Either constants or a const structure, right? So there's a lot of cases where you want maybe read-only memory, and this is a way to actually enforce that. So you've got to think what's going to happen. You type in execute that program. You say dot slash whatever, normal web server. What the operating system is going to do is going to look at this and put each segment where the program says, hey, this segment goes to this memory address. So we'll put it there and it will give it these permissions. So it'll give it write executable. So there's an executable bit if the section can be executed. And write execute. I think there's also a read. Maybe it's all readable. So this way you can have different sections. And have more fine-grained permissions rather than the entire memory can be read and written to by anyone. So this allows the program to have a little bit more control. So this is some of these typical sections when you look at these things. So the dot text segment section is the program's code. So this is typically where your code goes. And it is allocable, or alloc, which means that it came from the file. So the file got put there. And it's executable. It makes sense, right? We want to actually execute our code. If this executable bit was not set, we would get a segmentation fault whenever we tried to execute our program. The dot data segment is for initialized data. So this is allocated from the code and it's writable.ro-down. What do you think the RO stands for? Re-only. Re-only. Re-only. Re-only. That's still... So it comes from the program, but it doesn't have a writable flag set. So this is important. We need to count write to this memory. The operating system itself will stop you from writing to this memory. The dot BSS. So this is data that does not exist in the program itself. Sorry. This is data that does not exist in the file, in the BSS. The init and the fitting are created in postcode that's executed. So this does some setup and cleanup stuff which we won't really go into here. So the pq file format is the exd file format on Windows. So this is the standard exd file format. The way, there's a lot of differences from the elf file format. There are programs there soon, but they're going to be loaded into address zero. So address zero is going to be the first instruction that's all executed. They... However, all programs are not loaded in memory address zero. They're moved around and so the OS knows to fix this up so the relocation will fix that up but it will change all the addresses. That's all we're going to say about that one. We won't put that too much. Now we need to dig into assembly so we need a primer on x86 instructions so that we can understand and look at actual binary code so that we can actually exploit binary code. So x86 family starts with the 8086 which was an old school CPU. It had 16-bit registers and the idea was this game was so popular that new CPUs rather than defining a new instruction set architecture said we'll just use whatever the x the 8086 used. So what's the benefit there? Standardization, backwards compatible how? New system uses old architecture. So what happens when you buy a new CPU? So I have an 8086 I buy a new CPU that's three times faster. You have to what? You have to rewrite all your software. Not only do I have to rewrite all my software, that's the software I have but what if it's not my software? What if somebody else gave me this binary? Now I paid money for this system and now I can't execute it on this new hardware. So this means it needs to be recompiled by whoever created it and then they have to give me a new binary specifically for this system. So this is part of, it's kind of like a historical weirdness but this became the de facto standard of CPUs and so every single, so most CPUs support x 86. So, eventually, so 16 bits is not a lot. What's the main limitation of having the limits here? Yeah, one of the big ones, even though it's possible to do it, is memory size allocation. So it's difficult to address more than two to the 16 bits that have that memory size. So, eventually we have 32 bit registers and it's been a lot of actual extensions to x86. So there's all kinds of various speed improvements. They're actually Intel's creating and other companies are creating new instructions every year to do things faster. So they're doing crypto stuff natively in hardware, all kinds of cool stuff. Hyperthreading, multi-core, 64 bit architecture. Anyways, this is a gap. What do these numbers actually stand for? Does it have any macro? It's stood for the name of the processor. I got started from the 8086 and then I don't know where that name came from. Obviously, the 8088 is too better. So I think from there it's probably marketing, although I think these are motor roll engines. Yeah, I think so. So yeah, I don't know other than marketing, but there's going to be a P3 or P4 or like the...actually they don't even have names now, right? They're like the Sandy Lake versus whatever Intel chip is, right? So there aren't any names. Okay, so in x86, we wanted to address memory. Namely, the way we're going to think about it is the flat memory model which basically gives us 0 to 2 to 32 minus 1 addresses that we can possibly address in our system. There is so there is another way of segmented memory where you specify the segment first and then the offset within that segment and that actually allows you to access more memory than 2 to 32. So what's the core problem with a 32-minute system here? Yeah, so we can only access up to 4 gigs of memory. So how does your memory actually work? So let's take a step and think about... we have our program, right? We have our executable on disk, so it's just a file at this point. We call which system call to start executing that program. At this point, it's already been loaded. It's already an executable file. It's done all the linking and everything. It's ready to go. Almost exact. No. It's actually exact VE. So this is a system call. So what is a system call specifically? Or generally, what's a system call? Yeah. So it's a way for user space programs, right? Programs are not executing in the kernel. It's a way for a user space program to call some functionality of the kernel. So this is why I said you do libc functions, which is just a library that you can use. And you can also use any kind of system call. So the socket command is a system call. So the socket calls into the kernel to say, hey, I want to listen to a socket. So that's all of what those libraries do. So the idea is you want some functionality of the operating system. So when we want to execute a new process, we actually call this exact VE. We'll look at the parameters later. System call, which basically tells the operating system, here's the executable I want. You pass it a file, essentially the path to a file. So what does it have to do? It has to load the program into memory. It may have to do that. We can ignore that part for now. So it's going to read the Elf header file format. It's going to place each copy each part from the file into the appropriate thing that the Elf header specifically says. So it's going to copy this thing to memory address this, this thing to memory address this, this thing to memory address this. But how do you do that? How does the operating system execute multiple programs at once? It does use a fork, but how does it actually, how come your, all of your excellent backdoor servers didn't crash my, what, my operating system? Even though you did, technically, but Time shares. Time shares? So they're not executing all at the same time, but what else? Contact switch is how you switch between. But why do you need a contact switch? What was that saying? Yes. But how can I don't have to worry about you guys if you wrote a program that scanned all of its memory, are you going to find the other programs that are running on my system? Why not? What was that? Yes. This is a key point about operating systems, right? One of the key abstractions they provide is every process that's executing thinks it has free reign over all the memory, right? So it can access everything from zero to however much. So this is a long way to get back to this four gigabyte limitation means that one program alone can't use more than four gigabytes of memory. But you could have, you could, yes, theoretically, you didn't have a like a shim for a while where you could have a 32-bit system have more than four gigs of memory. The operating system would be able to handle it and then each program itself or each process technically would have up to four gigs of memory that it couldn't use. But it couldn't use more than that. Yes. So you're saying you have two processes? So it comes to the virtual memory management. So you should look up virtual memory management of the operating system. So the idea is you physically have some memory, right? But there's a level of indirection between when your program says, hey, give me address zero. You don't actually get physical address zero. There's a level of indirection where the operating system has set up hardware that says, hey, actually for this process, address zero is at address 20. Yes. Maybe Oh, two programs talking to each other? So you can if you want two different processes, right, to be able to talk to each other you can use I believe it's M-MAP to You can map memory across both processes. So you have a shared memory region where you write from one process and you can read from the other process. So you have to set that up programmatically when the program first runs. And that's one way that you can get communication in between two processes. What was that? You can also use sockets on the files. You can just use files. There's plenty of ways to talk to each other. You got to lock that memory every time. Yes. It's tricky. It's any kind of distributed programming systems, right? Or always tricky. Cool. Okay. Four gigs. So it all starts with registers, right? We're learning any kind of hardware system. So the registers essentially if you've never done any architecture before it's going to be, we're going to go quickly. So I think you have to study this on your own if you're not familiar with things. Right? So registers are essentially local variables of the processor. So why do I say that? Well, they're physically on the chip. And so computing adding them together and multiplying them doing whatever we want to do to these registers is incredibly fast. A and B is the only way we can actually perform any computations. So all computations must really happen on the registers. On X86 there's four general-purpose registers A, B, C, and D. Super easy. The way these look, though, that E, A, X, E, B, X, E, C, X, and E, D, X. So we'll look at exactly what the difference is here but for now the E stands for extended and the A stands for the A and the X, to be honest, I can't it was an extension to the original ones I don't know what the X stands for. So four registers E, A, X, E, B, X, E, B, X, E, B, X. Convention and I'll name these for now. So the idea is when you refer to when you're writing assembly code and you refer to E, A, X, so for instance if you're writing move E, A, X into E, B, X, when you write E, A, X you are referring to the entire 32 bits that are inside the E, A, X register. So remember we're talking about a 32-bit architecture. So this means the memories there are two of 32 memory addresses and the registers are 32 bits as well. If you only want to refer to the lower half so how many bits is that? 16. Is that A, X? So this is the difference. So this is why it can be confusing when you're reading code when it says oh copy E, B, X into E, A, X and then copy A, X into E, C, X right even though it's different work I mean it looks like different registers, it's actually the same register so you have to keep this mapping in your head. Also you can even split that E, A, X register and access the upper part so the upper 8 bits so the upper byte is the A, H register with A and so the high of the A register and A, L accesses the lower 8 bits so the registers and you can do this for every single one of these 4 registers so you can see you will often see variations of these when looking at my error code. So there's other registers the ESI register ESI and EDI are used also to other registers and I have 6 registers just like the other ones we can have SI all the other types of operations and then there are different special purpose registers that are also really important so we have ESP which is the stack pointer so why is the stack important what is the stack? What is the stack in the context that we need in here? Yes, so stack is incredibly important for calling functions right so we need some way in memory to essentially keep track of the call stack of what functions we've called as the program executes and when functions return so you can think of it as scratch memory we're going to get into it more the really important thing is the top of the stack is the memory address that's in ESP so there are some instructions that will you can actually arbitrarily reference ESP you can say move ESP into EIX there are also another set of instructions that will implicitly modify ESP so it's incredibly important to understand this and I'm going to turn on those as well EVP which is the frame pointer which we'll look at more in that later so the frame pointer point so the stack pointer points to the current the current location of the stack of the top most of the stack and the frame pointer is a pointer that remains constant throughout a function's execution that points and references local variables and parameters from the current ESP so we'll look at this more in depth we have different segments so this is how we access different segments so you mentioned that there are ways to access different segments the eFlags register has a bunch of different flags that change depending on when the instructions execute so this is where things like when test whether this I think there's an XA6 instruction test whether this register is equal to like EAX equals EVX and if it is then it will set one of the bits in the eFlags register you can always never access this directly another key one EIP so the instruction pointer this is the next line of code that will be executed so when the program executes right start out whatever the entry point is that's what the operating system is going to do load everything in memory set the EIP register the very last thing it does is set the EIP register to be this the entry point in the program and then the processor will start executing from there yes there is no program counter so it's the same thing different architectures different languages mints is the PC arm arm has a program counter register so this has the EIP register you also can't read or set this explicitly so how do you change this value function calls what else jumps conditional branches all kinds of stuff all these things implicitly changes the value wool gets that later there's also a whole bunch of floating point operations so when you're doing floating point operations depending on how you're doing it they may be offloaded into a different floating point co-processor for those things anyways the E-flag need all the basic reset I'm going to go into that data sizes so if you're not familiar with the different types of data sizes a word is 8 bits or it's like look at the exactly a byte is 8 bits 2 bytes is a word 2 words is a double word 2 double words is a quad word and so on and so forth to be honest I usually think in terms of bytes I don't really think in terms of the words but you do have to be careful moving things keep that in this is another incredibly important concept so what is envy in this how do you specify something in memory so that the high side starts the left hand side or the high side starts with the right hand side the high what side not the most significant bit the most significant byte so this specifies the byte order so intel uses little empty in the ordering which seems counter-intuitive so this means if you had the number so if you have in memory so at memory address 0 0 f6 7 b 4 0 if at that memory address you have 0 above that you have 1 above that you have 2 and above that you have 3 if you were to ask the processor print out whatever is the 4 bytes or the word whatever the 32 bit number that is at this 0 0 f6 7 b 40 the question is which number does it output does it output 0 3 does it output 1 0 0 or does it output 0 0 0 1 0 2 0 3 so in little indian it will output this way right it will output the most significant bit is at 4 3 so the number output will be whatever they call it as x 0 3 0 2 0 1 0 0 but if you took those same sequence of bytes the same sequence of bytes in memory in a big indian system and you tried to ask what number that was it would say 0 0 0 1 0 2 0 3 so this is why you have to you know in that c code you wrote for that server you had to write that hgoln function that is host to long number I think or host no hgoln it is being host to network long so that takes in that when you set port 80 you want to list it on port 80 let's say so the host is little indian format but the network order is big indian format so it actually has to swap them before it goes out on the network which is super annoying and confusing that the networking format is different than most of the hosts but as long as everybody knows and does those functions correctly then it's fine so this is really really important and this can be incredibly frustrating when you're trying to overwrite buffer we'll see where that gets into it but if it's been a while refresh yourself on indianness so that you'll understand when you're trying to do an exploit and you think that it's supposed to be working but actually it ends up crashing this is like the first place I always want to know about signed integers so if you put in negative 1 into the program how's that going to be represented all s right this is the other thing we're only able to look at essentially really you're only able to look at what bits are in the registers and what bits are in memory the interpretation of what those bits means depends on you right it depends on is this an unsigned number then it's a really large number if it's a signed number then it's a negative number so this is another thing that's really important to keep in mind things like characters it's all just bytes, they're all just 1s and 0s and especially when you're just looking at debugging the processor I mean not the processor itself but when you're debugging at the binary level without any source code you go back to you don't know is this an int or an unsigned int you have to kind of defer based on meaning and usage so yeah negative 1 is all s, negative 2 right the other thing is super handy which I always have out when I'm doing this kind of stuff in programming language calculator I actually get by pretty well on the calculator app on Mac there's a mode you can switch it to programming mode so you can get 64 not 64 you get hex input mode and it also shows you when you're typing in the exact bit string of whatever your input is really handy I use this a lot that's surprising enough so make sure you interact with it ok so what does x86 look like as a language so it is you're coding assembly language right so you are basically right above 1s and 0s although you're essentially almost at 1s and 0s because all the assembler does at this point is translate what you wrote to the equivalent of 1s and 0s and it's not very complicated so it should be so who has experience with the assembly language it should be fairly so your assembly language code has some directives which we'll look at in a second so similarly to the sections in the L-threader you can have a data section which defines essentially variables which will be a place in certain memory locations instructions to make it super confusing there's you'd think like for something as important as assembly for something as important as x86 and for something as low level there wouldn't be so many choices like how many ways are there to call a function in C in C 1 and how many different syntax are there to call a function how many different syntax is there to do anything to add a number 1 there's one way to do it but in x86 unfortunately there are two different syntax and it is completely opposite the order of operations so in AT&T syntax which is already using throughout which I'm using all my slides you will have your basically your operator so add, move, subtract whatever, jump so that's always on the left but then it will be source to destination so if you have eax, ebx this is move the value of eax into the ebx register Intel syntax is completely opposite so this is move from ebx into eax you have two of the exact same instructions that are written completely backwards from each other there's also more differences but I suggest you pick 1 and every I'm using any tool that touches this and I believe there's a way to change it from one to the other but you just need to know that in the settings so here's my main tip on how I always figure it out is I look for instructions that have a constant value because can the constant ever be the destination no and then that tells me what's the rest of the file so I'll see if we're moving constant 0 into eax well I know I'm in AT&T syntax because it can't possibly be the other way around if I'm moving eax into 0 I know I'm in Intel syntax because it can't possibly be doing that so we can define constants we can start constants with 0x we can define different labels and different types of data we can define bytes double words quad words for instance we can define a my variable that is a double word 32 bits and so this would be 2 32 bit values in the section of your assembly code we can define all kinds of nice strings and often these type of things are dependent on your assembler that you're using so whether you're using an assembler using an ASM or whatever you're using the syntax may vary slightly so when you say constants don't you sometimes just specify the artist's location like move a b or move 10 to 7000 so yeah so what this essentially this is a little extra nice layer that the assembler is giving us so now we can say like move bar into eax and when it assembles it it will put bar in a specific memory location and when we look at what assembly code it generated it will say if bar is at 7000 it will say dereference 7000 and take whatever's there and move it into eax so it gets rid of all that for us but this is some niceties for us when we're programming in assembly and then we can address memory and move things from registers to registers we need to be able to say access the thing that's at this memory location and copy it into a certain register so all of these have and surprisingly again for such a simple low level language it's actually quite complicated how to do these memory accesses so we have the width so what's the size of the memory that we're trying to access what's the base so what's the starting address which index in there are we getting and scale and placement so we have the starting address the offset from that base address the scales the constant multiplier from the index width width tells us are we doing bytes so are we doing bytes shorts, words, longs or quads and that would be in the instruction itself a lot let me build a good example the formula is essentially like this so starting to base go index times the scale plus some constant displacement so think about I always think of this like arrays we have an array of characters and we're going to index it well that means the base is going to be the address of our array the zero in element will be indexed zero times the scale which is going to be one byte and then if index is one it will access the next one and if we're talking about integers those will be 32 bits so the scale will be larger there the way it's written is like this so the displacement on the left base index scale and if index and scale are if index is zero it won't be there and if scale is clear it will also not be there so many times you'll see it kind of like this so what's this doing so first we'll fit L on move along so we're moving 32 bits so along is two words the word is two bytes we're moving 32 bits so that so the move here right this is the V we're copying one byte if it's an S it means we're copying also byte I don't know if this is the right answer the W we're moving words L we're moving along to Q we're moving a quad so this means start at EAS right EAS is what what is inside EAS the address of whatever we're trying to dereference or we're trying to access the memory so it will be some memory address this is important think of it like a pointer it's another thing that's important it's a pointer inside EAS is just an address and this operation is essentially dereferencing that pointer following that pointer but it's not just following it directly it's following it and it's getting that address plus ECX times 4 so if ECX is 0 we won't get the numbers back to EAS minus 20 in X and we'll copy that into EDX source destination destination source yeah so copy that into EDX that's what you said copy that what's that so more simple ones so what's this going to do so take EDP take EDP minus 8 whatever is located there at that memory address take it and move it into EAS so we're essentially think of here we're addressing fixed offsets of the base pointer of EDP so EDP as we'll see gets set up when a function starts executing and so we will go down 8 bytes access whatever integer is there copy that into EAS if it's 0 well it is the same as mole so yeah if it's 0X and it's not it'll be decimal think so so in this case this is 32 or yeah so this is 32 so minus 32 this one is just minus 8 so this is where the one we're doing is move into destination so this is move from EDP minus 8 whatever is at that memory location copy that into EAS does it work both are what into EAS or into the address which is ah this is move it into the register of EAS so let's just draw a picture so now this instruction all is happening yes so move whatever is in EAX so we just put X20 in there move whatever is inside EAX to wherever EVX points to plus the address that EAX points to plus ECX times 2 is that the value that's in so the value inside ECX yes we only be referenced when we see the parentheses so this is the important part now so in our specific syntax dollar sign before a number means a constant so this is move the constant straight move the constant value 80480 E4 into EVX this is all this is doing no memory manipulation no nothing just copy that value into the EX register register some special kind of memory or there are just locations of these the registers are on the chip itself so these are you're really stressing my upper knowledge flip-flops on the chip itself as part of the architecture so they actually do not exist in RAM at all this is why when you get to the habit of looking at your code what will happen is you'll copy a value from a local variable into a register then another value from a local variable into a register add the two and then copy it back into a third variable in memory because unless it gets back to memory it might as well not happen because it's still in the register so will it like subtract the decimal value and copy it to the so what does it mean to not have a memory address so important difference so the difference between this move and this move is what yes de-reference de-reference access whatever is at memory address 804A0E4 copy whatever is there the 4 bytes because it's an L copy that into EAX what is the percent sign the second the last one versus the last one the percent sign the percent sign needs a register so this is this specific syntax of registers but the last one but does that include the referencing table percent check on the dollar sign the dollar sign needs a constant yeah for whatever reason we don't need a dollar sign we don't need this move L on the next one I think it does impact I don't know what that is correct I think it would throw an error if you tried that how does it know what register to get do you want to register the last one the 0X804 well it's not a register it's a constant value so it says copy the content of memory 804 into EAX so the difference between the two is in this one we are copying the constant value 804A0E4 into EVX so after this instruction is executed in EVX better have this exact value whereas in the second one it says access the memory look up memory look up whatever is that 804A0E4 whatever is in there copy it into EAX yes do you say move L what if I said move B and then would it only look at the first 8 of earth it would only look at that byte whatever is at that byte location in memory yeah so it's just like when you say move L it's just extending the size so if you're interpreting move B is this is the address copy that byte into EAX if it's move L it's saying copy that in the next 4 bytes and interpret that as a little endium number well interpretation of the matter but take those 4 bytes copy them into EAX and the delivery address is always referencing the RAM when it's not like restoring cache memory there may be caches in the way but that's more advanced stuff the value after the color science is better a couple more questions is that the value itself yes that is a constant value so whatever you change that that will be the value of EAX after cool alright so we're back we'll learn more types of instructions


I was a small boy. My mother used to take me to the airport and gas him to watch the ODC-3, standing there by the fence, listening to those big radio engines rumble as they come to life, spit the big blue smoke, get a whiff of that. I guess it started to get into my blood at that point. Later when I joined the Navy, I actually took my first flight from Montgomery to San Diego. I liked the feeling of flying and being above the world, looking down and seeing everything as small models. Without my military experience, I'm not sure what I would be doing, but there's not many things in Alabama or any other state for that matter where a fifth grade dropout can make a very good living. I was born to a single woman in 1948. I didn't have a very stable home life. Had I not had the opportunity to join the military and make a career out of the military, I would not be standing here with all of my credentials and all of my degrees. They have got skills, education, all the things that I learned in the Navy, all the experiences that I have from traveling and working in the Navy. All of it has a Navy brand on it.


dedicated to the strength of the nation we hail yes proudly we hail starring Richard Denning in the common touch the United States Army and United States Air Force presentation and now here is our producer the well-known Hollywood showman CP McGregor thank you very much and greetings from Hollywood ladies and gentlemen welcome to your theater of stars for those famous names of the silver screen join us in plays we know you'll enjoy our star is Richard Denning the title of our story the common touch we'll have the curtain for act one in a moment but first here is your announcer with this message young men and women here's your opportunity for an important new career in aviation today's best deal for the aviation beginner is in the United States Air Force no experience is needed and you earn good pay while you learn the Air Force will give you the best aviation technical training opportunity for steady advancement security and good retirement benefits if you're 18 to 34 17 with parents consent find out today how you can begin this important new career get full details at your nearest US Army and US Air Force recruiting station now once again our producer the curtain rises on act one of the common touch starring Richard Denning as dr. Christopher hazard tucked away in a very small corner of Pennsylvania Susquehanna like a thimble in a sewing box with the tiny village of Groton it was a village that stirred nostalgic thought somehow of half forgotten things of an apple eaten beneath a tree a glass of cool spring water of flowers in an old brown jug and winds murmuring of an old Dutch legend at such a place in come-up lane a shingle swung and croon to itself on rusted hinges and pronounced in faded letters that within the weather board cottage one might find dr. Christopher hazard dealer in colics and pains abrasions and contusions dark hazard if you're thinking to move the Queen doc you can't do without putting yourself in check me see and sitting there with your chin and your hands won't bring about a miracle as the saying goes dark here in a bad spot recollect having seen much worse spots now you take measles for example are smallpox those spots are known angus as the rash of variella and have three stages propomal vestibular and pustular are you playing chess doc or teaching me the profession playing chess to be sure angus never do you mention bad spots so I'll move my night here which levels you like the trumpets did the walls of Jericho checkmate my friend oh that was a dirty underhanded trick dr. hazard or my name isn't angus mclean yeah you've been dodging around the board like a bird with a broken wing and I thought I had you all your gibberish about sports yeah well the next game will be different well I should pop over to see Janie Gibson angus I told her I would after tea oh that's it run away with my 25 cents oh you're a canny man doc oh I should think you're shameful defeat would be sufficient for one night Angus I'll have you know there's no man nor beast can beat the Scots you've no doubt heard the story of Robert the Bruce oh yes I do recall something about him a Scott wasn't he dark undiscussed oh yes sure I remember a Scott indeed he was once in a cave like you're now in a hole and a spider saved his life will you fetch my coat angus and if anyone calls I'll be back in an hour all one angus I noticed a spider in the rose heads this morning a big fat one you might go ask him what he knows about chess I'm awful scared I am I've never been so scared in my life scared of what Janie of becoming a mother Janie you're a silly little goose there's not a thing in the world to be afraid of and your right is rain now look at it this way Janie it's a miracle the oldest and the newest one in the world babies have been born since the beginning of time millions of them every second of the day your own mother had seven of them Janie of which you were one but what I don't know of course you don't but I do now now you just dry your tears that's and think about the day when he takes his first step and maybe falls down and bumps his head you'll have to kiss it better or maybe that wonderful tug in your heart when he says mama for the first time what gracious Janie he'll be in school before you know it coming home with skin knees and a black eye how do you know it's gonna be a he I don't know rightly but wasn't that the order Timothy Gibson the second it's got a nice ring to it Janie sounds exactly like a United States president well that makes two of us now you snuggle down and get 40 wings well you know with all this flesh you'll have Timothy having the baby instead of you and then I'd have to send clear to Philadelphia for a specialist I wouldn't know what to do Mrs. Wimble I'll be blessed if I know how you do it how I do what Dr. Hazard how you managed to keep looking so wonderfully young a person would swear you weren't a day over 35 they'd never dream you were in your early 40s Phil Stix you know I'll be 58 come July no bless me if it ain't the truth I wouldn't be given my age away if you wasn't no doctor a girl has to keep a secret you know well I wouldn't have believed it Mrs. Wimble and what brings you to my surgery oh say doctor it's my headaches again you know I feel something dreadful yeah and I think my liver's kicking up too I do I really do I get that short of breath you know my leg swells up and I sort of get the blind staggers well you've got enough complaints to stock a hospital Mrs. Wimble oh I'm a sick woman Dr. Hazard you know I'm down to 212 pounds isn't that awful yeah maybe I ought to take some huh yes yes I think you should I'll send angers over in the morning with some pills oh my what kind of pills Dr. Hazard oh something very special but there's only one thing Mrs. Wimble oh what's that Dutch ale oh it do you drink much Dutch ale Mrs. Wimble well you know it has me a sip once in a while you know these these pills I'm sending you they wouldn't mix with Dutch ale no well say what happens oh any amount of dreadful things oh my goodness yes but but then you have nothing to worry about if you don't take any well good night Mrs. Wimble Angus will be over the first thing in the morning are you quite sure you've not gone daft well only reasonably sure Angus why first the bees are swarming with the queen thinking to lead them the Lord knows where old patients hasn't had his oats and you're sending me to Mrs. Wimble with sugar pills blood pressure Angus blood pressure behind why doc are you so dead set on that bilious Mrs. Wimble tune on sugar pills that you let the house fall apart to see that she gets them why because they might do her some good Angus you wouldn't believe the symptoms she's got headaches upset liver short breath loss of weight no appetite what no appetite now I know you've gone down maybe she's no more sick than I am and I'm very well indeed but Grant and she's as sick as a goat what good good sugar pills do Mrs. Wimble isn't sick Angus she drinks too much Dutch ale you see she's lonesome since her husband died and she's sorry for herself and I can't see what an imposing array of symptoms Angus and if a few sugar pills and a few kind words from me will make her feel any better then I'm as glad as I would be if she recovered from bubonic plague and anyway her consumption of Dutch ale will drop I think a little you see Angus a doctor only deals with cause and effect and the cause doesn't have to be a germ or the effect of fever sometimes the cause is up here in the mind and the effect telephone doctor telephone something's always spoiling my lectures just when I get going to hello yes doctor has it where all right I'll be there immediately and don't try to move him right Angus hi doc there's been a bad car smash on Bauer Road get a harness on old patients while I pack my kit Mrs. Wimble sugar pills will have to wait I'm a doctor miss are you all right no he's not Mrs. Proctor would you be good enough to invite this young lady to your house for a cup of tea but we'll have to get this man to surgery I'm not going to leave my father please please you can't help here and you might be hindering now come along my dear I'll fix your nice cup of hot tea there's a good girl Simpson make a bed in your cart all the hay and quilts you can manage Angus you help him hey doc is he hurt bad fractured skull I think maybe smashed up inside come on Angus move man move hi doc on the double Mrs. Wimble and her sugar pills the common touch starring Richard Denning to bring you an important message from our government high school graduates for a job with a real future get into aviation now United States Air Force offers you unlimited career opportunities under the new airman career program you'll be trained in the job for which you are best suited and have the best chance for success you'll get good pay right from the start free room and board free clothing and equipment free medical and dental care free retirement plan this is your big opportunity look into it today get full details at your nearest U.S. Army and U.S. Air Force Recruiting Station certain rises on act two of the common touch starring Richard Denning as Dr. Christopher Hazard not since perhaps the signing of the declaration as the tiny sesquihanna village of Groton suffered a shattering of its drowsing piece is on the day of the car smash in the Bauer Road on that cardinal day the eyes and the ears of Groton were focused on the weather board cottage over which a shingle swung and croon to itself shamefully callous to the tense excitement within the cottage on the examining table of Dr. Hazard a man lay quietly on the edge of the black pool beyond the surgeon's door in the sitting room a girl waited doctor how is my father he's worse no no he's no worse at the moment however I find it necessary to be quite frank miss I don't think I know your name Craig Althea Craig my father's Mr. Denham Craig of Philadelphia miss Craig your father's condition is extremely serious to to be very blunt his hold on life at the moment is rather precarious what is it basal skull fracture depressed which means that part of his skull is causing pressure on the brain what are you going to do the only thing I can do miss Craig operate at once operate you how could you operate on my father you're only a village bumpkin doctor I know but you see miss Craig there's little choice in the matter send for a specialist send to Philadelphia get my father to a hospital the nearest hospital is Paisley and your father can't be moved I would gladly send for a specialist miss Craig if there was time but there isn't this is an unfortunate case of your father living or dying by the grace of God and what a little I know I'll require your permission very well Dr. Hazard even though I don't believe you know what you're doing however if what you say is true and if my father dies you'll have killed him shall we let accusations wait for a cause miss Craig Angus Angus where you want me yes I want every pot and pan in the house full of boiling water and I mean boiling Angus and then whistle over and bring miss Wimble back here sponge miss Wimble this Wimble are you all right a little faster than that's right small plant no no a small one from the side of the tray slow up the ether angus it should drip not poor can you wipe my forehead with a sponge miss Wimble yes thank you now give me the elevator that gadget fine easy Angus easy easy does it Dr. Hazard well I'm not sure of course Miss Craig but I think we can see the edge of the woods that's right that's right miss Craig cry it out I've never been so frightened in my life I had a couple of frights myself what was Angus trying to drown your father in ether Mrs. Wimble near fainting on me every two minutes when can I see him when he's awake tomorrow perhaps we've put him to bed in the surgery for the time being or you'll stay here of course miss Craig oh no I couldn't do that Dr. Hazard I'll go to the end Groten's in burn to the ground about to the time of Benjamin Franklin we've never gotten around to rebuilding it but I think you'll find it comfortable here miss Craig Mrs. Wimble staying on for a few weeks a few weeks I'm afraid your father won't do much navigating in the very near future and now what do you say to a pot of coffee and about a million raised biscuits I'm practically starved I thought we agreed to amputate the tougher and make it just Chris all right then Chris much better we'll be leaving tomorrow yes been trying to think of some way to say thank you but there aren't any words the past four weeks of just knowing you was more than sufficient thanks out there you know I've grown very fond of you have you Chris that's strange why because we seem to have so very much in common you see Chris I've grown very fond of you too do you mind if I ask how fond of you no I don't mind I think the Greeks had a word for it they called it love do you really mean that of course I do silly or I wouldn't have said it life does become involved doesn't it why Chris because I happen to love you too Althea inconsistent little beggar that Dan Cupid inconsistent country bumpkin falls in love with lovely wealthy Philadelphia debutante you way up there me way down here don't say that Chris it's not true afraid it's quite obvious Chris it doesn't matter where you are of where I am all roads lead to Rome and I'm going to Rome oh Chris please come with me Chris you not only have my permission to marry Althea but my sincere parental blessing oh thank you very much mr. Craig oh no thank you very much you see Chris a short while ago you saved my life and it's a privilege to give you part of it as a brief payment I'm very pleased Chris and I think you'll both be very happy you should do well in Philadelphia my boy Philadelphia sir of course you surely don't intend to remain here I couldn't leave here mr. Craig but there's Althea to consider Althea she's not accustomed to a small village Chris a weatherboard cottage oh there's nothing wrong with it but Althea has always been used to nice things feminine frills and in society her own circle of friends I couldn't open a Philadelphia practice if I wanted to mr. Craig money I'm making you kids a paltry wedding gift Chris $10,000 and I believe that money should work I can think of no greater work than yours Chris for her sake as well as mine and your own and the people that really need you think it over give it a try darling you look perfectly scrumptious turn around so I can see you better Althea I feel like a blasted nincompoop a frock coat striped pants they make you look older my sweet and more professional professional oh dearest I'm only Christopher Hazard MD and all this father all in scenery won't add or track from what I know my patience and Groton didn't care whether I wore overalls or a Hindu turban I know it Chris but the rest of the world doesn't and success depends upon a front window for display now kiss me and run along to your office and don't forget the valence party tonight everybody who is anybody will be there and maybe they'll all adopt my charming husband for their doctor wouldn't that be wonderful Mrs. Crofton may I present my husband as well how do you do my dear doctor I've heard so much about you in fact I've been thinking of coming to see you I've been feeling so dreadful lately the most beastly headaches and I wonder if well perhaps my liver isn't a bit out of tune once does doesn't one do you suppose it could be anything serious doctor I haven't the faintest idea Mrs. Crofton and I'm sure neither the time nor the place is fitting for a consultation if you'll make an appointment with my nurse I'll be glad to give you professional advice not social chit chat of course doctor has it please forgive me who is how could you Mrs. Crofton's one of the wealthiest women in Philadelphia I don't care if she's got three heads hypochondriac oh I'll see I've got to get out of here I can't stand it you stay and come home later I'll take a cab oh no darling I'm rather bored too if you're ready I'll go with you the doctor come down for breakfast yet doctor has a left quite early this morning madam early this morning did he have a call no madam he he left this letter for you a wise man once said you can't make a silk purse out of a sow's ear and by the same token I think can I become something which I'm I'm still a village pumpkin and my place is still among the windows and the prowlers of Crofton the people need me as I need them I'm hiding this to spare you the anguish of goodbyes we knew you'd be back doc I put a new coat of paint on the shingles and now this is a secret but the villagers are going to have a party for you oh doc it's good to be playing chess we again well yes thanks angus but I must say doc you're out of practice yes yes indeed I am and look at that board will you you're in a trap and you've lost your queen oh boy she patient just when I had your beat shall I see who it is doc no thanks I'll go good evening dr. Hazard Althea it must be after always doctor but I'm suffering a dreadful pain right here in my heart do you know of any cure for it I'll see you darling what are you doing here I've come to join my husband you see he's the village doctor here but not now a wise man once said if you can walk with King and not lose the common touch I lost it Chris and I'm ever so grateful to you for finding it and giving it back darling Angus Angus hey doc what are you wanting me just wanted to tell you Angus don't disturb the chessboard we'll finish the game in the morning I've just regained my queen our star Richard Denning a return for a curtain call after this timely message from Wendell Niles high school graduates there's an important place for you in the US Air Force you can continue your education learn a trade get ahead and at the same time earn good pay the United States Air Force has openings for specialists in air transport aircraft maintenance research clerical administration radio and many other fields the Air Force will train you for one of these responsible jobs two kinds of training are open to you you can learn on the job under the world's most skilled experts or if you qualify you can go to the finest Air Force technical schools as vacancies exist you will find interesting work job security good retirement benefits and opportunity for travel this is your big opportunity look into it today get full details at your nearest Air Force base or United States Army and United States Air Force recruiting station now once again at the microphone our star and our producer dick we've had the pleasure of working with your lovely wife Evelyn anchors and now with you here this makes it unanimous well you certainly make a person feel at home CP now I know why Evelyn keeps talking about you in your studio well tell her I hope she'll join us again soon and by the way I heard your radio show my favorite husband last Friday you and Lucille ball of a fine program well thank you CP but to have you any time left for pictures oh sure as a matter of fact I just finished the lie at Paramount with Barbara Stanwyck and John Lund oh yes I believe it's scheduled for release after the first of the year yes tell me how's that new Brentwood home of yours coming along all fine of course everything had to wait in the house until I got my hobby shop built that Evelyn keeps your busy making lamps balances and all the things a wife needs around the house oh she keeps me plenty busy and so does Dee Dee Diana Dee she's so cute how old she now five and going to school wonderful tell me does she still ride around in that red chariot seat and the friend of your bicycle yes but I'm taking the level stretches now no hill say CP why don't you and the wife come on out and see our place we will maybe we can pick up some good ideas from your hobby shop fine we'll be looking for you and Melton now tell me what's doing here with you next week our star next week dick and ladies and gentlemen will be lovely Barbara Britton and the title of our Christmas story my son is a wise man good we'll be listening so long CP goodbye dick you should have joined us next week ladies and gentlemen from Barbara Britton joins us in our Christmas story my son is a wise man until then thanks for listening and cheerio from Hollywood Richard Nannick here at the Paternity of the Hollywood Coordination Committee which arranges for the appearance of all stars on this program script was by Kimball S. Sant for the music of Eddie Dunstetter this program is transcribed in Hollywood for a lease at this time Wendell Niles speaking


What's up everyone? It's your girl Kenzie here from Leighton Sports Cards, and I'm ripping a personal for Dan W We've got a Box of 2021 Panini prism football first off the line. All right, Dan best of luck Let's see some beautiful shimmy shimmy see her for you Shimmy shimmy auto that'd be sick, huh? Then you got your photo sticker right there for you Here we go add Jalen waddle rookie base Trayvon mo rig we've got blue ice rookie and Nick Bolton for the chiefs It's out of 99 and all out silver of Stefan digs Sermon we've got Jalen camp red shimmer color match here Rob Gronkowski for the box Nice one there reds are out of 35 that is 23 of 35 on the red Gronk Dave Marcus May for the Jets to 199 and Zach Cunningham silver lessoner Michael Thomas remand race Stevenson rookie base Levi and wuzerique and silver Tyree kill chiefs Very new sums even Collins we've got Purple Tony Boselli on the purple cracked ice Jags of 225 and break Joe Burrow Let's see gold. I Seated gold shimmy shimmy coming up here, Dan Good luck Monty rice. We've got Rhonda more rookie Gold shimmer of Ryan fits magic There you go. That is seven out of ten on the gold shimmer Go on there for you Dan It's magic. We've got orange Derek Henry to 249 and silver Ocho Cinco He's pretty good and really you won a national championship is like one of the leaders of that Georgia defense Third rounder to the Eagles Sample Kylan Hill got an orange wave coming Jamar Chase rookie base and orange wave Michael Gallop for the Cowboys Out of 60 on that one sakehorn fireworks Brady we got Javon Holland and Diamond Brown Prism to 175 of the scratch That's great see Hawks silver rookie J.C. Horn Racy McMath Des Fitzpatrick red shimmer DK Metcalf to 35 we go Seahawks Nice receiver there five at 35 red wave Devon Bush the second for the Steelers to 149 and emergent rookie Rashad Bateman Warner a little piece of glue or something on these right there on these base Boselli We've got Elijah Molden Caleb Farley blue shimmer to 25 rookie Trayvon Moe rig for the Raiders Trayvon Moe rig and red wave rookie Otto semi Fajoco for the Cowboys Well, send me out of 149 Yeah, Justin Ross is pretty good. Got a back injury of Clemson went on drafted, but picked up by the Chiefs Should be solid Jalen Darden chess a rat purple ice of Roquan Smith a 225 for the Bears Alvin Kamara for the Saints we've got forest camo coming up Got Elijah Moore rookie Jake Funk we've got blue shimmer Devon white to 35 for the Bucks Forest camo of Lundanian Tomlinson for the Chargers nice LT on the camo That is 215 3 of 15 there's two plus one equals three jersey number even one of one And we've got a van Jefferson on the blue shimmer auto four out of five Beautiful color match there with the jersey to nice van Jefferson to five Alright last pack here for you Dan. Oh, yeah Dean Yeah, I'm excited to rip these ones for you Got Mack Jones rookie base Pete Warner Blue wave of Josh Jacobs for the Raiders out of 199 and hype of Brynn and I you Alrighty Dan, that'll do it for your box. Congrats on those hits and we'll get them right out to you