Hey folks, Adam DuPay here, and today we're going to be looking at the ponable.kr level code map. So this is a 10 point challenge, and so let's dive right in. So it says, I have a binary that has a lot of information inside heap. How fast can you reverse engineer this? So it sounds like it'll be a reverse engineering challenge, and it says, ooh, a hint. Always good to read the hints. See the information inside eaxebx when 0x403e65 is executed, interesting. So you can download this here, there's also an SSH thing. So I've downloaded it here, I've also SSHed, and there's actually an interesting read me here that says reverseengineerthecodemap.exe binary, then connect to the code map daemon, which is running on localhost9021. Hello. And the daemon will ask you some questions, provide the correct answer to get the flag. So interesting. So we want to do this to see what kind of things it's asking us, what is the string inside the second biggest chunk? What's the string inside the third biggest chunk? So we're clearly going to be half to be looking for what is this, what's this program doing? So we can look at it, we'll run file on it. So it actually is in eaxe. So the first thing to check is this file extension.exe, is that a red herring trying to throw us off? So I actually won't be able to execute this on here in my Linux machine or in the... So I actually don't have a Windows machine available now, but let's see, we should be able to reverse engineer this. So I will open up Hopper and I will load up this eaxe here. So it read executable to disassemble, we have our potable.kr and if we have, remind me later, we are talking about code map and there we have our code map.exe. A pretty large program here, seeders, some strings, which are always interesting to look at. These look like strings based on, I wonder if it's a... I'm gonna tell me if it's a executable or not, I don't know, if it's a statically linked. These look like calls into the functions, well, these look good, these are some strings that actually make sense. So again, this is the equivalent of, like we always want to be running strings on these binaries to see what types of things are inside this application and what things could be interesting and what types of things this application do. So if we follow these strings, these are the strings we saw when we connected to the daemon. So what we know is that these are interesting. So these will kind of tell us more about the program itself. So something to logging, so this is in what function, this function, it looks like it's some kind of a main function, does anybody call this? It's called here, stuff happening here, yeah, let's assume we'll call this main for now, we'll call it main question mark, because we don't actually know for certain. We can look at the disassembled view to kind of get some idea where did our functions go. Push, I will make 1000 heap chunks with random size. These should be a print function it looks like, maybe puts is my guess. So I will make 1000 heap chunks with random size. Each heap chunk has a random string, press enter to start the memory allocation. So then call this sub, so this probably is like a read function. Okay, let's go back to the hint. The hint is how fast the reverse entrance. So let's go here, see the information inside eaxebx when this is executed. So if we go back here, navigate, go to address or symbol, so where is this inside of here? Okay, so this is later on inside that function we just are, let's say calling main. So and the hint said, see the information inside eaxebx when this instruction is executed. Okay, 65, 403 e65, 403 e65, okay. So we could do is trace this back and start to look at what is inside eaxebx, what's inside in eaxe. Let's get a feel for what this looks like here. Okay, so this is where it told us to look for things. But let's, I want to get a bigger sense of what's going on here. So we can kind of see the outline here and if we say, so saying we have a bunch of local variables, push ebp, move the stack pointer, so this is a classic prologue that's going on here. Push all f's, push, interesting, push this memory address onto the stack. Do some other stuff, push eax, so move that into eax that I believe looks like a canary, push eax, subtract 54 from the stack pointer, move whatever's there onto eax, xor, ebp with eax. Interesting, I wonder where they're doing that. Let's see is that anywhere, it's just a place. So this does some setup, this should be interesting. We'll need to maybe dig in and see what this does. I will make 1000 heap chunks with random size. Each heap chunk has a random string, press enter to start the memory allocation. So I wonder if this is breaking a, sorry, I wonder if this is break ends up, it's going to be end up breaking the random to see how it's generating these random strings. Cause it says, cause when we executed this, it's asking for, so what is the string inside the second biggest chunk, waiting 10 seconds to prevent brute forcing. So then this, so start, add this, call this, this looks like it's saying press enter to start the memory allocation, maybe this is like a read type function. So this moves ebp, which is zero onto some variable. So it's zeroing out these variables to start and then it's starting this whole process. So let's see var 58 into eax, push eax, pass it to some function, then call another function, then multiply whatever's in eax with eax. One thing is I'll need to look at the calling convention for Windows 32 bit PE, CDQ, move, what is this thing look like. So call that with var 58, ESI, call that function times of by 2710 divide by 539, then call this function with eight as a parameter to get EDI, and then do something with a stack pointer that's kind of weird. That should do nothing. If EDI, if the results of this function is not equal to zero, then do some stuff into here set where EDI is pointing to to 40 F2 EC shift, I think this is a shift arithmetic right. ESI times 2710, one, eight, if EAX, which is the result of this function, which is the same function here, this is not equal to zero, do you have to take EAX plus four, do you have to set take EDX, or just to see what EAXO is the result of this output here. It almost seems like some kind of malloc function. But this is interesting, temp nine, I wonder where this name came from, temp nine is equal to a double dereference ECX called that as a function. So this whole thing just to get in ECX, this function here, oh, maybe I think we did see something about tables, maybe that anyways, call that function modded against 186 AO into temp nine, and set temp nine, oh, this must be a temporary variable that hopper is creating. So temp nine variable five C, five C, yeah, we haven't used yet. Do this thing of the stack that probably doesn't mean anything past that then to this sub 404. If temp nine is greater than or equal to 10, interesting, while EAX is less than is three a e calculator, oops, that did stuff, come up. No, thank you, Siri, I do not want you, I would like just a normal, happy calculator, good. And of course, I touch things, so just change this and, okay, just a nice undo gets rid of all of that. So we know that it's telling us that it's going to do this a bunch of times. So it's doing it, what does it say 10,000 times? So let's see if three E eight, eight, yes, 10,000, okay. So EAX, EAX var 58, so var 58 is basically I is going to be the loop iterator. So that's nice because now we can give that var 58, we can give that a name, we'll call that I, so this will be our loop iterator. Yeah, so I said I equal to zero. And so we're basically going to do this because you can see I plus one is equal to EAX. So it's incrementing it, it's setting it and then it's checking while it's there, it does that. And it does one, two, three, three more things, although it's not picking up. The interesting thing is it's not getting this pushing and then this call that this is a parameter to this. That's okay. The allocated memory size of BiggestChunk is percent D bytes. Oh, this may be stuff to like help us do things. Allocated memory size of BiggestChunk is percent D bytes. I'm going to run this inside wine. Do I want to install that, so we can run this, then we can actually start to try to debug things. Oh, trying to run this on their machine, that's a lot, but that's okay. So we're running inside wine, inside our virtual machine, maybe I didn't want to install staging. Yeah, it's fine. Oh, I can just do wine stable. Okay. Going back to the binary UI. Okay. So basically somehow getting all these values, so it's going to, but what did it say at the very end here? So the allocated size, memory size of BiggestChunk is percent D bytes. Ah, if that's not there, then that is definitely a printf. Push EAX, so variable 54. So dereference variable 54, move it into EAX, push EAX. So that's going to be the size of the BiggestChunk. The string inside that chunk is going to be ECX, interesting, that did not work. All right. So now that wine has installed, let's look at wine and try running this, 2.4 is a testing version, blah, blah, blah, that says I will make 1000 heap chunks with random size. That's great. That's exactly what we wanted. So if the BiggestChunk has a random string, press enter to start the memory allocation. So hit enter. The allocated memory size of the BiggestChunk is 99,879 bytes. The string inside that chunk is this string, log into PonoWolves.KR to get some answers. Cool. Okay. So this definitely, so let's see if this, yeah, so it says random, but this is when it's basically lying to us because we know that this random is not actually random because why we're getting the same value every single time. So now we can run it, which is nice. And so this actually tells us that this variable 54 has the allocated size of the BiggestMemoryChunk. So if we trace that back, we should be able to figure out this value of R54 is going to be the size of the memory that's allocated. And then R60 is going to be apparently that string that's there. Ah, and this makes sense. So if we look up here, far 54, so we'll call this size and we'll call this str. And so we have the size, we have the string. And if we did 65, we'd see this is where it says remember it told us about eax and ebx. So eax and ebx as the size in the string, let's see, how could we do this? See the information side eax, ebx, when that instruction is executed and when we look at this, we see that eax has the size and ebx has the string. So let's see, trying to think what would be good to do here. Okay, let's look at it this way. Maybe, aha. Yeah. So we can see this ESI has this string of the lowercase, uppercase, and digits. So my guess is that it's pulling from here to get these strings. So at this point, I don't really want to actually reverse engineer this binary where in the sense of doing it statically, I really want to do this dynamically because now I have it executing, it's giving me the output. So remember the interesting thing is this is telling us this is the size of the largest chunk and the string inside that chunk. Whereas if we execute this, what's the string inside the second largest chunk? And so we know it's not going to be this answer, right? Because this string is in the largest chunk. And the second answer will be, the second question will be what's the one in the third largest chunk? So we need to figure those out. So my thought process here, what I'm thinking about is essentially, there's a few ways to do this. One way would be to statically go through, understand exactly the algorithm and calculate all those thousand values that it's actually using. I honestly don't want to do that.  So an easier way to do what we want to do. And what I'm thinking about now is how can I inject because so there's two ways to do it. Either I can debug. And I debug this binary as it's running in wine. So use wine to debug and to output what are the... So basically what I want to do is exactly here. Every time I get this size in the string, I want it to print out what the size is and what the string is. And if this was a Linux binary with elf, I could easily do that with a GDB script. This is not. I will need to do, come with a different way to do this. One way that I'm thinking about is maybe because I have what I want here. If I can inject code into this function, then I could actually do what I wanted to do. The problem is I'm not exactly sure how to do that in Hopper because you have to worry about all of the offsets here. But maybe I'll explore that. The other option would be figure out how to debug things in wine. Well, when DBG sounds interesting, or wine debug, let's go dash H, wine DBG launch process as if you're starting with wine and run wine DBG on it, potentially a running process of WPI. This actually looks like exactly what I want it to do. Launch process as if we're starting wine and run GDB. This is what I want it to do. Interesting. Attach to running process of wine, WPI, Dnum and run GDB proxy to it. All right. Well, let's try this. So wine DB, I actually really would love to use GDB for this. And the command line is code map.exe. Huh. Okay. Well, what is going on here? I'm not exactly sure. It looks like Jeff does not appreciate being run in this GDB or something. Something here is not exactly right. Let's see. I mean, let's just see what happens if I just continue and it looks like I just killed it. So this is probably a good point to point out that clearly I don't have all the answers and I don't know exactly how to, all these things work. And this happens all the time in a CTF where you have a, here a Windows process. So how do I actually use wine, a DBG, which I've never used before? And maybe I can't end up using this and maybe it'll end up being a pain in the butt. So who knows? It's probably going to be extra, it's probably going to be a generic factory separate points even to symbol code towards a subset. Oh, so I don't need GDB for this. So, 30, I don't know why it's doing that. There we go. All right, reset that bad boy. Let's do this again, yeah, but without the GDB part. Okay, okay, so if it does a subset of GDB, then I should be able to do it. Basically what I want to do is I want to break point here. Fix me heap, RTL set heap information. I guess the question is maybe this binary is anti debugging for some reason. So hopper is the one I want to use. I don't know if maybe this is just being insanely slow or what's going on here. We shall see insert ASM instruction. So I'm looking for anything that has to do with, because I know I can modify the interesting thing, let's see, not region so I can not instructions out debugger, not create string. Let's see. Let's look up what that does first hopper interesting. So apparently Python scripts for use with hopper interesting hopper script assembler to install. Let's see. Do I want to run a just randomly install things and put it into my inter destination this code. Let's see is it going to mess up. Let's see annotation. This is still not doing anything, which is actually the exact same thing that the other Oh, see the question is even if I don't do anything, it basically just straight up does not work. So my thought is this looks like maybe there's some anti debug stuff in here. I could probably get around that. Let's see demango strings. This is simple instruction. So in our brushes, so procedure find C strings generate pseudo code, get relative drafts insert jump that you're not searching invert that's interesting invert a conditional jump. Oh, I know a way we could do this pretty easily. What if okay, so I'll make multiple versions of this. So let's control C this and yeah, okay, I don't know why I didn't think of this before. So basically we have this loop that we're doing a thousand times. And at the end, it tells us what the second largest thing was. I can actually just change this value this O three E eight to O three E seven. And that should print out the second largest value and then change it one more and that should print out the third largest value. Let's see if I can do that. So here, let's think, let's see, I know I can do this in hopper. I've definitely done it before. I think what if I say that this is not this, so O three E eight. So I want to edit this modify, I think I need to put it into like this. Yeah. So what if I do E seven, and then we go back here and we say, aha, there's a new instruction. This is code, compare it with E seven. So this now then I want to produce new executable, code map a second. So this should print out the one right before the end. So I should be able to just use my wine. See seven nine nine eight seven nine wasn't the same one should be comparing EAX to that. Yeah. While EAX is less than three E seven, that's exactly what we want. EAX isn't going incremental. What if I completely change this to like zero zero. Yeah. 3000 hex, which is 768. That should definitely produce new executable on maybe it's because I didn't save it. Try to have no idea this will actually just assemble it. I'm going to go ahead and say no, but let's for this address. Interesting question is why didn't that actually change it significantly? Like if I change this to zero even, I should like completely change this. Executable. Yeah. Okay. That actually makes more sense. Maybe it's because of that big if condition in there. So that's, that's, you can see I changed this code to compare that against. Oh, that turned that into an or. Okay. That's not exactly what I wanted. Oh, I see the three is somewhere else. Okay. Size and that. Okay. Good. You know, I is only touched and incremented in here in this loop. I mean, this I is only incremented once. Oh, maybe here's the thing. It's saying if EAX is greater than size. So, okay. So here EAX comes from this variable five C. This variable five C comes from here, this temp. So this is giving us the size. Okay. So this is giving us the size here with EAX and the idea here, this must be the malloc then of the size. I don't want to go into that, but okay. So I'm understanding it a little more. So the idea was we were only doing it a thousand times, but we didn't actually see when that number changed. We never saw that number change because it only keeps track of the largest and the second largest memory sizes, right? Because it has this check if EAX, the size that it just generated is greater than the size that we currently have, then update the size and the string. So let's see. Can I use this to my advantage? I mean, I could kind of do what I was doing. Let's see. I could do maybe a binary search like a manual binary search on the 1000. So do it at 1000, see what it tells me is the biggest chunk. Do it at, like we already have, do it at 500, then see if that changes it or not. It should change it and then I can kind of keep testing. But that's not, I don't really like that approach. What I really want to do is just be able to print out all of the size and memory or debug it and debug those things. So, but this is pretty interesting. So what about this EBX, this string? So we know the size comes from here, EBX plus F is zero. So that's going to be, so what's the size of this? One, two, three, four, five, six, seven, eight, nine, 10, 11, 12, 13, 14, 15, which is good. So this is zeroing out that last byte and setting EBX plus F, which is 16 to zero. And where is the rest of EBX? So EBX, so this is the memory location, temp 39, so this is the size. So this, okay, so temp 39 is definitely the, this variable 5C is the size. So this is some random function and that's probably calculated up here and obfuscated clearly here. But, so we do that and then we do variable 5C, then we pass that size into this looks like a malloc function. And if temp 39 is greater than equal to, yeah, so only do this if we actually have more than 16 bytes. Take ESI, EDI is variable 50, the address of variable 50, which I don't think is ever used so far. So the address of variable 50, and I'm gonna have to look at the actual assembly here because this doesn't really make sense looking at it like that. Variable 50 into EDI, rep, move SD, I actually don't know what these do. I'd have to look at that like, look in ESI and put something with EDI. ESI, move SW, move SB, XOR, ESI was itself to free it. And we'll look at it here. And then load effective address, move EVs, variable 70. So I pointed up this, let's see, into ESP, that's interesting. So changing the stack and then calling some function. What does that look like here? Call some function, mod 3E minus 50. 3E is interesting. Probably this size ESI plus EBX minus one, all ESI. Okay, so this is probably getting random junk, getting random letters from here. Okay, so we have the size, we know they're keeping the size. And what do I want to do? Let's see, could I programmatically make a thousand versions of this? Yes, I could probably do that. I really wish I could use YDBG when it's hanging. Because what I want to do is I just want to print out like the easiest thing in the world will be to right here. Okay, that's what I want. Right there, print out every time that hits, print out EAX and EVX. Maybe if I, it did say, could use it. Okay, I want to do opt, one staging, bin, wine, DBG, help. And I want that show running process of WPID. Yeah, so I definitely want to, I want to connect to that process. Wine server, wine console. Maybe one of these, three, two, four, two, four. Three, two, four, three, six. So I don't know which one to actually three, two, four, seven, one. No. Okay, I don't actually know which one to connect to. So that's why we have to actually, okay, process and threads, blah, blah, blah. Wine debugging, wine DBG, tele.exe. Must be launched without a clear list of running processes based on the info. Info process, code map, win console, code map, win console. Nice. Okay, so I should be able to do this and I want code map. There's two code maps running. That's interesting. Let's do 35. What number do you want? All IDs are in hex. Attach to 3F. Can't attach process. It's like two. That's weird. Sorry to attach to this. Attaching. Use the attach command, pick up the WPID of the W process. It's a neat feature. I would love to use this neat feature. Can't attach process. This is insane. Sample debugging session. Wine, winward. Winward.exe. I wish this thing would just work. Where is this?  32. I gotta clean these up. 36. 426. Info process. There we go. Code map. This is something insane. If I have to do this. 102. That is literally crazy. Okay. It didn't like even the 0x to be hex before it, man. That's okay. We have adapted. We have overcome. Now we are close to hacking this guy. What I want. This right here. I desperately want that. Continue. Yes. Print slash x, eax. Oh yeah. We are cooking with gas. So ad4e is the size. And as a string ebx. Amazing. This is great. All right. So I have what I want here. Quit. Okay. Yes. We are here. All right. So we start this. See if it has commands. So that's exactly what we want. And then we can use all this debug information. So info process. So I want, oh, eight. Wow. That is super handy. Okay. So now I am attached there. And I must be getting past if there are any debug checks. I must be getting past it here. So this is why I'm attaching to it. Which means it's waiting on that read call. And so this way is nice because now I've all I'm through all the beginning stuff, which apparently was taking too long. And I don't know either we were debugging. I don't know something was going wrong there. So what I want, I want to break point on this. And okay. It's all right. Let's see. All right. So I don't couldn't have my three eight. So let's see if we can do this. So change that from 38. Nope. It's all 38 to 1056. So I want when did you be GDB. And I want 56. Oh, there we go. Okay. I'm here. Break on this address. I guess at this point I should really just turn this into a script. But let's break there. And I want my commands. Yes. Okay. So at break point one, I want to print out first print as a number star EAX. So this will print out what the size is. I want to examine as a string EBX. I think I messed that up. But let's see what happens. Undefined to create continue. No, so close. Okay. I want to set the break point on that. I want print out EAX. C O N T I N U E. Continue and point. I don't understand. Okay. That's good. Here's 998. So nine. There's all the rest though. Okay. I'm going to do this out outside of Jeff. G E F because that is not being helpful. Disable number correctly. I believe it's in like a GDP. Ah, I think it's that one. Yeah. Okay. So if I, we got this, we are going to get this answer. All right. GDP a net easy. GDP eight. Terminal crash. No. See the terminals messed up. Code map eight again. I like that. Set this. There we go. Okay. Okay. That's good. Okay. Breakpoint commands at that breakpoint print as a number EAX examine as a string, the memory that's at E B X. I'll just do C. Continue. All right. There we go. Now I got my first largest, second largest, third largest, fourth largest, fifth largest, sixth largest. So now I could do this and see what is the string inside the second largest chunk. That will be this bad boy. 10 seconds to prevent brute forcing. The third largest is going to be this guy. Nice. Wrong. Hmm. Largest is this one. The second largest is this. The third largest should be this. Hmm. So let's see. What are some things that could be wrong here? Of course, I'm trying the same example again. So that may not be actually the best idea. But largest, second largest. Let's see. Because I'm running this in wine. I'm not running this on windows. That could definitely be a problem in the sense that maybe the different. Maybe it's going to be a different breakpoint. Let's look at this. Or maybe the random number generation is different because I'm running it in wine and not on windows itself. Let's see. This would be first biggest, that second biggest, third biggest, fourth, fifth, sixth. Hmm. That's really interesting. Okay. Let's see. I think the correct thing to do at this point is going to be to set up a windows machine so I can actually run this on a windows environment. So I'm going to pause this video and set up a windows machine. All right, we're back. So here I have a windows 10 VM that is able to download through ASU's relationship with Microsoft. So here I've copied the EXE to this windows 10 instance. I can run this. It will say I'll make a thousand heap chunks of random size. Press enter to start allocating every size of the biggest chunk is 99879. The string inside that chunk is this. I'm a little bit peeve because this is the, what's going on here? Because this is exactly what we, what we had on our windows WD inside wine. So I also have the Oli debugger here. So what I want to do is I want to attach to this code map. So Oli DBG is a debugger. Attach process paused here. Why isn't it showing me any windows? I do not know. So I'm not very familiar with Oli except I've used it a very few times. Threads, windows, handles, code. What I want to do is I want to do exactly what I was doing before instead of breakpoint on this instruction of 403E67. But I need to figure out how to do this. I know I'm definitely debugging here. Maybe it's just slopes that's running in a VM. I'm not 100% certain I still have my output here. Why was this incorrect with those two? All I wait is the largest chunk, second largest, third largest, fourth largest. Okay, that doesn't seem to be helping for second third. I mean, this is definitely the string inside the third largest chunk. Okay, we want to run this. It's been a while since I've very rarely run windows anymore. So it's kind of interesting. Okay, let's see if I can open it up. Maybe I need to open up the exe and then attach to it. Nah, wrong. How is that wrong? We need to run this as admin. That definitely will help. Yes, allow that. Open code map. Oh, I think I am. Okay, so how do I breakpoints? Breakpoints? How do I tell this? I want to add a breakpoint. Here I have the different, the memory layout here. Interesting. How would I want to, like if I wanted to put a breakpoint here? Okay, I can just toggle. So I can search for stuff. Interesting. How do I, that looks terrible. Okay. Absolute addresses for sure. Go to expression. See the problem is I also can't see that. Let's see, single step, trace into, trace over. Okay, good. So at least now I'm single stepping the program. That's good. Where can I get to E67? No, that's here. It's debugging. Just entire debugging plugins. To return arguments, patches, call stacks, breakpoints, watches, references, run trace source, file, text file. Yeah, I mean the problem is I want to find, oh maybe, so if I assume maybe the O4 got changed, we're about three E67. Wonder if that would be somewhere. There's three, three E15, three E67. Yup, movie AX. Okay, so that's the breakpoint that I want. So if I right click, dump search for breakpoint. And this will run program. So is it running? See now it needs a new line from me. Is that running in, ah. Ah-ha. Here's my code map.exe that I'm debugging. Press enter. Now I'm gonna go back to Oli. Does nothing. Look at that. Okay, great. Now I am in here. So EAX AD4E. So you can see you can change this value. So AD4E. I'm gonna keep track of this. AD4E will probably be that same value that we had before. So 44355. Look here. 44366. Interesting. So good. We're already getting different results. Although this string is exactly the same. FIT. So EBX. I want though. I want this selection. Nope, no, no, no. Don't mess with that. This is what. FITZR6. TIUZOHPX. Something like that. If I continue this, so this is the first time this hits. The second time it hits now in EAX is E912122KLMIG3KB8FZP6. I'd be better way to do this, but hey. X176.0. X176.3FBI76PGCXR33D. This is like exactly the same. It's driving me crazy. All right, but what is 176.3F? Which is exactly the same thing. 184CFNJQIVNYUX7NCWLSLURKC. I guess it's possible that there is something that's looking if it's being debugged. X1855FROKVKOIZGMUKRX1862712JCU5U. Allocated merry size of the biggest chunk is that. 8, 2. So this is what I, this is exactly what I said. The third largest chunk has his agent code map. Okay, what's the string inside the second largest chunk? This doesn't work. I will definitely be a little bit upset. I don't understand. I mean, the question is, is this program detecting that it's running on windows? That's something I'm trying to think about. The biggest chunk is this 99879. Maybe there's a case where there's multiple of the same. Seems unlikely. Maybe? How do I relaunch this? Ah, why did my breakpoint went away? Let's see. How do I go and dump those on? I want to see the memory of here. 8.  I feel like we should have it here. I must be missing something. All right, I'm going to pause it for a bit and dig around. Okay, folks, so I'm back and I had a flash of insight. So I have not solved this yet, but I went down several false paths. But I believe I strongly now understand why they're with the problem. So what I did is I went and downloaded some plugins for AliDBG to try to get it to hide itself. I was thinking maybe this randomization function is using the is debugger present or some of these ways to detect debuggers in windows. I was a little bit skeptical because this happened both in AliDBG on the actual windows machine also on the wine environment we were using. And I was still getting the same, the same issues here. So I think we can actually go back to our original approach and the idea is I was going about this incorrectly.  But we do not know for certain that this is the second most value. Why? Because it's constantly generating random numbers, random numbers for the size and then only keeping track of the highest number. So what we know is at some point this 18 6 27 D thrones 18 5 5 F. But what we don't know is if there's any numbers after that happens that occur between these two. So and this actually makes so much sense. And actually it was going back to the that's fine. That's fine. Going back to the Poneble dot k r level and looking at what it's actually saying. So this is a good instance where the hint is very good. The hint was look at 804 403 e 65, which was right before this jump, which outputs. So if you break point right there output e a x and e b x right there, you will see all of the sizes and strings that it generates. But what we were doing was getting here so we were getting only the largest values. So I firmly believe we can run this. So what we'll have to do then is we'll have to execute it get all 1000 of these and quickly sort them and figure out what the highest and smallest values were. So this is something I am highly confident that we can do. So we do when dbg info process.  There's got to be a better way to do this, but I just don't know what it is. And so we'll do do what works. If you don't know what it is do it works 58. So now we've got there now it's loading everything. I would have to hit enter. I did. We'll see. All right. Now I want to break not where I did before, but I want to break here, commands print slash d, no sign e a x, examine as a string e d e b x and continue and continue. There we go. Beautiful, beautiful, beautiful strings. So there'll be 1000 of these. I haven't quite figured out the best way it's going to be to extract all these. I mean, this is running in a screen buffer so I can actually get all of these. And once I have all of these, I mean, it should be easy, but I wonder if there's any way I can get it to like quiet mode. Okay, good. So that was it. Let's see if there's a b y o b. See if there's a way to just save this to a file. Shift F seven. I'll save this works on my weird keyboard. Control a tilde. Okay, so I can enter scroll back mode. I know how to do that here. Space to start selecting gg to the top of the buffer. Enter to copy. So now this whole windows inside the b y o b use buffer a paste. There we go. All right. And now I have everything here. So now let's open this bad guy up in my teaching own devils. Code map. I call this dump. This is great. So now I can get here. I can do dbg. So this is actually all the stuff that we want. Okay. And what am I going to do? I'm going to use Emacs. So I'm going to put a size and a string. So I'm going to write a macro. Go to dollar sign. Then go to the equal sign. And what I want is it to be in a column with the size and then the string after that. So then I need to go here. Keep doing this here. This is so awesome. And I can use the Emacs. But I'm just going to keep holding it down. I can actually see the lines. I'm at 100. It probably won't be exactly a thousand I think because it had a check where it needs to be at least 16 size. So there'll be some that are less. Actually we will do that. Yeah, I'm only 22%. So I think it's, so there we go. So now I'm going to run that. I just have Emacs do that. There we go. Until, oh no, I did do it a thousand times. 999. Dang. All right. Now we take that cat. Size and string. Let's see. Sort, sort lines of text. Well, let's just pass it to it and see what happens. Cat. Yeah, that's not working correctly. There we go. K-Pos. Key. Sort by a key. Key def gives location and type. F is a field number in both our origin one. So I think sort. I also need it as n to be numeric. Sort. There we go. And now we can see that we were definitely incorrect. So we had the correct. This is the largest. This is the second largest, but the third largest is TCK. So let's verify that that's correct. And hopefully get that sweet, sweet flag in 10 seconds. Okay. Well, I guess maybe I'm getting slightly ahead of myself, but we can actually see. Let's see. Where's this one? R-O-R-O-N-J-Q. Yeah. So there definitely is one in between those. Correct. There we go. That is going crazy. And I'm super excited. Well, this one took a long time and oftentimes that. So this is actually a good example of a case where you can see that I had to go down different code paths and, and I ended up getting stuck. I thought, oh, well, maybe the windows isn't wine actually isn't correctly emulated to the environment. So I had to install windows, try to debugging in windows, got the same result. And then that's when I realized going down that path was not the right way to go. But this is what happens sometimes. This is why, you know, when you're doing these CTF challenges, you have to make kind of a lot of different tests. And especially in this one, it took me a long time because this is something that I'm not a huge expert at reverse engineering windows binary. So that definitely took me a while. I didn't even have the environment set up. So thanks for watching and I will see you next time.


Let me know if it isn't, I'll find out later when editing the video anyway, anyway we're still on the 1020 EEG system. So we tried both GPT 3.5 and PAD and couldn't actually get good results, we're getting some weird coordinates that didn't really make sense, but GPT4, which I'm accessing using Bing, was able to produce more reasonable results, this is also because you can upload an image onto it, so it's actually generated correct coordinates, I still had to patch them up and they need more correction there, but it's much better than what other language models could produce. So we have the prawns, and also interestingly when I upload the image it's generated XYZ coordinates, so I don't actually know if they are legit or not, but then we need a head model for this, but the reason it keeps skipping are one or two occipital lobe locations, and when asked to plot to add this to a head model, it's always reverting onto using MNE or EEG lab, it's kind of hard to avoid, so this one's using pandas and MNE to another library, and I assume right, does it the XYZ coordinates combined problem would be that we don't have this head model, how do I create the head model file, it's a good question that it's suggesting by itself, it can have a chat with itself, it's closed all the, is we'll eventually have to turn it into a web app, so we want to essentially combine, we'll have to redo this anyway, don't like it there, this one, yeah this one is a bit, can we rename this quickly, it won't be a working flask, yeah we have this human head and now it's also telling us how to generate PD, PD, A3D, I assume it's, yeah it must be a 3D head model, PD head model, this is nothing we'll be looking at later is a long term EEG, we're currently doing this prompt, we already have a folder of other stuff that we don't actually need, we're still working on prompts, we also have 3D, obviously this one won't work, pretty sure I had MNE installed, so what's up, this is actually using all the arrays just being generated using pandas, so why do I need a montage object, we don't have the head model, have some code here, 3D electrodes, make the capital, then we have them, what is the same thing, the line for installing MNE, should be the same line, creating an info object using MNE, don't have that library, how to install MNE globally, so I'm still okay, not sure, check, I had MNE installed already before, but this error should go away, how do you fix this, that sort of editing thing, right, how is this still, give us errors.


Hi guys, just a few quick updates. I apologize for the low production value of this episode of The George Show, but I didn't have time to edit it and this is important. Don't put spam into your tags. We've now seen a lot of channels. 100,000 plus subscribers get shut down instantly just because they are adding spam into their video description. They do things like put random key words in the hopes of getting higher search results in Grand Theft Auto videos, in Assassin's Creed videos, and there's a new group called Spam404.com which is flagging these videos and while Spam404 doesn't actually shut those channels down, the flagging brings the channel to YouTube's attention and YouTube is shutting these down.  So it's none of this one strike, wait a few weeks so that you can fix the problem and then you're safe.  Of course, you only need three strikes.  I'm not joking you. I'm not joking with you. If you want to have your channel, we've seen channels go literally from, hey, I'm going down for dinner and I come back up and my channel is closed, terminated, gone. Now we've asked for appeals and there is a form and I'll talk about that in the Real George show which is properly edited to explain this. There will be a link to a form that you can use to appeal a decision but so far none of the channels that have used it that we've seen have gotten restored.  You shouldn't have been doing it in the first place, of course, but of course since nothing happens people tend to do things as long as nothing bad happens to them but now something bad is happening, really bad. So tell me in the comments below what you think about this behavior, what you think about spam404.com and if this has happened to you, tell us in the comments below so others who may not be believing me may believe you if this has happened to you because we don't want it to happen to anybody else. Of course, we want everyone to be safe on YouTube. We want everyone to grow and this is just a really big deal. You don't want to lose years of work just because you were trying to game the system with a few more views by adding spammy things into your video description. So I hope you take my warning and fix everything in your channel and I'll be back with a Real George show episode soon. Alright, thanks guys. Take care. My name is George, founder of Freedom and you've been watching the unedited George show.


Wel, yn y tofi tyfio ar hyn nesaf y Gweithred Gweithred Pwysig, y video er fawr i'r eiserwm o unionfyrdd. Mae'r unionfyrdd yn rhywbeth i'r ffordd o'r gumd. Mae'n diolch ar gynnwys, ddechrau'r eich swyddfa â'r unionfyrdd a'r unionfyrdd o'r unionfyrdd jymdeithas. Marco Silver ydi'r nyfodd ar gadddiad Everns 3 y môl ar gyflog ar hynny arbennig a hamdd wedi Cymru cymdeithasol. Llywodraeth y llei effaith yn gwneud ymateb yma i'r gyflwyno 3 yma. Rydyn ni'n gwneud ymlaen efallai'r gyflwyno 3 yma ar y mae'r gyflwyno 2 yma oherwydd mae'n gilydd. Onl, mae efallai efallai'r gyleu. Felly hynny, mae'n gwlych yn siaradau'r gyleu 3 yma ar rai byd ar gyflwyno 3. Rwydaeth i'r cyfleol sy'n golygu ddim yn fwy rhaidion i'r gilydd. It's been reported in the Guardian. It's quoted there that, he said, you know, if, if it's, the players have seen them when he's angry.  But whatever's happening it's not working at the minute, so maybe he needs to try something different. Sta'n Collymaws wade in on the debate today and said if he doesn't turn this round that've had nears finished in England as a top flight manager. Cael eu moddill sut ti'n g wedi dwi'n angen ti'n gweithio, a'i wedi'i bob bod gweithio. Fel tyfnwyr ei fod yn fenod, sy'n creu amser. A'r rhefydledd ar y cyfanydd fyddion rhaid mewn nos yw'r apreïdd. Rhaid i'n du i'n drwng yn fwy, mae'n drwy'r peth yn gwybod ar ddug o'r peth. Mae'r pelytiadau yn gwybod i'r pelydiau ac mae'n cyfanydd. Ond yma'n ddug o'n hynny mae'r gweithio ar gyfer y pelytiadau neu fwy yw o'n cyfrannu. Cydyddwn, mae'n gweld ei bod yn GTGW yn gyweithio, a dweud rydyn ni'n gweld o'r hwn yw'r ysbytfa o'r 14ol, ac mae'n golygu ar yhu chi ar summonerau, oherwydd, y reagwno'r pethau a'ch gweithio'r pethau i gyrdwyr, a'a ffrudio'r fath o'r bandwyr. Mae'n golygu ar ôl a'n golygu ar ôl, byddwn yn 2016, a'r pethau yn golygu gyrd, i'n golygu ar ymddangos, oherwydd mae'n golygu ar ymwneud i gynnyddiadwyr, yn gweithio i'r cyffredinol o'r ffordd o'r cyffredinol eich gael. Mae'n ymwneud y ddiweddol gan'i Llasi'r llunio'r ddechrau i ystod o yng Nghymru, ond 43 sefydig o'i ei wneud o'r dros y cyfaddio Llasi'r Fylo, ond Llasi'r cyffredinol nid o'n gwybodio gweld y ddiweddol, i'n meddwl am ychydig o'i cyffredinol iawn a'n gweld y rhan o'r cyffredinol. Ond Llasi'r cyffredinol yn y rhan o'r cyffredinol y dda, a dylai fy rhan o'r lef, bydd y dylai'r Lies. Felly, mae'n rhaid i chi ddweud o'r hyn. Cwca Martina was anon nhw sub, a Ffainod lost 2-1 over the weekend. Robin van Persie's go for them, but he didn't get on. A'r oedd y sub, Calum Connoly played in midfield for Bolton, but they went down 2-0 to Sheffield United Care and Dal came on for the final five or six minutes of that one. A'n Benny Benningam, he was anon nhw sub four weekend at the weekend, he was on the bench with Darren Gibson. Calum Machmanw. Calum Machmanw, the formerly of Everton. Better bench than us. I'm not even going to give that comment an answer. David Unzred has been speaking about Jar Virginia and how impressed he's been with the form of the Portuguese goalkeeper of Leite. He also praised Morgan Feeney and Tyus Browning in there as well, but he focused on Virginia and said he's been a revelation for us. Obviously, with Martin Stefflenberg getting older, you just wonder if Virginia is going to step up and be the number two next season. Not sure what lap on with Stefflenberg in the summer, but just interesting to see if Virginia becomes our number two. He's in the squad most of the time, always training with the goalkeepers before the game and stuff, so Marko Silver has used them as part of the squad and got the feel for it all season, so it'll be interesting to see whether he takes over the gloves as the number two next season. Finally, Royston Drenth has been speaking about his time at Everton and said that he should have worked harder for David Moyes. He said, talking about the semifinal, the team meeting before the FA Cup semifinal, when we needed them in 2012, he turned up a bit later and went in. He said they should have walked in and shut up and sat down quietly at the back. David Moyes told them to ref off and he said it back. He said they really should have just been silent when Moyes said that it took me medicine and then being part of the squad. He said that they thrived under David Moyes, but he didn't. He said he told them to ref off back, got off and went to Holland and never came back. We know what happened in that semifinal. Who knows, Royston, if you'd have played up Emily that day, you might have been a difference and it could have worked out very differently, but it just shows you that sometimes players react in a way that doesn't give them a way back, basically. There you go. That's it. There's not much floating around. That is it. We look forward to Marco Silver's press conference tomorrow to see what he comes out with ahead of the Manchester City game. If you haven't subscribed, please do so. It takes a second if you want more videos. Get over to Patreon. Thanks for watching. See you later.  Go on home. Come on, bollocks.


Anybody that doesn't know what's going on, they don't have like, what's their IQ level? What's their self-worth, right? What's their mental stability?  They're like, oh my god, oh my god, totalitarian, no, speak nothing, I would do my work, that's what they're doing in Canada. I look at them, they're like, what the f, right? People are now triggered by words, like common everyday words. They get triggered, they're twitchy.  Canada is got to be one of the most least mentally healthy societies in the world. People here, a lot of people here, maybe it's just the leftovers that I know, but most of them are leftoids, really, leftoids, they're mentally not there, they're going to need help. They're good people, they're kind people, they got good hearts, they just confused, they just got scared, they got traumatized, right? They got, what's that syndrome called, where you love your abuser, Helsinki syndrome or something like this? Yeah, there's a lot of Canadians that will need mental health, help in the coming decades. So if you're looking for a job to help out society, come to Canada, start talking to these people then.


What's up everybody? It's Jason here for jazby's casebreak.com. We just sold out 2022 hip read baseball autograph limited edition series 9 Do a case break around in teams number one and again guys 20 total boxes everybody's around a team MLB Here's a cell sheet hits there for you guys potentially popping out in there Now again, here's the dice throw their customer names from Ed down to Martin boss straight up Michael one from fanatics 9 down a kev And then there's the teams. Let's roll it 6 into 2 8 times. Good luck 1 2 3 4 5 6 7 8 Michael down to Chris 8 times And let's go 8 times here 1 2 3 4 5 6 7 8 Dodgers down to the pirates 8 8 So Michael you have the Dodgers Ed with the Orioles David with the Cubs Martin with the Mads Justin with the Nationals Matt Clark with the Royals Craig with the Guardians Kev with the D-backs Ness with the A's Eugene with the twins Brad with the Cardinals Michael with the Yankees Matt Smith of the Brewers Michael with the Braves Martin with the Rays Chris walk with the Tigers Danny with the Marlins Chris Bella with the Phillies Matt Clark with the Padres Ed with the Mariners Danny with the Angels Michael with the Blue Jays Naster with the White Sox John with the Red Sox Ed with the Rangers Fernando with the Reds Chris Bella with the Rockies Danny with the Giants Ryan with the Astros and Chris with the Pirates All right guys, I'm gonna go grab the cases and then uh We could uh get the next one going Wow Lakers can tie this game guys only down by three 10 seconds left Lakers can tie this game Reeves for three Was he fouled wow he just did shoot three free throws Man Reeves almost made that shot Kind of like double clutched it of course because he got fouled but all right guys. We'll try with the closing And Michael saying oh whenever I draw Teams that should be amazing. I guess skunk change that all right. We'll see Lakers be playing good ball right now guys I must I must say oh no, he missed it Damn it. Oh hit the ref out Well, they can still foul and play the foul game again, I guess Whoa, oh 80 just got fouled Chance to win the game Or take the lead I should say You guys watching this game guys It's Lakers uh six years game is wild Made the first one tie game I must say though guys, I don't I'm not a Laker fan. Maybe I just see it differently But I feel like the Lakers announcers are very cocky towards the Lakers You know, I get it. They're supporting the Lakers, but They just go really they get really excited for anything. Oh my god. He missed it Wow Anthony Davis had a chance to win the game He missed the second free throw overtime. All right, here we go guys Trevor's story Bowman Crone first for the Colorado Rockies And Colorado Rockies that's uh Chris Butler Now these these Trevor's stories at one point were like selling so quick like hotcakes Spencer Torgels MPSA nine Bowman Sterling prospects Otto That is Detroit Tigers Chris Walker We have a four out of six Cal Raleigh For the Seattle Mariners patch Otto Seattle Mariners Ed with that one Rated rookie. That's a nice little color match blue 41 to 50 Alfonso Yes Is that you from Instagram too? Oh, that actually was a cell sheet hit actually, you're right Lottie was the cell sheet and we got Eloy Hamenez debut booklets for 11 out of 49 and let me just cut it open just so you guys can see it Jesus man, these hip-freight stickers are just made of metal or what? Quick All right, uh white tops that's going to Nester and then Toronto That was Michael. Oh, that's right. Yeah, see Shit, I don't know that I didn't realize yet Toronto. Nice. Jose Altuve and that looks like it's from that logo craft your product Very nice in there for the Astros right each Got into the b-ball hip parade finally. Yeah, dude for sure man. It's very addicting. It's fun A little bit cheaper than personals Although obviously, you know the difference between here and personals is obviously you can purchase something team Spot on a break, you know and just get nothing in return So I think you know for some people the personals they rather have something rather than nothing but If you're specifically chasing a particular player or team Then it's sometimes it can help the wallet just by doing a pick your team rather than team tub of deal Gary Mitchell to 4.99 and still possibilities of getting some monster hits It's just uh, you know More riskier put it that way, but I think more more exciting and more of a rush though Whoa, whoa, whoa, whoa dual autograph. Oh Garrett Cole and Jackie Bradley jr. And that is number 32 of 50 Now, I don't know if there's a checklist for this This is way back in 2010. So I really doubt it So We probably have to go by college rules by this I know it's gonna be tricky, but again, if there's no checklist officially for this that shows That they're on their teams back in 2010. Then I have to go By college rules. So just just a little FYI guys That's the one thing about some of these repack products when they use like usa baseball or college baseball We'll check that out at the end of the break Cody Ballinger for the Dodgers 13 out of 15 And of course now a cub but Dodgers there for Michael and we got a gold That is a mark McGuire 31 out of 50 from top's chrome block Cardinals that is going to uh, brad All right, so that was the first case. Let's get the second case now. I'm going and a cc sabati Three color patch to 25 from diamond icons. That is a Yankees Michael P Melton is just having the game of his life I don't know if he got it off in time though Jesus Christ Miggy. Wow. That's a nice biggie right there. Look at that 35 out of 99 That's from 2010 It should be baseball Detroit Chris Walker Walker Bieler bowman chrome first So the Dodgers PSA now Dodgers that is Michael P and Lakers haven't made one shot in this overtime Blatting to 99 nice refractor And that is uh from 2021 Another one there for Blue jays and Michael All right after this box we're halfway through the second case Nice reach hoskens 10 of 10 three color patch purple diamond icons Phillies that's chris butler avi rutchman Orioles add with that one It might not mean it's your night tonight. It looks like you've done pretty well for yourself Getting into these fillers and breaks and hitting man Keep it going ride the wave Wow I wish that was like You know grippy, but look at that patch Kyle seager three out of five. That's probably one of the first years. They did um Dynasty this is back in 2015 Look at that pop and color right there Mariners that's going to add Yeah, no, I know but you're hitting those spots though People do the same thing and don't get anything, you know So it's like Yeah, Lakers are done. I haven't scored at all this overtime. They're done by nine now Jazz Chisholm for the marlins, that's a rookie to 150 And daniel on the board buddy and a massimo costa green auto refractor atomic sapphire to 50 texas rangers Ed with that one All right, last one here folks. Ah, there's the sell sheet hit Well a little wander franco patch autograph 80 out of 99 So there you go. We've got the latin the wander and that's going to the rays of martin d And there you go folks. That was a break. So again, I mentioned again with the usa collegiate stuff I'm going to try to find a checklist if I find one. We'll definitely go with that if not then Well, I'll do like I said go by college rules where they're currently at Or teams they play for the longest about other that's but this is uh 2000 and what 10 bowman sterling? Let me see if I can find the checklist I just know that they didn't really They didn't really put the team next to the vat before I don't see any on carver connection Like I said other places do have a checklist, but it's just It's just their name not affiliated with any teams I know the big rookies that you're there were like strawsburg and stuff, but Yeah, we're just gonna have to go by current current, uh Current team.  So even in the league. I don't remember I know he was a Red Sox for a while I don't even know where he's at now Toronto Is that where he's at? Oh, yeah, he was with toronto. He wasn't the red Sox for a long time, right? Yeah, it looks like he was a oh, he was back at boston and then he got traded. Oh, there you go. Toronto Toronto and uh Yankees yankees and blue jays roll it Signify 11 times here we go one two three four five six seven eight nine 10 11 And it's gonna go to the yankees six and a five 11 So yankees win that one and that is Mike actually you don't know what the hell You actually why don't even randomize this for you have both of those teams? Oh, well, I guess that was the rush I guess you have both I didn't even notice that Michael might win this one. Yeah All right. Well, there you go, man. Congratulations. That's funny um I'm still gonna put yankees though just so they don't get confused, but There you go. Thanks guys appreciate it. We don't have another one of these But uh, like I said, we still have more hiper in the store jaspyscasebricks.com


Hello, I am Mr. Satish Thalangi, Assistant Professor, Department of Civil Engineering, Washington Institute of Technology, Solapur. In today's session, we are going to see the project network updating for the project management. At the end of the session, the students will be able to compare the originally scheduled network diagram of a particular project with the network diagram which is going to be updated using the critical path method for the project management. Now, let's see what is the project updating or you can say the network updating. The network updating is nothing else. It is a process of replanning or rescheduling of the activities in the project on which the particular updating is going to be done or till the what the particular project has been completed and what the progress is there and what the progress is going to be there from the date on which the updating is going to be done. Here, why we have to go for the network updating is what that if there is a change in the plan, we have to go for the updating. If there is a change in the activities and it duration means what if there is addition of some activities or a change in the execution of the particular activity method or you can say means what for it if initially it was somewhat traditionally but now it has been advanced technology has been used for the execution. At that time, the activity may be change or activity are added along with that there will be change in the duration of the activities. Here, the change is due to the major reasons like a climatic condition or you can say the natural climaties or man-made disasters. Here, the man-made disaster may be due to the improper planning of the equipments or tools or you can say the in due to the lack of the safety on the side due to which there may be an accident due to which there may be a delay in the projects for that. We have to go again for the updating whether the scheduled activity is going on track or not other if there is a need to re-planning or rescheduling of the activity, we have to go and we have to observe. Here, the time changes for the updating are what assign the time of the update at which the updating is to be done. We have to assign to the updating project the date on which it is going to be updated. That will be the time the earliest occurrence time of the starting event of the project or the tail event of the activity which is in progress. Allocate or you can say assign the zero time duration for the activities which are already completed. We have to assign the zero for that the activities which are completed and we have to assign the remaining time estimate durations to the activities which are in the progress or we have to change the activity duration as per the requirement of the change requirement. Here, the addition or you can say the whole duration of the activity changes due to some revision or you can say addition of the activity or additional of the new technology in the particular execution of the activities. Here, assign the revised estimate durations to the activity for which the change is proposed. We have to collect all the data from the data information system that what is ongoing activities and what are the completed one and what are going and the activities which are going to come in the future. According to that, we have to change overall the times of each activities which are completed ongoing and the coming activities. Here, this is a question in which we are observing that there are the activities with the days. Here, the particular table is showing the activities and the days and the description which is below which is showing the particularly the what is a condition or you can say what are the present situation or conditions or the datas of the overall activities which are present in the projects. Here, when we observe activity one two and one three are completed as originally planned it is it has been showing and activity three four is in progress and we need six more days for the completion activity four five appear to be present some problem and it is now estimate time of the completion is 10 days and the activity four five can be complete in five days instead of originally planned seven days. Here, see we will construct the particular CPM network diagram for this particular question. This is a network diagram before updating when we go for the construction of the network diagram we have to construct or we have to present the network diagram with the event time as well as the activity times. Here, the yellow box are above and below the circle nodes are showing the event times and the box of which are above the arrow and below the arrows are showing the activity times and the duration of the particular activities. Now, let's see what will be the project duration when we go for the construction of network diagram. Here, we observe that there is a 41 days required to complete the overall project and the critical path one is one three two five and six. Here, these are the particular activities which are critical one one three three two two five and five six in the network which is not till updated as when we see the question they are saying that the project is updating going to or you can say going to update on the 14th day. We have to start as per the defined by the rule that the starting will be in the event one starting time will be the 14 that is the earliest occurrence time of event one and we have to change the durations of the particular activity which are completed or which are on the or in the progress or which are going to come but there will be a change in the duration as due to addition in the new technology or change in the activity execution methodology. Overall, we have to collect the information and we have to assign the newly obtained durations to each activities. Now, as it is been said that from activity one two and one three are complete as originally planned means these two activities are going to be totally complete at the day of 14th. So, this activity duration we have to assign zero here initially when we see the network diagram before updating we are assigning six and particularly one two and one three ten. Now, when we are updating we have to say zero and zero because they are completed. Similarly, we have to see the next activities which are in the progress or which are still need to be execute what will be the duration as per the data we have which are collected from the data source here when we see that they are saying that activity three four is in the progress and we need 16 more days to for the completion activity three four initially when before updating three four the time required was 12. Now, when we have saying when we updated we have to assign instead of 12 16 because this is the data which is particularly collected for the present project which is in the progress and the activity four five appears to be present some problem means as there is some problem it's now estimated time of the completion is 10. When we observe this table we can see that active four five the time required was seven days or you can say duration required was seven days. But when we are updating now we have to change the duration here we have to say that activity particularly four five instead of seven days we are assigning as a 10. Similarly, we have to go for the left activity that is activity four six can be completed in five days instead of originally planned seven days means what activity four six this is activity four six which was initially before every was seven days or required required. Now, due to some advance you can say or some additional technologies or new technology has been adopted or some machines are added for the execution or the resources are added for the execution its reverberation is reduced and it we have to assign the present duration as a five. Now, we have to keep the activities duration as it is which have been not described in the description. Now, this is a overall network diagram after updating. Now, again we have to follow the forward path to get the particular earliest starting and earliest finishing time of each activities and as well as of events and we have to follow the backward path here which will give you the latest start time and latest occurrence time of the particular activities and the of an event as well as when we see that after updating the project duration is four six which was initially before updating the project duration was 41. Now, let's see the comparison. Now, when we start to compare in the network diagram before updating and the network diagram after updating here the critical path was one three two five and six. Now, after updating it is been one three four five and six this is the major difference of the first major difference of the particular network diagram before updating and the after updating here again the project duration is 41 and here the project duration is 46. Second here the initial event that is one it's starting time it was zero but here the initial time in after updating it is 14 which is a third major difference we have to assign for the particular network diagram. This is the particular network diagram presentation before and after updating these are the select the answers for the today's questions. Hope so you have selected the answers correctly. These are the references for today's sessions. Thank you. Thank you very much.


And quadratics, cubics, and we even saw reciprocals in this video. There are just a few more graphs that we need to recognise, the sine, cos and tan graphs and exponential graphs. At this stage we just need to recognise what they look like to not be shocked by the shapes. So, don't stress too much about learning the exact places they cross the axes or anything. So let's start with the three trigonometric functions. The sine and cos graph are really similar. Let's have a look at the sine graph. It crosses through the origin, has a maximum of one and a minimum of negative one. And it repeats forever in the positive and negative directions. Let's now have a look at the cosine graph. See how it's basically the same as the sine curve? But it's just shifted a bit, so it crosses the y-axis at one instead of zero. So now let's have a look at the tangent graph. It's very different. You just need to recognise the shape. So we'll look at the actual values of the trigonometric graphs in another video that for now we just need to recognise the shapes and be able to complete a table of values to plot these functions. You can use your calculator to help you remember how each graph looks. If you type sine zero into your calculator, it comes up as zero, which should help you remember the sine curve crosses through the origin. And sine 90 equals one, so the curve is at one here. Type cos zero into your calculator and you get one. So that should help you remember that the cosine graph crosses the y-axis at one. And cos 90 equals zero, so the curve is at zero here. So all we really need to know at this stage is that the sine and cosine graphs are curved. They go up, middle, down, up, middle, down every 90 degrees and carry on forever. The tangent looks very different. It sort of looks like lots of separate tool fin curves. So now we can recognise the three trigonometric functions now for exponential graphs. Again, it's just about recognising the shape. We'll discover more about them in future videos. Exponential functions are y equals k, the power of x, where k is any positive number. So y equals 2 to the x looks like this. For any number that is above one, the exponential graph will also look similar in shape to this. For the negative values of x on the graph, the graph is very close to y equals zero. And then as the x values increase, the graph heads towards infinity. Whereas if we have y equals 0.5 to the x, for example, or any value between zero and one, the exponential graph would look like this. So it's just reflected. But again, you don't need to worry about remembering this exactly. Just be aware that exponential graphs can be flipped. Either way, they cross through at zero, one, and they both get really close to each other, but never actually cross the x-axis. So there we have our final four graphs. Don't stress about knowing their exact shapes, just be aware of how they look.


This is Sam, a crypto investor. He just put his savings into a new hot DeFi token. The price of the token is already skyrocketing. 5x, 10x, 100x. Sam thinks of himself as an investment genius. He goes to bed, dreaming of the Lambo he will buy the following day. When he wakes up in the morning, Sam checks the balance in his account and sees it is almost zero. What? How can that be possible? Sam is devastated. It looks like he was a victim of a classic rugpull. From January to July 2021, $113 million were stolen via rugpulls, the most common type of scam in the booming decentralized final space. While overall crypto-related crime has been steadily decreasing, fraudulent activity in DeFi has been on the rise. Unfortunately, returning stolen funds after a rugpull is almost impossible. That is why prevention is crucial. In this video, we'll explain how to spot a rugpull and avoid losing money while investing in DeFi. But before we get into it, don't forget to like the video and subscribe to our channel. So, how does a rugpull work?  Here, the new token is traded within a liquidity pool against an established token, such as ETH. To attract investors into the liquidity pool, the scammers promote the project on social media, promising high returns. As more and more investors put their ETH in the liquidity pool, the price of the new token increases. At a certain point, the scammers pull the rug. They drain the pool of all the ETH and disappear with the funds. That immediately crashes the price of the new token, leaving all investors holding the worthless bags. Now that you know what a rugpull is, how can you spot one? To answer this question, we reached out to two DeFi experts. For safety reasons, they both asked to remain anonymous. Here are six tips you can use before putting your money into a DeFi token. Tip number one, check the team's background and social media. Find out information about the token's development team. If the developers are anonymous, it's already a red flag. If the team's information is available, you should check how solid the reputation and background are. It's really about measuring the trustworthiness of the team. Are they anonymous? If not, who are they? Do they have a background in the industry? You often see websites where they've just taken some random LinkedIn photos and created a fake team. Many of those have been exposed. Another important thing to check is the project's social media and telegram chats. This helps to understand how genuine the enthusiasm around the tokens is and how authentic the community involved is. I feel out how people are acting in there. Does it look like they're talking to each other or it's a lot of people talking? Are people allowed to bring up topics that are not only promoting the token? That's a really important part. And so, for example, you might come in there and say, hey guys, so what happens when in this asking kind of hard question? Any kind of hard question? If you get banned, probably a scam. If you get muted or deleted, probably a scam. Tip number two, was the project audited? A legitimate project should undergo an auditing process by a reliable third-party service. If it wasn't, then you should be cautious. It means the code may contain bugs that could be exploited to steal users' funds. Unfortunately, audits are usually expensive and few projects can afford them. And even if the project was audited, make sure you read the actual audit. People say, oh, they're audited and they go in, but they don't read the audit. And the audit says, these people can steal your money. Don't put your money here. These people can steal your money, but people never read it because they say it's audited. Tip number three, test your ability to sell. Sometimes fraudulent projects contain hidden code that prevents people from withdrawing their funds from the liquidity pool. That is why you shouldn't invest a large amount of money into a project or coin, until you know for sure if and when you will be able to sell. Tip number four, check the token's distribution. Check the token concentration. If a large amount of the tokens are concentrated in the hands of a few people, that is a red flag. It means that a bunch of whales could potentially dump their bags and crash the token's price. You can easily check the token's concentration by using a block explorer, such as either scan or BSC scan. Tip number five, is the liquidity locked? Another important thing to look for is whether the liquidity has a time lock on it. A time lock is a security mechanism that prevents developers from removing the liquidity from the pool and make a way with your funds. As long as most of the liquidity is locked, you know, 95 to 100% is locked, then there cannot be a rug pull. Now you're probably wondering, things are getting too technical, how do I even check these things? Don't worry, these are a few online tools that can help you out. Tip number six, check independent auditing websites. Platforms such as TokenSniffer, RuckDoc and BSCheck.eu are run by experts who audit DeFi tokens. They break down most of the metrics we mentioned here so far and rate the tokens according to risk levels. Also, there are telegram communities where you can ask about a specific project. There's lots of people in there because they're like, hey guys, I'm thinking about going into this thing, I'm not sure about it, can someone take a look? And the coders and so forth in there will go look for you. Ultimately, identifying a project as a rug pull is not straightforward. In the unruly DeFi space, the border between a fraudulent project and the latest meme coin can be very subtle. Sometimes it all comes down to your own goals and appetite for risk. If you're looking for solid, legit projects with real use cases, then the indications we have given you are going to be valuable.  The goal of DeFi is democratizing financial services through a trustless and permissionless system. With almost no barriers preventing crooks from entering the space, DeFi is flooded with get rich quick schemes and fraudulent projects. That is why at Cointelegraph, we want to provide you with the information you need to navigate these rough waters. Hopefully, with our tips, you'll feel a little safer. Thanks for watching this report. I'm your host Giovanni and see you next time.


So, at this point we have a fairly complete understanding of the harmonic oscillator, the rigid rotor, the particle on a box, all of which can be used to describe different motions for a diatomic molecule. So, let's see what we can learn by putting those pieces together and describing the diatomic molecule as a whole. So, we know that the energies of a harmonic oscillator have this form, 1 half h nu plus one or two or three or four more copies of h nu for every excited energy level. The rigid rotor has different form for the energies, a rotational constant multiplied by the angular momentum quantum number L times L plus one. So, those are completely different states for the rotational energies and the vibrational energies. And remember that the sizes of these rotational constant and the vibrational constant, the vibrational, fundamental vibrational frequency are quite different from one another. If I convert both of those to the same units, if I convert them to units of wave numbers, remember that the fundamental vibrational frequency, that's typically on the order of several thousand inverse centimeters, whereas the rotational constant, that's somewhere in the vicinity of maybe a few tenths or maybe a few tens of inverse centimeters. So, the rotational constant is smaller by at least a couple of orders of magnitude compared to the vibrational energy. Vibrational photons that excite vibrational excitations were in the infrared photons that excite rotational excitations are in the microwave. So, real molecules of course both vibrate as well as rotate at the same time. So, rather than just treating them one at a time, we can consider the possibility that a molecule is vibrating and rotating simultaneously, in which case it'll have a vibrational quantum number, a rotational quantum number, angular momentum quantum number, and we can say that the total energy composed of the vibrational contribution to the energy and the rotational contribution to the energy, if we just sum those two together, we find that the energy will look like just the sum of these two terms. But where it will get interesting is when we see what those energy states look like. So, let's draw an energy ladder. So, here will be the energies of my molecules. So, these quantum numbers mean exactly the same thing they did for the harmonic oscillator and for the rigid rotor. The ground state, the ground vibrational state will be when n equals zero. So, let's think about what this would mean when we have n equals zero and l equals zero. n equals zero, the vibrational contribution is still going to be one-half h nu, l equals zero, with a zero here, the rotational contribution is just going to be zero. So, if I add these two pieces together, we predict that there's going to be an energy level for the molecule with an energy of one-half h nu. That's just the same zero point energy we had for the harmonic oscillator. There's no additional rotational energy, but it's certainly possible to also have a little bit of rotational energy in addition to that zero point vibrational energy. So, we'll put the molecule in the first excited rotational state. Give it l equals one, the first quantum's worth of rotational energy, and then the energy is going to be one-half h nu from the vibrational energy. And then the rotational constant times l times l plus one, that's a one and a two. So, we'll add twice the rotational constant as the energy of this state. Remember now that the rotational energy, when they're in the same units, either energy units or wave number units, the rotational energy is smaller by several orders of magnitude compared to the vibrational energy. So, I'm going to have a hard time drawing this to scale. I'll draw this level just barely above the ground state, the ground vibrational and rotational state. In fact, this extra amount of rotational energy should be several hundred or maybe even several thousand times smaller than the amount of vibrational energy. So, if I do it to scale, we wouldn't see this line. It'd be buried very close to the top of this line. So, I'll just draw a very small excitation due to the rotation. But also remember that these states are degenerate. The rigid rotor states have a degeneracy of two l plus one. So, there are, in fact, three states with l equals one slightly above the ground vibrational state. And if I continue up to the state beyond that, there's going to be one, two, three, four, five states with l equals two. And then I can continue to draw more states, seven and then nine stacked up here. The energy, let's see, the one half plus two b, that's the energy of this l equals one state. This state would have an energy of one half h nu plus six b. We've considered rotational excitations. What if I put the molecule in an n equals one state?  So, if this state is one half h nu, somewhere up here is three halves h nu. And then stacked on top of that vibrational excited state, we're going to have some rotationally excited states. A triply degenerate state with one quantum of rotational excitation, a five-fold degenerate state with l equals two, with more rotational energy. So, this would be the n equals one, l equals two state, and so on. So, we've got a whole family of rotational states stacked on top of the ground vibrational state, stacked on top of the first excited vibrational state, and then further on as we go up. That's what our energy ladder looks like. That's beginning to look more interesting and more complicated than either the harmonic oscillator or the rigid rotor on its own. Things get even more interesting when we remember that there are selection rules. The harmonic oscillator had a selection rule that required that we can change the vibrational quantum number by one in the upward direction or one in the downward direction, but no more than that. There was also the selection rule for the rotational quantum numbers. l had to change by plus or minus one, and the magnetic quantum number, the quantum number that gives rise to this degeneracy, that one was not allowed to change. So, let's say, for example, we have a molecule in this ground vibrational and ground rotational states. Which states is it allowed to make a transition to? Only the ones that obey these selection rules. So, we could, for example, go from n, l, m. If we start in the 0, 0, 0 state, ground vibrational state, ground rotational state, we could make a transition. We can increase n. We can increase l. m must stay the same. So, we're allowed to make a transition to the 1, 1, 0 state. So, that would be this transition starting here and going to this state. No, sorry, that's not correct. Going to this state, the one, the, the rotationally excited state. Notice that the energy of that transition, I'm going from energy of one-half h nu up to an energy of three-halves h nu plus a little bit of rotational energy, plus two rotational constants worth of energy. So, this, the delta e for this would be h nu for the vibrational excitation plus two times b for the rotational excitation. Some other examples, if I were starting, let's say, in the somewhat rotationally excited state. If I'm starting in, let's do m equals one for variety. Let's say I'm starting in the m equals one state. So, that would be starting here, let's say, ground vibration, one unit of excitation in the rotational energy, and then I'll call this one the m equals one state. I'm allowed to make a transition up one in n, up one in l, and I must stay the same in m. Or, I could make a transition up one in n, down one in l, and keeping m the same. So, I could make a transition either to there or to here, but this one doesn't exist. That one's not possible. There is no m equals one when l equals zero. That one violates the rules for how these quantum numbers need to be. The only state I could make a transition to from the zero one one state would be to the one two one state. If we think about what the energy of this transition would be, I'm gaining h nu for vibrational energy. I've gone from two b worth of rotational energy up to six b worth of rotational energy. So, I've gained a total of four b in rotational energy. As one final example, let's say I'm starting in the zero one zero state. I could make a transition increasing vibrationally, increasing rotationally, and keeping the same m. Or increasing vibrationally, decreasing rotationally, and keeping the same m. This time, both of these are in fact acceptable. This one doesn't break the rules for the values of m. This state can only go upwards. This state could go up to this state and have the same energy as the excitation we considered here. Or it could drop in rotational energy and then land in the vibrational excited but rotationally completely unexcited state. That would have an excitation energy. I've gained h nu worth of vibrational energy, but now I've lost some rotational energy. I started out a little bit excited. One quantum of excitation in the rotational energy. When I ended up, I had no rotational energy, so I've lost both of my b e units worth of rotational energy. So, we've begun to see here that the complicated structure of the vibrational and rotational energies combine together. So, we call those row vibrational states. Rotational energy stacked on top of vibrational energy. Those row vibrational states combined with the selection rules tell us specifically what energies the molecules allowed to absorb. And they've begun to look a little bit complicated. This is going to be the key to understanding specifically what energies or frequencies or wavelengths of light diatomic molecules are going to absorb in the infrared portion of the spectrum. So, we'll consider that next.


Hey, I just wanted to very quickly give you my response and reaction to the recent Patriotic Front press conference that they held that was chaired by the man that walks around with the binoculars, Mr. Rafael Nakachinda. And I'm always amused every time I see the Patriotic Front on social media or in mainstream media. I'm always amused because it's like watching paint dry. They regurgitate the same things over and over and over again. The Patriotic Front has simply refused to accept that the Zambian people have moved forward. No pun intended. But we have. And the P.F. are somehow stuck and they're frozen in time. The P.F. refuse to accept that we are living in a post-election era. The elections are done and gone. We're done away with that. We've done away with that. We're now moving towards a different goal. And that's okay. You must understand that. It's okay to have a different choice. And I was amused when Mr. Nakachinda talked about how we're carrying out a post-mortem of our failures. Even as you know, a post-mortem is an examination of a dead body to determine the cause of death. And the P.F. are going around the country, claims Mr. Rafael Nakachinda, which I know is untrue because the Patriotic Front doesn't have the wherewithal. They don't have the resources to do that. They haven't been going around the country with what money are they doing that. That's just a fable that Mr. Nakachinda spews from his mouth. The P.F. are not going around anywhere. All they have done is they've called a few friends, called a few people that they know, and they've come up with the results of this post-mortem where they claim that, no, we now realize the folly of our ways. We know now that we were brutal, that our caddes were out of control, that there was a sense of lawlessness, that we had no respect for authority. We had no respect for institutionalism. We now know that. Da, that's ridiculous. You knew that then, but because you were in power, you were so consumed with arrogance that you were blind to see it. Now, the P.F. claim to have this new outlook on life. I refer to the Word of God, Jeremiah 13, verse 23. Can an Ethiopian change a skin color? Can a leopard change its spots? Neither can a man who is accustomed to doing evil, can all of a sudden turn around and do good. Are you catching that? If a man is evil to begin with, and then later on they claim, oh, I'm going to be good from now on, change doesn't happen like that. Change doesn't happen by pronouncements. It doesn't happen from here. It happens here. So the question then is, is the patriotic front a different party? Absolutely not. It's got the same scoundrels. It's got the same guys in there, the same mob, the same gangsters, the same caddes. It's got the same characters that characterized the brutality of the P.F. are still there. Here it is. They're claiming, oh no, we've carried out a post-mortem, oh no, we've changed, we're a different party. You haven't changed. Lastly, let me tell you, a few weeks ago, we saw on social media several different big companies denying any involvement with the P.F., big companies, because there was an accusation out there that so-and-so company was funding the P.F. These big companies, after the P.F. lost, had to come out and say, no, we don't fund the P.F. So because these big companies have announced, they've said that they have no involvement with the P.F., guess what that means? It means the patriotic front doesn't have the financial muscle to sustain itself. And during this press conference, Mr. Nakachinda said that it is now up to every well-meaning patriotic front member to put in there, to invest into the party, that this party will not be bankrolled by one person. Are you kidding me? This is Africa. This is not Salt Lake City or Seattle, Washington, or Bogaloosa, Louisiana, or Memphis, Tennessee, Mr. Nakachinda. This is Zambia, where every patriotic front member expects a handout. You are living in a dream world if you think that members of the P.F. are going to take their hard-earned money and invest in that party. Wrong. Just accept it. You're dead. You're buried. And you're gone. Boom!