Hi there. My name's Norman Beer. I'm the director of the Open Learning Initiative here at Carnegie Mellon. And I'm going to take a step back briefly from talking about open access to research and talk a little bit about open educational resources, or OER. Before I dive into this, how many of you have heard of the Open Learning Initiative? Fabulous. My work's done.  So maybe a quarter of you haven't. Let me give you a quick tour. I'm going to start off talking about OER or Open Educational Resources, the notion that we have educational assets that are out there and are available for use, licensed in such a way that other educators and students can access these materials for free and that they're able to reuse, revise, or remix them. So when I talk about the Open Learning Initiative at heart, what I'm talking about is a research project around the creation and improvement of open educational resources. When you talk about the OER community, generally, tracing back the history of it, folks will look at MIT's open courseware project as the place where this really got its start. OER purists don't believe this. If I were at an OER convention, I'd get beat up for saying so. But generally, in the popular imagination, the Yulet Foundation back in 2001 was looking for ways to promote better access to education. And one of the mechanisms they were trying to do to facilitate this, providing MIT with a few million dollars to take any resources that MIT was willing to put online and make publicly available. So this ended up being a collection of quizzes, lecture notes, slides, really anything that an individual faculty member at MIT was willing to stick on the web. This was heralded at the time of the popular press as something amazing, something transformational. MIT's gift to the world. So when I first got started here at CMU, I was unaware of the rivalry that existed between MIT and CMU. Standing in front of my first class actually mentioned some research out of MIT favorably. I got booed by my students. So I've since learned to put a little venom in my voice. So this is MIT's gift to the world. After this announcement in the press, representatives from the Yulet Foundation showed up here at Carnegie Mellon and said, hey, see this project that MIT is doing? Are you interested in doing something similar? And the answer they got was, no, MIT seems to have that covered. And we're actually not sure there's a lot of value in just sticking some random quizzes and things up there. Folks from Yulet said, oh, OK, and jumped in a car and went back to the airport. And that would have been the end of it, except that they happened to be visiting us on a certain Tuesday in September, back in 2001. And by the time they got to the airport, there were no planes flying anywhere. They were stuck coming back to Carnegie Mellon and hanging out with us for about four days and asking, all right, if the access thing is not interesting to you, what would be interesting? Well, access is fabulous. We feel that the dissemination of knowledge and learning is core to what Carnegie Mellon is and does. But we want it to be effective. And so this question of how do we take these materials and put them out there in a way that's effective is really important. And we'd like to do this in a way that's going to really leverage Carnegie Mellon's strengths. In this case, strengthen cognitive science, well known expertise both in technology and how human beings use that technology. And lastly, our strength in bringing together strange multidisciplinary teams, mashing them together and seeing what kind of good work they can do. So this was how the open learning initiative was born. The notion that we were going to attempt to build courses, online learning environments, leveraging learning science and current affordances of technology. Put them together using a research-based approach and see if we could actually build online courses that can enact instruction in that time for independent learners. So the hallmark of this approach really has been a research-based approach. It's this question of not just using our instincts of how students might learn, but rather using what we know about human understanding. Or as we develop out these courses, trying to answer questions about individual disciplines. What is it that's really hard for a student to learn about stoichiometry? What are some specifics in understanding cellular automata? And what are some methods that we can apply from the sciences to build out a course that might teach this? And then at the end of this, authentically evaluating it. Other hallmarks of this, team-based approach to design. An obsessive capturing of data, because we're doing this online. Every student learning opportunity, we are capturing data about how students interact. And at the end of this process, taking an authentic scientific approach to evaluating, was this effective, was our hypothesis about how students would learn correct? Or do we need to go back to the drawing board? What this produces is a set of courses that are open educational resources. And this open component is fairly important to us. Why open? First and foremost, the access agenda was important to our funders, and it continues to be important to the university. But you get something else with open that I think is often overlooked. In order to do real research and authentically advance our understanding of how human beings learn, one of the things that we need is more data. We need a bigger end. And by putting these materials out there openly and freely, you very pragmatically are able to get a larger data set, and you're able to more rapidly advance the work that you're doing. Now at this point, 12 years later, the open learning initiative has roughly 40 courses, been used by thousands of faculty members, millions of students. And all of these courses are openly licensed. In the OER world, that generally means creative commons licensing. And one of the major pieces of work that we do at OLI, beyond building and researching these courses, is actually provide education into creative commons licensing. It takes an awful lot of work to convince folks that, yes, you can retain some rights while still licensing them out to the world. In addition to the courses, we've also spent the past 12 years doing research into this work. And I think most of the speakers that were here before me have done a really nice job of talking about ways to provide open access into that research. Our work is available on our website. Our work is available on the university archive. And we continue to publish as possible in open access journals, although I can't claim that we do it exclusively. The last component has been all of the data that's come out of this work. We have over 65 data sets representing these 40 courses. And we continue to create new data sets each semester, which are published in the Pittsburgh Science of Learning Center's data shop tool. And so you've got this tremendous resource of a data set of student interactions that have been tagged with semantically useful, excuse me, which have been wrapped in semantically useful tags about what exactly we were trying to accomplish with this student interaction and what might have occurred as the student moved through the system. So all of these materials are openly available to researchers as well. This open access to data has actually been one of the more interesting things that we've worked on, in part because you've got some real challenges in how you initially structure your protocol to allow for longer term open access to researchers that wanna dive in when you're dealing with this much student data. So the Open Learning Initiative has a number of resources that are available to you. The courses themselves are available to you as educators, as students, and as researchers. The actual data that we've created is openly available to anyone that's interested in performing this research.  And lastly, because of the work that we've done, we're also available to provide guidance on creative commons licensing. If you've got questions or interested in how it might apply to your own work, please feel free to look me up. Lastly, I think this is a question of why, why are we doing all of this? And the fairly specific reason in the open education community is actually going to borrow, right now, one in seven human beings on the planet does not get enough food. So, if you were able to build a food machine, and the food machine was non-rivolous, and was not gonna do any harm to farmers, would you turn on the machine differently? Is there anyone that wouldn't turn on the food machine? Good.  We have a learning machine. And one of the things that's amazing about this learning machine is that the more that we use it, the more effective and more efficient it gets, because that's the joy of these resources when promoted in a research-based way. We live in a world where the demand for education, for effective education, is just completely outstrip the supply of it. And so I think to not make use of this machine, particularly when you're building these kinds of materials for your own students, is fairly criminal. That's it, thanks for your time.


The way that you feel mentally at certain points can push you to do certain things and that's what I'm discussing today. In the previous video I mentioned something relatively crazy that I did if you want to watch that please do but in this video I'm going to reference my level of steps per day every day for a four week period. So for the four weeks leading up to my second bodybuilding show of the year which I just did about two weeks ago I was so sick and tired of running like literally running jogging running sprinting whatever you may whatever you want to call it jogging running sprinting any form of running any form of activity that was that was that was faster in speed than six kilometers an hour I just wasn't into. So what I what I had to do to maintain my level of condition and my level of cardio was to obviously extend the sessions still still do the same amount of distance but just not the same amount of time.


From science to science fiction, wormholes seem to be a pretty interesting topic. After all, it's no wonder we see it everywhere from DC Comics to Star Trek. But within the last 30 years, interest in wormholes have tremendously increased, leaving us wondering how exactly do these odd pockets in space even work and will humans end up traveling through one eventually? Imagine walking down the street and coming across what seems to be a tear in space, a hole if you will.  That is what a wormhole is. Wormholes themselves are a paradox. Their anatomy is so simple, consisting of two mouths connected by a throat or tube, yet their function, connecting two different points in space-time, a rather complicated phenomena. Let's say here on Earth we wanted to find a route to GNZ-11, a roughly 14 billion year old galaxy which rests 32 billion light years from Earth, making it one of the most distant galaxies. A wormhole would basically be like a bridge or tunnel which would allow us to take a shortcut and save us the huge trip. So how exactly does passing through a wormhole work?  Before we progress any further, let's first take a look at what a white hole is. We all heard of a black hole, a hole in the fabric of space-time in which objects can enter but can't exit. Well now imagine a region of space where an object can exit but can't enter.  The inside or throat of the wormhole is stabilized by a sphere of exotic matter which you can learn about in my previous video. Anyways, the exotic matter pushes against the walls of the throat and thus keeps the wormhole from collapsing in on itself. So now that we know some of the features of a wormhole we can already begin to see some obvious flaws. Starting with the fact that since at one end of the wormhole there is a white hole and at the other end a black hole objects can only enter and go one way. So if we wanted to go back to Earth, we would have some trouble doing that but that problem doesn't seem so bad. After all, assuming that we have already become advanced enough to make one wormhole we could just make another wormhole with the black hole end at the destination and the white hole end near the Earth. However, don't forget that we have to open a black hole on or near our planet which comes with some pretty obvious risks. In addition, we're not even sure about the existence of negative energy which is a point I have made clear in previous videos. However, not all seems lost. For wormholes may exist just not at the size you expected.  It just looks like the normal calm empty space you're familiar with. However, if you could shrink down to a really tiny size and I'm talking tinier than an atom, its nucleus and the protons, neutrons, quarks and gluons you would see empty space in a whole new light. Instead of the everyday serenity you're used to you would see particles popping in and out of existence which we call virtual particles. However, it's not just the virtual particles you'll find among the chaos. Many scientists also believe you'd also find wormholes which constantly transition in and out of existence just like the virtual particles. Thanks to this idea, the system could be scalable allowing for objects like people to go through. However, our current technology doesn't allow us to explore the scales these subatomic wormholes supposedly exist on. So at the end of the day, while wormholes seem like an awesome way of travelling it just remains a dream of what will hopefully come in the future to us. Until then, we will have to keep on trying to find a way to make our dream a reality. I hope you really enjoyed this video and be sure to leave a like and subscribe if you're not. And stay tuned for more science videos to come up. Also feel free to help yourself to some free HD wallpapers I put up on my website. Link in the description below.


In today's video, we're opening Konami's newest 25th anniversary set, Battles of Legend. What's up, guys? We're back with another epic new Yu-Gi-Oh opening. We have Battles of Legend, Monsters Revenge, one that we have been anticipating highly. And the reason for that is there are 20 25th anniversary secretaries inside of this set. So far, the only 25th anniversary secretaries we've had in English have been the promos in the 25th anniversary legendary collection. So the difference here is obviously they're not promos, they're pulled in these booster boxes and we do not know the ratios at the time of recording this. It has been a long time since we haven't know the ratios of a product. Technically last year in Battles of Legend, we thought it was one every two cases, but it was really one every one case. So they did switch it up a little bit, but it was the same rarity. Now we have a new rarity and we don't even have any idea how many we're going to be pulling per case. The speculation out there is more of like a collector rare ratio. So it'll be in like three to four per case. That'd be like one every three boxes and one every four boxes, something like that. We're going to find out probably not in this video, but I will have more videos opening this set over the next couple of days. And we're going to figure out the ratios, then we're going to be doing a live stream searching for, I think the dark arm dragon 25th anniversary. Well, it's not spending any more time. We do have a giveaway. I'm giving away every card we pull in this video. Just like the video, be subscribed, turn on notifications, let me know down below what card do you like the most out of the set. There's a lot of 25th anniversaries to pick from still five that we don't know. So could be some other big cards we don't know yet, which is pretty exciting. All right. I'm not going to spend any more time chat. Well, I will chat, but I'm also going to get to the opening because I know there is a lot, you know, a lot to talk about today. This is a pretty big set. Battle's Legend usually does pretty well every single year. And then of course, with these 25th anniversary cards, it's going to be even bigger. I am excited, but I'm not going to lie. The 25th anniversary so far, they're a little bit weird.  Yeah. There's some new ones like the armed Nios is probably pretty cool. I haven't actually like, I don't remember what it looks like. Like Dante's getting one. I'm sure Farfus happy about that, but there's some random ones. And then of course, we're doing reprints on cards like Zeus and IP. You guys know how I feel about that. I'm not happy about that reprint. I just think it's a little bit lame. I think it's a little bit cheap. There are a lot of cards that could use a really cool rarity like this and we already have them in these other rarities. So there's no real reason to do another version. I just don't like it. So I'm not a huge fan of that happening, but that is something that's happening in this set. A lot of people are a couple of people have asked if I was going to search for the IP mask arena. I'm like, absolutely not. We've already pulled the real version. You know, it's not fake. I know I said, I know people got triggered when I kind of implied that that one time. I didn't really mean to say these were fake rarities, but it's just like the lower end version of IP. It's just kind of weird. It's not something that I would want to search for. And especially since we've had an epic moment, you know, pulling two in a case, there's not really much we can do to improve that at this point. So I'm more excited about the new ones. There's a Teller Knight, Tomeya set and actually need a reprint. It was an expensive ultra out of Duelist Alliance. So it is going to be the third card, it seems like. So we're just going to go with that. So two from the back is what we will do. I don't know, as I said, don't know the ratios. I'm more excited, as I said, for like the new ones. Oh, we got a punk secret rare. So it's Ultras and secret res in here and then 25th anniversary cards. So I'm really excited about the data. I think the dad school, it got a go-sure recently, but it's the new go-sure. So it's a little bit iffy on if it looks that awesome. You know what I mean? I think this might actually be a better rarity. We'll just have to see it. Ooh, a secret rare Dark Hole. That's beautiful. Dark Hole getting a reprint. I guess, is that being used? I don't know why that got a reprint. It's kind of weird. I think there's a lot of good Edison cards in here as well, just in time for the big Edison tournament at Nationals, which is really cool. Final cross, we have the punk rising and a nightmare corruptor. He played. This is a really annoying card and it also needed a reprint from flood. So that's good. I think it was like 20 bucks from flood or something. Maybe it might have been 15. I don't know, but it's still pretty expensive out of there. And that's a really old set. It's like five or six years old. Maybe. Yeah. Yeah. Getting close to six. Not quite there yet. We have a, what is this? The classic Karibo? He's classical. All right. Very cool. And then the golden rule. All right. What is the golden rule? Do one to others.  There we go. We got a Yu-Gi-Oh card for it. Very cool. Very, very cool. All right. Do from the back. What else are we going to get? We got a Lamia. Very awesome. We got an Aratama. A lot of short names here, which is good for me. We have the punk Xiamen. That's good. The punk stuff probably needs a reprint. The Xto Hydra. What is this? Is this from the fourth season? I feel like it looks like the cards from the darts era. You know what I mean? But I feel like we already printed those maybe. Maybe the reprints. I feel like that's a new card though. Promotion. All right. The pawn just became a queen. Very nice. We got Baby Spider. We have a Ghost Sleeper. The Underworld Princess. Praying Mantis. And the Day Arantanth. The Ooze Giant. All right. Day Arantanth. That is a long name right there. Two from the back. We have number 72. We have Don't Slip. The Dogs of War.  We have Danelle. And a Danger Nessie. Secret Rare. All right. That's pretty cool. Nessie is a nice card. All right. Danger Nessie action there. All right. That's a good pull. Two from the back. There's also a card called Duality. Just Duality. Not Pot of Duality. Just Duality. We have Roshamon. We have Ghost Wyvern. And there it is. 25th Anniversary Rare. Number 92. Heart Earth Dragon. Hey. This thing actually got a reprint. Finally. It's the first reprint since its original set. I think it's Cosmo Blazer, right? I don't know if this one was on the list. Do we just find one that has not been seen yet? It's not on TCGplayer at the moment. There we go. We have revealed a secret 25th Anniversary card. Now I'm totally okay with this card having a 25th Anniversary. That's super sick. Number 92. Heart Earth Dragon. And guess what guys? You can win it. All right. All right. What a pull. Honestly, the Packard is pretty cool on here. That's the guy of the, whatever his name is. Not the Dragon Champion, but there's been a lot since then. Wait. Is that Dark Magician? Wait. Is that Dark Magician? Wait. He is. Wait. He is the, oh, Junk Archer. That's a good reprint. Dark Magician and one big Sky... No. Gaia. Yeah. That's different. All right. Sick 25th Anniversary Pull in our first video. Already starting off hot. We have Puppet Rock. I'm guessing they're not one in two cases if we just pulled one, but maybe we're just getting crazy lucky. Dracover, Zerker, and the Tinny. That's a good card to have a reprint in Secret Rare. This is such a good set because it gives a nice ultra and secret rare reprints for upgrades and decks and stuff. Ghosts. And then when you get the 25th anniversary, there's a dad. He comes in 25th as well. We got the courageous Crimson Chavalier. All right. Very cool. What else can we get? Can we get another 25th anniversary? Here we go. We have the Ghost Lancer. We have Don't Slip. The punk. The Volcanic Shell. That has a 25th anniversary, by the way, I believe. I think somebody said that. Let's see. That might not be on the list either. So maybe some of them have been revealed then on their Foxy Tomb. Good Secret Rare. I think the Volcanic Shell is a 25th, which is a little bit weird. I'm not going to lie. I know you Volcanic fans are happy, but that is a weird decision. We have Performapal. I feel like there need to be more, like, really cool ones. You know what I mean? Mysterious Dragon Clown. Crown, not clown. Like, I feel like we should be having some classic, you know, cards. Really, the only classic card is Dad. And that card's playable. So I guess Battles of Legend is more of a playable set usually. So it kind of makes sense to have more of those playable cards getting those hierarchies. Rocket Coder. But I was expecting, like, with 20, there to be, like, at least five really, like, old-school cards, you know what I mean? And there doesn't seem to be really any, like, at all. Like, old-school, old-school. There's, like, none. Very weird. Terraforming, technically, an old-school card, but it's still used to this day. So Dante, there you go, Fartha. So I guess that's the, you know, that's not really an old-school because people are using Terraforming all the way till now, but it is a Ferranic Guardian card. Herald of the Pure Light, which is cool. All right. Looking good. A lot of great pulls so far. I mean, this seems like a pretty solid set overall. Very, very solid. I'm wondering how many packs I'm going to need to open to get, like, a dad. I'm going to have to do the math, you know, with, like, 20 different ones. Shadow's Light. So, like, if it is, like, one in every, let's say it's a collector or ratio, so you get four per case, I would need to open, like, five cases to get the one. No, is that right? Four times 20 is 65, times 15 is 75. Okay, maybe not that. Maybe it's four. Four or five. IP Masquerain. I get in a secret rare reprint. All right. It's original prints of secrets. So they're reprinting the secret rare and the Starlight Rare. Very interesting how that works. Okay. Let me know your opinion of that down below. I know a lot of you guys are okay with the reprints, but I personally am not happy with it. Kara got an Ultra. That's good for Sprite. And this guy's record, that's awesome. Yeah, just let me know down below. It's okay to, it's okay if you're happy with it. It's okay if you're not. Everyone's allowed to have an opinion about what you think about the reprints. Personally, you guys know mine, but it is okay if you don't agree with me. That's totally fine. We have RGB Rainbow Lution. It's really in the reality. It's going to be fine.  Nobody was opening that anyway. But now you're definitely not going to open it, you know, but not like anybody was opening it that much. Besides me, of course, I was opening it. We have a Madolche Queen Tiramisu. Is that the first reprints? Has the Ulti and stuff from a, what is it? A Return of the Duelist, I think? That might be the first reprint. That's crazy actually. That card was very expensive in Return of the Duelist. So that's probably why that has a reprint now. Puppet Pawn. Okay. We got Mathemec Equation. Mathemec's getting a few. After they destroyed Circular, put it to one. We have a Ptolemaeus. I think it's still probably a pretty good deck, but Circular is down to one. Okay. Two packs or two cards from the back. We have additional mirror level seven. All right. We got Photon Vanisher, Thunder Discharge, Sprite Smashers. They're reprinting like the entire Sprite deck, which is pretty cool. Iblei, very cool. Maybe I'll actually get my Sprite deck together now, because I sold all my, you know, blues and stuff right away. I think I have one Ulti that I can't know. I'm going to sold that too. I kept it for a while and I was like, I'm never going to play this, but now we're getting the reprints. So maybe I will. Link Decoder. Not that I ever really play that much anyway. Try Edge Master, but I always want to put together decks and then never use them. That's what happens. Probably into the second box by now, right? Okay, let's do this. We have Macro Cosmos, Dimensional Fissure. Man, those are some annoying cards getting reprinted, protection of the elements, and Book of Eclipse. Still five. No, I was going to say still five cards left. There's a lot more than five cards. Five cards per pack is what I was looking at. That just made me say that we have the Volcanic Shell and a Danger Nessie. That's another good pull. You guys can win a 25th anniversary today. That's pretty sick. That Hardware Dragon looks nice. I'm not going to lie. We have the Guard. Also, it didn't like pop up on the sides like Starlight's do. I didn't notice it right till we pulled it. Okay, we will be able to do some Mega Packs in the live stream, not that I'm thinking about this, because we can just do the third card. And so we might have some cool Mega Packs on the live stream coming this Saturday. That should be pretty fun. I know you guys like those. We have the Sprite Smashers and a Terraforming Secret Rare. It's a nice printing of that. Did I feel like I had a legendary question, Kyva Secret, right? So it might be the second Secret Rare of that card. We have the Sakatama. We have Xiamen. We have DDD. DDD. DDD. Duality. This is actually one of the best cards. It's like 30 bucks right now. I mean, it's pre-orders. Got to remind you guys, of course, when you're seeing this, it's a couple of days before it's live on TCG Player for any seller. So these prices are going to be a little bit high for most stuff. They're not going to be what you're going to be paying in a couple of days. Most likely, sometimes they do go up. Welcome, Labyrinth! Already got a Secret Rare. Did they just print that card? Oh wait, that's the one from Tactical Masters, right? So I guess how long has it been since Tactical Masters? I guess that was last year at this point, so that makes sense. It wasn't a big welcome, Labyrinth. That was the new one. We have Punk and Synchro Zump. Cool. So a few packs left. Can we go two for two and get to 25th anniversary? We have the Aratama. We have Ghost Lancer, Ghost Sleeper. We have Prang Mantis and Sky Striker Mobilize Engage. A lot of good cards being reprinted in here, guys. Hopefully you guys are excited for this new set. I'm certainly excited because it seems like there will be a lot of high rarity pulls or cards pulled, which is always exciting. Shadow's Light Secret Rare. Here we go. Where we get more? Will it be epic? We have Spiral Quick Fix. We have Don't Slip the Dog. We have Oran Bull Nose. We have Danelle and the Dracover Zerk or the Tinny. Yeah, and on these, there's a lot of reprint secrets when you open a couple of boxes because there's not a ton of cards in these kind of sets. They're more of like a, you're going to get a lot of the same cards. We have RGB Rainbow Lucian. I feel like we've pulled doubles of every secret rare so far, except Duality, which is probably short printed if we had to guess because that's what they usually do with the best secrets, which is unfortunate. Might as well make a different rarity, in my opinion. Dark Umdragon and Amidulcian Kiwiin. All right, we got it. All right, one zoom. We have Catty Corn. Numbers Last Hope. The Punk. Link Decoder. And a Daedorant. Daedorant. The Ooze Giant. Few packs left in this opening. We've already had an amazing pull. It's been epic. Our new openings recently have been crazy. Like the first two boxes we usually open have been like really good. Protector of the Elements and a Photon Jumper. I don't know if we pulled that secret rare yet. So a new card right there, maybe? Cool. 25th. Let me know down below. What is your favorite 25th anniversary product so far? Foxy Tomb. We've had a few different ones. All right. Do you prefer the legendary collection this? Do we have one more? What was the other 25th anniversary? Why can't I remember it now? Dimension Fissure. Maybe? Well, this is the first main set with one. There's another Iblei. Iblei is not short printed, it seems like. So that's good, I guess. I mean, we don't really want people playing that card because it's annoying, but Numbers Last Hope. We got number 65 to Gen Buster. Oh, there we go. This is the card. Dark Magician the Night of Dragon Magic. I didn't know this was in this set. So this is a new Dark Magician and not quite Curse of Dragon. It's a level 7 or higher dragon or warrior monster. Wait, why? Why can't it be a warrior too? That's kind of weird. So somehow a warrior and a Dark Magician make this dragon out of nowhere. That is interesting. Does that have a 25th? Because if that has a 25th, that's what I'm going for. Sorry, dad. You're not getting the search if that thing has a 25th anniversary, which this thing better have a 25th anniversary. If it doesn't, I'm calling out Konami. I'm very angry at you, Konami. You've got to make that thing a 25th anniversary. And according to CCG player right now, it is not showing, but it also didn't show the one we pulled. So maybe it does. We're going to have to find out. One, two from the back. We have Spyro Quick Fix, Black Wing, another Spyder. We got Sprite Carrot and a Dark Hole Secret Rare. Four packs left in this opening. Hopefully you guys have enjoyed it. If you had, have, haven't had. Make sure to subscribe to the channel for more epic content like this, more new openings, more old openings, more epicness, more awesomeness, more amazing pulls. And hopefully it will be that Dark Magician thing, that confused little warrior and make a dragon out of nowhere. Baby Spyder, we have Math Mech, we have a Sage of Wisdom and Dante. Farva is going to be real happy. We've got to place that. What will we pull? Two from the back. It is a Macro Cosmos, Satellar Knight, Final Cross, the Punk Rising Carp, Terraforming again, and the final pack of the new opening. Here we go. We've got more coming in the next couple of days. So keep an eye out on my channel. Hit that bell if you guys want to be notified when I post my videos, 12 o'clock every day. Basically, if you don't want to, you know, worry about it. Ghost Fusion and an Assault Synchron. I don't think we pulled that one. So that is a new card in the last pack. That was a fun set. Shout out to the Homeflow Show, Daxer, JT Show, Puffins of Doom, Ernesto Dina, Missycle, America Doyster, Supreme Stage 21, another Thai show, Ian Musa, Junior Barting and Mimic Echo. Thank you guys for supporting the channel and I'll see you guys in the next one. Peace.


What are day-to-day operations like in a research lab? There's so much diversity in the kinds of things that people do, I just want to focus on a few commonalities. First commonality, the lab notebook. Everybody is supposed to have one, and document exactly what they are doing in each experiment. In the lab notebook, you'll see careful notes and tables, cut and pasted Kodak photos of gels, auto radiography film, and printed out reports from instruments. Most postdocs will have an entire shelf filled with lab notebooks, and they will show the signs of constant wear. Second commonality, the meetings. An astounding number of meetings are always going on. Departmental meetings, lab meetings, journal clubs, human resources meetings, phone conferences with collaborators, academic meetings, focus groups, training sessions on new equipment, invited speakers on scientific topics, students defending their dissertations, and my least favorite, institutional review board meetings for animal and human subject research. Sometimes a researcher has to pick and choose which ones to skip. Third commonality, the computer and email work. Even if you have no teaching responsibilities, you will still be responding to emails from collaborators and colleagues. If you're in a writing position, you'll spend a lot of time with documents and PowerPoints. You'll need to write condensed versions of the work you've been doing for various purposes. Everyone needs a computer in the lab, in some cases even to do their research. Fourth, math. That's right, research biologists do a surprising amount of algebra, arithmetic, calculus, and most especially statistics, and at every level. I won't get into all the applications, but significance tests are the bread and butter of most research. Students' t-test and ANOVA's, no kidding. What about the culture of a lab? As I've already mentioned, the lab is filled with young people, often from all parts of the world, which you really notice if you stop by the lunch room around noon. Other than the US, researchers are often from China, India, Southeast Asia, Europe, Africa, and Australia. Some have very colorful backgrounds, some are loud and outgoing, some are quiet and intellectual. There's sometimes a class of cultures. As you might expect, there are the jerks and the angels, as in any other workplace. One of the features of bench research in an academic environment is the occasional downtime. Many steps in biological analysis require incubations or run times over an hour. Some people take advantage of this to use their time efficiently, and some use it to goof off. On the other hand, some labs are occupied from 7 a.m. to 7 p.m. by the same postdocs. One of the other features of research are the odd hours. If an incubation is 12 hours, you may be back at midnight to check on it. I've been in the lab on Christmas and Thanksgiving, feeding cell lines or cleaning mouse cages. What are the perks of research? How about seeing your name in a journal at a university library? What about seeing other well-respected scientists citing your work? It feels good to get that level of recognition from your peers. One of the other perks are scientific conferences, a chance for scientists to get together and swap ideas. Grad students are sent with large posters presenting their work thus far, and they stand next to their posters answering questions during poster sessions. After hours, a large crowd of overeducated scientists hit the town. These kinds of experiences lead to a sense of community in the academic research world. Another perk is the constant mental challenge. This is one job where you don't get paid to be mindless. Your ability to think critically will be used every day. The sharpened your thinking to a razor's edge. Research can give you a rush you won't find in most other jobs. It's the pure thrill of discovery, of being the only person in the world who has the understanding that you do. It takes a long time for the first payoff, but once you get your eureka moment, it's hard to think about any other career. No one goes into it for the money. They do it for the joy of learning, teaching, and discovering. There's also a wonderful sense of being part of something important, vital to our continued existence as a culture, something noble and immortal, the human quest for knowledge about the natural world. The practical advantages are rewarding too. I've worked in cancer centers where the lab was situated in a patient area. It's very motivating to think that the research you're doing can someday benefit those affected by cancer. Research saves lives. It can make them better too. The discoveries in science lead to direct benefits to every area of our lives. So take a moment today to give some thanks to the researcher. And if the idea of lots of work for little pay, 10 plus years getting degrees, and the rush of discovery is exciting to you, perhaps you might be destined for research too. May God have mercy on your soul. Thanks for watching.


From Hollywood, it's time now for Johnny dollar Doris Cole's room, mr. Alter. That's what you got We were simply discussing two headaches in the value of aspirin want to speak to her headaches like that. Oh, everything's fine I like to speak to you though. Sorry. It's late. I have a long day tomorrow. I'm afraid it's important Good night. Are you thinking of arresting me mr. Dollar? I'm not a policeman Miss Cole You act like one answering my phone sneaking into my room while I'm gone That evens the score then you had a quick look through mine earlier in the day. Mr. Dollar. Just what were you looking for miss Cole? And every week day night Bob Bailey in the transcribed adventures of the man with the action-packed expense account America's fabulous freelance insurance investigator yours truly Johnny dollar From special investigator Johnny dollar location Caracas, Venezuela to the home office worldwide mutual insurance company Hartford, Connecticut Assignment the Alder matter Expense account continued Back in my own room after saying good night to a sullen Doris Cole I didn't feel the slightest qualms about having invaded her room and lying about the reason for it Why should I? The people in the older house didn't seem too concerned with the truth In fact, the whole case seemed to be a question of why or saying nothing consider Billy Alder had been shot at indicating he had a good reason to change beneficiaries five times in a month and Still he was the original say-nothing fella Keep me alive was all I could get out of him His wife had lied his daughter had lied and Doris Cole an old friend of the family had just proved to be a walking lie The passport I found in her room had her photograph all right, but it said she was Dora Janssen An unsigned letter in the same drawer had stated simply that the Caribbean star would dock tomorrow I got into bed and another thought hit me if the Caribbean star didn't dock Would the steamship company have joined the liars Club to Expense account out of seven ten cents one newspaper bought on the lagara docks early next morning My Spanish is pretty nothing, but I could read the important thing that the Caribbean star was due at noon What time to kill I drove into Billy Alder's office in Caracas He hit the ceiling when I told him about Doris Cole's passport. I was suddenly glad I'd mentioned nothing about the letter Dollar, how dare you search the room of a guest in my house?  What mine was searched thoroughly That still isn't any reason for your behavior. Oh one way ethics, mr.  There's only one reason.  I have a very busy who is Dora Jansen mr. Alder and why does she call herself Doris Cole? You're making too much of nothing dollar. It isn't a crime to use another name that depends on the reason doesn't it? She's No friend. Oh, who was it dollar. Aren't you tired of that tune for a man who's afraid for his life You've got more old friends than anyone I ever knew Also, I haven't noticed anything particularly friendly between you as she's she's not a well woman dollar I don't want you bothering. You don't want me bothering anyone exactly even the one who fired that shot at you So I can't help getting an impression that you have a pretty good idea of who it might have been I told you I was busy dollar. Yeah, but it's what you haven't told me. I keep thinking about dollar did You find anything else in that room beside the passport why mr. Alder what's happened to your sense of ethics? There's still plenty of time before the Caribbean star would be docking and Billy Alder's reaction had dictated my next move The cable office in Marguerra suddenly seemed like a very important place to visit There were too many silent mouths in Caracas, and I needed one that had something to say Okay miss you take this now see senior how you like this to go don't spare the horses. Okay cable rush see Victor Kelly world No, my lousy handwriting here To Victor Kelly worldwide mutual Hartford, Connecticut USA see want all possible information Dora Janssen a.k.a. Doris Cole u.s. Passport 1 9 B 6 7 9 4 3 dash 1 1 sign dollar and your address for the answer I'll pick it up here as you wish and lady, please and no senior don't spare the horses It was still early when I reached the waterfront where the Caribbean star would soon be docking There wasn't much point of watching the incoming passengers. I didn't even know who I was looking for So I found a spot at the peer entrance where I could concentrate on those meeting the passengers Here I made a grudging concession to all movie detectives item 7 another 10 cents another newspaper to hide behind And you know some it works fine Doris Cole According to that passport Dora Janssen was nervous excited And there was no trouble to stay close behind her as she met a passenger a short nondescript man in his late 50s When they jumped into a cab and hurried away from the pier They were closely followed by a man clutching an unread newspaper me The trip was a short one about six or seven blocks away the cabin front pulled up at a cheap hotel on the waterfront I circle the block once got rid of my cab and wandered into the dismal lobby The fan sleepy clerk made a concession you open when I See you look for something. Yeah, that gentleman who just came in I had an appointment with him Yeah, oh darn it.  You know the gentleman who just went up to room Yeah, yeah, you want me to say the number now When you think I ever been to a movie don't really you can save me a lot of embarrassment You've got it right there on the register. Yeah, mind if I have a look. I'm mine Look friend. When was the last time you got anything for free? friend, oh Why didn't you say so I was trying not to offend you here. Yeah, let me see You play black jacks and you know how you color 21 yeah, why? Like they say hit me again. Oh, you're rubbing and then see you want to do business or no Adam 910 bucks market smear schmooze are just playing grafts He pointed an oversized forefinger at a name on the ledger lost interest in me went back to sleep I'm the singer. It said roommates. I went up the stairway a few seconds later I moved as quietly as I could down the Grammy second for a hallway stopped at the door at number eight At first I heard nothing Then after a long minute the voices began angrily as though resuming an old argument Five minutes later, I was back in the cable office getting a second message off to Vic Kelly and Heifert It was a request for anything he could possibly dig up on Arthur Singer I didn't hope for too much because it would probably turn out to be an alias, but it was an angle I couldn't afford to overlook You're not back for answers so soon senior. Oh, no, I just want you to get this one off same fellow and same way No spare the horses. That's it. That's nice. It's not a Senior I want to ask you something shoot your business partner did I do something to displease him? He seems so angry my who seems so what? Well, he was so nice at first But after he read the man hold everything First of all, I have no business partner. Oh And I make terrible mistake just tell me what happened well this man He come in less than a minute after you leave was very nice So he was your business partner that he just leave you you will worry because you Forgot whether you say something in the message you just send then you ask him to check it for you He seemed to know what he was so you showed a job then That is when he got so angry. He just put it down and leave. What did he look like? A little less tall in you and he have gray hair eyeglasses see I guess See senior, please so you know him. I'm beginning to wonder if anyone really does. I am so sorry for my mistakes Oh forget it wasn't your fault. Just send that second message. See you about the answers Send her to me at William Alder's house as soon as you get him Maybe we'll read them together Sure Billy Alder was my new business partner Alder the original close mouth thought But it looked like there was nothing wrong with his brain or his eyesight Then suddenly I didn't mind that he'd read my message to Vic Kelly because a frightened man usually reacts at the extreme ends of the scale He'd been at the let's do nothing and maybe he'd now go the other way There was one more step I could make in the water front so I made it My credentials presented at the steamship offices got me a look at the passenger list at the Caribbean Star The name Arthur singer wasn't on it. I Started down the small waterfront street to where my car was parked My mind was full of Billy Alder and the pieces of this crazy puzzle tugging one way pulling another Trying to make sense out of it somehow use some sort of slide rule where logic could be a solid base No matter how I twisted it and I knew one thing it just wouldn't work. I didn't have enough yet to make it work I was just reaching for the door handle when I saw his reflection in the car window the man who'd sneaked up behind me blackjack raised high in the air The blackjack was just insurance. He was tough enough with us I finally worked up to the side of the car manage it a half Nelson and let the car door workers my blackjack Five seconds later an officer came rushing up in five minutes later. I sat in the office of hefe Velazquez chief of police You're feeling all right now amigo. Yeah, sure What did you get out of that blackjack artist? Just what I expected still won't say who hired him Understand this kind of fellow amigo. I do what I mean. He's Assassin of a Kenya, you know cheap hood For extra two boulevard, maybe three he would blackjack his mother He claims he does not know who hired him that he is to get his money in a letter That one I was spats. Okay.  This kind does amigo Otherwise, he would never be hired again. I'd I'd give a lot for a few minutes alone with him. Have a sorry Juanito But I like my job. Yeah, just wishful thinking not hard to understand.  I got an awfully big yander talk to that dog You know I got a hunch It's like I say if you ask him on a Monday, what is the day he must tell you Tuesday? You could beat him to death. He will still say Tuesday is the weather thing If a favor if I can't suppose I don't prefer charges Would you put a tail on him when he leaves Johnny look? I know it's a million to one against the hood doing a rough up without the money in hand But if he hasn't collected come on you go like you say million to one I know I'm grabbing at straws, but just in case if a come on, huh? Okay, thanks. Hey, what do you go back to the cable office? Oh, yeah And if a man in Harford has nothing to say I've got a permanent seat behind the eight ball Now here's our star to tell you about the final episode of this week's story tomorrow a puzzle never fits itself together You've got a snoop pry and juggle the pieces and sometimes people get killed that way Join us. Won't you yours truly Johnny dolly? Truly Johnny dolly starring Bob Bailey is transcribed in Hollywood written by Tony Barrett It is produced and directed by Jack John stone Be sure to join us tomorrow night same time and station for the next exciting episode of yours truly Johnny dollar Roy Rowan speaking


Police in Perry, Iowa, say multiple people were shot at the city's high school Thursday, early on students' first day back in classes after their annual winter Breakpoint 2 gunshot victims were taken by ambulance to Iowa Methodist Medical Center in the state capital of Des Moines, about 40 miles southeast of Perry, a community of about 8,000 people. Dallas County Sheriff Adam Infante said the shooting occurred before school was set to start, so there were few students and faculty in Perry High. School, the suspect in the shooting has died of what investigators believe is a self-inflicted gunshot wound, a law enforcement official told the Associated Press. The official was not authorized to publicly discuss details of the investigation and spoke to the AP on condition of anonymity, the shooting occurred in the backdrop of the Iowa caucuses and not far from where Republican presidential candidates were campaigning.


All right, I am really excited to introduce Alexandre again. He spoke in my track last year and did a bang up job. Last year it was his first time speaking at any kind of big conference at all. Since then he's gone on quite the world tour. He went to China, he went to hack in the box. He spoke in Europe and now he's back here to speak again. Let's give Alexandre a big round of applause. Have a good time, my friend. Thank you so much. Yeah. Hello, guys. Good afternoon. Let's talk about .NET Mob Reversing. It's a pretty easy talk. I think so. I'm a secret research. Here is our agenda about my presentation. Here you have my last presentations on confidence to death from China. Hack in the box, I'm Mr. Dan. In death com last year, I recommend you take some time to read it. In the last line, you'll see my tool, my personal 3-H tool. Mobile tool. If you have some free time, you can test it. Let's start. There are lots of people here. Honestly, once again, I was expecting 10 or 12 people. Because most malware analysts don't like .NET malware. Basically, malware analysts, while analyzing .NET malware, are concerned to unpack a binary from memory or find the encryption routine in a .NET malware or even to the equipped resources embedded in this kind of malware. But according to my experience, .NET malware can be so challenging because sometimes advanced authors, advanced malware authors try to modify the .NET malware, the application directly in the intermediate language. And I've been checking and analyzing some mirrors in .NET, which try to attack the .NET runtime. So it's recommended to learn a bit more on intermediate language and some information about metadata in .NET runtime. Most of the time, we find .NET malware around the world. And we have basically a native code, sorry, .NET managed code, load a native code on the memory. This is the common scenario. But sometimes things can be worse. Sometimes things can be a bit more complicated. You see, this is a real case that I faced some month ago. The suspect received an email, click on the link, drop a first dropper, this dropper fed a first payload on the Internet. This payload is composed by two pieces. One piece is a native code. The other piece is an encrypted managed code. This first piece in native language, in native code, is injected into another process, in a remote process. Once this code is injected, this code load the first managed code, the equipped load, this managed code fed a second stage from the Internet. The second stage is the real payload and the infection starts. So things can be harder than usual case. And I try to show it in pictures here. I don't need to show it again how to make injections. Injection is so easy. I try to show it here in these slides. These slides are kind of refresh about injections. I won't explain it because it's pretty easy. But as I mentioned, things can be different. For example, I told you that usually I have a managed code loading a native code into the memory. But sometimes, sometimes things are the inverse. I have a native code loading a managed code into the memory. In this case, for example, I use the CLR create instance to get an interface named ICLR method host. From this interface, I use the get runtime to get another interface named ICLR runtime info. From this interface, I use a new method named get interface to load the runtime. Afterwards, I use the execute application to activate the domain. I start the runtime using the start method. And finally, I use the executing the full application domain to start the real application, the real infection, the real payloads. As you know, a .NET framework is composed by a runtime, CLR, and some libraries. More authors can write memories using different languages such as C-sharp, F-sharp, VB.NET, and so on. Basically, these sorts of codes are compiled into a common language infrastructure and finally run by the CLR. We have several excellent tools to analyze .NET networks. I try to list some of them here. I use them daily in my daily job. Personally, I also use some additional tools that I try to show you here in red. These are great tools to analyze .NET networks and reverse some of them. And of course, you must know that most .NET networks use some kind of packers or crypters. So I try to show you some of them here and pay attention that the last one, VM Protect 3.40 was released, I believe, one or two weeks ago and now it includes .NET obfuscation. When you are working with .NET malware, you must try to remember that most of them are using obfuscators and obfuscators can. Obfuscating the control flow, these obfuscator try to rename methods, attributes, classes, and so on. Some of them encode all of the strings, of course, try to encode and obfuscate the cross-reference. It's so complicated to analyze this kind of code while you're using any kind of obfuscators. So it's very important that you know about that. When I'm analyzing .NET malware, usually I see the same functions loaded, they payload. In this case, I try to show it in green here. Assembled.load, Assembled.load file, and method.info.invoke is almost, almost, almost the same thing. Most times we see a kind of reflection approach and when you see a reflection approach, you will see a sequence similar to that. I'm using load or load file, followed by get type, get method, and invoke the method. Reflections is so used during .NET malware, so it's a very common approach. Another approach, another possible approach, is using get assembly name plus get type, get method, invoke again. As most malware have been using resources, or these .NET malware try to hide some data or payload into resources. You see sequences like this running pink, find resources, size of resources, and so on. Sometimes you see other sequences like this one in orange when malicious .NET assembly is trying to load some external DLL. All of these approach are based on trying to load something in runtime to evade your static analysis. Here I'm showing you a first very basic malware. I open in dnspy. We have the entry point there in green. I click on the entry point. I find a class named the Parable Buffer Cache Event Source. Inside this class, I see the main function and at the bottom, I see our potential malicious function named target invocation exception. Following this function, I see that this very special function is trying to load an assembly. This function are using a URL to load this assembly, but in this case the web link comes from several attributes. For example, I took one, the first one, and I checked that this attribute is being set by garing a new assembly using get execute assembly here at bottom. This function is trying to read a resource. This resource is encrypted. When you decrypt the resource, you see P is executable. Each of these variables are related to a resource that represents a possible or potential malicious native code. Here I'm showing the same code, but using intermediate language as it's similar. You see the main function, the endpoint. You see at right, our function, our malicious function. We have a token. A token is that number zero six. This token works a kind of index inside a metadata table named member reference table there. And when I try to follow it, I find our function here at bottom and more details are expanded. As you see, implementation flags are IL, intermediate language, and manage because I'm handling a managed code. This is a manifest. A manifest in this case is a file that wrap up everything. In this case, you can see the assembly name. You can see several managed resources related to embedded resources at bottom. You can see further information about this malware. As I mentioned before, this point, this malware is using reflection to load malicious contents at runtime. So you can see here several calls to get execute assembly methods in several points in this intermediate language code. Sometimes you are facing bit harder .NET malware in this malware brings some encrypted resources so you can use the NSPy or other to drop these resources, decrypted, and using reflexes. Reflex is a kind of plugin. You can add the original code and load the resource, the equipped resource to analyze the malware. In this case, you must remove the old references because the old references are reference, the equipped resource. So in this case, you drop the resource, decrypted, delete the original .NET malware, load it again, and that's it. You can analyze your .NET malware using this technique. Of course, it's always recommended to know a bit more intermediate language and, of course, metadata. I think that about 90% of case .NET malware or .NET malware authors trying to insert some malicious code in our initializers or finalizers. In this case, for example, usually I try to check every class constructor to find our unpacker, or the quipter, or any kind of hooking code. It's very usual, for example, in the last few weeks, I've been seeing several .NET malware trying to compromise the jit. In this case, these special malware, these special advanced malware, trying to hook this function, sorry, compile methods to compromise the jit. In this case, when the jit generates the native code, these special malware can hide or encrypt user code in runtime. For example, in this case, I try to see the class constructor. There, usually, I find some hooking code. These hooking codes try to compromise the compile methods, and by using this trick, the malware can hide or encrypt the user code. It's a very clever technique. There are other .NET details here. Most .NET malwares bring some very important metadata. So, metadata basically are information about classes, attributes, members. Usually, you will get very valuable information from metadata. A .NET application, as you see, is composed by a managed executable and a managed code. It's not so hard to analyze this kind of code, but you need to have some guidelines to do that. For example, a managed code is composed by a IP header, of course, CLR header, metadata, and intermediate language. In this case, I have the compiler here. I have the managed models. I have the resource files that are compiled to a final version composed by a manifest, a managed models, and a resource file. In using pictures, you see that a .NET header is composed by P header, CLR header, CLR data, and native code. And at the right side, you can see the same picture put in a detailed view. Metadata is very important because there I can find very valuable things and information. Metadata in this case is composed by definition tables, reference tables, and manifest table. There are several tables inside of these classes. And you should remember that all the .NET malware infection tried to use one of these tricks, or code manipulation inside the class constructor, or FAP analyzer, tried to load some, a method in function, a function, or use a component. So the tricks are the same, always the same. Here is a second case, a bit more complicated case. This is a real .NET malware. I'm showing here the intermediate language and the metadata information. As you see, you see the name, type the reference table. You see the method name in this case men and the flags. In this case, I'm using the iodesk to show this screen. As you see, the real managed code is so small, less than 5%. Metadata is so important because, as I told you, describe some information about members, attributes, properties, classes, and so on. This metadata is organized by using a kind of relational database. And it's so interesting because you see, I have a table. One, two, three, four, five slots. Each slot is dedicated to a class. Each slot tells me which methods belong to this class. At right. These metadata are organized in name streams and classified in metadata heaps and metadata tables. Metadata heaps is so easy because there are only concern is about strings. So a string heap is more important for us. And inside these six name streams, we have hash US is related to user strings and hash dash is a kind of uncompressed metadata stream. I believe that these two ones are the most important. When I talk about metadata table, we have several tables which is almost impossible to remember every table. You see, I list all the tables here. And since here works using a token. A token is a kind of structure composed by four bytes. The first byte determines the table. The remaining three bytes tell us the role inside this table. Here I show some statistic information about metadata. And at bottom, I show some user strings that I commented about the name of strings. Intermediate language in .NET is a kind of ASME language based on stack. So you see instructions. Load something onto stack or pop something from stack. You see a very usual application or two named NGIN. NGIN is executable to compile intermediate language code into a native code. It's so easy to do that. But the last three years I've seen several hours trying to attack the .NET framework. In this case these kind of infections are a bit more complicated. We have several kinds of .NET measures. But assemblies are classified in private assemblies and shared assemblies of course. You should remember that most malware samples try to hide some malicious content and resources. Hide by encrypting or obfuscate something. Some .NET malware tries to download an external assembly from somewhere. And other .NET malware are based on multi-file assemblies. In this case it's a bit more complicated because these authors try to compose the .NET assembly and split over multiple files to evade the defenses. It's so easy to generate a multi-file .NET malware. For example I show you here how easy it is. I compile for example a hooking.cs model. I compile an injection.cs and using a main program named defcon.cs I generate a library named malwarelib here. It's so easy to do that. Of course this operation does several metadata tables but it's normal. We have a real manifest about our second malware. You see some .NET models being loaded at bottom. Some external reference to assemblies. In this case our assembly is a strong assembly because it is signed by a private key from somewhere. The second screen here you see the driver the assembly name. You see several custom attributes. You see that the signature is using SAG SAJ1 you see several managed resources being used and at bottom you see that the real name of this malware is Mikrotik realtechdriver.se I show you here how to compile a final executable in C-sharp. It's pretty easy. You have a key pair you can sign this assembly by using this procedure here at bottom. After signing this .NET assembly you can see the public key there in red. During some infections I've seen native codes trying to copy a .NET assembly to GAC. GAC means global assembly cache. In this case the author was trying to execute the native code copy the managed code to GAC because other pieces of this malware would use the shared assembly in the GAC to continue the infection. It's a kind of second stage. It's pretty easy to copy to that because you can use GAC filter there in orange or you can use the MICU package to do that. Of course to copy anything to GAC you need to have a key pair to sign your .NET assembly. If you don't have one you can use the only the public key and try to delay signing. In this case you will sign the .NET assembly only use the public key. To do that you can follow this procedure. You can add some resources by using slash resource. You can add some references by using slash reference. It's pretty easy. Of course I don't have enough time here to show you how to explain every single instruction in intermediate language. So I left some slides here showing it important instruction in intermediate language. I don't have enough time to do that unfortunately. And here I show you a real, real malware is the same malware so I try to comment several lines. Of course you must know about C-sharp to understand this code. Here we don't have anything different from a C-sharp code but the names and the keywords are a bit different. You have a public class, you have a private class you have a facility class you have a constructor here C-sharp, you have some private fields we have some stack reservation there, max stack you have several operations load things to stack and pop things from stack you have a custom a custom instance here at bottom you have private class you have a invocation of a native code in the middle here you see a invoke implementation here trying to call a method code you have here at bottom a local variable being initialized with zeros we have a try cat structure so it's so similar to a C-sharp code I try to comment several lines here to help you later you have for example here our dotnet malware are interested in get our keystrokes you see in this case malware is trying to hook some keyboard operations as you see the dotnet malware is trying to hook the key-down event and key-up event so it's a kind of keylogger at bottom here we have some event declaration in this case our dotnet malware is trying to subscribe some functions on this event at bottom key-down at up key-up and finally our dotnet malware not malware using aggregate to invoke this event so easy to do that several constructions being called here finally I found the decryption function this function is responsible for decrypting several strings from this malware as you see I try to comment line by line or the most line here you can try to monitor all DLLs load from the GAC by using FuzzLock or even process monitor but as I told you some advanced malware try to compromise the dotnet framework try to insert some hookings even try to compromise the GIT so it's this kind of malware are more dangerous here at bottom I show you the complete procedure for example I can copy a DLL from GAC modify recompile to the native code and copy back again to the GAC it's so easy pretty easy to do that of course nothing is so simple to do that I need to I need to have sign assembly as I don't have the private key from the Microsoft it's so complicated to do that other approach it would be to re-sign all the dotnet framework it's so hard to do that I can try to copy the modified DLL to GAC but if some applications or services are using this DLL it's not possible I can try to force a reboot to make this copy and even that I get it to do that I need to force my current applications using this modified DLL so in this case I need to uninstall and remove the native code from the native directory case meet show a very interesting way to do that case meet show a very nice trick by copying by dropping assembly to GAC dot DLL to force applications using my modified DLL I can try to for example I have a register composed by two entries one entry is pointed to the assembly code the other entry is pointed to the native code in this case I try to change the second entry to point to my modified DLL is another approach here some dot net malware try to compromise services try to introduce some hooking in GIT some dot net DLL try to load external assemblies so there are several tricks of course I've been using winder back to analyze this kind of dot nut malware using an extension like slsx and here I show you a complete approach for example here I load the extension sls sls dot DLL I found the native entry point disassembly the entry point I found the PE entry point there by using dump bin I try to display the pointer and finally I find the core easy man function by disassembly I can dump the domain in this case I see the system domain I see the share domain I see our domain from our malware I see several calls to external assemblies visual base sitting the DLLs I list some manage reception I can try to switch the track for example in this case I switch to track zero I dump the domain stack trace here our dot net malware at bottom I list some manage tracks by using the tracks here as you see you can see that tracks tracks 0, 2, 5, 10 and fourth thing are manage tracks all of them are managed by garbage collector I list the native the native stack at bottom using key n I pick up an entry there I check that if this address belongs to the GT code yes in this case belongs I pick up the method description reference I disassemble it so we have the disassembly function here I check the manage stack again I pick up object address I check again if this address belongs to the GT yes again I dump the method description information here I pick up the class reference at top I dump the class structure information I found the I found that this specific class has six methods 28 instance fields and five static fields I can check one of these fields for example in this case a value type field by using dump VC I found a hash table class composed by several several fields here at right I dump the method table information I dump the method table information again but detail the output as you see several methods some of them compiled I dump information about a specific model I found the assembly reference I dump the assembly information I found the parent domain information I dump the domain information at bottom it's pretty easy to do that of course here here is a bit more complicated finally I found the method table structure and the structure here I found some interesting classes possible malicious classes possible malicious classes I take one testprint.client I dump some information from these classes as you see there are several methods there I pick up one I dump the class and it's very interesting because there I found some fields in English Portuguese and German language I I took the German one to check the information as you see this part wasn't executed by Jit because at bottom is Jit the null so I tried to put a breakpoint to a future execution I dump it again all of the stack objects I saw a function using an array I dump this array this array is composed by an element that in this case is a structure as you see at bottom I dump it okay that's the same slide I check the heap information I check any kind of references to these objects by using GC root references from references from the stack from the handle tables I check the finalize heap to find something interesting I check the find and handled because some mirrors cause strong heap fragmentation I check again again some problems with locks and deadlocks locks and deadlocks I try to find a string inside the heap the managed heap at bottom I dump the mirror from memory and finally finally I check the thread environment block I dump some strings from there I found some nice strings at bottom I dump all of the heap I found some classes I took one keyboard hook and so nice I dump methods from these classes there are several methods I took the last one try to disassemble in intermediate language try to dump all strings from the memory related to this method and it's nice I found several urls related to banks so this is a kind of Trojan banker I I'm leaving some break points for you here these are very nice break points to test together some additional information and I test the url in virus total by using overview I can see that is a malicious site and I test the domain and I found several related things several malicious things associated to this domain it was a very long presentation I know about that if you want I can expand details for you thank you so much to the DEF CON staff as usual for you who reserved some time have a nice day thank you


In a video, Ukrainian President Volodymyr Zelensky predicts his country will win its war against Russia without giving up any territory. In China, Beijing officials increase COVID-19 restrictions and testing after they report 49 new local cases. In Sri Lanka, supporters of the ruling party attack people demonstrating against the government in Colombo. Police used water cannons and tear gas to break up the crowd. And Hong Kong's current leader Kerry Lam meets with the newly elected chief executive John Lee, who won 99% of votes for the position.