But you touch on something around anxiety. And I know that with autism, there are particular barriers that can make mental health difficult. I mean, just part and part due to the statistics around mental health and also the life experiences that we have. But also to do the things like alexifimia in terms of understanding our emotional states, putting things in place to recover and putting breaks in place to cope with different anxiety-producing situations. But I'd really love to know more about your experiences in ADHD and how you think it might differ to ADHD in autistic individuals. Yeah, I mean, like a lot of neurodivergent people, I've had really bad mental health experiences, both in terms of my internal experience and then trouble getting help for it. One thing, and this is, I don't know if this is just an ADHD experience, but my emotions are huge, like they are all consuming, totally overwhelming, right? That's another reason that people often get it incorrect. But borderline diagnosis is just these big emotions. And that was happening when I was, again, like a really little kid, I was having meltdowns. There's family lore around some of this stuff. But in my case, because my parents would hit me when that happened, I started moving towards shutdowns. So I stopped having meltdowns and I would just go catatonic for hours as a kid. So I mean, I was having these huge experiences that I had no context for. I didn't know anyone outside of my immediate family who was having emotional experiences like this that seemed uncontrolled and uncontrollable. So I don't know that I had, I definitely had anxiety as a kid. I don't know if I was having depression exactly. I don't know if I could pick that apart from the shutdowns at this point. But I mean, I also had a very traumatizing childhood. It was very physically and emotionally abused. So that was bad and obviously did not help. But the big like, thank you. Yeah, I mean, it sucked. My parents were totally unequipped for they shouldn't have had any kids let alone seven. But the big thing that happened was at the end of my junior year of college. And if you don't want to hear a mention of sexual assault, just skip ahead 10 seconds right now. I was raped at the end of my junior year of college. And that just absolutely sank me into an immediate depression, really like really bad suicidal on and off for a couple of years. And the the statistic that just gets me every time I see it is that 90% of autistic women have been sexually assaulted. And most of them are within a lot of cases, they don't realize that it was assault until after the fact, which did happen to me. I like, I knew it was bad.  And I was like, Oh, yeah.  But like, for me, growing up evangelical, it was a big deal for me that my first sexual experience was like, yes, against my will.   And so in my world, you know, for me as a 17 or 18 year old at that point, I did not, I didn't understand what it was to like have control over my body and to be able to talk about it in a reasonable way. So all of these things, and then obviously having like the trauma from childhood. So when depression hit me, it hit me really hard, because it was not just Oh, there was an event. It was like, Oh, it's not situational. This is your entire childhood. This is all of your autistic experiences that haven't been, you know, accepted. Like it was like everything at once. I also was living in Minnesota at the time I was going to school in Minnesota, which is a very like the US, you know, has all these different mini cultures within it. Yeah. Minnesota is a very, very, very aggressively neurotypical culture. It is a culture. So the one term I've heard is guest culture, not ask culture. You are assumed you're supposed to guess what people want and then provide it before they ask you. You're not supposed to ask what they want. If somebody asks, do you if they offer you food, you're supposed to deny it three times. I'm like, this is some biblical. So people would offer me a snack and I just be like, Oh yeah, sure. And they'd be like horrified that I said yes. I'm like, why are you asking me if you don't even it was a terrible place. That's really weird. To not know you were autistic. I mean, that happens anyway, doesn't it? Just just out and about in most places. We're neurotypical. It's like, oh, do you want this and that they don't actually mean it? And you're like, yeah. Yeah. Oh, well, yeah.  I've actually I've heard that Minnesota is actually good place in terms of school if you're autistic, if you know you are.  People were just awful to me. I got bullied more there as an adult than like in my entire childhood. Jesus. So that was bad. That was like a bad period of time. And then also like right around that time, I had a silent guy here. Don't know if that's me or not. I can hear you. Hey, up just popping on to say thank you for listening to this podcast this far. If you could do me a real solid, please make sure to rate the podcast if you're on a podcasting streaming service and do all that like, subscribe, comment stuff on YouTube. Damn, even send a heart in the comments if you don't feel like typing. Make sure to check out my link tree, which is always down below in the description, or head over to my Instagram page at Thomas Henley UK for daily blogs, podcast updates and weekly lives. This podcast is sponsored by my favorite noise-canceling, noise-reducing earbuds that you can adjust the volume on. Really, really great thing. They're called debuds and you can find the affiliate link down in the description of this podcast for a 15% off discount. Anyway, I hope you enjoy the rest of the podcast. That's all from me. We were talking about mental health and stuff. You explained a bit about your experiences with things and I think it would be good to talk about the differences, now some unique challenges to being an old HD with that sound okay? Yeah. For me, one of the big formative experiences was around that. My auto-HD looking bipolar and having that diagnosis because I was on lithium, I was on a bunch of different medications over time for both depression and anxiety and the bipolar diagnosis. One of the big experiences that was really hard was I was like, well, this isn't working. I keep getting depressed and if I'm doing what I'm supposed to be doing, if I'm doing therapy and I'm taking my meds and I'm sleeping well and I really good about substance use, I was doing everything I was supposed to do and I was still feeling like shit. That was part of what made me suicidal a lot more often was I was like, well, if nothing I do can touch this and I'm still having what I now recognize as meltdowns, not depressive episodes, but this is still happening and so it's never going to get better and so I may as well just be dead. That was the thought process and I first of all recognize there's internalized ableism in that because now I'm like, oh, you can just live. Like comparing yourself to neurotypicals.  There doesn't have to be this element of being cured, but I would say that that particular experience having these huge emotions, having no help for them at all and really just not having, nobody was looking at my experiences and understanding me. They were just like, here's the label and this label works well enough and whatever, here you can have it. That was really hard and then I think another thing that a lot of neurodivergent people experience going to therapy and having your therapist be like, wow, you're so self aware. I do think that neurodivergent people have more metacognition, like more awareness of what's going on in our mind. That interception, not interception, introception. Yeah, like being introspective and being able to look at your internal experience and analyze it because you have to because nobody's helping you with it and you're having all of this information and all of these thoughts. The way I think of it is having like between four and 16 tracks in my head at all times. There's just always stuff happening and some of those tracks are music and sometimes there's two musical tracks going on at once and I'm like, could we not do this? I do not need to think of every mashup in my head. Having just so much information going on at once and then when you bring that to a mental health professional, they either think it's disordered because there's too much going on, right? So there's a whole bunch of labels that can go with that, including bipolar and they're like, well, that's problematic. You're having too many thoughts, right?  I've organized them and here's me explaining what I think they're about and where they came from and what they mean and they're like, oh, you don't need help. You've already figured it out. This is what we're going to do in therapy. You know, I think you were saying before about what you're saying. I have that experience a lot as well. It's almost like you are going there to educate the therapist on stuff. And that's if they're a good one. If they're a bad one, they just kind of gloss over your experiences and tell you what to do and tell you all the ways that you should be thinking and acting. Just think less. Just worry less. Yeah. Pretty much. Oh yeah. And yeah, you were saying about, oh, it's gone again. Oh my God. Let me have a think. Yeah, you were saying earlier, I think that you understand autism and ADHD and neurodiversities, but you still have difficulties with it and stuff. Oh yeah. And I've had a similar experience with mental health. I did so much work. I did a lot of my degree around mental health and the biology of it. I understand the neuroscience behind it and the medications and a lot of, a lot of, a lot of lived experience and a lot of personal research has gone into me understanding my mental health conditions. Depression and anxiety, particularly. Still, still is an issue. And I think that that's, that's an important aspect to it because you know, in my brain, I think that I would think that understanding more about how it works and what's happening would alleviate all of it. And I would just be like, Hey, right. I'm catastrophizing. Hey, right. I'm being very learned helplessness about this situation. And having, having all of these, these thoughts about things doesn't always change the reality of like day to day living. Like I understand why I'm depressed and understand which thoughts are not real and which thoughts are very, very negative and not necessarily representative. But it doesn't stop me feeling that way. Like I was kind of whenever I've been into therapy, I've always made the distinction of, right, I understand it and I know and I know what and I know why and I know what helps. But I've done that and I still feel this way or like this.  Subscribe, drop a comment down below. Even if it's something simple, like sending me a heart or an emoji, it really, really does help me with the algorithm. All of my links to my socials, like my daily Instagram blog posts are down in the description. But other than that, I hope you enjoy the rest of this clip. And that's an experience that I have a lot, both, both being autistic and also with, with mental health is like, it does just because you understand it and just because you have the knowledge and have the practical tips and ways to wherever come it, it doesn't mean that it's always just going to get away and you're going to be able to manage it. Totally. I'd say that I probably have done more to help myself and manage it myself than any therapist has ever helped me with. There's been very, very minute, various, very small things, which I think therapists who have talked to me who, which has been somewhat transformative to me. And that was particularly around like anger, like I'm a very, I'm a very angry person. I get angry and irritable and annoyed at a lot of things, but I don't express it. And I kind of like push it down and ignore it. And so one of the situations that you know, I was talking to my therapist about that, they were like, right, so anger doesn't always have to be this kind of over aggressive behavior and speech. Like it could just, just be feeling angry about something and telling someone that you're not happy with something and putting boundaries in place and things like that. And I was like, Hey, actually, you know, I probably don't do that enough. And I probably don't listen to myself about what I'm angry about enough, I guess. So I have a lot of, you know, bad experiences with people being angry and aggressive and stuff. And I'm always like, I don't want to be like that. I don't want my anger to dictate my behavior. But I do think, you know, that was like one of the things that someone's mentioned to me that has had an impact on me. All the other stuff, pretty much nothing. It's either educating them or being told a lot of useless information that doesn't apply to me. Like strategies to cope with anxiety. You know, I don't need the strategies to cope with anxiety, because I cannot tell that I'm anxious until I'm at the point where I need a panic, I have a panic attack or a meltdown or anxiety attack. So it's not really useful for me for managing it long term. And a lot of the ways that I manage my mental health is this kind of blanket approach. Like, and this can obviously fall into a lot of, you know, harmful ways of coping like SH or it can be, you know, with things like substance use, that kind of blanket approach that makes you feel good generally, and doesn't necessarily have to be like this directed thing where you like process something and you implement strategies and things like that. It could be every day, you know, I have my meds, I go to the gym, I listen to music, I have lots of different sensory things around me. So I have this kind of blanket mentality of trying to, well, successfully sort of bolstering my mood and my day with a very blanket approach rather than like targeting and be like, hey, I need to do these anxiety relief things. Yeah, that makes so much sense. And part of, so I've done so much, like you're talking about the intellectual, you know, the psycho education side of things. I was in therapy almost constantly for 15 years. I have myself taken a year long trauma education program that was for therapists, but I like got a scholarship for this thing because I was very interested in trauma. I am a board certified hip to therapist have done a whole bunch of trainings. I know so many things about the mind body system and how they interact and how magical change can be and how quick it can be when it's embodied and integrated and all of these things. Like I know all of these things intellectually and I've experienced them. I've had some really wild, great health results from hypnotherapy myself. So I love it. I think it's really great. And knowing all of these things, I still have an autistic PDA profile brain where when I'm having a bad time and my brain literally knows probably a thousand techniques that would help me, I'm just like, I don't want to, I want to be miserable right now. I want to just feel like, I just want to like have this, it's like internal stimming and like letting the emotion take me and have this experience. And there's a part of me that wants that and that's okay. Like there's a part of me that just wants the intensity of this experience to just wash over me and just like be in it and just let it pass by. I lean into it. Yeah. And I almost like, I can almost have a better time having that experience for the 30 to 90 seconds that the actual physical mechanism of an emotion usually takes in the body to just like let it happen and be in it as opposed to, oh, and now I'm at rate because I don't need to do a technique for that. I can just look around the room, save free things. Yeah. And if I'm actually, yeah. It gets annoying. It does. It feels like it's trapping you sometimes. It feels self-infantilizing to me to be like, oh, you're having an emotion. Like, let's do this thing. And I'm like, okay, or I could just like let it happen. And like, you know, I've got, okay, so I have like a weighted plushie, a couple of these that I love. This is like three pounds or something. Putting this on my lap is comforting. It also can help with focus for both ADHD and autism. So like, write something like that. I'm like, okay, now there's a soft, heavy thing in my lap. That is nice. Right? But this is just like a, like I'll just grab this during a meeting. I don't go through a whole rigmarole in my head of like, oh, no, I have to like do something for the emotion that I'm just like, look, this will, this will feel slightly better. And it's okay to do things that feel good, even if they're not the most adaptive option or the most healthy option all the time. Like we don't always have to do the best thing or the perfect thing for this emotional experience. Yeah. Yeah, definitely. I think there is that tendency to be like, hey, right, we need to get all of the factors involved in this just completely ironed out needs to be a plan for everything. A lot of the time for me, it just takes me more energy than it would take to deal with the emotions themselves sometimes.  Like it's, it's something that's a part of you and the way that you, you function the way that you feel and think and I think at some point you, there is a mentality of just being like, hey, you know, actually I'm just going to deal with this and be okay. We're just dealing with feeling low today and not give myself walks in nature and doing all of this self-help stuff. So that I'm an unacceptable level of being okay. Like I'm used to it. Like for me, it's been like 12 years. It's like, I know what it's like to be anxious and depressed. I know that sometimes I'm not going to be able to cope with things and just being feeling okay with just letting things flow out and having this, this difficult day, couple of days and then getting back on my feet and using those strategies. And it's a very individual thing, isn't it? Because everything that you read, everything that you, the studies that you look at, the research that you look at, the lived experiences in from other people, they're all individualized or generalized depending on what you look at. And they're not always your experience. And it's not always easy to put yourself into a box of right, this is helping most people. So therefore I'm going to do all of these things that help most people even though a few of these things actually don't help. And they actually cause me more stress. Yeah. And I think part of that is this comparison both with others around us and then also this idea of what a life is supposed to look like or a day is supposed to look like. Because I know for me when I was depressed, I usually actually felt okay if I was alone because I got to just be low energy and nobody was commenting on it or telling me that I looked bummed out or something. I wish people do all the time anyway, because I just have like low affect on my face a lot of the time if I'm not thinking about it. Flat affect. Yeah, I have flat affect a lot of the time. So people would be like, are you okay? Have like resting grumpy? I have like a slight frown naturally. And that would bum me out more to be around other people and have them reflecting back to me because I was like, I don't actually feel that bad. I'm just at home like hanging out with my cat, like engaging in my special interest. I feel okay. I'm technically depressed by like some standard, right? I feel low energy. I don't want to do things. And maybe I'm not, you know, eating or showering enough and I don't want to be around people like I'm meeting the technical definition of depression. But I feel okay because I'm doing things that feel good to me. That's really, really, really important that you talk about that because autistic burnout often, you know, it shares a lot of similarities with situational depression, like from things. And that is the way that you kind of cope with things. You kind of reset, you reduce stimulation of stressful things, sensory social things, productivity related things. And that's how you kind of reset yourself. And I think that's something that's worth highlighting because it may not always be that, you know, when you get yourself in these situations that you are just naturally just becoming more depressed and you are struggling, it might actually be, you know, there's kind of more situational things of, you know, I'm just things are a lot in the moment, kind of need some time on my own. I think the way that I distinguish when it's mental health and not burnout is like how prolonged it is, how long have I been feeling like this? Have I bounced back after having a rest and having a break? And a lot of the time it is kind of more to do with that kind of burnout thing and it often does help.  So it's neurodivergent person. And as one example, like I know you were joking, but they're like go walk in the woods or something, right? Go take a walk in nature. Like to me, again, if I was having like a depressed but overall okay, you know, maybe have a more burnout resting experience at home. And then if I would go and do something like that, right, just typical advice given to people, if I would go and do the thing like go walk in nature. And if I did not feel better, because I was like, this is the thing that's supposed to make me feel better. And if it doesn't work, then there's something wrong with me. Like it can be it made me feel more depressed to do the things people said were supposed to make me feel better if they didn't make me feel better expectation you come back and you feel better and like, no, so I would rather not do them because I don't want to know that that doesn't work for me. Yeah, yeah.


The first thing I'd want to do is know a good deal more about Thomas Springer. It's really hard to know much about him with only this. So I go track down, luckily I can find him in tax lists, find out what he's listed as owning at different moments, how much he paid, I can find his will, I can find the record of his marriage and his children's birth in the local church, and I can find the deeds of his sales. So I want to find out as much as I can about him. And then I want to find out about other people who live in, in his Mill Creek Hung 100 or Newcastle County, those other people on the tax list, what their lives are like, how much land they own, what possessions they have, so that I can tell, is this man typical or is he exceptional in some way? And for that I'd want to then locate the document in the context of other documents, particularly in this region, and compare this inventory with the inventory of other people in northern Delaware in this time period, maybe take a 10-year period of time and see of people who die, and paying attention to how old they are when they die, what do they own, how much is it valued at. So I think that first Thomas Springer find out more about him and then find out more about the other people around him in his community and what's going on in the region in general. I think what's interesting, the other final context is the context of change in material culture and probably what's most interesting there is the house itself because it's very easy to have an image of 18th-century houses and early 19th-century houses as being several different rooms, high style with separate parlors, bedrooms, a central hall in the Georgian style. That's what you see when you go to most historic houses because the ones that have been saved are these very nice houses of well-to-do people. And here's a really ordinary house. It's small. We'd have a hard time being comfortable living in this space and there's no evidence particularly that Thomas Springer or Elizabeth Springer or their children had a hard time living in this space and it turns out it's extremely typical. Most people in the early 19th century are still living in one or two-room houses made of wood, not made of brick, not fancy, nothing permanent, nothing mental after all that long.


So the next talk is called KTRW the journey to build a debuggable iPhone Well hardware debugging of an iPhone is usually not possible It's not possible of iOS devices or it wasn't possible for iOS devices and Security research of the kernel is therefore quite a challenge Well with the Apple a 10 chip Apple implemented a thing called kernel text read only regions which is called KTRR in short and Brandon asset of Google project zero he found a way to make a debuggable iPhone and tonight he's Gonna tell us how he broke this car to KTRR and how he made Debuggable iPhone out of a regular production iPhone. Please give a warm round of applause to Brandon Awesome. Thank you very much. I'm very excited to be here. Thank you for showing up to my talk and Today I'm going to take you along my journey to build a capability that I've wanted to have for a very long time a debuggable iPhone So what exactly do I mean by a debuggable iPhone? Well in order to kind of give you the context that you need to understand this I'm going to need to talk about something which isn't frequently talked about in public and that's the thing called Dev fused devices Development fused devices prototype iPhones These are all names for similar concept, which is a type of device a type of iPhone that has extra Debug capabilities built into it. So that's things like serial wire debug JTAG Basically functionality that now allows you to debug the phone at a very low level for example doing things like Single-stepping through the bootloader putting breakpoints in kernel mode and dumping registers modifying registers source of things which would be very important for Apple engineers to be able to do but which are Definitely not something Apple wants available on production iPhones distributed and mass Now in order to connect to these special type of iPhones debug capabilities. You need a Really special type of cable usually called a probe It here's an example of what's called a conzi cable It has a special lightning connector on one end Which has a special accessory ID burned into it which allows it to communicate with the debug hardware on the phone It has a controller which is the chunky part in the middle Which is able to talk the debugging protocol and it has USB port on the other end which you can connect to a laptop and On the laptop you would typically run software for example. There's this tool which you can find Online called asteris this is not software which Apple is willingly distributing. This is kind of as I understand it leaked code so it's not something which Is like you know sanctioned but There are people who are able to obtain this software and use it to operate these debug probes Here's an example of a screenshot where someone was able to use a Kong serial wire debug probe and connect it to a 32-bit dev-used iPhone and You can see register dumps. You can read and write memory do so all sorts of really low-level debugging on this iPhone Now I need to say I do not use dev views devices I don't have access to these devices. I don't want to have access to these devices to do my work That being said it would really be incredibly useful to have such a low-level and powerful debug capability So this is the motivation for my research project I wanted to find some way to build a debug capability on a regular Apple certified iPhone Some way to build my own homebrewed dev phone And there were a number of different features that I wanted present in this homebrewed dev phone I wanted the ability to patch kernel memory and in particular the ability to patch the executable code in the kernel for example modifying existing instructions or Injecting kernel shell code things like that I wanted the ability to Kind of do your standard debugger features set break points at watch points Kind of the third item that I wanted this debug phone to be capable of is I wanted it to use only You know standard off-the-shelf debuggers. I didn't want to use or to depend upon Proprietary Apple software like asteris in order to operate The next item is I wanted this homebrewed dev phone to be updateable So I wanted to find some sort of low-level vulnerability such that if I'm going to spend, you know three months trying to create this Debuggable phone and then Apple is able to patch The whatever technique was being used in the next version of iOS and now all of a sudden I no longer. I'm able to debug the latest version Certainly, this would be very useful. I can always Diff kind of the differences between subsequent versions of iOS to still get useful information from my debugger But I would really love to be able to amortize the development cost of this debugger over many iterations of the iOS operating system so keep this capability alive as long as possible In practice what this meant was I was going to be looking for perhaps a bootloader vulnerability Maybe some sort of hardware bug something which was Either difficult to patch or even if it was patched It was early enough in the boot process that it would still be possible to update the version of the iOS kernel running on the device and the Final thing is that I wanted this dev phone to use only parts that you could obtain at an Apple store So no specially fused CPUs no Special debug cables nothing of that sort Now I want to mention something really really important that happened Probably the most important thing to happen to iOS security research in several years And that is pretty much just a couple of days before I was about to open source KTRW Axiom X released a boot ROM exploit for all iPhones between the iPhone 4s and the iPhone 10 Now the boot ROM exploit is actually Strictly more powerful than the capability used in KTRW Everything that I want to do and my debug phone is totally possible to do using the boot ROM exploit alone So I want to tell you this just so that you're aware that many of the assumptions that I made Going into this project really don't hold anymore, but they did hold at the time that I started this research And I do expect that future debug capabilities and future research platforms on the iPhone will be based around the boot ROM exploit instead So with that let's talk about the main mitigation that makes kernel debugging on iPhone right now Both really hard to do and also so important And that's a mitigation called KTRR If we look back at the list of requirements that I wanted in my homebrew Dev phone The very first item on this list was I wanted the ability to patch kernel memory and in particular to patch the executable code Now normally on most systems, this isn't actually that difficult Once you have the ability to read and write kernel memory You can just modify page tables make some page and memory read write execute stuff your shellcode in there And you're basically done But on the iPhone Apple has added a mitigation called KTRW And the idea is that we have a kernel caching memory that's been you know put there by some sort of secure boot process But once it's in memory and the system is running Apple would really like a way to guarantee that the kernel cache gets locked down as much as possible and Any data in it which really does not need to be writable is never going to be modified basically keep The guarantee that once an iPhone is booted the code running in your kernel is exactly the code that was protected by and Verified by the secure boot process. So there is some data in your kernel, which does need to be writable But there's also a bunch of data which really does not need to be writable The most prominent example is the executable code. Clearly. We don't want that to be changeable But there's also a bunch of other pieces of data which are worth protecting for example You have strings maybe format strings Virtual method tables the page tables that are mapping the kernel cache itself into memory All of these additional pieces of data Apple would really like to have them be protected and not modifiable And that's what KTRR does. It's going to lock down all of this data that we want to be read-only as the defenders So as far as we know KTRR stands for kernel text read-only region So what KTRR boils down to is it's a very strong form of write X or execute protection It's available in Apple A10 CPUs and later and it provides two very strong guarantees First is that all writes to memory inside of the region protected by KTRR will fail But this basically is what provides kind of the lock down guarantee that what was put there by the secure bootchain Kind of stays that way and can't be changed But there's another part to it which is equally important and that is that all Instruction fetches from memory outside of the protected region are guaranteed to fail This is what ensures that you can't put new executable code in the kernel But the only code that you're allowed to run is the kernel zone code So in order to kind of understand how this works in a little more detail Let's look at an oversimplified diagram of how CPU works So here we have the CPU cores. This is for example an a11 CPU with six cores The little purple box in the bottom corner is the MMU We have the highest level of the cache hierarchy is the L2 cache behind that is the memory controller called AMCC and Then this is connected to DRAM. Now the kernel lives contiguously in physical memory in DRAM and this is what Apple wants to protect with KTRR So the first step in order to lock down this region happens on the MMU. So let's zoom in to a single CPU core What Apple has done as far as I understand is basically just add a couple of registers to the MMU That point to the beginning and ending address of the region to protect What this allows us to do is the CPU core can now check whether each instruction It's about to execute violates the security guarantees we want from KTRR So for example, let's say the CPU wants to issue a right to a physical address outside of the KTRR region That's fine. We can execute we can write to that memory. So this will be allowed by the MMU and the right will go through If however, we try to issue a right to an address that points to inside the KTRR region This violates the security properties of KTRR and so the MMU will recognize this It'll deny the right and it'll cause that instruction to fault Similarly, if the CPU tries to execute an instruction that is fetched from an address outside of the KTRR region MMU can recognize this and cause that instruction fetch default But so here's kind of the new picture of the CPU cores We have a bunch of new registers in the MMU that kind of have this KTRR protection built into them The next however, this isn't the complete picture that we need in order to Protect this memory see there are other Devices that are connected to your system all sorts of peripherals. This could be like a Wi-Fi chip This could be like a USB stack all sorts of thing any sort of hardware device which could Issue DMA commands to your memory controller. So in order to protect against malicious peripherals DMAing over the protected region We think that Apple has added a registers to the memory controller as well that also point to the beginning and ending address of This lockdown region such that that way anytime some peripheral tries to DMA over the secure region The memory controller sees that this DMA doesn't look valid and it'll just discard the right So this is kind of the picture that the hardware now looks like in order to support KTRR But this isn't actually the complete story either because There's one specific edge case that needs to be properly handled and that's when a CPU core goes to sleep for a little bit And then wakes up what's called resetting Anytime the a CPU core goes to sleep It's going to power down registers and in particular the MMU Registers which store the KTRR bounds are going to lose their value and be reset to zero So when the CPU wakes up from sleep We need some way to reset those registers to point to the beginning and ending bounds of the lockdown region So the reset vector is the first piece of code that gets executed when a CPU core wakes from sleep And it does so with the MMU off And what Apple has done is they've added code to the reset vector that basically just initializes those KTRR registers The beginning and ending bounds are stored in these global variables These variables by the way happen to lie inside of the locked down region, so they can't be modified And once it reads those values into general purpose registers It writes those bounds into special system registers That are used by the MMU to verify the KTRR security properties so once this code executes KTRR will be locked down on the MMU and Once again, you can no longer Execute memory that lies outside of the lockdown region So now that we have kind of a high-level understanding of how KTRR works Let's look at how it's possible to break KTRR and we'll start with a few historical examples There are two historical instances of partial KTRR bypasses up till now And the first one came out pretty soon after the KTRR mitigation was first introduced And it was discovered by Luca Tedesco who's going to be giving a talk. I think in this room tomorrow evening So what Luca found was that Apple had left an instruction in the kernel cache that They didn't mean to leave executable, but it accidentally was this was the MSR TT BR1 instruction Which sets the special TT BR1 register This register stores the physical address of the root of the page table hierarchy Which means that if you're able to modify the value of this register Then you were able to supply your own custom page table hierarchy and therefore remap virtual memory onto new physical pages So this is exactly what he did. He just chose a remapping that placed the read-only regions of kernel memory onto new physical pages that contained a copy of the original kernel data Now it's important to note that KTRR was still actually fully initialized At the point at which you were able to execute this MSR instruction so We can patch read-only data, but we can't execute new kernel code because KTRR lockdown on the MMU still did occur So what the KTRR bypass in 10.1 basically achieved was limiting what was protected by KTRR down from the whole read-only region to only the executable code But we get a whole bunch of new data in the kernel, which is now writable The second KTRR bypass That was released was more of a bypass in spirit than in practice But it's definitely a very important tool and a huge inspiration for my research so back in iOS 11.1.2 Ian beer found that the debugging functionality in the ARM specification was actually implemented in Apples processors and could be used to implement a full-featured kernel debugger So if you read the ARM architecture reference manual, you'll find that there are Documentation on a feature called self-hosted debugging Basically the architecture provides a set of debug registers, which you can access via MSR instructions And you can use these debugging registers to set breakpoints in kernel mode and also to by implementing exception handling code in your exception handler you can catch your own Breakpoint exceptions and basically had the kernel implement its own debugger for example, this might be somewhat analogous to using a KDP to debug a Mac book Now KDP has actually been removed from the iOS kernel that's distributed on production devices however, the Debugging registers that one might use to implement this are still present still fully functional And what Ian found was that he could use return-oriented programming to set the values of these registers correctly in order to implement a Rather full-featured kernel debugger He built something that works with LLDB proved quite useful And in particular it was able to by setting you know breakpoint single-stepping modify register values Execute existing instructions in the kernel in basically arbitrary order So not native like arbitrary shellcode execution, but pretty darn close So I Started this project of trying to find some sort of KTRR bypass by looking in kind of the Places that I thought would be more powerful find more Powerful KTRR bypass is more likely to lead to something that would be persistent across multiple versions via OS Where I started was looking in iBoot. I was trying to find some sort of iBoot bug in the image for parsing and verification functions. I didn't end up finding anything there Next I kind of read through several sections of the ARM architecture manual Saw some interesting things about you know, maybe you know if you have weird malformed TLB Entry if you have weird malformed page table entries. You could do something weird with the TLB That didn't really end up yielding anything useful I played around a little bit with you know, I kind of misunderstood how KTRR worked a little bit And I thought you know, maybe there's a way to Corrupt the L2 cache and then bypass KTRR that way that didn't end up really working either So I kind of you know tried a bunch of things none of them really panned out and I put This research on the back burner for a while And it was actually while I was doing something totally unrelated that I happened to generate a kernel panic Which reignited my interest So I was playing around with interrupts and I'd managed to get a CPU core stuck in an infinite loop With interrupts disabled in kernel mode And I got a panic message which said you know panic watchdog timer timeout CPU on has failed to respond So kind of the exact thing you would expect when a CPU isn't responding because it's stuck Burning CPU cycles in an infinite loop eventually system notices and panics because you know, there's some significant problem here But what really caught my attention about this panic message was something much earlier in it where it says attempting to forcibly halt CPU one Now this was really interesting to me because according to what I'd read from the arm manual there wasn't any Standard way for one CPU core to halt a second CPU like there's no MSRs that you can write to I didn't really remember any way to accomplish this So what I figured was there's probably some sort of like proprietary interface going on here where you know, maybe there's special CPU control registers which are accessible via MMIO and Somehow XNU is trying to leverage those in order to halt the CPU. So this seems like you know pretty interesting I've never seen something like this before So I decided to you know, pull up the Security engineering tools needed to figure out what was going on here So I grep through the XNU source code to try to find the string attempting to forcibly halt CPU Pretty quickly came to the function ML debug wrap halt CPU which seemed to implement this functionality It takes the index of which CPU you want to halt so on a CPU with six cores So to be the index zero through five And the actual part which halts the CPU is just right down here a couple lines lower So what this does is it reads a pointer to some volatile memory from a per CPU data structure This is memory this variable that stores the pointer to the memory is called debug wrap reg and then the actual part of the code which halts the CPU is Simply consists of the single line where it writes Some special debug halt of value to the debug wrap reg So this really strongly Supports the idea that this is some you know special mmio register and when I was looking online for trying to find references to this debug wrap thing I wasn't really getting any results. So it kind of really strongly suggested that yes This is some sort of proprietary Apple specific interface The other thing that kind of caught my attention was this reference to something called core site I remembered hearing, you know core site somewhere else before but it doesn't really didn't really know what it was Marked it as something to come back to But what really caught my attention when I was looking through this file was a function just a few lines down Called ML debug wrap halt CPU with state This does basically the same thing as the other function except in addition to halting a CPU It also reads out the values of the registers on that CPU that was just halted and the way that does this is actually quite remarkable So first off you can see that there is another reference to this core site thing It says ensure memory mapped core site registers can be written So clearly something with core site is important here. Maybe it's the block of registers that contain this functionality But the important part is this for loop right below which iterates I over the indices of your general purpose registers What this code does is first it's going to generate the numerical opcode for the instruction Which writes the value of general purpose register Xi into the special system register debug DTR So this isn't an instruction which already exists in the kernel cache It is just literally generating the numerical value of the opcode for that instruction Next it passes that opcode into ML debug wrap stuff instruction And finally it reads the value of the debug DTR register and writes the value into the output buffers Xi field So this is actually really interesting because of what it suggests is that ML debug wrap stuff instruction is somehow Executing dynamically generated instructions and this really flies in the face of the security model That KTR is designed for so KTR is meant to ensure that you know all of the instructions in your kernel cache Those are the only ones that you're allowed to execute But here there's some sort of interface which seems to be able to execute any instruction you want on a halted CPU So this is definitely really interesting Now just because there's code to do something in XNU doesn't actually mean that it necessarily works in practice So I basically just decided to test to see if this code actually runs I pulled up an old kernel exploit that I'd written and I basically just wrote an Packed together something that would call the function ML debug wrap halt CPU with state Pass it an output buffer and then dump the contents of that buffer And what I found was that the output buffer really did look like a bunch of registers So there's a bunch of stuff which was zero which you know is kind of weird But the value of CPSR Does look correct. It actually looks like a CPU running in kernel mode And the value of PC it doesn't really look like a normal kernel virtual address Those usually start with you know like ffff, but it does really look like some sort of physical address perhaps And with a little bit of digging into this I pretty quickly discovered that this is a physical address of an instruction in the reset vector Now things are really really getting interesting because what this suggests is that we've managed to halt the execution of a CPU core While it's actually running the reset vector and in particular before the MMU has been turned on now This is a really critical point in time for KTRR because before the MMU has been turned on KTRR is unable to protect the CPU from executing instructions outside of the locked-down region So of course what I really wanted to know was how do we use this capability in order to bypass KTRR? Well, it turns out that there's kind of a more fundamental question that I need to answer first Which was what exactly is this core site thing anyway? It's really hard in practice to at least for me to exploit something without kind of knowing a general sense of how something works And so I basically just searched for core site in the ARM reference manual and Came across a bunch of references to core site in connection with something called the external debug interface Now the external debug interface it turns out is pretty much just a different way of accessing the same functionality that Ian used in his self-hosted kernel debugger So the in the self-hosted debugging interface you write to these debug registers using MSR instructions The external debug interface provides kind of the very similar functionality. It's probably the same Debugging hardware under the hood that you're driving, but the interface to access these registers is via MMIO Rather than via executing MSR instructions So this means that basically the functionality that is necessary to build a kernel debugger is still there Even though the BROC gadgets that Ian used to activate it are taken away the memory mapped interface still exists and In fact, this isn't even the first time not even close to the first time that someone has tried to use debugging registers in an ARM processor in order to mount some sort of privileged attack Shin Yu Ning and Feng Wei Zhang presented an attack at Mosec 2019 where they basically were able to leverage the same debugging registers on Android phones to break the protection of the Secure world so they were able to Make one CPU core debug another CPU core make that second CPU core Execute instructions to enter the secure world at EL3 and then also make it execute instructions That would cause it to read and write memory in the secure world So just to summarize kind of the key concepts behind the external debug interface It is an on-chip debugging architecture. It provides per CPU Debug registers which are accessible via MMIO The actual interface itself how to use these registers is really extensively documented in the ARM manual It talks about, you know, what the names of all the registers are at the offsets of them Like how to program the registers in order to do things like set break points and watch points So I'm not going to go over all of that right here But what I will say is that the external debug interface is certainly more than powerful enough to do any sort of kernel debugging That we might be interested in definitely capable of setting break points and watch points single stepping execution executing arbitrary instructions poking at memory all this sort of stuff So the idea for my attack was we have these debugging registers We can do things like single stepping and we know that we can halt execution in the reset vector So I basically decided I would try to use the external debug interface to single step the reset vector And then once the reset vector is about to execute the KTR lockdown instructions Just jump over that piece of code. So KTRR never gets initialized So if we look at the reset vector, we'll just step through all of the first instructions and then once we see that we've hit this conditional branch Where we're just about to start doing the KTRR register initialization set x 17 to 0 jump over the KTRR code altogether now This is a nice idea But we don't actually have all the tools yet necessary in order to carry it out We know that we can hold a CPU and we know that we can execute arbitrary instructions on it and do things like modify the values and registers But we haven't yet found the ability to resume executing on the CPU after it's been halted So if we set a break point on the reset vector, for example, that's nice But it's not going to be of much use if we can't continue execution after that point Furthermore, there's another somewhat more subtle issue which is that we're using one CPU to hijack another CPU as it resets But CPU resets happen all the time any time a CPU core is idle for a couple of seconds It'll eventually just do a reset as it powers down and powers back up again So we're gonna have to do this KTRR hijack We're gonna need to modify the execution of the reset vector and skip the KTR initialization Every single time that a CPU core resets unless we can find some way to disable the core from resetting So I didn't know how to do either of these two things So I kind of just decided to play around with that Original proprietary register that I found earlier. So the XNU source code documents a couple of the bits I think it documents two of the bits in that register The remaining bits are undocumented. So I figured, you know, might as well set some bits clear some bits see what happens see if I learn anything interesting and I kid you not by sheer dumb luck. It happened that that register contained Exactly the pieces of functionality we needed to pull this hijack together. So bit 30 actually will clear the Hult and it'll allow the CPU to resume executing and bit 26 will keep the CPU powered up So that it doesn't subsequently reset and then we have to re-hijack the reset vector So basically the attack that we described before Works perfectly well Once we have this new functionality We just make sure that once we hit this branch we skip over the KTR register lockdown code And then these registers never get written to KTRR is never initialized on the system and kernel memory becomes executable So what this looks like is first we have KTRR enabled once we do this hijack KTRR is disabled on MMU and now any Page in kernel memory could now potentially be executed got a little bit more to go Thank you So now that we've found a way to break KTRR I want to talk about how to build an actual debugger on top of this because I found it to be a quite non-trivial challenge So there were a number of steps involved in this process and actually in many of them I encountered issues that I thought would be basically insurmountable So the first step in the process is we need to remap the kernel Because even though we've enabled the ability to execute arbitrary kernel shellcode. We don't yet have the ability to patch kernel memory Next we need to figure out some way to load a kernel extension We need to make sure that we're properly handling interrupts because we're going to be disabling or sorry We're going to be halting CPUs and once the CPU is halted it of course can't service interrupts anymore we're going to need to establish some sort of communication channel between the Kernel extension running in your iPhone and your laptop running LLDB and Finally, we need to implement a GDB stub to process the packet sent by LLDB and to drive the debugging hardware So at the point in which we bypass KTRR we Have the ability to execute arbitrary kernel shellcode But we don't yet have the ability to patch kernel memory The reason for this is that even though we've disabled KTRR on the MMUs It's still fully enabled on the memory controller so even though we can Execute code outside of the read-only region the read-only regions physical pages are still fully protected and we can't modify them persistently So this is actually kind of problematic for us We really do need to modify the page table permissions in order to make the kernel extensions memory executable and The root of the page table hierarchy lies inside of the KTRR region, which is still protected So the solution to this is to basically do exactly the same thing that Luca did in The 10.1.1 bypass which is to remap the kernel onto fresh writeable pages and set ttbr1 to point to the new page tables instead so what that looks like is initially the ttbr1 registers is going to point to the root of the page tables which lies inside the protected region What we have to do is we need to copy the kernel the pages containing the kernel We need to copy the data of that onto new writeable pages that are outside of the protected region update the page tables in kernel memory and then make ttbr1 point to the new modified page tables instead and With that we do now have the ability to patch the kernel So the next step in this process is we need the ability to load kernel extensions This actually turns out is pretty simple once we bypassed KTRR All we have to do is we need to allocate some memory to put the kernel extension in Copy in the binary Dynamically link the kernel extension against the kernel that's running because if you want to have a kernel extension Presumably you're going to want to call kernel functions at various points After that we need to modify page tables to make the kernel extension executable And finally we need to call some function in the kernel extension to begin it running And with that we're now ready to start designing a kernel debugger So what I eventually settled on was a pretty simple design I would have one core in the CPU which I called the monitor core is going to be exclusively reserved for the KTRR W debugger itself So it's no longer going to be running XNU All of the other cores in the system are going to continue to run your operating system as they do normally When you set a breakpoint or a watch point on one of the debugged cores It's going to cause that core to halt and enter debug state So the monitor core is just going to sit in a tight loop Polling all of the other cores to see when they enter debug state and when it notices this It'll send a message to LLDB over some communication channel saying hey this core halted because it hit a breakpoint and then LLDB can Take care of the rest Now when I implemented this I pretty quickly encountered weird panic messages So this is one example AOP panic no pulse on something or other And it took a little bit of effort, but what I eventually learned was this was being caused by a Processor on the device call it called the always-on processor Sending periodic interrupts to the main application processor and the interrupts that are sent by the always-on processor Need to be handled or else the AOP will panic and once the AOP panics it brings down the whole system Now some of these interrupts are actually relatively easy to disable. I reverse engineered the watchdog timer kernel extension and found the Hardware interface the set of registers needed to Disable that but there are other interrupts, which I wasn't able to narrow down. I wasn't able to disable now I'm I strongly suspect that the dev fused devices that some are able to acquire do have the ability to Disable these interrupts or other or in some way are not affected by this problem because presumably when apples engineers are Using one of these devices to debug the kernel and they halt the kernel for a few seconds It's not a great user interface if when they resume Execution the whole kernel panics because of this interrupt problem So I strongly suspect there's a way to fix this problem, but I wasn't able to find it Instead I basically implemented a big hack, which is that I started servicing interrupts from the AOP on the monitor core itself Now this introduced its own problem, which is that now execution on the monitor core can jump back into XNU and start running the IRQ handler at basically any time and that includes when Any of the debugged cores is halted holding an IRQ critical spin lock This is a huge problem because once we try to acquire that same spin lock We can't acquire it. It's already held and the only way that lock can be released Is if that debugged core is resumed which it has to be done by us so we enter this deadlock For a very long time. I thought this was pretty much an unsolvable problem for my debugger But it actually turns out there's a really really simple solution And the reason is that the XNU kernel itself has to deal with this problem See when an IRQ is delivered and some code is processing the IRQ if interrupts were enabled Then a second IRQ could be delivered and cause the IRQ handler to be re-entered In which case that same lock would be grabbed a second time. What that means is that interrupts have to be disabled while in an IRQ critical region Which means it's really easy to test for whether it's safe to halt one of the debugged cores You just check whether interrupts are enabled or not if interrupts are disabled That means that it's possibly in an IRQ critical region and you just wait a little bit of time before halting that core And after that all of my interrupt problems pretty much disappeared So now we're at the point where we have a Text running in the kernel we seem to be able to halt and resume CPU cores But we need some way for LLDB running on your laptop to communicate with the debugger running on your iPhone's kernel I considered a number of different options each with various advantages and disadvantages Serial is really really nice because it's incredibly simple to implement USB I liked because it would be really really fast Wi-Fi I kind of just threw in there in case the other two didn't work There wasn't any really compelling reason to implement a debugger over Wi-Fi What really made the decision was the disadvantages of each technique So for serial as far as I'm aware you do need special hardware in order to operate Communicate with the iPhone over serial so this basically violates the first goal one of the goals of my Homebrew Dev phone, which is that you don't need any special hardware everything can be purchased from an Apple store The other two techniques USB and Wi-Fi both suffered from the same problem Which is that I would need to write a custom driver for the hardware The reason for this is that I cannot rely in my debugger on the code that I'm debugging if I set a breakpoint and CPU core halts while it has some lock used by the Wi-Fi or the USB drivers then when my application ruin my kernel debugger tries to communicate over that mechanism using the Stack built-in to XNU it's going to try to take the same lock and deadlock same problem. We had before so Whatever communication channel we use we need to implement a custom driver for it, which is self-contained So out of USB and Wi-Fi. I basically figured that writing a USB stack was slightly less painful It was pretty easy to figure out with some googling which Hardware USB controller wasn't used in the iPhone It's a controller by synopsis called the design where high-speed USB 2.0 on the go controller What's somewhat unfortunate about this controller is that it is Proprietary the interface that it uses to communicate is not one of the standard USB interfaces Which means that you cannot use kind of your stock open source off-the-shelf drivers for it And when I tried to look at the data sheet to see how I could you know program my own driver I quickly ran into a login wall. I couldn't actually access it and I Was unable to obtain the data sheet for it So this seemed really problematic, but one thing that I could find was open source header files for this hardware now there are open source drivers for operating it But all the ones that I was able to find That operated this hardware did so in a host mode so kind of as a laptop rather than as a device you plug into it And that didn't really work for me. So that wouldn't Be that wasn't what I wanted, but I was able to use the header files which contained the register definitions Now the only place that I could think of that contained a fully self-contained implementation of the USB stack that operated the exact same hardware as used in the iPhone was the iPhones very own secure ROM so the secure ROM is the very first piece of code that runs on the Application processor when it starts up and it needs a USB stack in order to communicate With a computer over for DFU firmware upgrades So I basically took Apple's secure ROM there are dumps of it that you can find online and I put it into IDA and reverse engineered the Secure ROMs USB stack basically back to source and then re-implemented it in C And so this was a rather painful process But the end result was that I was able to make my iPhone appear to my laptop as a special TTRW USB device And with that the only step left in actually implementing a debugger is Implementing the GDB stub this is pretty easy as compared to kind of the other stuff in this project The GDB specification is open source basically just a bunch of parsing and then driving the external debug interface And once that was done. I had the ability to debug a production iPhone Over USB no special cables. No leak software involved Yeah, it was pretty cool So here I'll do a hopefully very quick demo of how to operate this debugger. So I have an iPhone which You can see here right now you're able to see the Kind of the screenshot of it on the laptop But as soon as I operate the debugger the USB stack will be taken over and you'll no longer be able to see This part of it. So What I'll do is I'll simply start the app that loads the kernel extension And so once that's running we'll lose Connectivity with advice, but we can connect to it with LLDB and Yeah, okay, so LLDB has recognized This device as an iOS device an iOS kernel cache It's discovered the load address and it's halted the kernel so we can now resume execution Now I can't show this on the display But for those of you in person you can see that the device is still responsive You can do things like load apps and yet there's still a kernel debugger attached to the device So we can do things for example, I'll set a break point on the sys to call min core All right, so we have a break point set now I have an application on the device that is simply going to call min core with very distinctive arguments It is possible to load an app onto the device over Wi-Fi even once the USB hardware has been co-opted But for this demo, I'm just going to have the app pre-installed the device I'm going to click on the application icon and it basically immediately halts CP the phone is no longer responsive because we're halted a break point We can do things like get a backtrace. We can examine registers So look at the memory point to do by register x1 and we can indeed see our arguments that were passed from user space We can do things like set watch points kind of all of your standard debugging functionality Hey So we'll set a watch point on this memory address and resume execution and we basically immediately hit the watch point and You can see the instruction that triggered this watch point loads x10 and x11 and These are indeed the values that we expect so watch points seem to function correctly We can disable the break point and the watch point and resume execution The app runs again your phone is responsive. So basically full-featured kernel debugger Cool, so thank you very much the debugger source code is available on the Google project zero github I also wrote a blog post kind of describing in more detail the process of finding the KTRR bypass This was a really really fun project and I'm really Excited to hopefully make Kernel debugging on the iPhone just a little bit easier Future versions will probably be based on the boot ROM exploit, which I'm really excited to see what comes out of that So, thank you Thank you very much So we have five minutes left for a Q&A. Please queue up on the microphones in between microphone one two three four we have some more so and Maybe you have questions from the signal angel signal angel No questions from the signal angel so microphone one please Yeah, thanks for the amazing talk at the beginning you showed us a tweet of the exploit and you said that Everything you could do is possible with this one as well and it said that it's not patchable So do you see any problems regarding security or anything using such a technique? Is it possible to run it like without I Don't know having the iPhone unlocked and is there any way to sort of abuse this which Do you mean the boot ROM bug or do you mean the debugging registers used here or both rather? Yeah, just everything all the above I Don't really know This isn't really kind of my area of expertise I can see you know some people might be able to leverage these types of vulnerabilities for you know proximal physical attacks The debugging registers that I'm using here aren't really all that useful For a remote attack because you encounter that problem or you know CPU resets and the KTR bypass gets lost And really once you have a kernel code execution You should really consider your device fully compromised anyway So I don't really think that the debug registers or security issue the boot ROM, you know, maybe for physical stuff, but It depends on your threat model. Thank you microphone for please Did you have a look into the Linux kernel for the design word to core driver because it's in drivers USB dvc too I think yeah, so this was actually really funny Basically as soon as I had finished implementing the USB stack and I'd got it working I realized that the reason I couldn't find any open-source drivers online was because I was searching for the wrong things in Google I'm just really bad at googling and the files containing the driver for operating it in Device mode were just named something different than I expected so You learn as you go Great. Thanks microphone one please Hi, great. I really enjoyed it So I have a quick comment and then a question so comment is This is the first time this is publicly revealed But the Vita was actually the trust zone was first dumped exactly the same way through the core site register So that was 2014. I thought it's pretty funny seeing this this still happening again and again my question is you said you reversed the The USB from secure on so did you find checkmate? So first about your comment definitely I Know that there are tons of people who have found similar capabilities basically nothing that I've done in this project is Original work all of it is building off of stuff which other people have done so absolutely. That's definitely the case About whether I discovered checkmate or not the first time I was looking at iBoot I basically saw the USB stack code and was like, oh my god This is so complicated. I want to avoid touching this if at all possible. So no, I completely missed that Thank you. So no more questions. Please another big round of applause for Brandon


Paterson, we are at the 13th annual St. Louis prototype mobler's meet. I'm doing an outdoor photo shoot. We're going to talk about this tablecloth. That's absolutely magnificent. This was the best hobby in the world. The What's Neat. The What's Neat. The What's Neat. What's Neat starts now. Catch the What's Neat podcast every week. And full episodes of What's Neat every month at the Model Reward Hobbyist YouTube page. Also be sure to check out the What's Neat this week video podcast on YouTube by typing in What's Neat this week. We record a show every week on Model Rewarding and What's Neu in the Hobby. What's Neu starts now. The What's Neat show is sponsored by Lombard Hobbies, your value hobby shop for over 40 years of modelers helping modelers. Big inventory, value pricing, fast shipping and great service. Additional support is provided by Walthers Trains. Everything you need to build a great model railroad. Check out their website at Walthers.com. And by Bachman Trains. Now that's the way to run a railroad. Check out their website at BachmanTrains.com. And thank you for helping us support the best hobby in the world. This is What's Neat for February 2022. I'm your host Ken Patterson and this month we have a great show in that. Jennifer Kirk, all the way from the UK, has a great video this month, great production values. And she's now working with us on the What's Neat show throughout this year of 2022. This month she shares with us how to work with static grass and the various types of application methods to add static grass to your layout, including lots of ground foam and also in addition flowers. It's a great segment by Jennifer Kirk this month on What's Neat. Also we've got some fantastic drone footage from our drone pilot Dan Scheidel. He shares with us the Missouri Pacific Heritage Unit as it runs through snow and some magnificent scenery and modeling ideas from above. I love doing this segment in that it shows you a great perspective the way we view our layouts from the air from just that right height. Whereas you can see the color treatment of everything, the way trees should look, the way scenery should look, all of the answers to our modeling questions are right there in this video footage. Also this month I share a segment on how I built the shelves that hold all the trains that are the background for the podcast. It's a very short segment. It's a very easy process of stair stepping up one by fours in order to create the whole unit that actually holds the trains perfectly for display. Also in this video we've got our guest Larry Harrington from Bachman trains in Philadelphia, Pennsylvania and he shares with us some of the new products, these wonderful Amtrak charger locomotives, new paint skinks for this year, end scale. Yes, they're coming out with end scale chargers as well. So look forward to that segment in this month's video. Also Walthers has announced their National Monoero Build Off Contest for 2022. They've included a brand new contest for this year that they've never done before and that's end scale. So the end scalers out there can also work on this, creating a scene. They're giving away over $7,000 in prizes to the winners. You've asked for it so they've changed it up again by adding end scale this year, the third annual year that they're doing this. All the entries and all the folks that win the prizes will be then eligible to be finalists in the People's Choice Awards with one winner determined overall with votes being received via social media. So look forward to that. For more information on that you can go to the Walthers website and look it up at www.walthers.com.nmrbo22 for more details on this contest. It's really exciting that they're doing this and it's a good way to add just a little bit of extra budget for your modeling experiences. Now I'd also like to say please check out the What Sneaked this week in model-rewarding video podcast that we shoot every Saturday night down here in the studio. We bring in guests. We bring in all the new products that are announced all week long. We're very immediate in that if it's new you're going to learn about it within just a couple of days of the announcement. That's the beauty of the weekly show that we produce. So with that let's continue on with the rest of this February 2022 What Sneaked. What Sneaked. I'm Jennifer Kirk and today I want to talk to you a little bit about static grass and how you can get the most out of your model. And today we're going to be looking at a few products that allow you to lay some really quite long static grass that's a little bit more tricky to do with your regular applicator. Up to 12mm in fibre length and that gives you a really great overgrown unkempt type of terrain which is what we're all striving for on our models. We've all become really really used to the static grass that has really made a difference to our modeling. And I've got the regular sizes of grass here and these are really easy to apply using a standard static grass applicator. But what if you want to go up to a really long fibre length? All that's going to happen is that this is going to become choked and you're going to get nothing coming out of the end. As an example if we wanted to use something like 12mm static grass or 10mm static grass that's just going to clog up the static grass applicator. So instead we need to step up to a bigger size with a bigger gauze on the bottom. For that application I've got a Pro static grass applicator. As you can see it's much bigger and the hopper itself comes with interchangeable heads which go up to even the largest of gauzes. And this means that we can feed that extra long static grass through this and still get that great static grass effect. If you want to use this with smaller sized grass it's really easy to just swap out the gauze on the end. And use the variety of different sizes that come with it. And that means that this really is the jack of all trades that lets you do all manner of static grass work on your layout. The smaller applicators still do serve a great task. If you want to precision apply to a layout or you just want the shorter static grass then really that is a great way to go. But if you're dealing with a huge layout that has some really quite wild scenery then the Pro static grass applicator is perfect for that task. When it comes to adding flower effects that couldn't be simpler. We've got here some grades of fine scatter and they come in an easy storage container. As you can see they're really easy to apply. They're a fine sponge powder and they create a great effect. We can mix and match these colors to get the kind of terrain that we're looking for. For this it's always important to study prototype pictures because accurate trees and other forms of fauna are what make or break the believability of the modelled area that you're going for. When it comes to flowers we've also got something for those too. And it's really easy to just apply a fine sprinkle of these different coloured flower effects. Less is more with these as you'll see as we apply this to the model and it really is just a suggestion of the local flowers. Sometimes these look a bit garish in the bag but believe me the end result when you sprinkle them on is really effective. When it comes to powering the Pro Static Grass applicator it uses exactly the same 9 volt dry cell battery that the others use so you don't need any special power source for these. It's simply a case, twist off the end and fix the battery to the terminals. Then slide the battery back in and screw the end on firmly. It really is that simple. Filling the hopper is really easy. We just turn it the other way up, it balances itself and then we just unscrew the lid that has the gauze in. Then choose your static grass. I'm going to go for a mix and it's absolutely fine to mix different colours and lengths together in the tub. That gives you a really great unique random look which is just like nature. Just pull it apart with your fingers and drop it in. If you get a big clump just pull it apart a bit it just helps that static grass on its way. I'm going to mix this in with a few different colours just to get a slightly random effect. Now you don't want to fill the entire hopper to the brim. What we're going to aim for is about a quarter to a third full. You can always refill it part the way through the application. You don't need to rush, it really is quite forgiving on time. You could even come back another day and do another pass on the layout so you're really not in a rush to do this. When you're done filling it up take the gauze and we've chosen the largest gauze from the kit and that's just to ensure that those longer fibres can pass through and then carefully screw it back onto the top. Don't over tighten it just needs to be hand tight. When it comes to adhesive all you need is this as the magic ingredient. Static grass layering spray is a really great adhesive for making sure that you can build up layer after layer of static grass without it getting weak or drifting about your layout at a later date especially if you move that layout around. Stay to exhibitions or from location to location if you move house. This adhesive assures that everything stays just where it needs to be and it doesn't flatten down previous applications of static grass and now we're ready to move to the layout. This is the area that I'm looking to treat. Now it's already had a pass with the static grass applicator but this is much shorter grass and what I'm looking to do today is to build that up and give me a really authentic tangle of scrub land. If you've already got figures in place like we've got here it's just a simple case of just pull them out. We'll put them back in afterwards but it just makes sense to not bury the people in the grass. To take the layering spray now give the can a good shake and it's just like applying any kind of spray adhesive or paint from a can. Gentle strokes just move it backwards and forwards. You don't want to drown the pre-existing terrain with the glue it doesn't need a huge amount. It's always best to take on smaller areas at a time. You don't want to rush yourself. The grounding wire from the static grass applicator. You don't need to put a nail into your scenery although some people do advocate this it doesn't help at all. Instead you can either hold it and the static grass applicator will ground through you or if you don't like to do that it's even simpler just to clip it to the rails somewhere out of the way. Turn the static grass applicator on and then turn it over and just gently waft it backwards and forwards over the area that you're wanting to build up that extra layer of static grass. Give it a vigorous shake don't be frightened of it. Every once in a while just stop and add another layer of the static grass layering spray. You don't need to do this too frequently but you do need to have a layer in there just to help everything stick together. As you can see the glue isn't so heavy that it mats the previous grass down and that's what we want. We still need to keep that body and then we're back in with the static grass applicator building up that thicker wilder terrain. Periodically do check to make sure that the hopper hasn't run out. It's very very easy to get carried away and spend an awfully long time shaking nothing so do keep checking and if it needs filling up just put a few extra bits of the grass in and continue. As a top tip it's a great idea with a second pass perhaps to change the colour of the grass and it gives you a really nice random realistic long grass. Now that we're happy with this huge tangle of wild grass and brambles we move on to the next step. This is where we look to add in some extra texture and for this that's where we bring in that fine foliage. Picking our colour a tiny pinch and then just sprinkle randomly. Don't dwell on every single area you're just wanting a small amount here and there. Again less is more. Then we can add in another colour. I've chosen this algae colour. It's really quite bright but what we need to do is just take the tiniest of pinches and you can see that it adds a really effective highlight to the grass. It's like there's little flowers just coming into bloom. Some areas you can dwell a bit more other areas a little less. Cycling through the colours there really is a great range. The more colours you can just put the tiniest amount of in the better and more realistic your static grass will look. To secure that in place again we're back to the layering spray and it's just a quick blast over. If you want you can mute it down with a little bit more static grass. This is really useful if you find that perhaps you've put a little bit too much of the scatter in for your liking and you can just tone it down with another layer of the static grass. In this instance I want to move on to adding a suggestion of other coloured flowers. This is where we bring in these colours. You only need a very small amount of this. Again a tiny pinch from the bag and just a few flowers into that layering glue. We can add in another colour. Again these small bags go a really long way. And then another blast of the layering spray just to fix them. And in this instance I'm going to just tone it down just a little bit with an extra single pass with the static grass applicator. And that is all you need. The only thing left to do now is add back in any of the detail that you had to move out of the way. I left this tent in place. If you do find that you've got an object that's got a bit of static grass on it it's really easy. Just rub it off and it very very quickly just comes back to life. I'm just going to glue back on that detail that we removed. Don't worry about excessive glue. Be sparing but also use a glue that's going to work for this task. Which means something like a simple PVA is perfect for adding these little bits of detail back onto your model. And there we have it. Our little scene has been created in simply a matter of minutes. You can see that the static grass has kept its shape. It's lively. It sticks up and it even holds its shape even with the smallest of knocks. It is really easy to create that overgrown, unkempt, wild look to your static grass just by using this extra large applicator. With the layering spray and those extra fine scatters we can create all sorts of effects. And as you saw they really quickly and easily build up to a really professional finish. I hope you've enjoyed today's video and found it really informative. I'm Jenny Kirk. Thank you for watching. Enjoy seeing them and they absolutely fit perfect on the shelves. Now it was just a total coincidence that later on I discovered that in fact locomotives could then fit on the shelves perfectly just as well. It's a very simple design. It's simply built out of one by fours and I've done it as a T pattern and I step stared them up three shelves for each row of locomotives. So let's do this. Let's go into the shop. This will be really easy to show you how to do and let's design some shelves to hold your model trains for display. I started the process by taking one by fours that are completely straight with very few knots and I cut them on the radial armsaw. This shelf unit was going to be six feet long. Once all the wood was cut I ran the one by fours that will be the upright pieces through the bandsaw. Cutting these parts to be two and a half inches high creating the height for our shelves in between the models. I then like to use two inch wood screws. I countersink the screws into the top as you see the top rail is centered. The uprights that are two and a half inches long are then attached to the backside of the one by four creating a stair step type of a shelf design. I work my way along as I've got help here with Daniel helping me put this together. You can see the shelf next to it that's stained is the way this one will turn out. Again, simple stair stepping centering the one by fours on top of the two and a half inch pieces of wood. It makes for a very simple design. I continue screwing these sections together. This is the top rail you see me putting on the very top shelf again centered on top of the one by four. I then take a sander and I like to sand everything smooth before applying the stain. This alleviates any splinters and makes for a very nice finish when the polyurethane goes on. I also like to sand the edges. I put on red oak stain as you've seen me do in the past. This is the color treatment that I do to my entire layout room in my studio. I apply the stain liberally working my way up and around all the shelf pieces. And I do not wipe this off with a cloth. Once the stain's been applied with a two and a half inch brush, I simply let it dry overnight so that everything is then ready to accept a real nice high gloss coat of polyurethane. After the stain is dry, I come in with Minwax high gloss polyurethane and I like to put on three coats of this sanding in between coats giving me a very high gloss finish. It looks professional and it looks absolutely dynamite when all the trains are on the shelves on display. And that finishes this shelf unit which I then installed into my two by twelve dimensional lumber, simple household lumber into the shelves of the entire studio. This fits into place and I generally screw it down. For this segment of What's Neat in the February 2022 video, I've got with me Larry Harrington all the way from Philadelphia, Pennsylvania. Hey Larry, how are you today? Great. Ken, how are you doing today? I love it when you're on. It's great when we can keep the modelers updated directly with the manufacturers about what's going on in our industry. And today you've got some really cool stuff to talk about, don't you? Sure, we got lots of stuff that just came in recently and a few surprises as well. So you ready? I'll kick it off here. Absolutely fantastic, Larry. Give it a shot. Okay, a couple of things that we talked about before, but I just want to give everybody a quick update. We have all of our SC-44s that we announced earlier last year, the Coaster and also the Ace. They have shipped and they are the distributors and dealers now. The real exciting schemes are the day one Amtrak, which is getting tested right now in the real world. So we actually delivered before Amtrak did to revenue service anyway, and there's the phase six version, which is pretty cool. This has also been delivered to distributors and dealers. Now we do have a few quantities that haven't shipped yet that we'll have in stock, but everybody's got their initial orders that had them on order before December 1st, and I'm sure we got some orders after that point, but they'll be covered after the fact. Another new product that we got is our concrete track. Yes.  I do. Exactly. So we started out this with straight 18-inch terminal re-railer and also 22-inch curves, and we'll be announcing a few more pieces in our 2022 catalog as well. This is kind of a neat addition. We've been concentrating on the high-speed rail lines of Amtrak and modern items, and so this is a perfect... It meets perfectly with our existing Easy Track, but it just has the concrete ties of detail instead of the wooden-tied detail. It does look fantastic. Just the fact that the concrete color is absolutely right, you nailed it on the track. I just used this track to shoot the Bachman 2022 corporate catalog cover, which we will be running in the March What's Neat video on how that setup went, along with this Amtrak locomotive that I got this charger at number 300 we used for that photograph. It came out dynamite. Very good. That always come out dynamite. Some really nice cover shots. My favorite is the Milwaukee Road E7 that you did a couple years ago for the Williams line. That was a three-rail shot where we did an area called Touchy, Illinois, and it had a very characteristic bridge in the background. We copied a prototype photo. In fact, I'm going to show that shot right now on the screen. It was one of my favorites as well with a Hayawatha in it. Yeah. What was cool about it is we did both the front and rear shots. The front of the catalog had the locomotive and the back had the tail end of the passenger car. That is so true. That was neat. Speaking of three-rail, we have a few items that are not in stock yet, but they'll be in stock shortly. We're doing the egg liner in O-scale. This has been very popular in the large-scale line, so we decided to add it to the O-scale line. We have a number of different paint schemes. We've got the Independence Day, the ever-popular Christmas one. We also have, I'll show you the boxed version here. Nice. We have the Halloween version. Of course, the egg should be an Easter version as well. We got those four items coming in shortly. A lot of people don't realize about that egg liner is there is a prototype for that. In fact, they designed and built a yard tower with two ends of those tail ends of the passenger cars, butted them together exactly like the A-line and put it up on stilts. They did. It's from the New York Central Yard Office, exactly. One item we've been working on, we've announced already, but we got our paint samples in recently. This is our K-4 streamlined version for N-scale. This will have the economy soundtrack sound package in it. You notice we have an operating coupler on the front. Some people want that for double-heading and also running the locomotive in reverse. But for a streamlined look, we've added a small dummy snap-in that we can replace the coupler with. This is what the locomotive normally looks like when it's in a conscious with passenger cars. Very nice. It's just one screw and you snap it in place. It's really easy to change out. We started doing that on a number of our locomotives, so you can have the option of having a coupler or not having a coupler on the front. Larry, I was honored to have George Bugatuck and his wonderful wife were here yesterday, in fact, in the studio on their way passing through. It was great to see George. I mean, Soundtracks is top notch. Yes, they are. They've been working with them for a long time. We've got a couple of things that are kind of not even announced yet, but we kind of teased about this on our social media. But this is the end-scale version of the ALC-42. So we've got the, it's an army green, but it's just whatever paint they had when they were doing the thing. But there's the HO version versus the end-scale version. So this will have a full sound package, and this sound package comes from TCS. Right. This is a full wow sound package, and this will have virtually all the functions that the HO version, including the light-up Carter light on the side of the locomotive. It will have, this version doesn't have operating strobes, but strobes, but the SC-44 will. And we had to do either, an either or situation, do the tight space in the cab here. The ALC-42 will have operating light number boards, and the SC-44 will have operating strobes. So it's one or the other, because they're too close in there to be interfering with each other optically. So that's why we did that. So that'll be in development right now. This is our first test shot, and we're working with TCS right now to get the sound just right. It's the same sound recordings. It's the same sound decoder that's in, obviously in a smaller package that's in the HO, but the functions and features will all be there. So it's real exciting. We started with, we did some 3D printing ahead of time so that we could get the decoder sized and fit in there properly before we even had our first test shot. It's amazing to me how 3D printing has not only taken over the modeling aspect of our hobby at this point, that's all we talk about on the podcast is 3D printing. It seems like almost every episode of the show, but now you're utilizing it as well for pre-production work. Exactly. It comes in very handy, especially when you're dealing with electronics, you have to make sure that they can fit. So it's critical. You can use a drawing so much, but once you start to put things together, you have to have the clearances and make sure they're not going to overheat and all that stuff. Yeah, that's awesome. Finally, I just came in today so we walked out. We have our first test sample of our Express Reefer. So this is a painted silver sample, but I haven't completely reviewed it yet, but it looks pretty good for overall. This is a New York Central prototype. Okay. So it'll be released sometime this year. That is fantastic. Four paint schemes. So that's what I have for today. That is absolutely awesome. All the viewers of the show love it when you or Doug Blaine come on the show and show us the latest updates. In the December video, all the new Christmas products were fantastic. That we got the review. So thank you so much for that. No problem. Thanks for having us. We appreciate it. And so with that, guys, that wraps up this February video, and that is this segment for What's Neat. All the products seen on this episode of What's Neat are available from Lombard Hobbies in Lombard, Illinois. Or order online at LombardHobby.com. Walthers Trains, supporting hobby retailers across the world since 1932. Check out their website and learn more at Walthers.com. Bachman Trains. Now that's the way to run a railroad. Check out their website at BachmanTrains.com.


Now, VOA Learning English, the team who brought you Let's Learn English, presents a new course for young learners. Let's Learn English with Anna. Hi! I am Anna. Welcome to my treehouse! It's a 40-lesson multimedia course for early English learners from 8 to 12 years old, with fun activities for the whole family. Panda. Party. Pup. Pup. Now, you can try. Now we go back to- You can watch the 5-minute videos in English or in Amharic in English. That is our question for today. How do you feel? You're 10 years old! Visit Anna in her treehouse with her helper Max to learn English. And I am Max. That is Max. Max is an E mailbox. In her treehouse, Anna teaches basic reading and writing skills, using fun objects and songs. Days of the Week. Monday and Tuesday. Meet Anna's young friends. Hear how they talk in English about their daily lives. On Saturdays, I like to play soccer or baseball. Today is Monday. I go to school on Monday. Superhero Day. Explore the world in English with Anna. In each episode, she takes you somewhere new. Party. And there are lesson plans to help teachers teach and evaluate English-speaking and writing skills.