Welcome to this May Day version of the Development Reboard. Call this meeting to order. This is a in-person meeting. We have no remote attendees. I guess to check the box Meredith, I'll let you do your, do your spiel. I guess we can do that first. Yeah. It's been so long since I've done a whole meeting. Introducing members starting on my left. Kevin O'Connell, board member. Meredith Crandall, staff. Rob Goodwin chair. Joe Karen and board member. Wonderful. Wonderful. So now Meredith will talk about our procedures. Yep. And so this is, this is definitely for people who might be watching tonight over work on media streaming this. I'm going to share my screen for you so that you'll know how to get on tonight's meeting if you so wish. So. Get my little spiel. So for anyone who is viewing tonight's development review board meeting via work on media, you can participate in tonight's meeting via the zoom platform, either with video access options or just over the telephone. You can type this link into your browser and it will bring you into the zoom platform. And that way you would be able to actually have video over your computer or smartphone and be able to see what's going on, see what we do when we share screens as well as be able to ask questions and interact. Alternatively, you can dial in via your phone and plug in this meeting ID when you're prompted. And I'll let you into the meeting and you'll be able to hear everything over your phone as well as ask questions and speak with us. If you try to log into the meeting and you have problems, please email me at mcrandall at montpillier-vt.org. If anyone does decide to get on via zoom know that turning your video on is optional. And when you do, if you do log in that way, please change your name in zoom to both your first and last name. That way we will know who has logged in and be able to call on you when appropriate. Please also make sure to keep your microphone on mute if you log in over zoom. That way it will reduce background noise. In the event the public is unable to access tonight's meeting, it will need to be continued to a time and place certain. And I will know about that because I will be monitoring my email throughout tonight's meeting. I will now hand the meeting back over to the chair. All right. Thank you, Meredith. And welcome to Catherine Burgess. Glad to have you. No, we're all right. Do we have a motion for the agenda? I submit a motion to approve the agenda. Second motion by Kevin second by Joe. Those in favor of the agenda being approved say hi. Hi. Gender is approved. Okay. So first of all, a few comments tonight. We are sad to see Abby have this as her last meeting. And we really thank you for your time over the last several years. Thank you, Kevin. Great. And pinch it a couple of times to be the chair, which was awesome. So thank you for that. And I also want to crutch that Kevin on the, another 25 year term on the DRB. Thank you, Kevin. It's been great having you. And so glad that you are willing to continue to, to be a part of this. I think we'll have a lot of good presentations this evening. So I have to seven by street is one of them. And. 2481. Melton street is the second and then Bailey have his third. Feel free once you're done with your application, you don't have to stick around for the entire meeting. Feel free to go. Our last one is actually. Applicants here on the board and. Be doing musical chairs. So. We look like we moved the approval of the minutes to the end. I know we haven't changed the, which is fine to change the procedures for all the procedures yet, but I'll put it there and I just left it. It's just fine. I like it. I like that. So. The first application five to seven vine street, just to give you guys a preview of sort of how this process works. If you haven't been here before. We will swear everyone in it's going to. Sketch plan. Sketch plan. We don't have to do that until you get to Jeff. That's right. Oh, this tricks me up. Oh, this tricks me up. Okay. Well, that being said, we'll skip that. If you want to come up. To the microphone and introduce yourself. It just makes you're seated and. Just make sure you're into the microphone. So the recording secretary can hear you. Yeah, cause this will be the, the video that ends up getting posted on the website for people to be able to view. My name is John Miller. And. And Maureen Miller. Wonderful. Okay. And so you are both here for the vine street application. Yes. Yeah, great. So Meredith want to give a brief technical overview. And then we can turn it over to you all for a. Summary from your perspective. So this is a sketch plan subdivision. So as the board's pretty familiar with, you don't actually make any decisions tonight, but this is an opportunity to give the applicants feedback on any questions you may have things you might see as missing or needing some elaboration in the application before they come back for the final application for subdivision. So this is a, it's a already developed parcel. It already has two homes on it. They're separate. Separate buildings and there's a shared driveway. And so the proposal is to subdivide this into two different parcels continue with a shared driveway with the driveway being on one parcel. And there's, there's not a lot of complications to it. There's a little bit of the, the. Little bit of a twist and that there's no proposal to add that a second driveway.  As well as. What we've done previously in other applications where we want to see a copy as a deed or something else to show that. The person who doesn't actually own the driveway has rights to use it in clarity on, on those types of situations, but otherwise the, um, I don't see any red flags with the application. Right. Thank you, Meredith. Um, yes, just want to maybe provide a little summary or summary of your project that gets brought up to speed on what you're proposing and. Fund this property for 35 years. Two houses have been rentals all of that time. Um, We can't really do it anymore. It's a little too taxing. We're getting on in years and. We're ready to move on. And it's a cumbersome property because. There aren't too many left in my pillar that are single fat, two single family homes on a single plot of land. We actually bought it from the. The butlers, Charles butlers and, and all. And they actually had the family in both houses. Um, which was, which was pretty unique as well. But again, that was a long time ago. Um, we're just, we were just excited to see that the, uh, zoning had changed. Um, in such a manner that is. Is ideal for kind of getting rid of these. Anomaly. Land uses that it's just really like in the meadow, everybody is. You know, there's, there's a lot of condominiums, but they're almost always in the same building sharing a law. Uh, I don't know if too many other properties that still exist. I know I know of a few, but not in the meadow anyway. And the meadow is, is getting much tighter packed. Uh, there's a lot of, uh, Seems to be a lot of activity and increasing the. The amount of units in certain buildings and so forth. And this is a great opportunity to, to break these two apart. Um, The shared driveway situation has been working flawlessly for all of this time because it's a nice big, wide driveway. It's flat. It's straight. It's short. And it's got plenty of room on one side for parking. So, um, that's all been kind of figured out. And, um, the utilities run under the driveway to the back house, which is as it should be the front house has its own sewer and water system that runs nowhere near the driveway. So really the houses are, are completely separate. The other thing that's of interest is the, um, The back house, which is number five has a large backyard, which was always kind of shared by the two houses. But I need to say that it was a rare day when anybody from the front house ever went into that backyard because it was the backyard that the kitchen window and the, and so forth of the back house looked out on. So they've always really owned it in, in reality. Um, and the subdivision seems to take care of that perfectly. It just seems like it's exactly why the zoning was changed. And I don't know what else can I tell you? I do. The discussion of the sharing the driveway is interesting. Um, should I just pass these out or? Yeah. Um, You can just give them down one end and we'll pass them down. Um, I don't know if there's enough, but there's some, I think it's five or five of them. Yeah. I can get one later. But, um, I think we got Jim Palmos auto to try to clarify the, the message that the, that the, the two houses when they're separated will share all the maintenance. Of the driveway and any repairs and plowing and so forth. Again, it's really small. We don't plow. Uh, somebody with a snow blower takes care of it. It's worked all this time and it's not disruptive. So I'm sure that that's how it would continue. Um, I don't know. I don't know. Um, he wrote it up pretty nice so that the, it's an easement for the, um, For the front house or the number seven vine street to use the driveway and the parking spaces and. Is even indicated on a site plan or, um, that's, that's a separate element, but indicated where the parking spaces would be located. And, uh, and so there's a lot of, uh, you know, There's a lot of, there's a lot of a lot of people bump out there with, uh, with a Nizalia plant or not a fire bush and a little bit of, uh, Rock work around it that actually defines those. Defines those parking places. Go ahead, Kevin. Yeah. So, uh, is there one water connection for both houses and that, that so they have their own separate. Attachment to city water. Yes. And then sewer as well. Yeah. Yeah. John, you said you had brought the site plan that I have electronically. Yes. Right. Do you want to pass that around? Cause this, so the, the sketch plan that you have right now. Doesn't have where the water lines run and everything. And that was one of the things I called out in my staff report. And they actually have an updated one now. And I, I can also share screens. You guys. Yeah. I mean, I just, I just remember some of the older houses in the old neighborhood. We'd have one water connection for, you know, five or six. Yeah. Yeah. I mean, there's still, department of public works is still dealing with those. So this shows where the water line, there's a water line here. Water line here. And this is showing. So this will be a version of a new site plan that will come in with the final application. So there's designated parking spots here. We have that. We don't know yet. Yeah. I don't see the sewer on here. I just see the water. Yeah. So this could be something that's just cleaned up before. Yeah. And the back house it travels the entire length of the drive. Okay. Yeah. So we've got, yeah, because we have the electric and we have water, but just for the final application, I don't see sewer on here. Um, No, who would have that? Department of Public Works. Oh, okay. Potentially. Um, Yeah, I think the biggest concern is to make sure that. But, but you don't need any easement or access to maintain. Yeah. I think a testing that that's where they run. Um, as well as, you know, department of public works for the final will confirm that there's separate. Um, I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. The owner of the driveway is the house in the rear. And so the house on the left there. Seven, I guess we're going to have an easement for the driveway, but the person who owns the driveway will also have their utilities under that driveway. Yes. Okay. Yeah. Yeah. I don't know. I don't know. Did you get a chance to review the staff report? I did. Yes. All right. So there any, any questions and issues in there about moving forward or what not? It didn't seem to be anything. I mean, there was the issue of the language. Yeah. Yeah. Which we've been working on just to make sure that. That's going to be easily understood. And then there was some question about a nearby fire hydrant, which. So where, where there's a fire hydrant. On fine street. Well, I'll be able to help you find that. Yeah. I'll be able to help you find that. We'll walk around the neighborhood. I've got them all on my, my mapping software in the office. Honestly, I've never seen one here. There might be one near Meadow, Mars. I bet, I bet we can find it. And it'll, it'll work out. Well, you and I'll have a meeting this week. Great. Oh. Yeah. I mean, a lot of these issues, it's like, you know, it's like this part of the process where it's like, we don't need to run through and like address them and just to make sure that. Any big issues that look like they needed addressing. Yeah. You know, it was, it seemed like there were a few details that were like something about 20 years. But I believe that Jim wrote it forever. Yeah. So I don't think that would be a problem. So you mentioned that the, the, there's a rear yard here for the five by fine street. Yeah. Parcel. Yes. And so it looks like it's shown here as like a separate. Lot almost. No. Those are setbacks. Yeah. These are the setbacks. This little line, I think, is because that maybe used to be a separate parcel at one point. It got merged. So that little line, I not quite, is it on the. Key. Yeah. So there's a, there's a right of way here, I think for maybe utilities or something. Okay. But it's not, it's not a parcel line, the bold lines of the parcel lines. Does that make sense? I mean, it just, it looks like an interior lot line. You know, to me and I don't know, I think it would. Make sense to call it out to just say that there's not too lots there. But it just, it's got a book and a page called out on the plat. As separate than the five vine street. Wait, wait. Right. So, oh wait, because you're looking at that. Right. Not the. Now I see what you're talking about. I think it was a. It could very well be another parcel line. I think it's just. Yeah. Yeah. We'll, we'll clear it up with Richard. Separately. Yeah. The original owners make sense. I think it, it would just. It's only been two owners in all these years. Right. Butlers. For what? Hundred years. So what do you want it to look like? I mean, I think, I think it would just be, make sense that like the. To just clarify that that line is going to go away if it exists. So Richard Bell could tell you exactly what it is.  I'm sure we. Looks like you use the same designation to use for setbacks. Yeah. Yeah. Well, so there's, well, so there's the. Right. Cause. Cause it's also. Rob's looking at the draft. That you submitted versus what I have up on the screen right now. Is the site plan. Right. So the site plan shows the setbacks. But this line here. Don't see where my hand is on there. That's the one that's a little funky because it's got this line here. It's got a lot of dashes that's very much like the bold property boundaries here. Yeah. And just say, right. I think because he's not. It may be because it's not 100% clear. On the deeds. What. What happened there? Yeah, I would just, I think that it would be mature bell. I want to do. Yeah. He understands. I'm sure. So. Yeah. All right. That's really all I had for questions on this. Like. Yeah, there's some issues to address, but it seems like you're working very well with Meredith and what not to, you know, address them and that's what this process is for to do a weather report. So anyone else have any. I'm pretty satisfied. I mean, to me, the, the issue was utilities and. Yeah. You've answered that. Is there anything else you would want to hear from us? No, I think you've done a great job and. You're teasing crossing your eyes and you're on the right track. So anyone else. Yeah, wonderful. Thanks. I'll work with you guys and. Feel free to. To be an email tomorrow with when you are. Want to try and meet. Over the next couple of days. I won't be in the office on Friday, but I'll be in the office the next. You've been great. Yes. We appreciate it. And can I get one copy at least of my. No, I don't need none.  Oh, big site plan. Yeah. That would be. Not that. That's probably in the process of changing anyway. Great. Well, thank you so much. You're welcome so much. Got tired of climbing up on the roof and cleaning the gutters. I have. I have a lot of work to do. I have a lot of work to do. But with ours, there's a couple of really huge pine trees. Beautiful. Yeah. But the entire. Every porch roof is like. Got six inches of pine. Every time. Yeah, I know.  We have to do it all. You couldn't. Rent them at a reasonable price, which is us. Yeah. Always. Always below market. Reasonable. We have to do all the work ourselves. If we had hired that work, then they would be paying. A couple of thousand dollars a month or whatever people paid today. And we've just always gotten to know our tenants and really care about them. So we are done though. We have some luck, right? Yeah. Yes. Yeah. Right. So the next application is our. 2481 Elm Street. Chris and Marcus. Paul. That doesn't do. I'm cool. I'm Chris Hammer. And I want to fill out the application. Paul was like a country somewhere. But I'm really just being. Support for Paul. So he's the guy who initiated the project. And I'll Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. Paul. I'll Paul Markowitz. Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. I'll Paul Markowitz. Alright. Thank you. So. Meredith, do you want to just start it here? Yeah. It's just a second. Perfect. Uh, so. Uh, this is another sketch plan subdivision. And a fun little twist on this one is that the smaller parcel being created is actually currently developed. It's developed with a community guard. And that's one of the few things that could actually be on that land because pretty much the whole section of land, this end of the existing bigger parcel is within the flood plane. A large part of it is also within the river corridor, which is an area of land that needs to be kept free of really any big structures because it's an area where under our river hazard area regulations, we want the river to be able to move should it need to because natural rivers move and shift their banks. And so there is very, very little that could be built on this piece of land, but agriculture is an allowable use. So this is actually one of the things that could happen and have this be subdivided and still be used. So it's a nice little combination of circumstances. The remainder of the parcel is going to remain as is. There weren't really any big red flags on that one. You've seen the staff report. So time for questions and feedback. Perfect.  Closer to the microphone, Paul, because you're, I thought I'd just give a little background on how we got to this point. So the land was owned by Donnie Goat, had been in his family maybe 40 years or so. And Donnie had a serious illness. He passed actually about two months ago or so and he was sick for a while, quite a while, and he had deeded the land and given power of attorney to three people whose name Tina Gallison is the principal person to that. Anyhow, they had made it clear that when Donnie died, and we've known he was impending that he was going to be dying, he was in hospice, that the land was going to be sold. They were going to sell the land. And we realized that it was an opportunity that if the land was like it had been a community garden for about 35 years, and the land was sold, there was going to be no guarantee that the property would be able to remain as a community garden. So I approached the Tina and on her behalf, she reached out to Donnie Goat, I had actually suggested something like a conservation easement, and they got back to me and basically said that he wanted to donate the land to the city. I was pleasantly surprised and happy to hear that. And so back in the fall we applied for and got a grant from the Conservation Commission to cover basically the cost of doing the survey for the set the boundary for the lot, as well as any legal costs associated with the transfer. We have made it clear to Tina Gallison that she doesn't have to do, there's no expense to her, no effort for her, we'll do all the work associated with that. It turns out that to get the minimum two acre lot side that it almost perfectly coincides with the existing parcel where the community garden is, the boundary, the property is great. Basically straight shot from the road to the river and covers the two acres of the community garden. You know, what else we're actually really excited at the idea that I was telling somebody that it feels like we're going from being a renter to an owner, be a member of the city. I don't know. So that's kind of the background, we're really excited, community gardeners, we have about 20 somewhat gardeners there, about 30 plots or so, the overall parcel is about two acres, maybe about an acre of it is actually in garden, river bottom, really fertile land. So, there he is, and the agreement with the land owner, current land owner is they wanted to see the garden, the land continue as a community garden. So we've actually put together a draft deed said that the land is going to be restricted to cultural purposes and as a community garden. That was their primary interest. She is expressed to me that her interest is in carrying out the wishes of her friend Donnie passed away to make sure this land continues as a community garden that his fathers offered to the gardeners there, you know, 35 years ago, so I don't know. There are no structures at all on the land. I mean, other than like a little shed or something, but nothing more substantive than that. So excuse me for actually asking a question that might be obvious, but so why does it need to be a subdivision? Well, the owners are going to sell the property, they're going to sell the entire parcel. Right. So we're talking about peeling off two acres. Oh, the total of the total. OK, what's the size of the total? It's 13.2. OK, thank you. Yeah, that's what I'm looking for. That's fine. Yeah, and just to be clear that the land, once we go through all this, that the land would be owned by the city. And so we've been in conversations with the city about, you know, what would this what do we need to do to make sure they're comfortable with that, you know, from our side, the gardener's side to make that happen. But they don't have the plan. So, yes, I know that garden has been there forever, pretty much. What is the water source of the north branch? Huh? Excuse me, the northern branch. Yeah, that's what I thought. Yeah, we don't have any. That's a potential future upgrade. But basically, you want water, you haul it from the river. So, yeah, yeah. And there's also rain, too. That's always a good thing. We're a big fan, which we have plenty of right now. We're really good rain bikes to be saying. So the fact about the deed restricting the use of it, I think, it's kind of important here, helpful, I guess, here, you know, just because we're approving this subdivision, creating a line of perpetuity, someone comes along and is like, well, no, I want to build a house. But like, well, it's in a flood plain. You can. We would think about ways to, you know, communicate that during this process that like, well, yeah, like you look at this map and 75, 80% of this is not buildable. Um, I guess my question is, I don't know the answer to it is whether we require at least some version of the. River corridor in the flood plain depicted on the plot to sort of, you know, not just parcel one, maybe that's a comment you made, but I can't remember if I put that in here and not, um, but I think that even if it's not on the plot, you could require that on a site plan. We can easily add that. Yeah, to show where the river corridor and then the flood plain limits are. I think that would be definitely doable. By the way, we have a shared draft copy of the deed with the city's turning and he's signed off on it or not officially, but basically some of those. Yeah, so that that could also be something. If you want to see that and how that be part of the file. Yeah, I mean, just so you can see the language and then it's, I don't know that, yeah, that that could be an attestation.  If that makes sense.  And there's going to be some language for the city that this is going to be, you know, a parcel specific before a community garden. Somehow noting that condition on the survey, because the survey also gets recorded, could be helpful in the future for, you know, someone just being reminded that there's only one thing you can do with this, you know, with this land. So the, so when for the subdivision process, right? A lot of times you can have a subdivision and somebody will subdivide the land and record that final plat in the city land records before it's actually transferred, right? Before you do the exchanging of deeds and all of that. Sometimes you do it all together.  If you sequence that so that on the same day, everybody was also signing, recording the deeds. And that's just possible because you have to sign off on that. Yeah. Plat. Right. Um, but if you can do that in that way, the plat will have a deed reference on it, or at least a note that says, you know, at the same time, a deed with use restrictions, and you can put the name of it was recorded in the land records. And that's a note, a new note on this plat so that somebody who only sees the plat still sees where the new deed is, right? Cause right now it's plat is only referencing prior deeds as notes on it as to where other lines came from, where other information came from. Sounds easy. And I think the surveyor, I think intended to record the plat after, I mean, it could be simultaneous, but I'm assuming that she'll be able to reference a new deed. Well, cause you can't, you can't create the partial and transfer the land until the survey is done. And I mean, I don't need to call out the exact open page. You can put a note on the plat that says like a lot one to be conserved for whatever language is in that deed, community garden. Like that is enough of a notice that says, Oh, okay. I'd better go look for that. Yeah. So the time the city council has to obviously approve the deed. So you're saying after that happens, when the signing of the deed happens, then then it's, well, how about, how about, how about we talk so that we can go through everything that we want to put in the final application? Okay. Um, and how, because I, I am not up to speed on everything you have done with the city for the transfer. So we'll work out the details. But I think, I think what Rob just said about having a note in here that says this land, you know, which is it proposed lot one shall be conserved via deed restrictions for, and then whatever language you've got in the language that you're running through for the deed. Um, and that can be something also that, you know, the city attorney can probably take a look at to make sure it's just consistent with the way they want it referenced. That should be pretty easy to add. Yeah. It's, it'll be an easy, it'll be an easy note to add. Um, and that's just, it's, like Rob said, it's a little red flag for whoever looks at the plat. It goes, ooh, I better go find that deed right now. Yeah. Oh, you know, the community garden has been in existence for a long time. Hopefully it will continue to be in existence for a long time, but you never know what happens. Yeah. I mean, those two things that the river corridor, flood limits, nothing that has to be like surveyed, certified, you know, by a, you know, elevation certificate or anything like that, you don't need to go down that road. But just like, you know, plotting what information the city has to give context to, you know, what the parcels look like. So your preference should be to have that on the planet itself. Oh, it doesn't need to be on the plat. I mean, a site plan. Yeah, we can add a site plan. Yeah. Use, use this basic information, but make it a site plan in front of them. It's all, it's all digital data. So you can add it to them. Yeah. And that's, I mean, the state's updating their maps by the end of the summer. So having that on the site plan makes more sense than would put on something recorded because those lines can change. Yeah. What else? No, I have a question. Yeah. There was a note in your comments, Meredith, about impervious surfaces on the other parcel. Yeah. Yeah. And what, what is it that you actually need from us related to that? So a general statement in the final application, right? It doesn't have to be exact because we know it, it means that the requirement as to, you know, an estimate of how many square feet of impervious surface are left on that parcel. So it's the, you know, like the footprint of the buildings and the, um, graveled driveways. We can, we can calculate that on Google. Yeah. Yeah. Yeah. So it was one of the things where I was able to do an estimate quickly on my stuff, but I was like, I'm not going to try and actually get it exact. And it's, you know, it's clearly going to be less than the max allowed, but it's just getting that as much as possible in those final applications. We want the data to be coming from you versus my filling it in. No, we can do that. Anything else? Any other questions? This is like mom and apple pie, right? Yeah. Somebody awesome. This is great. It doesn't get better than this, right? Yeah. I mean, one thing I could add, there was an issue that came up, it's actually Tina brought it up. She's dealing with subdivision in Williston where it's as much smaller parcel and they're having to get a state septic permit. And so she, she brought that up to me and I was like, that's going to be a drag. So I contacted a engineer in Waterbury and said, I need an estimate because I have to, Paul, you got to raise more money and they came back to us and said, because of the configuration of the law, and actually I was able to, you sent me the reference in the, in the state rules that because the existing septic system is more than 500 feet away from the law, what they're worried about is that you're taking off two acres. Maybe that's the place for the replacement septic. Clearly it's not floodplain. You couldn't put a replacement field there, but there's plenty of room on the existing law to have a replacement because initially, if you don't have that distance, you got to actually design a replacement field. If there hasn't been one already identified and that I have to happen before we could get, because we need to get a state subdivision permit as well. Sounds like we don't need to do that. So it's just a big relief. If you have something in writing from the state versus just the email you sent to Paul, maybe put that whatever you got in writing from the state in the final application. Yeah, I'm trying to get a confirmation of that from the state engineer. Awesome. And I haven't, you know, I've been created for months back and forth. The state, it takes a while sometimes. Your proposed language to about it only being a community garden is helpful. Yeah. So you can include that. Right. You definitely need a septic service for a community garden. I mean, we require them to go through that process to somewhere in our rigs. It's, so because of what the use is, DBW isn't going to make them. And we need, we need something from clarifying that they're not going to need those state permits. Right. Because I mean, they're out past city water and sewer. And so just confirmation that they don't need that because otherwise they would need to show that they can comply. Yeah. So yep, you were right on the right track with that one. Good. You guys, you guys got to it before, before I got to it in my staff report. So it was nice. I'd seen that the email, but we definitely need that something from the state. Yeah, shouldn't be an issue or worked at a farm where we're into this all the time and it should be a five sentence. Yeah, disclaimer. So the rules are pretty clear. Yeah. We probably should have a state employee confirm that our interpretation of the rules. Yeah. If you can. That's a really good thing. Yeah. So just in terms of timing for the phase two here on our application. So we're going to read work. This is my first time to this time. So we're going to resubmit with the information you've asked here that we're going to submit the final application. So when, once we do that, when can we get on the before the DRV again? So it'd be good if we had an email exchange about this tomorrow so that I can actually look back at my calendars. I believe we're taking applications right now for June 5th hearings. And because you don't need to go to design room. Email me tomorrow because I have to look at my list. It's a complicated list because May has an extra week in it. So it could be the deadlines this Friday. It could be next Friday, but call or email me tomorrow when I can look at the calendar on my wall. And that would get you on June 5th. That's the next available date. June 5th. June 5th would be the hearing date. And then the actual permit can't get issued until there's a written decision. And that just takes some time. And then as fast as we can. And there's a 30-day appeal period after the permit. There's a 30-day appeal period after the written decision is issued. That starts when it's signed by the chair or whoever chairs. It's not always a problem. Right. Thank you. Yeah. Thank you. I know you guys were trying to do this a lot sooner. It's just we hit the hurdles of what's required. We have to agree to use the garden from the current owners. You do. Starting today. Starting today. Yeah. Good. Thank you. Thank you. Thank you. Wait till the middle of July or August. Fresh to move this thing is a little bit off, but we want to keep it moving. So good. Well, thank you. And by the way, Meredith's been way helpful. So thank you. We know. Good to hear you. Have a good night all. Good night. Thank you. Have a good one. What was that last thing? Good bridge. I'm good. Have you done one turbo? Regarding. But like. Oh, yeah. There's a DGP restriction to bloodplain and we were put around the site plan to make sure that thanks for your service. Yeah.  Just state that we stand. Yeah. It's in my, it's in my staff report, but. Well, it's just like waiver of development rights, right? That's that. Oh, there's that video. So, so I think that's fine. The point they were trying to make was that the. Partial that has the house and business that has a septic. Yeah, they had failed to have to have something from the state clarifying that removal was laying. Is it gonna hurt those? So it's double because we have to look at both parcels right? Make sure. Yeah. Carving off the sheet stuff in the floodplain. I know exactly. Cool. Yeah. They made us. Yeah. Yeah. I had different emails. I go and pours out the town clerk emails from the like state for that like waiver. Oh my gosh. Well, that's I mean, that's basically what we're gonna make them do. Yeah, exactly file. Yeah. Um, right. Yeah, first I'm going to use myself excellent choice. Perfect. All right. I just go up there. And that's logged into zoom. So you logged in so you can share some screens or something to. Yeah, that's already a log in as long as you don't have to share anything and I wouldn't worry about it. That's recusal acknowledged. So yeah, don't little difference. Don't even touch anything. Just worry about the microphone. All right. So we do have to swear you and this is the real deal. So I do. Would you raise your right hand to be sworn in as witness? Do you follow me slayer or affirm that the testimony you're about to give is the truth, the whole truth, nothing but the truth under the pains and penalties of her tree. I did. Great. Um, it switched to surround. You want to go first and do your presentation. The narrative chime in. Sure. I can just give a quick overview of the project and some of the complications with it. Um, so I live at 17 Bailey Avenue, a single family home. We share a driveway with the neighbor actually very similar situation as to what was just before the board with an easement to use our driveway. So my house is very, very close to the property line because it's right on that driveway, basically, and that's the first issue is the setback issue. But into the project. There is a house is basically a two story box with four rooms in each box or each floor.  It's called a solarium in the official National Historic Register. But it's two stories and the bottom almost certainly used to be open, but it's been since glassed in and the upper story is also glassed in. It's like a sleeping porch off one of the bedrooms. Um, there's no foundation under it. It's just a porch with some glass on it. So it's not even Vermont really a three season space more of like a two season space. And then it's really not that pleasant in the summer either because all that glass acts like a greenhouse and it gets pretty hot in there and the house doesn't have air conditioning or anything. So it's just hot. Being totally uninsulated is just not terribly useful.  Everything's as cold as it is outside. Just doesn't get snow on it. Um, so the plan is to remove it entirely and rebuild it much in the same footprint of it will be two feet wider, two feet towards the back. Um, so no closer to either of the properties any of the side, but it will go back towards us towards the back of the property like two feet. Um, there'll be a foundation insulation. It will be a real part of the house. Um, and another major difference is right now there's a flat roof on top of it, much like a porch, it will become a peak through the flat roof is starting to it just directs water kind of back at the house, especially on the corners and is rotten away my eaves there. So that's going to have to get dealt with one way or another, whether the project got done or not with a peaked roof and a gutter system shouldn't be a problem anymore. Um, yeah, other than that, uh, one of the major issues with the project is that the building is in the national of contributing structure of the National Historic Register. It's in the application. Um, so I did have to get approval from the DRC, which I've gotten, um, I went before the historic preservation committee that gave me some pointers on what they would like to see. Uh, so honestly, they didn't have much. Um, just a couple of details about the Eve or the, what do you call it, the cornice at the top of the addition and, uh, there's a ice pass through that still exists and we're going to try and save the front of this ice pass through, it can't be functional anymore the way that the configuration of the new addition is going to be because of this little porch that's going to be kind of where it is now. Um, but on the inside, it will still remain the same. Um, we're not really changing anything on the inside of the house, except that the current entryway from the back porch is going to become a pantry and current bathroom is going to become an entryway. Um, yeah. Uh, in the addition, we're going to add a bathroom on both floors. So that will kind of bump up the number of bathrooms in the house right now. There's a single bathroom upstairs for the four bedrooms. Now there'll be two, which would be significant change, especially for my wife and I. Um, and yeah, downstairs would be a mudroom and then we're relocating the bathroom and that's about it. Joe, when was the original house built? Nineteen, 18, I believe. Same year, the road sucks one in the world series and, uh, we believe everything was original to the house except for the glass on this first story. So this seems to be like very two separate like application criteria. It's one is demolition. Part of a portion of a historic structure and the other is a setback waiver. Yep. This is just treated as two different reasons. They're here. That's just be organized and treat. This is two applications in a sense and maybe we just go over the setback criteria first. Yeah. And then we can tackle the other one. So the, uh, the newly put up for new zoning rate require that we grant a waiver. Wait. So this is a, it's not a choir that you grant a waiver, but it gives you the option to grant a waiver if the criteria are met. It's a because what, what's being requested for getting closer to the property line is within a range that's that the board is allowed to grant a waiver. It doesn't have to go to a variant stage or something more, more a higher tier. What's, what's the cutoff for that? For having to go to, uh, if the request was to have the building closer than five feet to the property line, you would have to go to a variance. And at that point it has to be that there's really no other way for you to use the property. Um, okay. We're not there. Okay. Which is great. We're in the waiver, waiver role, which is there's just the two criteria chunks, um, criteria were, um, from figure four zero two. So this is on page five of the staff report and that's actually has four parts to it. Um, but the, the allowing this addition to continue to be, is it six feet from the property line? Approximately, approximately six feet from the property line that allowing that won't alter the essential character of the neighborhood or district. Um, won't substantially or permanently impaired lawful use or development of adjacent property won't reduce access to renewable energy resources and won't be exorcist or which is going to be detrimental to the public welfare. And then the proposed development is beneficial or necessary for the continued reasonable use of the property. And this is just, you know, the, the current portion is the same distance from the property line. This is just continuing that for two additional feet. So my question, I'm sure there's a good answer for it. The, uh, the waiver analysis versus the, uh, like enlargement of a non-forming structure analysis. Okay. So I actually had this conversation with Mike earlier today because we were talking about something else. Um, so a non-conforming structure is one that does not currently comply with the zoning regulations, the existing zoning regulations. But when it was constructed, it could have gotten a permit at that time, right? For the, for the right, or there was no need for a permit when it was built, right? Which is the situation, the situation. Yeah. So yes, this is a non-conforming structure right now for the setbacks. However, Joe is here asking for a permit to just continue where it is, right? If the permit is granted now, because you can, because there's an allowance for a waiver, it will now, the entire thing be a conforming structure. It just will have gotten a waiver to be a conforming structure, right? It is, you're granting a waiver for something you're allowed, you're allowed to do this. Now, if you have something and we're, Mike and I are talking about this, there are places where you're not allowed to make it worse, right? So we've had situations where say this was two feet from the property line. No. You can't now get a waiver to continue that. It is not an allowable waiver. Sure. Distance. Because it's very good because it's less than five feet, right? It's less than five feet. Right. And so in that instance, somebody would be asking to, to expand that non-conformity, which again, you're not allowed to do either. But here basically, it's a using a waiver to, to convert a non-conforming structure to what will now be a conforming structure with a waiver. Yeah. So we're going to get the waiver. Yeah. No, I think, I think that rush. It's not one or the other. It's the fact that in this case, like, that one kind of like leads, like leads into the other. There's a, there's a connection between the two analysis. It's going through that in here. Yeah. I figured it would come up. Yeah. But yeah, because something got a waiver to be built does not mean it's now not, does not mean it's non-conforming. Yep. Which is interesting.  Right. You got a permit and now you comply with the regs just with a waiver that was allowed. I mean, it's like, we were talking informally or before the meeting and essentially. You're closer. Essentially we're, we're providing precedent on behalf of the new regulations. Yeah. So, okay. So as long as we know what we're getting into. I mean, this is, this is, but it's, it's why there's waivers in here. Yeah. Right. It's while the waivers are very specific. Right. Right. Pretty much when they redid this pretty much every time there's a waiver, there's a very specific range in which the board is allowed to act with that waiver. Outside of that, you start getting into variance territory where so far, you know, pretty much it's really, really hard to go there. Okey-doke. I'm all good on the, that analysis as far as the waiver goes for the setback. I get it. It meets criteria. Yeah. It's the criteria. All right. So part one complete demolition of portion of a historic structure. Meredith. Tell you, you're doing so well. So I'm hoping everybody read the case that they added to the packet. Yes. So a lot of the, not a lot of, but the most recent demolition 14 Liberty street, the board decided that on more of the economic standard versus the community benefit. Standard that we have in our regulations. When the environmental court heard that appeal on the Nova review, which means they put themselves in the place of the board, so they're not critiquing what the board did. They just step in and look at everything fresh and they accept new evidence. So there was, there was a bunch of new evidence about historic nature of the barn as well as financial stuff about the property. All sorts of new information was put in. The court decided that there was not sufficient evidence to make that economic determination and instead the court went with the community benefit determination and used language from the city plan as well as language within the regulations themselves to look at what the city had already determined were goals and things that were beneficial to the community the whole based on policy statements. And so, you know, I think that the fact that the court went that way to me indicates that that is a good way to go that there's some examples here as to how to look at facts that are available. And so that's what I tried to lay out in the staff report. But it's, you know, it's really the board. It's almost like the board is having to look at this provision again with new eyes to figure out how it feels about that. Do know that the Historic Preservation Commission, Mike Miller and I are all working on trying to come up with a better demolition provision that is much clearer and has multiple steps into it. So that maybe early on if there's a decision made, you can just sort of be like, no, we don't have to worry about this anymore. But I don't know if it's going to make it for this next go around. It's a complicated issue. So hopefully this year, but it might not be till next year. So you guys got to help. Yeah. You got to work as to how to be able to guide applicants as to what needs to be in their application. I mean, did we look at another application where the energy efficiency of it was considered part of the public benefit? Right. Yeah, we did. That was a good one. Yeah. Yeah. So, so, yeah, I mean, I think it's great to have guidance on this. It's it was always a, we didn't know which way to go and everyone applying for an application like didn't know which provision to go. It's, you know, it's just, it was kind of murky. So maybe this makes it easier already. How does Joe, how does your application and your project benefit the public? Well, I wrote it in my narrative actually, and I basically based that around, you know, we're improving the structure. Like you said, that's a totally uninsulated space. And if you look at the pictures on the upstairs, that sleeping porch, which is uninsulated is connected to the bedroom by two double glass doors. So, and that's assuming that most of the house is like what we would conventionally call insulation also. So this new portion and basically the entire side of the rear of the house, it's going to be have modern insulation, the roof area will have modern insulation. Right now, we can't even really use that bedroom in the winter because the door would turn off the radiator that goes up there. And if someone needs to stay there, we'll warm it. But I'd be heating it all day every day, you know, if I actually use that room. So it's just my point of view is it's going to make the house better in every way. There's no way that it's not making the house better. It'll be more usable year round. It'll be a better space to use in the case of the mudroom that we use the porch right now. It'll be better to use an insulated mudroom. It'll be easier to access the house right now. You have to go through two double doors in the space of like two of these chairs and it's pretty tight, especially if you're carrying like a car seat or something like that. We'll have like a real entryway now into the house with like a modern with door and only one of them that's insulated. So that's my whole point really in the narrative is that we're going to make the house better. And if it's up to the board, whether or not you think that that makes the community better, whether that's substantial. I mean, it's a single family home. It's not like I can feed a thousand people from it. You know, there's I don't know how much a single family home can really benefit the community other than just be a better single family home. When was the porch built? It looks like it was in original. No, it's original. We think it's original. Okay. If it wasn't original, it was pretty darn close because we found reference to it. 1927. Yeah. Oh, okay. So it was very documentation of it. It's exactly the same construction practices and everything. That's the front porch that sounds like sounds like it's original structure then, but then they just put glass in between tapered posts. So that's like kind of just set in there. So did like did the design review of the historic preservation permission Friday like guidance or highlights? It's like what the defining historic features were of this, you know, of this building. Yeah. They asked about natures of the design. So like it's a shingle house. So the addition is going to be shingled. Trim's going to be the same. The windows won't. They'll be modern, you know, insulated, double-pane windows, triple-pane are not insured, but they won't be exactly the same. But they also don't want you to copy it exactly. They don't want you to go get windows from an old house and put it in there and pretend kind of like that it was always part of the house. They want someone walking by to not even notice it, but someone who knows what they're talking about, obviously that's no. That's obviously different. Kind of is how I thought of it anyway, how they explained it to me. The facade and like the frontage of the street still maintains the same architectural style as the original. That's the other thing. If you go by my house, you might not even notice that this thing's there. I mean the house itself is completely blocking it. It's set back on one side significantly and on the other side slightly, maybe like two feet. So it's like I said, the house is really a box with this porch kind of added onto it. Even if it's all original, but you can't see it from like in front of the house like a from Google Maps. So you have trouble even noticing it in the back there. So my neighbors that will see it every single day. They have absolutely no problem with the project. They're excited about it. I guess you could say my other neighbors who can sort of see it there. They have no problem with the project. They're the only ones, real ones that matter. The other property that's a budding mind. There's a giant barn. It's like right up against my property line. They can't even be a foot of distance between our property line and this barn, but it's two stories tall. They can't even see my whole house little on this porch from their house. You have to be in my yard to see the house. So, oh no, I don't think it's a detriment to to the community. I don't think I don't think anyone's going to notice unless they notice the construction trucks. It's even going on really. So, so yeah, that's saying it's both architectural style, but also the scale and desperate and experience is pretty much changed by the project. Yeah, that was another thing that Historic Preservation Commission commented on.  We're just making the existing footprint slightly larger and making the interior space way more usable. So it's not really like affecting the character of the house really at all. It'll feel different when you're inside, but it won't look really any different from the outside. As far as usability goes.  Would that owner have more or less work to do in order to like upkeep on the house in this portion? My I would imagine less. So my my my point being is that what they may have less more opportunity to put maintenance into the front part of the house and the other remaining portions of the house. I would say that's a very astute observation. Yes. And it's certainly the case. At least hope, right? Well, that's all I needed. Yeah, I just think that the that in so many instances in Montpelier, as we look at historic preservation, especially when the design review committee has looked at it and they feel good with it. The historical society is like that. They feel good with it that the public benefit of added insulation is awesome.  Yeah. You know, one house at a time. Yeah, I agree. Similar discussion earlier this year. It's like there is a public benefit of reducing energy. Yeah, absolutely. Yeah, climate mitigation. Yeah, absolutely. And I think that properly sealing and insulating and up taking care of a failing portion of the house or to be failing portion of the house protecting the well, the good architecture of the other is also public benefit. And just as a clarification to make sure everybody's aware the addition is going to be on a foundation. So that's going to also take any like pull off the back of the house. It's all going to be properly supported. Yes. Although it's been there for a hundred years. So for a hundred years, it's going to be good. But who knows? You'll see what's going on in there. Once you take it off. So there were some informal recommendations from the design review. Like I don't see a need to let condition this permit and include those. I think that, you know, I trust their guidance. And the force at which they put behind those, if they wanted us to approve those as part of the permit, they would. Is that other people see those the same way? Oh, yeah. We're too glad to hear your supreme process, Mary. Oh, for the requested demolition that when we have this kind of advice from the design review committee that some, you know, we have, yeah, we can give that credence. It's supposed to starting from scratch. Well, I mean, we're so design review committee. This the property is in the design review overlay district. So it had to go through there. The nice thing is, you know, Joe had the option to go before the historic preservation commission as well and was willing to do that. So that was a completely optional in the future. It might not be optional for applicants depending on the scale of what they're trying to do. Um, people who may we may end up doing something where it's like, well, you hire your own expert or go see our city experts and get an opinion, but we need an expert before it comes to you guys. So you guys have something to somebody else's opinion to consider a motion. Alrighty. Motion from Sharon. Motion to approve demolition of a two-story and closed solarium on the back of 17 Bailey Avenue and to grant a four-foot waiver of the north side setback for construction of a two-story addition on the rear as presented in application number Z two zero two three zero zero three eight and supporting and supplemental materials. Second. Motion by Sharon second by Kevin Sharon. How do you vote? Yes. Kevin. Yes. Yes. Yes. Rob votes. Yes. We have a unanimous approval. All right. Thank you all very much. I do have to be decisions to write before yours because last week was all staff reports. So it's going to be a little bit. But do you feel like you have more empathy for applicants now? Sitting here. We said they're sweating it out. I actually guys all made it very easy. Honestly. So one final I guess is approval. Yeah, sure. I'll become a board member again and I would definitely like to say thank you, Meredith, for all your help on this application. Big help. This house. Are you looking for a motion to approve the minutes? We are looking for a motion to approve the minutes for April 17th. We'd like to make a motion to approve the minutes for April 17th. Motion by Sharon. Second by Abby. All those in favor? Aye. Aye. Minutes are approved for April 17th. That's it. Right. And rather stains from that because I wasn't there and whatnot. But that's fine. State statute. So the funny thing is I think when this got condensed onto one page for both DRB and DRC tonight, the next meeting date got removed from. The 15th. Except that. We have new applications for you and because nothing got continued tonight, there is no meeting on the 15th. So your next meeting is actually. Five weeks away because may has an extra Monday. So you don't need to get until June 5th. So don't be surprised if you see at least one of these sketch plan subdivisions in for final. I wouldn't be surprised if at least one of them files in time to get in. And then there's also potential. I haven't gotten all the pieces in yet potential additional use application. But, um, except we won't see Abby. Yeah. Yeah, you get to you get to just go have fun. Just enjoy the summer. Gee, while the rest of it is to tune in and watch every Monday on TV. Totally okay. If you're like. Not going to have that on my calendar. I'm going to enjoy. Well, I also accept a motion to adjourn. If anyone has one. So moved. Second. We have a second and a motion to adjourn. Nah. The eye. All right. All right. Great. Thank you everybody.


walking over to this talk, I was thinking to myself, I'm a full-time job as a developer and I'm thinking, you know, if there's one thing that developers love doing and we're super competent at, it's string handling. It's not like there's an entire industry based on just how poorly we've mangled that up over the years. And if there's a second thing we really love doing and are great at implementing correctly, it's Unicode. So I'm sure we're in for something exciting here with Unicode or emoji shell coding. So help me welcome Adrian and George. Hello DevCon. How are you today? Great. Welcome on board. Before we depart, please make sure that your seat is up, your tray table is towed, and your seat belt is securely fastened. If you have any electronic device, please switch it to DevCon mode now. Please be careful when opening your overhead bins as emojis may fall on you. Thanks.  So let's present ourselves. So this is Adrian. Hello. It's his third DevCon talk, and I'm George. It's my second DevCon talk. So security researchers at EcoNormal Superior in Paris, France, we are both French, as you may have guessed, and we both managed to fail at the Turing test, but that's another issue. What we're going to see today? So we're going to talk about some generic tooling and methods to write shell codes under heavy constraints. We'll dive into the dark art of shell coding. We'll play with emojis to make computers do things they definitely shouldn't do. By the way, you'll also see the first emoji shell code ever created. Brace yourselves. We're going to turn emojis into merciless payloads. So let's begin. Who has ever written a shell code? Just raise your hand. Come on. Just raise your hand. Don't be shy. Feds won't arrest you. Well, about 20%, 10 or 20%. So for the remaining, let's explain what a shell code is from the beginning. So a shell code is some code that you either found or managed to inject in your target. This code generally gives you some power. Usually, it pops a shell. That's why we call it a shell code. Now it can do a lot more things than simply spawning a shell. And generally, what you do is after injecting it in your target, you jump onto it using what we call a vulnerability. So you can have buffer overflow, use after fee, and so on and so on. Just go to the CVS list and you have all of them.  However, there are many issues with shell codes. So the first thing, for example, if you have a buffer overflow using a scan F, so you need to input a C string. And a C string, you can't have a new character inside because it breaks everything. Same. If you treat it as input, same thing again about scan F, you can't have white spaces because it will just break your shell code in half. You can have other constraints. So for example, your name can only contain letters, so you can't have a name with digits. Or you can also have string escaping. So if you put it in a form, generally, you have string escaping which tends to break your shell code. And of course, trying to pass your input with containing slash bin slash SH as your first name is not really credible. So it does not look legit at all, so it gets deducted. What can we do? So here we go into the domain of constraint shell coding. So generally, many hackers want to pass their shell codes as pretty stealthy. So the idea is you want to reduce the set of characters that are used for your shell code. One of the normal constraints that have been studied for long is alpha and red shell coding. So your shell code must only use letters and digits. Here we're going to see on x86. And x86 has been solved quite a long time ago, so here it has been solved by Rix in 2001. And the idea is really simple.  So here on x86, it's pretty easy because you have single letter instructions for push and pop, which allow you to manipulate the stack. You can also increase increment and decrement registers with only single letter instructions. You also have control flow instructions like jump and comp. So this is pretty easy. They are all alphanumeric.  So it's pretty easy shell coding on x86. And if you want to switch to x64, so it's pretty easy.  So x86 is pretty easy. Actually, it's even so easy that other people manage to go much further than that. So people tried, so this is not alphanumeric anymore, because here we add some spaces and punctuation, but people manage to write shell codes entirely in English. So the idea is you take English words, punctuation signs and so on, and you want to make a shell code that looks like English. So this will be our first demo. So in this scenario, what we'll be doing on x86 computer, so we will do a set user ID exploit. So this happens on a lot of computers. So take for instance changing your password. To change your password, so any user can change his own password. For this, you have to modify the password file, which is on Linux on ETC shadow. And for this, you do not have the right permission to do so. So someone has to change the password for you. For this, we have a specially crafted program, which is called a set user ID program. So it's a program with a special permission that a user can execute that performs actions at the administrator level, which is root on Linux. So here we can check for this program here. We can see it's called main, it's in red. And we have the S bit in the permission that describes that it is a set user ID program. So if this program has a vulnerability, instead of changing just your password, what you can do is send a shell code to have other actions. So here we want a root shell from this vulnerable program. So it's purposely vulnerable here. So I just take my shell code so you can see indeed that it looks like English. If you try to understand it, actually it does not meet anything. And then when I paste it, I press enter. And here I have my root shell that just spawned. So I can check indeed. I have UID 0, which is root. Thank you, George. So we have seen that doing alphanumeric shell coding on x86 works fine. What about other architectures? Well, let's look typically at risk architectures, aka reduced instruction set. Well, then we don't have single characters instruction anymore. And we also have very few addressing modes. So no way to do instruction from memory to memory. And, moreover, we have very heavy constraints on the operand side of instruction. So basically this means that the previous techniques doesn't work anymore. So let me present you three ways to get around that. Namely, compilation, emulation, and unpacking. So the first one is compilation. And the idea is that you want to write a compiler, which instead of targeting your usual architecture, will target the constrained architecture. It has been done in the past for slightly different things, which is called single instruction set computer. Typically, the morph scatters is a compiler, which takes any arbitrary C code and compiles it for only the move instruction on x86 because this instruction happens to be too incomplete. So it works quite fine for one instruction set computer, much less when it comes to our risk setup, because then the constraints are on the operand and not on the opcode. So writing a compiler is much more difficult and like nobody really knows how to do that. So this approach is a bit bad for us. So the second one is the emulation way. And this time, the idea is to spend quite some time to write a small interpreter for some language. This interpreter will pass the filter. Typically, it would be a phonymeric. And then since you have an interpreter, you can encode any payload, arbitrary payload in your target language and interpret it. This is typically what Yunnan and Overs did in 2009.  So it works fine. But there's an issue with this approach. Namely, it's that the harmfulness relies on what you can do with an interpreter. So if you want to use it on actual exploit, it means that you need to escape the interpreter or that the interpreter has to be able to write outside of its sandbox. And typically, in Yunnan case, it's not the case. So we're a bit stuck here too. Third one is unpacking. So this time, we want to encode our payload in a constrained, compliant way. Typically, I want to find a way to encode my payload in alphanumeric. Base 64 would be almost good for that. And then identify, like, high-level constrained and try to write some alphanumeric unpacker from that, which will be able to unpack my payload, then jump on it and execute it. So you spend some time writing this unpacker, which is alphanumeric. You have your payload, which is encoded in alphanumeric way, unpack it, jump on it, and then you can run arbitrary payload. So this is what George, me, and some of our colleagues did previously from ARM V8. So we're going to show a small demo of that. Good. So in this setup, we have a small account manager, which is very badly written and has an obvious buffer overflow vulnerability in it. So it's asking for your username. And obviously, before getting to the buffer overflow, there is some check to make sure that the username looks like a valid username. So alphanumeric works fine here because the username, which consists only of letters and digits, is quite legit. So we are going to use our payload here. As you can see, it is only made of letters and digits. And we're going to use that as our username and take control of this account manager. Here, the idea is to dump the ETC Shadow file, which is a Linux machine, the file which contains the hash of all user account passwords. It takes a bit of time because the terminal is a bit slow. Good. Let's finish. And then we have a win. Our payload just dumped the slash ETC slash Shadow file, and we have the hashes of all passwords. So in a sense, we can, I think, almost say that alphanumeric shell coding is solved. It even works for the RISC-5 architecture. And this is what some colleagues, George and I, presented in DEF CON 27. So don't hesitate to jump back in time and see our talk again. Back to emojis. A few months ago, Bluedit and Jorain, which is a security researcher, asked George and I, well, you have done alphanumeric shell coding. Could you maybe do emoji shell coding? I didn't think about it and found a very good reason why it was impossible. So just gave this reason and I was happy with it. Then, 2 a.m. next morning, I just wake up and realize that my reason is totally wrong. Like, I did a mistake. And so I tried to fix it. And after a few hours, I realized that, well, I can't fix it. So I'm only left with one possibility. That is to prove that doing emoji shell coding is possible. Hello. And then I woke up at 8 a.m. I opened my mailbox and what I found, a horde of wild emojis that were just saying hello world to me in KMU.  And then you look into it. Then you ask for the source code. Then you look more into details and you find bugs.  There are bugs everywhere. And then I just went and saw Adrian and we sat together on the table and we said, let's clean this shit and send it to DevCon. And here we are. Good. So we want to execute emojis on some architecture. So execute emoji code. For that, we first need to look at emojis and try to define a bit what emojis are. Well, let's say I wanted like 10 years ago to send a nice text to my girlfriend. So I typed my nice I love you. The probability that she would get this instead was unfortunately quite high. And well, this is not exactly the same meaning. So we needed to do better. And fortunately we have Unicode which is now quite an old standard to the rescue. We can take the Wikipedia definition which is that Unicode is a standard for consistent accounting, representation and handling of text expressed in most of the world writing systems. Namely that like we want that everything displays quite the same and in a consistent way for everyone on any system. So what do we have in Unicode? Well, obviously we have Latin letters such as this capital A and on this part Unicode is actually compatible with ASCII. Then you can find many other scripts such as Japanese characters, more obscure stuff such as the whole set of alchemical symbols. Yes, it's in Unicode. You have also the whole set of playing cards, spilies and some odd characters such as QnA form. So this is a single Unicode component. So this very wide character is a single Unicode character. And then more stuff such as the Holy Han grenade of Antioch or Kim Kardashian. Well actually not the last two ones, at least, well, not yet. So we have a very small sample of Unicode characters and now the question is, well, what's an emoji in this? Capital A, well, clearly not an emoji. Smiley, clearly an emoji. But maybe what about the jack of spades? Well, you look into the Unicode standards and well, it's not an emoji. But let's replace the jack of spades with the black joker. Then the Unicode standard says that it is an emoji, starting to get a bit confusing.  Then Unicode says this is not an emoji, even more confusing. So we are going to settle for a very simple yet a bit subtle definition, which is that if Unicode says it is a qualified emoji, then it is an emoji, period. And in UTF 8, which is a way to represent Unicode code point in bytes, emojis are at least three bytes such as this nice smiley face and at most 45 bytes. Moreover, there are new emojis every year and we are currently at Unicode version 14. So for today we are going to consider doing shell coding with UTF 8 emojis on Unicode version 14. Good, so we have emojis here and then we need to run the emojis on something. So we are going to use Rescribe. What's Rescribe? Well, Rescribe is the architecture of the future. Or well, this is what we said three years ago at the Con 27. I think now we can even say that Rescribe is the architecture of the present. Well, since 2021 you have some real Rescribe products that you can buy as a customer so maybe you already have Rescribe CPUs at home. And in more technical terms, let's see what we have in Rescribe. Well, this is a simple risk architecture. They push a lot to have open source ISAs and also they push a lot for open hardware. And in Rescribe you have two and four byte instructions and it is little engine. Remember that for later. Well, so now I need to execute my emojis on Rescribe. Let's try to look back at the method we saw previously in the previous work and see if it still works. So, Alpha numeric x86. You had to take the whole set of single letters. It gave you a set of instructions. You realized it was too incomplete so then you could shell code in that. Alpha numeric over risk architecture such as ARM v7, v8, or Rescribe you took the set of quadruplets of letters on digit. It gave you a set of instructions. Again, you figure out it was too incomplete so you were good. What about emoji Rescribe? Well, let's use the first method. I take my list of all emojis, see how many of them can be executable as Rescribe. Too bad, only ten of them are. So that's not too incomplete at all. Let's try the second method like pairs of emojis. We still have very, very few pairs of emojis which are valid Rescribe code. And if I go along and I take triplets, quadruplets, it's not getting better at all. So we are stuck. The previous method will not work here. So I'm going to try to present you the way it works before we are able to fix this issue with an example. So on the bottom of the screen you have this A-U-I-P-C instruction, which is in Rescribe a way to load the PC relative offset into the RA register. And if you look at how it is at its exact decimal representation, it is 97, F0, 9F, 97. And this is not a valid emoji. This UTF-8 is not a valid emoji. So we are going to split it into like this. 97 and write the other parts. So let's try to take all the left part. I want an emoji which ends with 97. So I look into my big bag of emojis. Find one, this is the OK emoji. We start with F0, 9F, 86. And too bad, these three first bytes are not Rescribe code. Typically, this is three bytes and as I told you, there are no three bytes instruction in Rescribe. But maybe we have another gadget which can do jumps and then you can jump directly on the 97 and execute our A-U-I-P-C. Let's look a bit more into our bag of emojis and this time we find the bang emoji, which ends with 97 and starts with E290. This time it's quite nice because E290 is a valid Rescribe emoji, add S11, S8. So at the expense of trashing the S11 register, I can then start directly this gadget, execute my add then my A-U-I-P-C which is my target. Good, we have two ways to do that and on the right side it's going to be quite similar. So this time I want an emoji which starts with F0, 9F, 97. Look again into my bag of emojis and I find the calendar emoji. It ends with 97, EF, B8, 8F which is a valid Rescribe instruction. So this time at the expense of trashing the T6 register, I can finish my gadget. Again, last time let's look into our bag of emojis and we find the bin emoji. This time the last four bytes are not valid Rescribe but 9-1-EF is a small forward jump. So again I can end my gadget by jumping out of it. In the end this is quite good because I can use any combination of OK bin, OK calendar, bang bin or bang calendar and execute things and I have quite a trade-off between the gadget styles and trashing registers or not. Good, so the question is, well I could do it for one specific instruction, how can I do that, how can I find a way to generate all possible gadgets and a whole list of emoji compatible Rescribe instructions. Well, for this we have to take a little step back. So we'll be talking about code reuse attacks. So for the people who know it already think about return-oriented programming or just-in-time sparing. But here let's present for those who do not know it. So return-oriented programming has been published originally by Shaham and others in 2007 and the idea is really simple. So you take a huge binary, typically the C-standard library, and then you just scan it and you find small, little reusable code snippets. So those little code snippets are called gadgets. And the idea is once you have a whole collection of gadgets, what you do is you try to assemble them together, you chain them in order to have your shellcode. So you just rebuild the shellcode in the form of what we call a rob chain. Then you send this rob chain as input in the vulnerable program, and you still have your shell that pops. There is a variant of it which is called JIT spraying that has been published by Blazakis in 2010. And the idea is instead of scanning your binary to find gadgets, what you do is you just create them by controlling some code that then is compiled using a JIT sprayer, just-in-time compiler. So here the attacker, for instance, has on the right side of the screen, on the top part the attacker can control and write any code he wants. So this is typically JavaScript, for instance. So what the attacker does, he assigns to the variable y some immediate that are absorbed together. If you send it to Firefox, this goes through the just-in-time compiler and is then compiled as the binary code that you see below. And in this case, it's pretty easy because the attacker manages to control four out of five bytes of the final program. So here you can generate gadgets as you want, and you can just do your return-oriented programming as before. So this is JIT spraying. So here we have to do the same with emojis. So we can control emojis, and we need to build gadgets from it. So how do I create gadgets from emojis? Here it's a little bit complex because do you remember the infinite monkey theorem? It states that if you take a monkey, you give it a keyboard, and if the monkey types on the keyboard for an infinite amount of time, then almost surely he will type any given sequence. So here we do the same, and we take our monkey, and we give him an emoji keyboard. Only problem is that there is no algorithm to look for gadgets in an infinite stream. So previous methods were only scanning binaries, but not infinite streams. So here we have the output of a monkey here. We need to invent a new algorithm. So let me explain this algorithm. So here we have three lines. So on the first line, what we have is the emoji stream. So this will be a stream of emojis. This will be what our monkey will type. Then this emoji stream will have a hexadecimal representation that is on the middle, and we must synchronize it with some executable stream. So this is risk five instructions, and both should coincide on their hexadecimal representation. So let's start with an instruction. So let's take, for instance, add S7, S7, S7, S8. So here I have an excess of my instruction stream. So what I must do is find an emoji, which starts with E290. So let's take our bag of emojis and take, for instance, the chain emoji here. So here I go on the opposite side. So I have an excess of emojis. So I must find some executable instructions that fits the hexadecimal representation here. So let's look what is inside. So I find an OR immediate, which fits. And here is something very interesting, because here I managed to end my emoji stream and my instruction stream at the same point. So both are synchronized here. Both are synchronized here. And what I can do is I can just stop here and consider that this is a gadget because I can reuse the chain emoji independently without taking care of what comes before or after. So this is a gadget. Let's go to a second case. If I take the basketball player emoji. So again, I have an excess of emojis here, so I must find an instruction. So this B9EF is a branching instruction. So it's a small branch forward. So this is another very interesting case because now I can escape out of my gadget and I do not need to end my basketball player with other described instructions. So this is another gadget. So we can see here the second gadget that we managed to generate and we can reuse it as it is. Let's go to the third case. So let's take the snowman emoji. So again, I look for an instruction that starts with 84. So let's take for instance, store word. And then here I come back to the beginning where I have an excess of instructions and I complete it with an emoji. So the copyright emoji here. And again, I can do the same as before. And here I have a branch which ends my gadget again. So I do this for every possibility. And in the end, I have a whole list of gadgets that are usable for shell coding. And so on and so on. Just a side note, for people who know a little bit about grammars, so the method we use actually is really generic. As you may have guessed, the algorithm follows derivations of a grammar. In the form, we have a non-terminal that produces a terminal followed by a non-terminal. Here our terminal is emojis. So for people who know about it, this exactly describes what we call a right linear grammar. And there has been a very interesting property detailed by Patel in 1971 who says that any regular gram expression, which is typically for computer scientists what we call a regexp, is converted to a right linear grammar. Of course, adapting the tool is left to the reader as an exercise. Well, let's get back to emoji now. So I managed to generate all gadgets that can be implemented using emojis. Now we just have to change them. Good. So let's try to write our emoji change. Using the output of our previous algorithm, we want to look at which instructions are indeed emoji compatible. And well, at the beginning it looks quite fine because we have a bit more than 4,000 RISC-5 instructions which I can find in at least one of the gadgets. And if you look at what kind of instruction we have, first we have some logic instructions like add, end, sub, and more. So that's quite good. We have branches, both conditional and unconditional, both forward and backward. That's very good because for control flow, that's very useful. We can address many registers. So here we can see we can address 14 registers, but not the stack pointer. Don't worry, even if we cannot touch the stack pointer, we can still find ways around. And in practice, it's not that much of an issue. However, we have very few immediate, so very difficult to load constants. And actually in this 4,000 instruction, we have quite a lot of floating point instructions which we don't want to use. To give you more idea of what we have, for some families of instruction, such as the CSR family, we only have a single one of them. So this is the one displayed here. And in the end, what we see is that we have a tiny bit of everything. So the set of risk-5, effemogic or compatible risk-5 is very diverse and very difficult to work with because it's very difficult to combine one instruction with the other. Yet, we do manage to do this. And I'm going to show you the overall view of what our shell code looks like. So we use the unpacking method that we showed you previously. And basically we have a small initialization part, then our unpacker which embeds the encoded payload. So the unpacker will unpack this payload in memory, then jump on it. And it means that it's very easy to change the payload because we can generate the unpacker easily from the payload. Let's focus on the unpacker. So in our last talk, we went very far into finding ways to do very efficient unpackers and with many gadgets to do that. For this time, we're going to go the very opposite and write a very simple unpacker. So for that, we will only use three gadgets. One is increment the A1 register, second one is write the value of A1 in the pointer pointed to by A3 and the last one is incrementing the A3 register. So with that, we can write an unpacker. I will show you how. So for this, we take an initial payload, which is a very dummy payload of only three bytes, three, 20, and 10. And if we go back to initialization, what we do here is that we make sure that A1 is zero and then A3 is set to the first address of where we want the payload to be decoded at. So let's back to it. We have A1 equals to zero. Let's output three times the increment A1 gadget. So then A1 is free. And we can store A1 in A3, increment A3. From three to 20, it's 1D. So we output 1D times the increment A1 gadget. A1 is not 20. We can write it. We're good. And from 20 to 10, well, we have to output the A1 plus plus gadget at zero times so we can write it in memory. So this is the way that we generate our encoded payload. If we execute this, well, then we start from A1 equals zero. A1 plus plus three times A1 equals three. We write three to memory. Then we add 1D to three. It's 20. We write 20 to memory. And add F0 to one. So A1 is 10, write it to memory. It means that the initial payload is equal to the decoded payload. And we have found a way to encode any payload into our encoded payload which will decode at the exact same initial payload. And since all of this gadget, A1 plus plus, A3 plus plus and store A1 is in A3 are emoji compatible, it means that the whole encoded payload is only made of emojis. Let's present you, like, a bit in details how we do this A1 plus plus, A3 plus plus gadget. Okay. Time to switch to GDB over Beamer. So here, let me present you what we have. So on the first line, we have the emoji stream as before and we have its hexadecimal representation on the bottom. So here, let me spawn my binary code. You have the two gadgets on the left part of the screen. You have the registers on the right part of the screen and you have the memory where we want to store our payload on the bottom right part of the screen. So let's start with an up-like operation for the first gadget. So this will just trash the value of S3. If we go to the next one, we store A1, which has been initialized to AB before, to the address pointed to by A3 which is 8,000. Then we just take our branch, which will jump to the next gadget and we start with another up-like instruction. Same, we have a branch to the next two bytes, which is also an up-like instruction. And in the end, we add the value... In the end, we add the value of T2, which is 1, to A3, which will increment A3. And we can continue as we want. Here, I have a small gap between the two gadgets and I can fill it with whatever I like. So here, I can fill it, for instance, with three England flag emojis. All right. Let's switch to the demo.  So this is a quad-core RISC 5 64-bit board. So now it has been discontinued, so we can't buy it anymore, unfortunately. And it manages to run a Linux. So if it has a Linux, let's play with it. So in this case, what I made is a small network interface that is vulnerable to a shell code. And here, I can check that I have my shell code, which is all emojis. So you can see my emoji shell code here. And what I will do is I will just send it through the network to my high-five-unleashed board on its vulnerable interface. So let's send this shell code to the high-five-unleashed. So I just cut it through Netcat. I press Enter. And here, I managed to get my shell. So let me check if the CPU is correct. So let's see. I can see that indeed I have a RISC 5 CPU from C5. And if I just check who am I, I'm root. So I managed to get my root shell. Well, I went a little bit quickly over one thing. So I have my gap between my two emojis. So what I can do instead of just putting England emojis? So I can put whatever I want. I just need to find emojis whose size is compatible with the gap. So this is just a variant of the subset sum problem. So you can look in Wikipedia how we solve it. And in our case, it's very easy because we have three and four bytes emojis. And as we know, every number above six can be written as a sum of three and fours. So it's really easy to solve it. If we want to have a little bit fun, so we can instead, for example, try to look at how I can fill this gap with the minimal number of emojis. And this is standard dynamic programming. It took me exactly four minutes and 13 seconds to solve it and implement it. So you can try it and it's pretty easy. Well, and now I can fit with whatever I want. And this gives me something very interesting which is called polymorphism. And this is almost trivial to have polymorphism. What is the purpose of polymorphism is to generate many variants of the same shell code that all behave the same. And this is very useful because now you can pass antiviruses that generally use the notion of signature, so they compute the hash of your shell code and check in the database if it's already known. So now I can generate as many shell codes as I want, whose hashes are all different. So for example, I can put five emojis here. I can also put these 10 emojis or more emojis as much as I like. When you do shell coding for real, sometimes it happens that pointer arithmetic is a bit flawed and you don't know exactly where the vulnerable program will jump on your payload. So to make up for this, you start your payload with a long list of knobs, which makes that even if it doesn't jump exactly where you want, it will just follow the list of knobs until it gets to the start of the meaningful part of your payload. So this is what we call an upslade. And in Unicode, we have something which is called... we have like a sled emoji. So obviously as hackers, our first question was, well, can we do our upslade using the sled emoji? Well, the answer is yes, we can. So we have to copyright it, put a few knobs, and as many slides as you want. So believe me or not, but this is perfectly executable RISC-5 code. And with that, we can do another demo. So this time, this is on RISC-5 32-bit. So this time, I have the word with me. So this is a nice, expressive ESP-32 SIFRI board. If it is too small for you to see, well, just look at the slides. You have a picture in much bigger. And a nice thing about this one is it costs nothing. You can get it for less than $10 from your favorite distributor. So it's very nice to hack with. Good. So for this demo, we have decided to use a very bad coin wallet. So this one is again, vulnerable to an obvious buffer overflow. And it's going to ask for the passphrase to just access it. And so obviously we want to use our emoji shellcode to, well, get the private key of the wallet. And if we can get that, this private key, we are rich because we get all coins. Let's get that. This will be a bit slow because we don't get that. Good. So here you have the end of our emoji shellcode. We have used polymorphism here. This is why it looks a bit nicer than the previous. And at the end, you can see that it worked. So we have done the private key of the wallet. And so now we are rich unless you manage to get the private key and extract the money before the end of the talk. So it worked. As a conclusion, well, we have shown you that we are able to do RISC-5 emoji shellcoding on both 32-bit 64-bit slides. And that's the method that represented you, even if it was a bit technical, could be used for other kinds of filters, other kinds of constraints. And we have to talk a bit about what happened during the making of this project. So it might not be easy to see, but all of these slides are made with latex. So we had many issues with latex. And typically, we did crash Tech Studio, we did crash Real Attack, and more. Most PDF readers cannot display our slide correctly. Acrobat reader is probably the worst. And all other PDF readers have various glitches. We even had issues with VLC. We found that recording the demos would not play on VLC. So I had to convert them all from MKV to MP4. We found a way to break Firefox. So this is Firefox explaining currently the... I'll do it. Yes, good. And if you press F5 with PDF in fullscreen, then you lose crawling in the tab. Like, I cannot crawl anymore in the screen with PDF. And if I press F5 again, this is this. Good. Well, it is still broken, so I have persistently broken this tab. So well, I'm good to switch to the new tab, the backup tab to finish this talk. Well, other things such as terminal slowness and cups, if you know about it, this is what we use in Linux to print things. So I did there, George, to print the slides. Tell us what happened. So I tried to print the slides, and I managed to break both my computer and the printer at the same time. And since then, I was not able to use my printer for any task at all. I have to do a factory reset, I think. Good. We also have a GCCseq fault, which we need to investigate, and very big things for Windows, for the occasional BSOD when compiling the slides. Bottom line, emoji support is hard. There are still many issues in libraries, software dealing with images. If you want to find exploiting them, it's probably a good bet to look at them. In the end, obviously, we do release all of what we did. So you have a GitHub repository. Don't hesitate to click on the link. If you cannot click on the link on the big screen, just remember the short link. You have our email address if you want to contact us. And if you have any questions, don't hesitate to come to the bottom of the stage, and we will happily answer them. Thank you very much.