Thank you very much. It's a pleasure to be here today and I'd like to begin by thanking the organizers for having invited me I'm conscious. I'm speaking at 5.30 in the morning in Colombo This is the earliest talk that I've ever given in my life So whenever it's invited to talk I was really wondering what to talk at this audio I know it's going to be a high-part gathering of global leaders and I don't consider myself in that league Operating in a research resource poor setting as it were although I really don't like to say that The first question that's asked from me most of the time when I come to the states is very Sri Lanka So I thought I'll put this picture up and tell you that it is in the middle It is the middle of the old world and the new world is not there And Just to tell you that it's the middle of the old world meant that it was in the middle of the silk route And if you really look at the archaeological evidence in Sri Lanka, we have coins from everywhere in the world Which shows that it was actually the middle of the world and Recently one of the archaeologists said that you know, we were the counterfeiting capital of the world And I didn't like that no characterization of Sri Lanka as it were But you know, everybody knows about the pyramids of each other and the pyramids in Egypt But where if you that was 6,000 years ago, but 2,000 years ago The twin towers in the world were actually in Sri Lanka. Those two buildings up there. They are Buddhist troopers which are taller If they are more than 4,400 feet tall built and stand up to this day And they are and even the most ancient excavated hospital in the world is in Sri Lanka So we had a very advanced civilization at that time, which went into decline and the technology that built this also went into decline and About a thousand years ago and we don't have documentation of that When the British came to Sri Lanka in the 1800s We were first to embrace western medicine at as it were and some of the earliest institutions In that part of the world are there and this is where I am the faculty of medicine University of Colombo and you can see the old colonial buildings which are standing up to this day the Unit I work is the human genetics unit in the faculty of medicine in Colombo, which was established in 1983 by my Professor who my boss who was actually trained in the UK. I followed him About 15 years later and also trained in the UK and returned back to Sri Lanka in 2004 and up to this day We are the only medical genetic center in the country providing clinical genetics diagnostic services And also training research and so on and we serve a population of about 20 to 21 million people now when I went back to Sri Lanka in 2004 I was you know, I had this big idea. Okay done research Let's go there and set up a research program and thought very little about the clinical side of things But it didn't take me long to realize that There was no funding to do research and the research came became a real small component and it was the clinic that Where we really had to operate seeing the patients Kettering to their needs looking after them and so on so I thought I will try to Well, let me go back. I thought I will try to Tell you a little bit about the Sri Lankan health care system at this point because you see Although we are not as kind of strong in research I think we have been very efficient in translation of the research findings Elsewhere and applying it in in clinical practice after all we are all human and I think You know discoveries made in other part of the world We should be broadly applicable in our country and one of the advantages we have is that all our clinicians Serve a mandatory period of one or two years Outside of the country before they get birds board certified as consultants usually in the UK, Australia And therefore they are they are you know exposed to first-world care and when they come back they practice I would say Okay, which is comparable with the UK, Australia and that would mean rest of the world So if you look at some of the health indicators of Sri Lanka, I just thought I'd compare some of these indicators with that of the US and Singapore affluent neighbor in our neighborhood You can see the life expectancy Is hovering about 71 in Sri Lanka. I think it's 77 in the US and Singapore slightly higher If you go to the lifetime risk of maternal death, I mean Figures are coming down dramatically in our country and Infant mortality similarly and that in a background of Economics which look like this a per capita income of Sri Lanka standing at 3000 Compared to per capita income ten times that in the US and Singapore And of course a health expenditure, which also looks like that So if you were to talk to the World Bank or the other funding agencies, which I do very often There's think of us as a high efficient low-cost model and they are you know Query all the time is why can't other developing countries try to emulate that model so the issue that I face and a few of us who are you know Making the case for genomic medicine face is that what gains can we bring through genomics To offset the huge gains that have been made With the conventional technologies as it were and I think we need to You know take that into consideration and you would appreciate that Perhaps the reason only I'm here from kind of a less affluent country is that the people who operate actually Or the countries which are at that level Would find it very difficult to make that economic case because To you know bringing genomics into the picture to bring down the you know improvements such as we have shown in Sri Lanka So I think we need to be cognizant of these facts So this was this is a situation that I face in Sri Lanka in terms of research and the bedside and so we Try to work on the bedside More looking at research happening elsewhere in the world So towards the end of last year December it is the ongoing process we We thought we need to really take and how it's been almost 10 years since I returned and started developing a unit and a team and we thought we need to look at what we want to do and Look at it from a more strategic point of view Strategic planning and development as so we articulated a vision for us and a mission Which was very much focused on delivering care to the patients and Then We are not alone in that because we had by now established Collaborations of with various groups and networks across the globe. So we didn't feel You know that we were in a developing world setting. We thought we will embrace it head on What are the services available in terms of technology in the country? Mind you we are the only Center which is you know delivering any form of genetic care to the entire population we have partnerships with one of the private sector hospitals which has enabled us to bring in technology and deploy it through their system which is also You know propelling stuff and of course. We've just seen the process of establishing a next-generation sequencing facility So these are the technologies which are available in the country current manpower Support 30 to 40 people You know serving the needs and our biggest problem is brain drain I Would have trained 70 people in the last 10 years and out of them about 60 have found employment either in the US UK or in Australia and So it's a continuing Problem so we are moving from brain drain to brain circulation and trying to see how we can actually try to make use of these people even if they are working abroad and We have taken various tests to bedside including some of the farm cogenomic tests and so on And they are being widely used and of course we've also established partnerships such as with the European Molecular Quality Network to try and Subscribe to that External quality assurance program and also we are in the process of working towards ISO accreditation really in terms of research We are now developing Various thematic areas we've also on top of genomics brought in a little bit of stem cell biology because there seems to be Interest among the scientists working with us there as well and our research collaborations Are built around collaborations we have linked we have developed with the uncle the various professional medical groups the oncologists the surgeons the neurologists Thermologists and so on. I mean, there's some professional group always working with us And the next layer obviously is the international collaboration. So why do we work with the? professional groups it is with the view to bringing about you know continuing if they have in research with us They will work and then of course we want to use a kind of Online platform to make them genetic literate so that we can move forward. Otherwise, you know, we can't engage them In addition we that's where we asked located in Sri Lanka We have been training people from up north in the middle and down south and of course We are sitting we've in June last year when the International Genetic Education Networks had their meeting in Colombo We established a kind of a Network of medical schools in the country develop deliver, you know proactively engaging in Education not only of doctors, but also of the allied health professionals Now with that mission and mission We've now we are now in the process of articulating certain, you know, translational goals as it were and These are this is one of them because there is a need from the from the cancer the oncologist I won't go into details of it We've made the case for expanding cancer genetic services and the reasons the rationale is there and the strategies that we have adopted to Bringing some of these technologies to the country are also listed here another area that and I agree with that statement about you know Keras testing and you know her to test Keras testing which was mentioned earlier because that's the exact, you know You know case that we made to say that this test should be introduced here Similarly, we we are now in the process of introducing her to new testing because in the absence of testing every breast cancer patient is getting accepting which is a wasteful thing Well prevent and cure thalassemia is also one of our other goals Just to dwell a little bit on that because you know, this is the Big burden that we have still of the monogenic disorders We have for example thalasse 3000 thalassemics taking up 5% of the annual drug budget of the country for chelation and and and and and of course blood transfusion which is provided free in the public health service Which is leading to life expectancies of these children Going up to 30 40 years now and every year a million rupees is spent on a child for this and it's it's becoming a huge burden and of course that lack of other other services are also contributing to that and we are we are planning to You know help support establishment of those as well And one of the newer things that we really want to do is to work with genomics the last one last strategy Want to work with the primary and secondary modifiers genetic modifiers of the condition to see where the treatment treatment received by these people can be optimized and and These patients can be optimized and that and the condition made a more manageable one Again a traditional area but defects and inborn errors of metabolism. We need to work in that area simply because Because the burden is what is preventing us from achieving or you know, making that last mile from like 11 per thousand infant deaths to like six or seven, which is that in the west because we don't really Terminate pregnancies and we do not have a program which is aimed at controlling We've also worked on improving general genetic literacy among medical and allied professionals and one of those Initiatives have been the initiative that we have we have with the the international genetic education network run by the American Society of Human Genetics We had a successful conference in Colombo Colombo last June and we are now in the process of establishing South Asian network and of course we also trained the first geneticist in In Nepal and now Nepal is developing their infrastructure and we are trying to help them further so that Even with our resources so that they could also develop their services there So ladies and gentlemen, I think in the past 20 minutes I have just taken to you through briefly on how we've you know in the setting that we work in Try to do our best and I hope that you know the next time that is Gathering like this maybe in a few years time I'll be able to say much more about how we what we have achieved through the goals that we have set up for the next two years, thank you very much It was brought up in the panel something about pathogen sequencing Could you talk about you know given your location and you know it? I think global health being an important and infectious disease being You know so important. Can you talk about pathogen sequencing? Yeah? No, I think I I should have mentioned that I didn't put all our goals that we had put up So metagenomics is one of the areas that we want to really work on very strongly and at the moment We I wish I should say we are you know articulating our goals on metagenomics so in terms of genetic laboratories, I think the the bulk of the work in you know Genetic laboratories especially in the private sector sent to be on detection of Pathogens and so that tends to I think I know colleagues both in Sri Lanka as well as in the in in in India Where there's a lot of work, you know most laboratories genetic laboratories actually survive on the side business of doing diagnostics for infectious disorders disorders and I think There is definitely a case for you know introducing metagenomics and Taking that into the clinical realm Thanks, so you mentioned that you're using modified genes so you screen for modified genes for thalassemia It's one question the second question is are you considering using hydroxyurea for sickle cell and And thalassemia mosaicates The first question well, we don't do it in a clinical setting as it were This is some kind of a work in progress Trying to take a research and Secondly, we know we don't test


I'm Nick Harbour, I'm an incident responder and consultant with Mandiant. My primary Jamauer analysis also do a lot of research and development. So let's get cracking. Oh, there's also supposed to be questions and answers or something, they want me to keep me hostage in there for two hours. I'm going to have to bail on that, as you can imagine, that doesn't sound too entertaining. I did compete in the Race to Zero competition, so I'd kind of like to get over there and see if I won or not. So I apologize for not having an extended two hour QA session. So let's start with what we're going to talk about a little bit today. I'm going to go over some basics on Packers and exactly what the current state of the field is today and a little bit of theory behind them, and then I'm going to talk about my tool that I'm releasing called PE Scrambler and how it's different from what's out there today. And I'm going to rant a little bit about the challenges and headaches I faced when writing the tool. It was kind of a pain. And I'm going to discuss piecewise some of the techniques that it's using and go into the theory on exactly how they work, why they work, what the flaws might be in modern disassembly techniques and things like that. The future avenues of development such as the polymorphic code replacement. And then I have a tool for the good guys at the end, which is a malware detection tool that uses a disassembler to detect packed binaries in malware. So releasing two tools today. This is a talk that's going to encompass both of them. All right, so let's talk a little bit about Packers and where they're going today. A Packer, if you don't know what it is, is a tool to compress or encrypt a binary so that it still has its original functionality. There's two sides of the coin on how they want to be used. Compression or protection. And there's usually a trade-off between the two. So I plotted on a graph like this. So you have Packers that are really good at compression that don't particularly care too much about being hard to reverse engineer or thwarting the reverse engineer. Then on the other end of the scale you have Packers which actually make the binary larger but are very difficult to reverse engineer. So my PE Scrambler tool, it's certainly going to be on the armoring end, not on the compression end. It's going to make binaries probably almost twice as big. So a little bit about the traditional Packer design, which is going to encompass most of the easy common Packers that are on the compression end of things. As a reverse engineer and malware analyst, I don't usually lose sleep about those kind of Packers. They're easy to defeat. And the reason they're easy to defeat is they all work on the same basic model. The Packer program compresses or encrypts the original binary in its complete intact state. It appends a small unpack or stub program. And then when the executable runs that unpack or stub launches, unencrypts or uncompresses the original binary in its complete state and then just jumps into it. So if you catch it with its pants down, you have the original binary pretty much intact. So here's how the process works when the actual Packer compresses the original binary. We have an original binary here which has three sections in it, .txt, .data, and then a resources section. I'm just picking on UPX. It's a pretty good basic model of a Packer. All that stuff in the .txt and the .data, which is executable instructions and any type of data needed by the program, is all compressed and put into one of these sections in the Packed binary, usually the UPX1 section. And that's also where you get the stub program put right in that same thing. And there's a UPX0 section, which is just kind of an empty placeholder. And we'll see how that loads. Whenever you launch the Packed binary, it looks quite a bit different in memory than it did on disk. You have that UPX0 section which was empty in the actual file that becomes much larger in memory and actually comes pretty much the size of all the original data. So the entry point in the Packed binary launches. The stub program unpacks the original code out of its section and populates it into the UPX0 section, and then it just jumps right into it. And most traditional Packers are kind of just theme and variations on this very basic model. You have a Packed payload. You have kind of a landing zone where you want to put it. The Unpacker stub, through any type of gyration and mechanism, unpacks it and it's complete original state. So the binary has to get back to a point where it was originally compiled to run from. There's not a whole lot of moving that you can do on where that thing is. So like I said, they're easy to defeat. There's many ways you can use to detect these basic Packers. We can detect when code is being overwritten. We can detect when that section jump occurs, like when the Unpacker stub jumps into something that didn't used to be code. And the main problem is that it uncompresses the original binary into memory. So if you catch it while it's running, you have it and you can easily reverse engineer it. Nothing's been changed with that binary. So stepping it up a notch, some more sophisticated Packers do some things, mainly with actually modifying that original binary. At no point do you actually have a complete original intact binary that you can easily reverse engineer and IDA-PRO. So Thamida and VM Protect are pretty good examples. They actually translate the instructions in the original binary into like a virtual machine language that executes. That's particularly tricky, but it also, as you can imagine, might have some problems and compatibility and whatnot. Those are commercial tools and they cost quite a bit of money to run. And it's always going to use at your own risk. Not that my tool isn't, but I work on a slightly different model. So how my little Packer works is I manipulate the x86 instructions for the purpose of anti-reverse engineering. So I have a disassembler, so I basically disassemble the whole binary, and based on all that analysis, I can move around chunks of code, I can wrap chunks of code, I can do all sorts of things. I can hijack function calls, wrap chunks of code in anti-reverse engineering, and later on we'll get into some polymorphic stuff that I can do. So some of the challenges and headaches I've had when writing this is there's no margin of error for bad disassembly. So since I'm in the business of finding instructions and manipulating them and moving them around, if I do that on something that wasn't actually instructions to begin with, potentially serious problems with the binary, it's not going to work. So IDA-PRO can get away with that and it's disassembly because whatever, it disassembles something that wasn't real, you know, the user can go in there and mess with it and it's fine. But for me, I have a realistic set standard on what needs to be proper disassembly. It simply will bomb out my whole program if it isn't perfect. So I spent most of this project actually refining the disassembler, reducing false positives and getting the code really to a true disassembly, which is pretty interesting. There's a lot into that. It's pretty amazing that pretty much almost any arbitrary data structure can look like Intel assembly if you disassemble it, even though it completely isn't. So my disassembly is very pessimistic, and I'm going to use this same disassembler engine and the other tool I'm going to show you at the end of the talk, which I can use to find malware. All right, so let's get into the first little trick I can do. It's called, I just called it function call dispatching. So basically, with my disassembly, I'm going to find every function call in the program, whether it's to an internal function or to something from the import table, like an external DLL, I can find each one of those instructions and actually remap them to a tiny little 65-byte function that I insert into the binary. And this function is basically then going to call whatever it was supposed to call. So if you look at an original call tree of a function, so we have function A that calls B and C, and then each one of those calls functions of its own. If you dispatch all these with, and you remap them all to point to the dispatcher, the call tree is completely obliterated. It all looks like everything is just calling one function. It's pretty sweet. And once we have the ability to do that, we can do further avenues of research and like function level packing and things like that. So how this thing works, it works based off the return pointer. So I'm just going to cover a quick primer on the return pointer for anybody that's a little bit new to this. So here's a quick snippet of C code, prints out two things. When this gets compiled, set of assembly instructions, notice those two call instructions. That's the real important guys that we're looking at here. So we see offsets being pushed to the printf and whatnot. So I'm going to step through this and watch how it executes. First the push. So you see the string hello world pushed on the stack or really a pointer to it. Now when the call instruction executes, this is the key point here. The thing that was pushed on the stack is what's called the return pointer. So when the printf function is done, it knows where it needs to get back to in your program. And we can continue stepping through. And the same thing happens for every single function call. And in most binaries, that return pointer is never going to change. For every return pointer, I should know based on disassembly what function was supposed to have been called by the previous call instruction. It's pretty basic. So the function called dispatcher, all it does has a table of return pointers and then a table of targets. Whenever it gets called, it checks the return pointer off the stack and sees what it's supposed to call. It sets up the stack and jumps to it. It's beautiful. So the next concept here is code chunking. So it's going to kind of open the avenue for a lot more advanced areas of research because the main problem you have with trying to add anti-reverse engineering code into a binary is that you don't have the ability to just wedge in extra bytes into a binary and hope that it works. It simply doesn't work that way. It's going to fail pretty miserably. That's what I tried when I was young. I found it to be a lot more of a problem, but once you have the disassembly, you can know how to intelligently move things around. So that's exactly what I do. I find sequences of instructions that I can easily relocate and I do things like I substitute a jump there and put the instruction somewhere else and then I jump back when I'm done. It seems pretty basic, but once you have the ability to move things around, the code becomes more position independent and I can insert code everywhere I want. So I can weave in anti-reverse engineering code to that. I can make it also more difficult to reverse engineer because that's going to obscure the flow control of the program. One basic thing I just call scrambling. That's where the term PE scrambler comes from. So here's four functions, and if I break them up into little relocatable sections, I just jumble them up. It's pretty simple. Now, unfortunately, this isn't going to be enough. If you're looking at it in a static linear disassembler, this might kind of beat you for a while. It's like, ah, what's going on? But IDA Pro with its graph mode is still going to kind of reconstruct the functions appropriately. This isn't quite good enough. So I mentioned the relocation technique with a simple jump, which is the programming equivalent of, like, go-to if you guys are old, like, basic programmers. But there's other advanced things I can do. I can do things like find instructions that produce known conditional flags, and I can put in a conditional jump. Which, to a human, we know that's basically unconditional. It's like, you know, if the moon is made out of cheese, go here. To a disassembler, it doesn't know that the moon is made out of cheese, but we know. So let me start with the basic jump relocation, just in case I didn't quite catch that. So here we have a set of instructions on the left and how it's going to get translated by P.E. Scrambler on the right with basic jump relocation. So we have a call instruction, and then after that, I'm going to relocate everything from the test instruction down. So basically breaking this off into two sections. And it's just simple. I just replace the test instruction with a jump, and everything I moved it that it was pointing to is moved to somewhere else in the file. This is basically position independent, so there's no real problems with this. But it's also pretty easy to detect. Ida Pro is going to show you basically what you see on the right, where it's going to show you function chunks, and one just flows right into the other. No real advantage to doing this if you're looking in modern Ida Pro. But Ida Pro isn't very good at these, the known conditional stuff like I was talking about. So the whole idea here is we're going to find a flag and substitute a conditional jump. Later on, insert conditionals, which are kind of fake. So here's a fake conditional jump. I'm going to target here the XOR instruction. So XOR EAX EAX. That sets EAX to zero. Since it's zero, the zero flag is going to be set. And then I do a jump, JZ. That means jump if the zero flag is set. So to us, we know that the zero flag is set. I can tell you that zero flag will always be set at that point in the program. The disassembler doesn't know. So it thinks that other stuff can happen. So I have a point right here where I say fake code right here. We'll get into that in a second. But this is a completely unconditional jump in reality. We can also insert some fake conditionals, like I was mentioned, to kind of trip up the automated analysis process. Things that the human knows. So right here, in most Windows processes, I mean, this is pretty ridiculous. You'll never see ESP being, you know, 8000 or greater.  So I can insert an instruction right here that says, compare ESP with that and then jump if less than or equal to. So that's basically an unconditional jump in the Windows process. A disassembler, there's no way a disassembler is going to know that. It's not going to keep track of what ESP should be, what are reasonable values or not. It simply doesn't have that level of intelligence. But we, as humans, do. Someone must do. Just kidding. So the whole point of doing these fake conditionals and everything like that and trying to trip up these conflicting sets of disassembly. This is how you defeat a disassembler. So most disassemblers, when they come to a conditional branch, they trust the false branch first because they disassembled the false branch first. Whatever they disassemble first, they trust the most. So what we want to do is basically get the false branch executing wrong code and have that truth branch executing from a slightly different offset so that it actually doesn't match up. When the disassembler does go to process that truth branch, it's like, I already have instructions here. I'm good to go. I'm going to bail. So here's an example. We have three instructions, a push, a move, an XOR. They take up five bytes. If you start at the 5.5, they produce that exact set of instructions. If, for whatever reason, the disassembler started one byte earlier and we planted an E8, then it's going to disassemble a call instruction. It's pretty basic. And the disassembler is never going to go back and produce two overlapping instructions. They just don't. So what we do here, like with these false conditionals that I was mentioning, we have the truth branch point one byte in, then we have the false branch point to one byte before. So if it's doing that false branch first, like I mentioned, it's going to actually disassemble the exact wrong instruction. So the truth branch is going to be hidden, essentially. And like I said, since we have the ability to move around sections of code and change the size of things, I have the ability to add these types of little nuggets in there all throughout the program. Because I have free reign to add code as needed. So here's the basic rule. So now we're going to get into some impossible disassembly. This is a common one. It's fairly well known. We have a jump instruction, which is two bytes. Oops. Jump actually jumps from the end of the instruction. So the argument here is negative one. So it's actually going to jump into itself, which seems kind of ridiculous. But it actually executes perfectly. So it jumps into itself, and then starting at the second byte of itself, which is increment EAX, then decrement EAX. This is kind of like a know-op, a know-op that will fool a disassembler. All right, moving on. I've come up with a lot of these over the years. They're kind of fun. It's like a puzzle. How do you completely ruin a disassembler for life? So here's another one. A move instruction, XOR, and then a jump zero to negative seven. So I'm going to show you the flow of how this actually goes. So going from the end of the jump of zero instruction, it points back here to the second instruction. And if you look at what that actually is, it's part of that move instruction. So it's actually the operand to the move instruction. And what is that? It's a jump at five. It jumps right there. So notice the jump of zero to negative seven. I said on a conditional, it takes the false branch first. The false branch, I planted an E8. So it's going to disassemble that stuff as a call instruction. And then the truth branch is going to produce a disassembly. You're jumping to embedded instructions within embedded instructions. I don't think a disassembly is going to get this. You guys might have a disassembly that will. I don't. Then we can get into polymorphic replacement. This isn't quite as going to be as advanced as some of the viruses and whatnot out there, but even at a basic level, this can be pretty mean for signature detection. So what I'm going to do is seek out small little clusters of instructions that I can replace with equivalent instructions but I didn't have the ability to do this until we had the ability to break apart the binary which allowed us to add more code as needed. And also these types of polymorphic replacements can be randomized. So basically, given an original binary, every time I run this tool, I could essentially randomize the binary, the compiled code, which is pretty neat. So here's a few of them. I have a push instruction which is really simple. The push modifies the stack. It puts a variable on the stack. As well as a move relative to the stack. So I manually adjust the stack pointer and then I manually move data onto it. It's the same thing as a push. Same thing with call. Call is just like a jump, only it puts that return pointer on the stack. So I can manually put the return pointer on the stack and then do a jump. Fairly simple. You get the idea. With the push and the call, I'm just showing you an example of actually just randomly inserting useless or subtract from the stack pointer. It's completely useless code. But if you had an antivirus or something that had a signature for a sequence of instructions and you added code in between it, the signature's broken. So one thing that most compilers do is this is what the first thing on the top is called the function prolog. It sets up the stack frame, that kind of thing. You can do this with one instruction, but most compilers don't for efficiency. So I can actually find the function prologs in almost every function replacing with, like, Enter. Or there's any number of ways you can imagine to set up a stack frame, which can be easily substituted based on disassembly. Jump instructions. All the return instruction is it takes the value off the stack and jumps to it. So I can substitute a jump for a push and a return pretty easy. As you can kind of see where I'm going with this, there's any number of instructions which have any number of equivalent mappings. There's a lot that can go on here. On the last one, I actually substitute a logical comparison with an equivalent one. So let me show you an example of this tool. It's only on the screen, so we have to press my typing. All right, so in this directory, I have pescrambler.exe and I have notepad.exe. So pescrambler.exe, I run it, get the command line options there. It just takes a dash i input file dash o output file. There's really nothing to it. So, let's specify dash i notepad dash o new notepad. And once you see the list of things it does, disassembling, generating cross-references, remapping call instructions, armoring code, that's all the other things we talked about. And now that should work. Let me get a directory listing here. In the directory listing, you can actually see that it actually added $30k to the binary, so it's actually much bigger. It blacked my screen. Yeah. Hold on. My screen is black. I don't know what's going on. Anyway, you have to trust me it did. There we go. Bear with me. Yeah. All right, so there is notepad launching right there. That's the actual new modified notepad that we were playing with, everything. I don't know what's going on with my laptop. It's been a pretty solid laptop up until now. Let's take a look at these in disassembly. I can show you some of the things we're going on here. Here's the original notepad. This is before I modified it in IDA. You can see IDA shows you a nice graph of all the instructions and all that. The main thing I want you to look at here is the actual, this is basically the map of the binary. Blue means code, gray means data. That's all you need to know. Take a look at the pscramble binary. Take a look at the map up there. Not quite the same, is it? Yeah. So now, here's what I was talking about with the function called chunking. You can see it's actually translated what we had into just a series of these little jumps and whatnot. We can still kind of get some logic here going. So this call instruction right here, this is the actual function called dispatcher. You can read through the logic if you want. I'm not going to spend much time on it. If you look at crossrefs2, we're going to get a nice little map. This is every function that's calling our little function called dispatcher. And as you zoom in, you're going to find it's quite flat. Every single call instruction in the entire binary is calling the same thing. Oh, and that's not the whole story. Let's do the equivalent. Open subviews. Trackpad. Anybody have any ideas on what this is going to do?  The reason is Ida doesn't know exactly how my function called dispatcher works, so it doesn't know that this thing actually calls every other function call in the whole binary. So you could reverse engineer this, figure out how it works and all that. It's pretty simple, just a little bit of shell code. So, some other cool bits. I think, that's pretty much it. Let me show you what a normal call graph looks like in a normal program in case you haven't seen it. Oops.  Graphs. Function calls. Here's a normal call graph of an entire program, and you can see through reverse engineering you can get inferences here. So if I see a function that calls a bunch of registry functions, maybe that's something that does registry stuff. If I wax all this stuff with the function call redirector, it's good to go. So, just some ideas there on what's going on. Moving on. All right. I don't need to go any further. I was just going to show you one more tool.  We're way ahead of time. Okay, one other tool. Let me get this back to the top. Find evil. So I have a tool here. It's a GUI. So I'm going to try to launch another GUI. And I did it again. It's completely blacked. Damn it. All right, so how Find Evil works. I'm going to go talk about what was in the slides. How Find Evil actually works is I disassemble the binary. And based on disassembly, I know how many instructions were legitimate. My disassembly is very pessimistic, so it doesn't trust anything that it doesn't absolutely think is code. So if there's any anti-disassembly tricks, like what I've shown you, it completely fakes it out, and it won't disassemble very much code at all.  So what I do here to find malware is I'm going to disassemble every binary on the system. I'm just trying to go malware hunting. Disassemble every binary and see which ones don't have very many instructions that I was able to disassemble. Typically in a large binary, I should have a whole bunch of instructions that were able to be disassembled. Whereas packed binaries, I'm only going to disassemble maybe a little bit of the unpacker stub. Okay, here's Find Evil.  Now I'm up over here, but you're not up over there, so coming up, coming up. There we go, okay. Hooray. See, I saw that I'm running a little quickly, so I'm purposely doing this to stall. Okay, so here's Find Evil. We just do a new scan. If you've ever used the other tool I wrote called Red Curtain, the interface may seem a little familiar, but vastly different technologies underneath. Red Curtain did, like, entropy analysis on all the binaries to try to find binaries that had a lot of random data in them, which means usually, like, compressed data, which can be used to detect packers. The problem with Red Curtain, though, is you've got a lot of false negatives on some packers. If they had really weak compression, or they didn't do compression, they just X-word, the entropy score would be quite low. So I didn't want something that's going to give me false negatives on a packer. And this technique, I've never found a false negative. Just throwing that out there. Oops, not my documents. I'm going to scan just a little demo folder I have with some malware in it. Find Evil malware. It scans. If you notice, that actually disassembled pretty quick. If you ever loaded a binary and IDA-PRO, it takes a while to disassemble. I go much faster. One of the reasons I go much faster is for this purpose, I just capped the disassembly at 10K. So once I've hit 10K, I'm assuming I'm probably not packed. I bail. This is code to disassembly ratio, even though it's kind of fuzzy on that screen. If it detected there's not enough instructions for the size of the sections that are marked code, I'm going to flag that. If I detected, if it disassembled 10K or more, I just marked it as green and you can move on. So that's the main field. And I've never seen a truly packed binary that actually did not score red in that column. So there's also a yellow field, but it's a little bit more rare. There are other columns in here of interest in case, for whatever reason, that didn't quite work right, file to code. So if I have a really small file, and then I go through the PE file format and I see that actually when the thing's in memory, there should be a whole lot more code that kind of keys me off to the fact that maybe it's actually compressed in the file and it's going to be uncompressed in memory. So I flagged that. That's also a pretty dang good indicator. I've never seen a false positive on that one either. Some of the other columns, you can take your pick, but this is a good way. If you have a hard drive or whatever, you can just run this tool against it and if there is a packed binary on there, it will be red. So this only has the problem of a few false positives maybe, but no false negatives that I know of. And both of these are available on the website. Let me skip to the end. So the source code is not currently available. Yeah. Truth be told, my company might take action on me for even releasing the binary. They seriously did not like it, but I did develop this completely on my own time. No company affiliation officially slides don't say my company, so we'll see what happens. I like to put stuff out there, so you might see code, you might not. Don't hold your breath. You can get them at rnicrosoft.net. That is not an M, that is an R-N. So it's all up there. And thanks a lot. Anybody have any questions? Are you in the blue? It's just the Shannon entropy curve. So we go through the binary, find every section that's marked as code and the image count code characteristic and then do entropy on those. Next down here. Yeah, interesting you mentioned that. Well, I haven't looked into multiple dispatchers because the one seems to do enough job, but with the function called dispatching, I'm looking into actually, that's where I'm going to intercept things, maybe be able to change the functionality of any function that I want to remap or just wrap it around with some anti-reverse engineering code, things like that. There's a lot of options you can do. Rescramble it twice. Not really because my disassembler is very pessimistic, so if there's any anti-reverse engineering tricks, it just shits the bed. I mean, it fails. So whenever I try to go to rescramble it, it's just going to get like three bytes in and be like, dude, you know, seriously. Yeah. So, good point. The next tool I want to write is just, I don't know what's going to be called, but based on my disassembly, I'm going to look into ways to dynamically pack and unpack strings as needed based on, so weave that code right in instead of unpacking all the strings up front. It can be done with disassembly, I believe.  I would like to say no comment, but yeah, I did want to do STAG with this, and it can be done, and it may be being done, and maybe not. No official comment. Mandiant is not responsible for things said on this stage. Down here? Oh, well, you saw a notepad running, right? I actually surprisingly, I thought with the function call dispatcher, where I'm intercepting everything and adding like, you know, tons of instructions and tons of loops and whatnot to every single function call, I thought it would be a lot slower. Surprisingly not. You said, if I looked into more calculating, oh, yeah, more complicated programs, but I did a pro, and it worked. So, you know, I think that's somewhat sophisticated. Over here? It's normally, I'm putting it in, whenever I relocate sections of code, I usually put it at the beginning and just wrap it. Or even just the simple jump, the conditional jump trick works fairly well. There is anti-debugging code I can put in. It's not in the free tool. It's on the web right now. And that gets, it's really tough to debug this tool, as I'm writing it, because I'm writing it for the specific purpose of anti-reverse engineering, and you have to reverse engineer the output to figure out why it's failing. So, like I said, this has been a nightmare project, but it's workable, it's usable, and that's phenomenal. Any other question back there?  Unfortunately, more than I would like right now, it's probably on the neighborhood of 20 to 25%. That's just going to be bug fixing. It's still kind of alpha prototype kind of stuff, but when it works, it's pretty good, but that's just going to be continuing development. Oh, God, Steve Lawler. Interesting you add that. I don't actually obfuscate the V-table, but I do, I mean, the V-tables do get run through, because I have the ability with my disassembly to run through every single potential pointer in the binary, which is something Ida can't do, because it's too trusting and forgiving. So I can run through every four bytes in the binary and try to find anything that looks like it might be a pointer value. A V-table dispatcher. Version two. Cool. Yeah, I haven't tried it on a wide variety, and I don't have any good tools for instrumenting that kind of stuff, but for like malware purposes, that's mainly not that anybody writes malware. So I would really be kind of sparing if performance is that much of an issue with you. I might look for things that, anti-reverse engineering technologies that you can integrate in your source code so you can turn it on and off as needed and put it in sporadically. The whole advantage of this tool is that you don't need source code. You can just run it against the compiled binary. So people who don't have the source code can use it, and it does things in a way that the source code stuff won't. If performance is that big of an issue and your timings come out to be shot after you run it, I don't think there's any way I'm going to get around that. It's a fundamental issue. So, any other questions? Well, it's interesting you mentioned dead code because it's going to be tough to determine it to be dead code. Dead code would be, at least typically in my thought, is like functions that don't get called, things that are left out, looked over. The instructions that I insert are not dead. They're executed frequently. So, I mean, you could do some runtime optimization and say, well, these instructions aren't needed. That would be an incredibly sophisticated tool, though, so that's actually probably a lot harder than anything I've developed and anything I'm going to develop. Well, it's not really based on variables, like the conditional jump trick and whatnot. That's just a flag register. Theoretically, I mean, something you come out to predict it. But I can probably write the anti-reverse engineering stuff quicker than people can write the code to actually detect what I'm doing. It's a losing game for detection because this stuff is easy. Like, getting the code to mix stuff up and all that was tough. The actual technique to defeat disassemblers was easy. There's nothing to it. Any other questions? All right, well, thanks. Hopefully.


The absolute state of the damage. Hold on. Are they gonna do pressure on offense? I don't think so. No pressure. Come here. Ugh, great ape. How's it going, everybody? Datsunoi here back with some more Dragon Ball Fighter's rank matches. This time we are once again continuing on the week of Super Baby 2, but now over on the PS5 account, which means we are going up against a lot higher ranked opponents. So I think right now we're actually going up against the second highest rank, and he is playing a scary team. Look at Super Baby 2's instrument. It's still so cool. And I actually got the original color, too. Let's go. Hold on. Let me throw out some... Oh, he also had the same idea as me. Everybody's throwing out ki blasts these days. I'll take it. I'll take it. No, I didn't link the beam. That would have been so sick. All right, rocks. I'm not gonna connect to each that. Well, we don't always get what we want. 6M, I'm not gonna block it. Oh, man, this is so exciting. I feel pretty warmed up with Super Baby 2, but I definitely can't say I've been up against opponents this high. Let's go. I'll take it overhead. Krillin going to start things off strong for us here as we get a hit on UI Goku. Do I switch out to Baby or do I keep him for the assist? I think I have to switch out. Oh, never mind. We're gonna switch out, but we're gonna do it after the kill. Why not go ahead and lock it down? Destructo disc, Yamcha spearball. And of course, we got to end it with this move here. I don't know what it actually is, but to be honest, it looks like Baby's version of a final flash. So I'll definitely just call it Baby's final flash from now on. Oh, that range was sick. Oh, that was nice. Give me a bar. Oh, it was just a little too high, but the Key Blast bring him back down. That was sick. Galeclaw. I don't actually think that was over. Did I just get caught and not blocking? Maybe I was switching from crouching to low. Yamcha holding back. No, Yamcha. Reflect that. 2H. Where's the 2H? I'll take this instead. Take the corner reflect. Oh, he gets hit with staggers. Yo, I honestly think I really do enjoy Baby Vegeta. It might have to be a situation where I play him. Like, as a man, I know we're only on day. This is the first official day, actually, but it just feels so good, dude. Can't do heavy into that. Where's my lesson? Is he gonna jump? Do you want to jump in me? I took a chance to read. We're going to lose a character for it.  I was addicted to the idea of a read. I should have let it go. Oh, wait. No, I just gave him Anchor Baby Vegeta with a Beam Seasist. Oh, no. This is not going to go well for me. This is not going to go well. What do you have to say for yourself, Baby Vegeta? What does he do on Anchor? The damage he can get is insane. Look, he's fishing for something. He's fishing for something. Look, he's going for medium stars. He is fishing for it right now. Rock assist. Let's go. Back it up, Baby Vegeta. Now we're playing defense against one. Five bars. Do I spend it? To be honest, he does not have a sparking, so I might as well spend the three bars. Full screen.  Take a little bit of a mix. I don't think you can actually safe jump his level three either. I saw that as well. Oh, there's the Seasist I told you about. No. Get off of me, please. Guard canceled. I don't want to play defense. Now remember, he can still call that assist. He can still call that. It doesn't really have an assist cooldown. He can spam that if you want. What is this damage? Oh, I'm just going to spark if you don't mind. If you don't mind, I'm going to go ahead and spark so that I can take the game with a level one spirit ball that locks it up. We get game one. Baby did a little bit. I wouldn't say he carried the team, but he did take out the first couple of carried. Look at baby in the background. Not a scratch on him. Man was just chilling in the back. All right. I want to start off strong. Oh my goodness. All right. All right. All right. All right. Okay. Take sliding and then guess what? We're going into this. Yeah. The Super Dash made a lot of sense there. Don't know why I didn't anticipate it. To my extent. Fair play. Fair play. I did. I did panic vanish. All right. We're going to try to raw attack. Forgot you. I go. I'm just going to raw tag it out.  I'm not trying to stick around. See what happens next. Walk the knee stuff. Reflect that. Get the pressure. Look at us just dashing up. That was sick. Yo, talk to me. The job. Oh, no. Oh, we still got the chase down. That was sick. Yo, baby's assist coming in clutch there. All right. Toss a spirit. Toss a death ball at him. Take this. Now, what is the mix? That's the mix. Just a simple overhead.  Super dash at me. That was sick. All right. We're in. Let's go down on his luck. Key blast for Oki. Let's go. He wanted to super dash the key blast, but I saw it coming. No. What a drop. I couldn't. I couldn't do the darkness free shot top. I couldn't. I couldn't do it. I'm stuttering. I'm stuttering. No. I was so focused on getting that. Oh, that's not going to kill. If that's not going to kill, then I don't even want to worry about it. Oh, that was cheap. Got caught trying to stand up to blog. All right. I still think we have a decent lead though. This lead is very strong. Two S didn't work. Oh, that's nice jab. I got to give it up. I can't believe we weren't able to confirm off that. I went a little too slow. Baby gave us a great lead though. Five bars he's jumping about. Let me go ahead and take that. He doesn't have spark. So once again, I'm going to try to rush this baby. Both characters have enough health where limit break isn't too worrying for me. No way. He got okay. Still connected. Whoo. We are about to take a two over. I'll take a two o victory. Can baby lead us to it? That's what I'm looking for right now. I need it right now. I'm going to solar flare. I think I think he's going to try something. He's going to. Oh, okay. I'm scared. No. Image makes is going to be enough to seal the deal too afraid to click a button. But that's exactly what you got to do in that situation. I will take a destructo disk seals it up against the second highest rank. Well, I feel like that was a great game to start with. Now my confidence my confidence with baby is at an all time high right now. Okay. We found another opponent this time a God of Destruction right playing Jiren. All right. Baby's also in the background. My man. Wow. The the height difference between baby Vegeta and just Vegeta. Oh, nice movement. The assist also came back. All right. That was unfortunate for me. Man.  I got a tech. I should. I got a spark now. I got a spark. I should have tech but now my answer is I got a spark. Assist is coming back.  All right. We're out. Got to escape that. Come here. Was that a counter attempt? I think he was sticking his head out there for a second. Spit on him. Hold on. Throw some rocks as well. That was such an unfortunate look on Jiren's face after the rock doesn't matter though. Destructo disc into baby's final flash. I got to look up the actual move name going to lock it up. We get a character lead at the cost of our spark, but at the end of the day, I'm gonna I'm gonna call that worth for us. All right. We got to switch out. If we want to extend that into the current corner though, baby had used to superdash defensively. Let's go another hit. Another big hit. I want to switch out to baby. You know what? I will switch out to baby again. Hold on.  Get it ready.  He did. He woke up dragon rush. Insane. I I've never seen it come. I did not see this coming. Oh, level three. Okay. We're going to live. I mean, we have to take. We have to take knockdown. I assume how far is baby from us? Oh, we're good. We're good. Come here. Sensei bead sensei bead barely healed us. Come here. All right. All right. Back it up. No superdashing allowed. Oh, he's got sparking. I didn't fully realize that. I blocked it. I was like, maybe I can gale claw here. Maybe maybe he won't see it coming, but not sparking allowed him to jab out of that. You know, I got a superdash defensively. If you jump, I got a superdash behind the back. Okay. Nice. He called me out. He called me out. Whoo. Those key blasts. They're going to come back if I'm meeting you. If you are getting comboed, as long as you are at the assist, those things are gone. All right. Now we have just one character left to deal with Vegeta. He does get a full health bar with limit break though, which is kind of scary. Where are you going? I'm taking half of it. I'm taking half of the health bar now. Nice. Do we throw another rock? I'm going to throw another rock. That also worked. I just wasn't there to capitalize. What a move. I'll take it. Connections in the air. Take them downtown. No spark. I might as well spend the bar. So right here, I'm looking for either a wake up level three or DP. Nope. I'm not seeing either. I'll take game one. Whoo. All right. That was really good as well. He was moving at the beginning there. I was really worried for baby safety. This time though, I'm feeling pretty good. I'm going to try to get. I think it's time we get at least a loop in. Come on. We got to hit at least one loop combo in the real. Now that I got this controller down. Thank you. Thank you. I do try to counter me. All right. Here we go. Super Dash. Oh, he's not feeling it. I thought about super dashing, but I didn't want to risk him to aging and I regret it. I do regret that. Oh, okay. Last time you dragon rush there. Oh, there was nothing I could do. I had no part of it is coming. I think he low key took out my assist with that assist. He took out my assist with his assist. Hmm. I got it. I got a tag out here. Here's how I'm going to do it. My goodness. I'm panicking. I panicking. It's fine. We still got it. We still got it for the most part. It was so bad. I definitely didn't think the fact that you can delay that combo that much actually scared me half to death. No, that was supposed to be okay. I'm going to mix. Where are you going? Can I just talk to you for a second? Can I just talk to you for one second? Mixups. I don't know why I reset. I should have taken the super, but let's be cheap. I want to spend less bar. Baby's moving now. Oh, that should have been a 2-H. I had it. Who did I kill? Oh, Vegeta. Siasis locked down. Okay. Didn't really lock him down. Hold on. Hold on. Hold on. Hold on. Don't hit me. Don't hit me too hard. Ugh. I thought he would try to hit me pretty hard. No, Yamcha. I'm sorry. No, Yamcha got caught in the crossfire.  Hold on. Let me move a little bit. Let me move a little bit. You know what? I'm switching out to baby again. Final flash in the air. This character is so cool, man. This character is so cool. Why not just attack him like that? Oh, I forgot which baby I was. Damn it. That was so fast. I tried to react. I really tried to react with the spin. Either way, I'm not too afraid. Maybe he'll make me regret that. He does have baby's assist now. Oh, I hope I don't. I'm not. I hope I don't regret saying I'm not too scared. I'm scared. The Key Blaster coming from all angles. I'm terrified. Downright scared. We're moving. We are moving now. Is it over? I think it may be over. Couple of destructo discs. Seal it up. Let's go. Now, the question is, do I go one more match? The question is, do I go one more match? And I'm thinking the answers. Yes, we're going for another long video. Let's go. We are back with the final bonus round, I guess. Come here. Let me just go. Let me just run the combo real quick. I'm just not even going to end this with sliding. I don't need it. Oh, mix-ups. Am I looping? I'm looping. Why not, right? Why not loop? I actually had to end that early because of the way it started. Damn. I'll take it. Don't run. Had to end it early because of the way it started, but baby is moving now. This is definitely a character. Oh, there's still so much to practice too. I'm going to cross up. There's so much to practice. I still got to get his re-jump down. It is a little weird. And then there's new combos. Let me see if I can't do a new combo real quick. Nope. I don't know how to link the beam. Doesn't matter. We're back on the old loop grind. I did it again out of habit. Oh, man, the old loop grind. I still think the loop looks better, but there is a new combo with that beam. 2H. I got a, you know what? Hold on. I'm 2H there. That was nice. Nice 2H. I called out the Vendell assist. Actually, hold on. What's Vendell's bee assist? Can I check out the bee assist real quick? Can I check a bee? Oh, it's the Yamcha assist, right? That might be good for me. I'm getting limit break right now. The damage. The absolute state of the damage. Hold on. Are they going to do pressure on offense? I don't think so. No pressure. Come here. Great aim. You know what? So nice. I'm thinking about doing it twice. Should I do the great aim super? I mean, that's, I think that's too much of a read. Oh, come on. The read was actually correct. I thought that worked for a second. Oh, wow. It spawns on top of you. Oh, no, my dead limit break plus sparking. It's going to be rough. It's going to be a rough ride. Hold on. Okay. I think we live by a little bit. Oh, nice. Oh, get me out of there. I'd rather keep the assist. I'd rather live to see another day. Let's go. All right. We get another good hit. I'm just going to keep this one. You know what? Bring baby back out here. Level one. I'm going to make a read up tech for me. So nice doing twice. Never mind. Was really hoping for another jump, but instead we'll just get left with that one sliver. Hopefully we don't lose this. Nice. Wow. That looked aggressive. I don't know why Krillin slaved her head into the ground like that, but that was a really fun match. Obviously, we're going to go again. We're going to go. We have to get the full match. Oh, counting on. Yeah. Hey, thanks man. Okay. So I guess during this rematch loading time, if you guys are playing baby right now, I think he's out on most platforms. PC seems to be getting kind of forgotten about right now. I don't know what that's about, but yeah, it definitely should have been out. I think by now, but I don't know. It's it's weird. It's weird, but if you do have the character, what are you thinking about baby so far? I think he's really fun. I just got hit. I think he's really fun. I think he's another example of why this season of DLC has been so he's so unique. He's so different, but also he's a, you know, he's just a lot of fun. He still has that fighter's feel, but also like he's like 80 gimmicks. Oh, no opening up, huh? Spin the win. Take a level three with you. That move is so childish. The EX grab is so funny to me. What was I forgot what I was even saying because of that. But yeah, this season of DLC really fun, really unique, but still captures that fighter's feel. I think I would have loved to see a season four with this quality, man. Another season. I'm going to go over him. Oh, nevermind. Got caught. Is it air tracking assist? No, that time I did drop the combo, but I wanted to see if I had an air tracking assist.  Darken the spring shot. I'm going to do it twice. Oh, I shouldn't have done that to age dangerous. Am I dead? It's definitely enough bar and going to go out to a level three and make it happen. Looks like baby's going to be sitting on the bench for the rest of this one, but I still think it was an overall good show for the first time out. This is the official start of the right week. I'm actually really happy with what we were able to do. But yeah, I guess for the rest of this, we could just talk about a future plans. Oh, we're moving. So, uh, yeah, obviously I'm still going to be practicing baby to try to get some even newer combos down. There's still, since the character is still so new, there's still BNBs being discovered. Um, dragon rush routes. I still have to get down mid screen stuff stuff like, ah, and of course we're finding what I already do. What a reaction. And of course we're finding stuff that I already do. Oh, and I just, why is this 21 kind of smoothing right now? Hold on. Stop that. I need you to stop. Oh, that 21 was putting a lot of pressure on me. I was like, yeah, let me talk about baby. And 21 was like, nah, you're going to talk about this 2H. 2H. I mean, 6M. I've forgotten what everything is now. Should I level 3? I kicked upside the head. I might lose. There's a good chance I lose here. Slammed to the ground. Level 3 out. I'm dead. How much time do we kill off for sparking, if any? Oh, it's going to be close. It's going to be close. Damn, baby's so sick. Baby's so sick. I'm just thinking about how sick that is. The spin, I shouldn't have sparked right away. I'm just going to super dash if anything comes of it. Let's go. That's, I think that's good enough. Limit break. 7 bars. You were messing with Yoncha. Actually, maybe not. Kind of depends on how much the healing wants it. And am I bad at the game? Which the answer, of course, is yes. Didn't block it last time, but 2H is it? That's why they got hit. I spaced it poorly at that time. They tried to 2H the first time, which is dangerous. But now it's dangerous for me. Now, now it was the correct read. It's looking real dangerous. I have to block. I shouldn't have blocked. Why am I playing defense? Just play offense. Let's go. We're going to wrap it up. Great games to all the opponents. Hopefully you enjoyed this one. I know it ended a bit slow, but still, I really do hope you enjoyed this first official week of baby video. The one yesterday was more like a bonus. Also, like I said early in the video, let me know your thoughts on SuperBaby2 down below in the comment section while you're down there. Make sure to hit the like button and subscribe if you're excited for the rest of the week with this character. I know I am. Other than that, you'd also check out some more videos that should be on your screen right now. Thanks again for making it all the way to the end. I've been Dr. Doi and I will see you in the next one.


We have a lot of sustainability minded customers and we want to educate them on just how sustainable electric vehicles are and we want to educate them on the types of charging, level one, level two DC fast charging. Every car has level one charging that comes with it. You literally plug this into your 110 outlet in your garage. Come up to my level two charging station and then I can plug it straight into here. The third option is a fast charger option, so you take the adapter, you plug it in here, you take the Chattano end of the DC fast charger and plug it in to here, but it's going to charge this vehicle up from dead to completely full in less than an hour.


What's up everyone it's your girl Kenzie here from late in sports cards and I'm reppin 2022 panini prism football hobby 4 box break number 61 pick your team gonna go over the teams and then we'll get ripping alexandros s jets and bucks brian each washington collume f with the Giants and falcons Carlos f packers david f panthers ed b raiders edward h Dolphins edward p cowboys ravens harper b titans hung chi c bills Jeffrey h with the Steelers Niners chiefs lion seahawks Jared K patriots Kenny H bears Colt Saints and Cardinals Kyle S Vikings Michael O Jags and Eagles Mike L Browns Patrick Z Chargers Ramar's a Broncos Ron L Bengals Russell B Rams and Scott N with the Texans All right. Thanks again everyone for getting these filled up. We are all full for the daytime breaks again Sam will be live at five Four more group breaks tonight. Well Kyle over on drip. All right. Let's see some Finns says SL VR Let's see some fins silver all out Darren Waller. We got orange to 249th stube Connor Jacks Brodery guys and Drake London rookie L way out of interesting request fireworks Josh Allen. We've got blue ice Josh Allen 99 bills Thompson and John Dotson got rookie Kenny Pickett emergent purple ice a 225 Justin Jordan Poyer Guanwu Isaiah Spiller rookies Silver Javante Williams. We've got bears the 75 on the green scope Kyler Gordon rookie Otto Chicago Logan Hall Calvin Austin the third Silver brilliant Jamar Chase orange Chris Godwin for the Bucks the 249 Jack Jones Brock Purdy Ricky Silver Kyle Hamilton rookie for the Ravens hyper to 175 Brian Burns Stanley Jr. and Alante Taylor Brilliant Joe Burrow blue wave to 199 rookie of Kyle Phillips Titans Brian Cook Khalil Shakir Silver Darren Waller purple ice a 225 of Nick Mangold Trill and Burks rookie to be though Got Brian Dawkins silver and we've got to 75 and Eddie George on the blue ice Sensational signatures. It's a cool one Titans Eddie George has been a great case for the Titans orange to 249 Tyron Matthew Tray McBride trust in Ebner So look for a snake skin. So hopefully you can see one here new recruits Drake London rookie A purple power to 49 Dak Prescott for the Cowboys Garrett Wilson rookie Evan Neil Yeah, our Mars. It should be fun. It should be fun Yeah, I'm Jordan. We got Matt Corral the 225 Panthers on the purple ice They've got strong junior and McCreary probably do something with family after I get off tomorrow of box one That's silver fireworks of Russell Wilson green scope to 75 equal Harman jr Trayvon Walker and Drake Jackson rookie brilliant scooper cup orange Matt Corral to 249 Panthers Mets you the third quay Walker Silver Tyree kill hyper to 175 Peyton Manning coats I like Pierce Andrew Booth jr. Silver Carson Wentz We've got Otto up next for the Colts a Michael Pittman jr. Silver Pittman jr Snip Connor and Malik Willis Ricky base New recruits Traylon Burks. We've got C each purple ice the 225 chiefs Ruckert and James Cook Warren sat orange to 250 bucks Kyle Hamilton and it could be Dean Hope everyone's having a great Saturday Good relaxing weekend To appreciate you tune in into the stream fireworks that press got orange the 60 famous James for the Saints Kyle Phillips and Wanda Robinson Fonte Adams fireworks. We've got green scope to 75 mafay Seahawks Mcduffy and George Pickens rookie silver James and Williams rookie Lions red wave to 149 Josh Jacobs Mafia and Algea rookie pull out Josh Allen blue wave to 199 Dawson Knox for the bills Got Ritter and Doolitch Rookie emergent Trayvon Walker purple ice the 225 Emmett Smith Cowboys Piggity and sauce gardener Ricky got silver Jalen Johnson next auto We've got to 49 a Skyler Thompson on the purple power rookie auto There you go SL VR You're asking for some fans Skyler Thompson to 49 13 of 49 there Purple power auto never know Benito in Washington To it doesn't come back last pack here box to silver rookie Desmond Ritter orange Darnell Mooney to 249 Christian Watson and Jordan Davis New recruits breeze hall. We've got the 225 Julian Love Giants Gordon and Rashad white silver flashback Jalen hurts Go birds to 175 Trayvon Walker Jags Davis and Thornton Brilliant Jonathan Taylor red wave to 149 kill a little Herbert Bears Got sauce for key and Bonito Silver rookie of tight channeler Vikings blue wave to 199 Rashad Weaver Titans mantra Washington and Christian Watson Silver Cortland Sutton next auto up. It's gonna be Seahawks to 75. Nice Kenneth Walker the third green scope rookie auto You go Seattle Washington that's gonna be Jeffrey H Grats on that one Jeffrey 11 of 75 we'll make that one for you. Can you pick it and Chris O'Lave? New recruits silver trailing Berks orange to 249 Fletcher Cox Eagles Cross and his son Haskins There's an L-Wave base. Let's see if we can get you on over Mars Got Carol Aftis on the orange wave to 60 for the Chiefs 52 of 60 algae rookie Desmond Ritter Silver, Zach Wilson next auto up. We've got Chargers Austin Echler Me go LA Just do like killed it for me in fantasy this past year Phillips and McDuffie buys to 99 Garrett Wilson. There you go Jets Nice sit there That one's going to Alexandros s Pacheco on the orange that is 90 of 249 Sheeps cook and Hamilton Silver Darren Waller orange to 249 Christian Kirk Jax The Kobe Dean and Wanda Robinson Hype Javante Williams got Navy camel coming up pickings and Moffat See Niners who show me rookie. Oh, no, we've got a Nick Bosa a nice one there. You imagine that's a broccoli Two of 25 Niners nine minus seven is to Jersey number eBay. What a one Last pack box three silver brilliant scooper cup green scope to 75 Bernie Kosar for the Browns Dulich and a big eight. Come on snakeskin. You hiding this last box of the case And you're not guaranteed them but typically a case hit Box of prism for the daytime. Garrett Wilson fireworks rookie got Brandon. I you to 175 a big giddy and a soft circuit base silver rookie David Bell Browns blue wave to 199 DK Mecca Like Bonito and Montrell Washington Silver Leonard Williams, we've got to 75 Duke McAllister in the sensational signatures green scope Philips Wanda Robinson Jalen waddle prison break. We've got to 99 blue ice Josh Jacobs readers Duffy and George Pickensworth. There's our snakeskin There's our snakeskin. We've got it's a alarm for the bills to 149 Moffay and algea rookie Cowboys Dallas it's going to Edward P No rookie It's gonna be a Michael Gallup on the snakeskin short front case hit Nice silver fireworks Nick Chubb purple duck Prescott for the cowboys to 125 Ritter and dutch Got Bailey zappy on the emergent blue ice to 99, you know New England another blue ice rookie. Nicoby dean equals to 99 Ruckert and james cook silver chris carter orange walter jones to 249 seahawks Kyle Hamilton, nicoby dean silver lockdown mica hide Got davis price to 135 Niners Watson and jordan davis Emergent damian pierce. We've got to 225 purple ice myles sanders Tygo on thorn and kyler gordon Silver michael vick. We've got malik willis on the silver rookie auto Nice one there tightens Malik willis Heck yeah white and kenny picket rookie last pack and then we'll do a recap Silver hype of nazi harris orange to 249 and tenio gates Chris alive a rookie and charles cross rookie all right Here we go recap We had the malik willis silver rookie auto deuce mcallister saints austin eckler chargers skyler tomson on the purple power Uh dolphins michael pitman jr. Colts uh eddie george titans kyler gordon bears and he kind of walker the third green scope auto to 75 11 to 75 there. All right, that will do it for football. We've got one more break coming up. Thanks everyone


Since the late 2000s, Ubuntu has been the most important and popular Linux distribution out there. Like, it's not even really all that debatable. It's just a distro that the vast majority of people who use Linux on the desktop use. And for that entire period of time, it has also come under a lot of scrutiny because of that popularity, whenever canonical and the people who develop the Ubuntu desktop make any type of change, there's always an outcry from some portion of the community. It's just the way that it kind of works. And it doesn't even really matter what changes they've made, whether it's for good or bad. Some people are going to be pissed off because they made the change. And even as new as I am to the Linux community, like I started using Linux full time in 2017, for that entire period of time, at least for the most part, Ubuntu has been a very important and influential distribution. But it feels like in the last year or so, maybe even two years, the influence and popularity of Ubuntu seems to be waning, at least in terms of its usage on the desktop. Now, I don't have any hard numbers to back this up other than the recent losses of the Ubuntu desktop on the Steam hardware survey. But it still feels like a lot of like Linux YouTubers, a lot of bloggers that cover Linux have moved away from speaking about Ubuntu in a positive light. And it led me to think about the future of Ubuntu, because like I said, Ubuntu has been a very influential, very popular distribution for well over a decade. What does the next 10 years look like for the Ubuntu desktop? And is it even appropriate to start thinking about Ubuntu as a waning desktop, something that is on the decline? So let's just start off with the current state of Ubuntu, because I think that a lot of Linux YouTubers, a lot of Linux content creators, whether they create blogs or whatever, have been very unfair to Ubuntu over the last couple of years. And well, they have had some stinkers in terms of releases. The release from late last year was not a good release in terms of stability, in terms of consistency, it wasn't very good. But the most recent LTS was actually quite good and quite well received. But there's still a lot of talk about how Fedora is the new Ubuntu and how we should stop pushing new users to Ubuntu and push them towards Fedora instead. And it makes me wonder, is that something that we should really actually do? Should we stop telling new users to use Ubuntu and instead use Fedora? And as I'm thinking this, I'm wondering why this should even be a question, because for me, it's not actually a question. If I were to tell someone what distribution they should use as their first Linux distribution, Ubuntu is definitely still probably the one that I would say. Now, there are other options that are really good. So Linux Mint, based on Ubuntu, ZorinOS, based on Ubuntu, we kind of get the idea, right? Like every distribution I can think of, except for a couple of exceptions that I would point a new user towards, they're based on Ubuntu. I would never tell a new user to go use Manjaro. I know some people have said Manjaro is great for new Linux users. I don't think so. Arch is just something that should be used by a new Linux user after they've used Linux for a little while and understand the differences between a desktop environment and a distro. Once they get the lingo down a little bit, then they can try an ArchBase distro and probably be more successful at it. But for me personally, whenever I tell anyone that wants to use Linux for the first time, and they ask me what they should use, I always point them towards an Ubuntu-based distribution. Easy to use, very stable, lots of software, I mean, the list just goes on and on, right? Even something as locked down as elementary OS is a good option for new users, again, based on Ubuntu, popOS, based on Ubuntu. So this idea that Ubuntu is no longer important, that it's not something we should point new users towards, just doesn't make any sense to me. It doesn't make any sense to me. Now, that doesn't mean that Fedora is bad. Like Fedora is a fantastic distribution, and it's not even as if Fedora is a bad idea for new users. I would say it could be used by a new user fairly successfully. But there are certain quirks about Fedora that are just different, things like their complete disregard for anything proprietary. So you have to enable certain repositories in order to get those things. And it's not well explained. So it's not as if enabling those non-free repositories is hard, like they give you an option right there at the beginning, but they don't explain why you should do so. You know what I mean? They don't say, hey, if you want Nvidia drivers, you have to enable this thing. And they don't do that. They just have, like, if I remember right, just like one sentence, would you like to enable non-free repository or something like that? And that's it. Like then there's a button. So that's one quirk of Fedora that is not all that new user friendly. Also, they use vanilla GNOME. And while I think that vanilla GNOME has gotten better, for sure, Ubuntu has actually done a fantastic job of taking GNOME and making it so that it doesn't suck so bad. They've made it faster. They've made it more customizable. You know, they've added features to it that make it so you actually want to use it. And while, like I said, vanilla GNOME has gotten better in those areas, it's still not as far as Ubuntu has taken it. So I think that Ubuntu has actually done a better job of making GNOME usable than the Fedora guys have. So that's another thing that I think would, at least in some ways, make Fedora less interesting or less good for new users. And then there's community because there is a very large community surrounding Fedora. And it's a good community. Like they're very helpful. And there's a lot of documentation for Fedora. But when you're a new user and you need to find some help, you want that help to be as plentiful as possible. And because Ubuntu has been so popular over the last decade and a half or however long it's been, there is a ton of documentation out there. Now some of it's out of date, obviously. But if you have a problem with Ubuntu, there is like a 95% chance, maybe even higher, that someone else has had that problem as well. And there's a solution online for you to fix your problem. And that's not necessarily true about Fedora because it's not as widely used. So when we start talking about what distribution we should point new users towards, I still feel Ubuntu or an Ubuntu based distribution is the correct answer. So to answer the initial question, is Fedora the new Ubuntu? I don't think so. Like I don't think that Fedora is ready for that position yet. It has to grow in popularity. So the documentation and support online increases. It has to be more user friendly, at least in certain areas. So I think that Ubuntu is still and rightfully so the best distribution for new users. And I'm not just talking about Ubuntu, like the thing, like the actual distro. I'm talking about, you know, the flavors and the things based on Ubuntu, like Linux Mint again, elementary OS, Zorin, PopOS, whatever, things based on Ubuntu just tend to work better for new users on the broadest range of hardware than any other distribution out there. It just seems to be the case. And there's a reason why Ubuntu has been so popular. The question I asked earlier is why there seems to be this idea that Ubuntu is on the decline. And I think some of that is general dislike of canonical. Now I can't really explain why people dislike canonicals much they always have. Like I don't really understand it. Like I don't know whether or not it's just antipathy towards all corporations or whatever. I don't know if people tend to have this kind of tribalism towards liking Red Hat but disliking canonical. I don't know because some people who hate canonical with a passion are perfectly fine with Red Hat and well, Red Hat is owned by a corporation that is bigger than canonical is. So I don't really understand the idea of disliking canonical just because they're a corporation. Now some of that I think some of the dislike of canonical I think is due to the fact that canonical has been known quite frequently over the last years to work with the devil. And when I talk about the devil, I mean Google, Microsoft, Amazon, they being canonical don't seem to have any problem working with giant evil corporations that everyone in the Foss community rightfully can't stand. So some of that evilness seems to have rubbed off on them and they got infected. That's a possibility as well. But also I covered this in a video a few months ago. Ubuntu, at least before this last release, is kind of boring. Like it's just one release after another, hardly any new features, just making GNOME as stable as possible, whatever. It just it works. It's nothing exciting. There's no push forward. And the thing about Fedora is it seems like Fedora has become the distribution that pushes things forward. And that used to be Ubuntu. So Fedora develops type wire. Fedora pushes forth Wayland. Fedora pushes forth advancements in system D, like so on and so forth. Like it's just on and on. Everything that's new to Linux and Linux desktop over the last few years has come from the people and the community surrounding Fedora. And there's this idea that Fedora, therefore, is taking over from Ubuntu as the distribution that is pushing things forward. I would argue that Ubuntu hasn't been that in a long time and maybe even hardly ever that. Like Xorg was developed by the same guys that are doing Wayland now. And Xorg is 30 years old. You know what I mean? Pulse Audio developed by the same guys who are doing type wire. It's not as if Ubuntu has ever been all that innovative. And when it comes to underlying technologies, it doesn't mean that they've never contributed to any of those things they have. But a lot of their big ideas have been complete failures. Things like MIR, you know, technically still around, but definitely not Wayland. You know what I mean? And there's nothing wrong with that. But I don't think Ubuntu at least recently has ever been that distribution that has pushed things forward. That's always been Fedora. So in that case, you know, you really can't say Fedora is the new Ubuntu because there's the roles really haven't changed. So bottom line now that I've been rambling on for 10 or 12 minutes. Ubuntu is a fantastic distribution. Fedora is a fantastic distribution. But I don't think that Ubuntu is as on the decline as some people seem to think. So that is it for this video. If you have comments on the state of Ubuntu, you can leave those in the comments section below. If you want to follow me on Twitter, you can do so at the Linuxcast. If you want to follow me on Maston or any of my other social media networks, you can find those links in the video description. You can support me on Patreon at patreon.com slash the Linuxcast, just like these fine people who have supported me throughout the last year and a half. I really do appreciate everyone who is on this list. I can't even express how grateful I truly am for each and every one of you. So thank you from the bottom of my heart for the rest of you. If you want to support me like these fine people again, patreon.com slash Linuxcast. Thanks everybody for watching. I'll see you next time.