All right, we'll props to you guys for showing up. It's the first talk of the morning, so appreciate you being here. All right, so my name's Tilly Bush-Hump. I work at SAIC, do security consulting, pen testing, some other interesting stuff, and I did this research with Dave Weston, who used to work there with me and is now at Microsoft, so yeah. Today we're gonna be talking about retrace, so we'll start with tracing applications at runtime and show how we can use this for vulnerability pinpointing. We'll go into programmatic debugging with a Ruby-based toolkit we wrote and end up with some generic kernels and application stuff. So first, let's talk about the background of retrace in case you're not familiar with it. This is a kernel-based dynamic tracing framework, something that Sun built many years ago. They open-source it under their SDDL license. It was released with SunOS 10 back in 2005, and retrace has since been ported to Leopard, so back in October of 2007, it was the first time that we saw this on a desktop operating system. So that's when we started to get curious about how can we use this for exploit needs. We're also seeing it being ported to FreeBSD. It's currently in the FreeBSD 7 current branch, and will be in the FreeBSD 8 stable branch. This guy, John Viral, ported it to FreeBSD. Yeah, so what we're gonna talk about mostly, we're gonna use examples of OSX as an operating system, but really it's generic to anybody who implements retrace. So if you've got a Ruby interpreter and you got retrace, you can use our toolkit with a little bit of customization. One interesting thing, which I'm not sure, is I had heard in the upcoming iPhone releases that retrace may be included, so I know instruments is supposed to be included, so that would implicitly tell you that there's some retrace functionality. So I'd be very interested in seeing how retrace performs on a mobile device coming up. We've also seen it on Netrino, partial implementation. So the basic overview here is that retrace is a performance tracing framework. So it enables you to observe what an application is doing at runtime. This may remind you of other tracing utilities like S-trace or K-trace, or things that are sort of single purpose. retrace gives you the framework to implement your own tools to either reimplement things like S-trace or to specify exactly what you're interested in tracing. So you do this by defining these probes and then actions that go along with the probes. So this is what the architecture looks like here. We have a lot of cooperation from the kernel. That's what the bottom of the screen is here. So you get these categories of probes like system call probes or the function boundary tracing for tracing functions within the kernel itself. So one useful way to think about this in analogy may be consider an entire operating system where there's break points in every strategic place, and it's just a matter of enabling those break points to get some type of instrumentation in that area. So it really is like having a system with a debugger attached from top to bottom. So that's kernel subsystems, the kernel itself, IO, networking, user applications, and at any time you can just say, hey, I want to know what's going to happen when that particular point of instrumentation is hit. So there's this user LAN library here, libdtrace, which is utilized by a number of applications, generic OS applications, but then also the dtrace user LAN binary itself. So what we're interested in doing is writing these dtrace scripts, which will be run through this whole environment. So we write these little dtrace scripts in a language called d. The authors describe it as a syntax of c. So you basically specify your actions that get compiled into some intermediate form and then run with cooperation of the kernel as the application is being traced. Now, d actually turns out to be quite limiting because it doesn't have control flow. So there's not things like loops, which really limits what we can do in our logic. It's really meant for taking measurements and doing comparisons and small amount of recording. And there's good reason for this, right? You don't want to be the kernel and accidentally hand off control to some script that's hooking a function that's never going to return because the kernel will never get control and then you're completely screwed. So you'll see that safety and performance are major priority requirements in the design of dtrace. So sometimes this works to our advantage because we care about performance when we're doing tracing. And sometimes it's not to our advantage because you'll end up dropping probes and stuff. So that's probably one of the main problems solved by our talk and by our framework is, of course we've got this really cool framework that does tracing of the entire system, but it's primarily designed for troubleshooting, for performance, and for overall debugging of production systems. So Sun created this as a way to say, hey, we can send our consultant in there on your live production system and he can tell you what's leaking memory, what's sitting on CPU for too long without you having to set up a completely separate system which you would normally have to do recreating your production environment so that you can debug because it's too dangerous to attach a debugger to Apache or your SQL server in live. So what's happened is that, of course that gives us a lot of power from engineers, but because of the safety and performance considerations, you'll see that we kind of have to figure out and do a MacGyver thing around some of those roadblocks. So the bottom line for performance is that there really is no impact when detrace is not active. And when it is active, it's been streamlined to be most efficient. Okay, so there's a million of different things we can do with detrace and a lot of them have been implemented with these singular tools like S-Trace and TROS and so. So you can re-implement those if you want or focus in on exactly what you're curious about in application. So the real takeaway here is that detrace combines system performance, statistics, debugging information, execution analysis into one small framework. So it turns out to be very useful for us as reverse engineers because we want to answer very general questions about behavior, but then we also want the ability to zoom into a specific situation or condition and inspect exactly what the application is doing. We also have the ability to trace the application as it's interacting with the rest of the system or to trace multiple applications at once. So before you run off and all write your own detrace scripts, there's a lot of work that's already been done out there that you can reference. So there's this thing called the detrace toolkit which includes pretty much every kind of script you'd want for monitoring performance, things like I-O, disk I-O, system call tracing, things to snoop file input and output which is interesting and monitoring file activity. Just to give you an idea of how powerful detrace actually is, if you notice in the 10.4, so the Tiger release, there's a utility that's been around since the creation of OSX called Ktrace and that was your main system call tracing tool. Well that's been replaced in Leopard with like a 50 line descript and it performs about 60% better. So you can actually allocate any of those tools that we showed on the previous slide. The nice thing is that you have a custom a singular interface to all of these tools so instead of having to write a custom bash script where you launch Strace and then switch to GDB you have all of this in a sort of uniform very elegant framework that you can use to create sort of monster tools and you'll see a lot of that in the Sunday Trace Toolkit, some really great examples. Okay so let's take a look at some simple examples. This is a one line detrace script. This is a script here. You have the pro definition and the action itself. Basically what this is going to do is trace every application across the system recording the number of times that each application makes a system call regardless of what that call was. So the output from running the script for a short period of time shows us that, you know, Syslog made one system call, CubsD made four system calls and Veeamware made almost 7,000 system calls. So what we might be interested in doing here is drilling down and focusing on Veeamware and saying, okay, which system calls is it making? Or what the arguments those system calls are? Here's another example. This shows a small detrace script that hooks every open function every open syscall function at the entry point and then simply prints out the executable name and the first parameter of that function which will be the file that was open. So output from this might look like this. It shows finders opening a plist file, Veeamware is opening dev, urandom and so on. So these configuration files and these resource files are being opened by these different applications. So the cool part is you can start to use what are called predicates which we'll explain in a second where you can say when this system call happens with this particular argument which files are then open. So you can get some really deep sort of nested if else type of statements to really zoom in on the particular area of the application that you're interested in all without having access to the source code. Okay, so to review some of the terms we've heard here, there's probes which are your points of instrumentation or you can think of them as your points of hooking. There's these providers which are just logical categories of probes and then there's predicates which are conditional statements. So these are evaluated true or false and then the action is carried out or not. So you can hook something and then decide not to do something. This is, if you've seen AUK, it's much, the syntax is much like AUK. You specify some condition like, you know, the line AUK is processing a line. So the line has four elements to it and then the action that goes along with that you know and if there's four elements in the line then print out the first one. So it's a hook, a predicate and an action. So the way the syntax looks is like this. You've got your probe which consists of the category the module which is usually a library the function name and then this last field is usually the entry point of the function the exit point of the function or every instruction within that function. The predicate is the conditional statement that's evaluated to true or false and then the action is carried out depending on that predicate. Okay, so let's talk about how we utilize this for our reverse engineering tasks. Okay, so you probably already have some ideas of how this can be used for reverse engineering. You can get all sorts of information about how a particular application you're interested in either testing for security or understanding just a general understanding of how it's interacting with the system as a whole. So you know what syscalls are going on, you know when it's making IOs, what files it's touching you know all sorts of things about it. So the idea here is that you can really quickly by either using a script that you've created beforehand or tailoring a script to the behavior of that particular application you can get an idea of how it's working at a sort of a top level and then you can zoom in on the areas that maybe have a part of the attack surface or just going to give you some general ideas about the security of the application itself. So it's very useful. The other thing is you can use predicate so for example you may want to trace until a function gets an input from your fuzzer, right? If string copy is getting 5000 days, maybe you want to trigger the debugger at that point and say hey I want to see what's going on here. So it kind of releases you from that idea of having to say a million breakpoints which kill the performance and change the memory layout of your application and will only trigger a debugger when there's a specific incidence that you're interested in. So the way we like to think of it is as a rapid development framework for reverse engineering tasks and tools. So the way we use it is we're lazy reverse engineers, right?  If something takes too long if you have to attach the debugger and you have to write all these conditional breakpoints you're going to get tired. But the idea here is that we've really sped up the exploit development time, the vulnerability assessment time by giving you the tools that can really tell you what things you're interested in very quickly. So you can script things you can attach and re and unattach from an application as it runs because it's running in the kernel you're not interfering with the memory of that at all If you've ever experienced this while using GDB, you set up an exploit you get it working. The second you detach GDB the memory layout is different so now your show code doesn't execute and it crashes instead you don't have those problems with Dtrace. So the idea is that you can refine what you're interested in or what you're doing without any performance penalties or slowdown at all. So let's look at some of the simple things we get with Dtrace that are provided for us that we would have to implement ourselves if we were to write our own system tool. So this is things like control flow graphs, symbol resolution call stack traces and the ability to examine function parameters both in user space and kernel space. So here's an example of control flow we've got the arrows to the right indicate that the function is being called and then to the left indicate that the function is returning. So from here we can get a sense of which functions are calling which functions and when they're returning. This is the dynamic call graph. Here's an example of a stack trace with all our symbol information. So this is the FTPD main function at the bottom here and it's call stack trace all the way up to the top where it's calling string compare. So not only do you see the library but also the function name and the instruction offset within that function. So it gives us the ability to pinpoint exactly where we are in the execution. And conveniently record the function parameters as well as the return values. So this shows us it's recording the first argument of the function. So for hooking string compare it simply prints out what the first argument is, is special one. The syntax here actually gives you a little bit of idea of how Dtrace is working. If you notice the syntax there is copy and str because what you're actually doing here is you're asking the kernel to copy information from user land into the kernel to give you information. So the way a break point works is by modifying the target process memory. It writes an in through instruction and that's what causes the execution to pause in the CPU and the CPU calls back to you says what do you want to do. This is very different. It doesn't modify any instructions in any way or cause any pause in that execution of the program at run time. So you're getting a great view of everything that's going on in this application from the kernel's perspective without disrupting it at all. So what you see is what you get here and that really becomes useful. When you're attaching a fuzzer and you're annihilating this thing and causing tons of threads to happen, if you were to have a debugger attached you'd be heading break points every two seconds and having to continue and really slow down. With Dtrace you don't have those problems. You can easily monitor an instrument of fuzzer without really any performance costs at all. So we also have a convenient way to reference all the CPU context. With this global uregs variable that Dtrace provides us we can print out values like EIP, EAX and all the CPU registers. That also works on more architectures than just x86. So if you saw that the EIP is actually abstracted so it works on PowerPC, Spark, x86, a couple other architectures. So this is a cute little example that hooks the uname system call and then changes what it's going to return.  So we record the pointer to the buffer on the uname entry point and then on the return point of the function we just overwrite that buffer with our own information. So this shows us that Windows is running on a PowerPC architecture in 2010. Here's another small example that shows file process snooping. So this shows the right entry point and the right return point. So same idea, record the buffer and then print it out when the function returns. So this would allow me to sniff all of the output from David's terminal or any other application. Okay, so hopefully this gives you the context of what we can use this for. We're thinking about monitoring the stack, about doing code coverage metrics. We could use those metrics to automate feedback to the fuzzer to tell it to adjust inputs in certain ways. Monitor for heap corruptions. That's a really useful area. So we're going to go over some of these now. So I talked to you already a little bit about the difference between Debuggers and Dtrace as a framework for monitoring an application, but just quickly, it's really important that you don't think of it as a Debugger. There's things that GDB does that Dtrace will never be able to do in vice versa. So one thing that Dtrace doesn't do well is exception handling. We've got a trace script attached to an application and you trigger a buffer overflow. Dtrace is not going to say memory error, read or write error at a particular address. It's just going to stop, because remember it's designed for safety and performance. So as soon as something goes bad, it just detaches from the process and drops the probe and says I don't have anything to do with it. But that being said, it's infinitely more flexible for conditional breakpoints or conditional instrumenting than GDB is. What we find is that using the two together is going to give you the optimum bang for your buck. What we'll do is we'll trace to a condition that we're really interested in. When we see that a buffer overflow is about to happen, we'll send the stop signal to the application. We can attach GDB, let GDB continue it and there you go. We find that's a really flexible situation for exploit development or for looking at a vulnerability close. The other interesting thing is the comparison against S-trace or L-trace or some of the other tracers you know. The main problem there is I don't know how many of you attach trust to a really complicated application let's say Apache. The amount of assist calls that are happening per second or per minute are just devastating. It's going to drive your CPU up and make it almost unusable. You don't have that problem with D-trace. Truss and some of the other tracers work by actually setting breakpoints where the system call is made or instrumenting PROC-FS so PROC-FS pauses and allows you to grab the arguments. You don't have to do any of that. Brendan Gregg did a little bit of study you can check it out on brendengregg.com where he studied the performance of a trust implemented in D-trace versus actual trust and D-trace is about 68% better performing. You hardly notice system call tracing when you have a binary instrumented. Again some of the limitations are that D-trace is designed as a command line real-time tool so it really works on only standard in and standard out. We had to do a lot of trickery with Ruby to parse the standard out to get things into arrays and to retrofit data structures onto the output of D-trace. If you're hoping to use it and you're just going to get an array of arguments that were touched by your fuzzer or something like that you're not going to get it without our tool. You're not going to get a lot of data from your coshionaries. Like we said it would be really hard to use D-trace as a serious security tool. We'll talk a little bit later using creating a HIDs tailored to a custom application. The problem here is remember it's designed for performance and security so if you start to get a lot of errors D-trace will just back off and start to drop probes. So if you were going to use this as a dependable hey I need to know D-trace would just detach and it would go undetected. Those are some of the options or some of the things you have to deal with when using D-trace. Let's talk a little bit about what we did with D-trace combining it with Ruby and combining with some other Ruby based tools and a programmatic debugger framework that we've also written into the combo. What we did was we hit certain roadblocks with D-trace where we just couldn't do certain things to be able to do and we started looking at taking Ruby and combining these two things to give us better logic processing so that we weren't just doing the data recording. We came up with Retrace which is a combination of these two things. It utilizes this LibDtrace Ruby bindings library written by Chris Andrews to allow us to access D-trace from Ruby. What we do is write common tasks in Ruby that build these little D-trace and send them off and run them and then handle the results. Another aspect of this is to utilize IDA and its static disassembly power with this runtime dynamic tracing. Now we get both the dynamic world and the static world together. There's a plug-in called IDA-Rub for Ruby. This has two parts. There's the Ruby client module and then there's also the IDA part, the IDA server plug-in. What we do is we run IDA on a Windows box in a VMware and then over the network we can communicate to it with our Ruby based framework. Saying things like color dis-instruction annotate the disassembly in this way or pull down the disassembly information itself. This gets around the lack of IDA GUI support on certain operating systems and architectures. If you're using Solaris, unless you have a Windows system next to you, you're not going to be able to combine static disassembly with runtime. By using the network XML RPC between IDA and retrace or retrace our framework, we're really opening up the merging between statistical analysis, our static analysis and runtime analysis and it makes a really powerful combo. The other thing is we skipped over MetASM but MetASM which is a Ruby based assembler, disassembler has some incredible power itself and it's part of the Metasploit framework and you can do things like write PE files from memory, you can create assembly and disassemblies and Ruby write them to L files so you can do quite a bit of stuff and that really comes into play and becomes really powerful with malware analysis, automated unpacking, there's just so many applications and that's why we really picked Ruby as a framework because we feel like the integration of all these tool sets is really the future for automating a lot of the tasks that used to be really powerful. So what we found here is that by using this framework both the tracing and also the static analysis, it's allowed us to decrease the amount of time it takes to do the analysis to write successful exploits. We also had limitations with just doing tracing, we wanted to do things that were more like debugging. So we went ahead and wrote, see Ruby bindings to wrap OSX's mock API, the debugging API and the ability to utilize that from Ruby. So now we can do things like set traditional break points, search through memory, change the memory permissions on different memory segments, we can search for specific op codes and segments we know are executable. So this really provides us the third element. So we've got the tracing part with retrace, the disassembly with tools like Aida and MetaASM and then this debugger ability. So the way I guess I sort of covered this already, but the debugger really provides a wrapper around the native debugging API which allows us to do this stuff and walk memory segments and catch exceptions and do symbol resolution and all that. A lot of people sort of have the idea that Mac OSX is really just BSD, but that's not the case. You don't have the standard ptrace API like you would on every other POSIX system, it's really mock at the core. Even though there is a BSD subsystem, most of the intensive sort of system internals and system programming you're going to be doing isn't mock, so we had to have the fun job of learning how to send mock messages back and forth to the kernel and stuff, but we've given that to you here so you really have a flexible marriage between the best parts of debugging and Ruby and the best parts of retrace and detrace. So here's how it all comes together. There was this co-format string vulnerability. We ran into Rob Carter and Nate McFeaters back in DC and they were showing us this thing and curious on how we could use detrace to really pull out the information we needed from the application at runtime in order to understand how to write the exploit. So we threw all these tools together and were able to trace through all of the different formats that happened in the application until like the 2001, which we were actually interested in, trace until we hit that spot and then do the application analysis, whereas just sitting a break point would have took forever iterating through each step. So we used the predicate feature to say only stop the application when one of the variables has this %25 in it. So the way we envision this with the framework is sort of like this at the top here is the code for specifying the detrace Ruby lib to say hook this vf.ffunction and if the argument is this %25 in then stop the application.  We want to see the disassembly of the function itself so that we can find the return instruction of the break point there. Then we continue the application and we have a callback function for when our break point hit and then we continue the application. So then at the end of the function we hit the break point and we want to inspect memory at that point to say okay, is the overflow aligned properly? So the cool part about this is this is not quite automated exploit development but it's about as close as you're going to get. So he kind of shaved over the fact that you had to sit there and hit continue a thousand times on every printf that could possibly happen in iPhoto well, imagine doing that during the exploit development process so literally this script could save you several dozen hours of the lifetime of an exploit developing it and in fact when Nate and Rob brought this to us they were like, you know, we can't even stand GDB anymore, this is killing us and so we actually came up with this script all sitting together at a bar one night and it's actually worked out pretty well. So when you're done with this script you know exactly what instruction you need to overwrite and you can then use our opcode searching feature to just find instruction in executable memory that's going to point you right back there. So I mean two steps beyond this and you have arbitrary code execution. Alright so here's another interesting idea right, we know there's something funky with ASLR on OSX and we may be interested in trying to analyze that. So one thing you know you've found a bug in an application and you're trying to figure out how the memory works so that you can use specific values and return to libc style attack. So what you can do is start up the application and then do some simple resolution to figure out what interesting functions you want to use are at what locations. But you know these addresses will be randomized or they should be after each run. So you search memory for some sort of function pointer to one of those addresses and then you restart the application after it's been randomized and you search again for references to those same functions. So you try and find some spot and virtual memory that always contains a pointer to that randomized address. So this is the sort of task that you can also automate with this framework. So our frameworks up on popupred.org we're going to stick it up there tonight. Retrace is already up there, we just need to add a red bug. Okay so let's look at monitoring the stack. So what we're going to do here is we're going to have a classical stack buffer overflow. We're going to trace our application until that instant and then print out all the information that we care about. So we want to do this to pinpoint exactly where the vulnerable function is. Yeah this is a situation where maybe you're fuzzing an application and you get an exception from whatever debugger you have attached. You look at the stack and it's filled with A's right but who over flew, where was that and how can you leverage that to do either understand the vulnerability itself so you can protect yourself and understand how important the patch is or you want to leverage it for arbitrary code execution and it's definitely not a one, two, three step from getting a stack overflow to understanding exactly the nature of that bug itself and whether it's new and what the problems with it are. Alright so here it is in one probe we're going to hook every function in every return address right we'll hook every function in every module if our EIP or the next instruction pointer is four on four on the encoding of all a string of A's then we're going to stop the application saying okay something bad happened here let's check it out. So you know this works in the generic sense where you're overflowing with large strings of A's but I mean that's not always the case right we want some more generic solution so our approach here is to at function entry record what's the return address is on the stack and on function return check what EIP is. Is our next instruction equal to that return? It should be if it's not we know something went wrong right there's some sort of overflow that corrupted the return address. We're going to give you a little tip that might save you several hours that it cost us you see that second slide point there UREGs are ESP and not UREGs are ESP that is a big one on the core 2DL architecture which is a 64 bit architecture they don't call it ESP they call it SP and if you confuse those two it's going to cost you several hours that's not a problem so RSP is the architecture independent reference to that so we had some problems with tail call optimizations that happened at compile time and also some functions that Dtrace can't trace so this is kind of through a wrench on the problem so I won't bore you with the details of tail calls but the basic idea is that some functions don't require their own stack frame so although you're calling new function there's no new stack frame so then it kind of messes up how do you think about the return pointers and all that stuff so Dtrace has a particular way of dealing with that and you just have to know what it chooses to do if you're curious I'll tell you all about it but the basic idea is that instead of comparing IP when we enter a function we record the return address on the stack when we exit the function then we look at that same spot in memory see if it's the same so we have this problem with functions we can't trace our solution is just to ignore them because they're usually not the functions that we're interested in anyway so it turns out Dtrace has some problems with tracing functions like when they're inside jump tables and so it chooses to just ignore them we'll trace the entry point but then it doesn't know how to do the return point so our basic way to determine which functions can't be traced in this way is to say show me the entry points for all the functions that you know about and show me the return points so let's look for mismatches because some will be in one list and not the other we just exclude those functions with predicates so let's take a look at how this works so what we're going to do is run an RTSP quicktime exploit like we've seen a lot of these this year so it's listening on the local host and then we're going to start a quicktime and how to connect to this malicious server and then stack overflow is going to be delivered but what we're going to do there is attach retrace to this application so that we can watch the overflow as it happens so we load up a quicktime here and we're going to attach retrace so we start up the Ruby environment now this is actually like your standard IRB so you can go ahead and specify whatever kind of Ruby code you want so there's all our commands like searching memory attaching a debugger and stuff like that so what we're going to do is run we're going to specify the PID the stack overflow tracer on quicktime now we go ahead and connect to the malicious server which is going to deliver the payload so a lot of things happen all once there the application you know it opened up a window to read that the payload was delivered down here and then retrace stopped the application so it's actually halted so we get all this information pointed out about the context of the application's current state you know we get a basic message about the stack overflow occurring we see the exact module where the overflow occurred the particular function what we expected the return address to be and what it actually was so in this case it's you know 0x17 blah blah blah but it was actually dead B probably a problem so here's all the CPU registers you can see in this situation a number of them were overflown the base pointer and so on so here's our stack trace you can see again module name, function name followed by the exact instruction offset within that function so from here we might be interested in doing something like you know attaching a debugger and examining the memory space searching for instances of particular strings we want to use in a return to C style attack so what I'll do is I'll show how that happens with a different application here let's use ADM so ADM's a chat client right I just picked it randomly so imagine that we're going to do a simple return to libc and we need to use binbash as one of the parameters to some system call function we need to know a location in virtual memory at this moment where binbash is located so what we're going to do is dump all of the memory all the virtual memory segments and then search through them so in retrace this works by taking and dumping it to disk with redbug we've actually implemented it so you don't need to dump it to disk so here we search for binbash, the string binbash looks through all the memory segments and we get about 5, 6 locations so let's just attach a debugger and then check what the value at each of these locations is just to make sure that it's usable for our situation so in retrace what attached debugger does is just it stops retracing and then gdb to the process so here we can see it's really in the same state now let's inspect memory at the first location we can see that this is a string that starts with binbash but it's got all this other junk on the end of it this is not going to be useful to us so we can expect the next memory location it turns out to be binbash and all terminated so this is what we want to use and as well the other 5 locations are all binbash so those would be potentially used so the idea here is to get around data execution prevention you can manipulate to make a system call in this case if you make the system call slash binbash you're going to get a shell, that's a bash shell so that's why it's so interesting on there because we can't just run code off the stack anymore we'll have to return into mprotect or binbash, something like that to actually leverage getting a shell on the box okay so some other things we can do with retrace instruction level tracing that will give us the ability to do code coverage we're very interested in that so let's briefly talk about it the idea is pretty simple here retrace gives us the ability to print out the address of the instruction at each point so we just print them all out and then map them into IDA and we can visually represent what code coverage looks like during a particular run of an application so that's the whole approach, it's really pretty simple there's things we have to deal with when we're tracing instructions that are in a library that's mapped like deep in virtual memory space and our disassembler it's mapped at location 0x1000 so we just have to deal with mapping those offsets so it's not really a problem, you can just either trick your disassembler into specifying exactly where the starting point for the address is or you can do the offsets in Ruby itself you do have some issues with performance, right? because tracing every instruction can be heavy load on the system so you just scope to only trace particular libraries or applications you're interested in so what this turns out to look like the real fruit of it is this you get a function call graph and the particular blocks that were traced or run during the application or highlighted so you can say, cool, I missed this whole section of code, let me figure out how to tweak that jump to access and test the rest of it so maybe per fuzzer run you would change the color and then you end up with a really cool rainbow or a mandala but you know on every sequential fuzzer run whether you're hitting code that you weren't before you also do stuff like this with simple dot graphs show what the function what the system call graph looks like at run time so you may know that something was patched here there was a vulnerability here and the patch was applied to this function so they're doing some sort of input sanitization here but there's another code path to get there so let's look at how we can get down here and access that vulnerable function again without going through the patched function I'm going to tell you about how to use dtrace to write heap overflows so how many of you familiar out there with the term heap spraying and that type of stuff show of hands so heap spraying is all about heap determinism right controlling the determinism the allocation patterns on the heap so you can set this heap up so your overflow gets arbitrary code execution if you want to know more about it the immunity guys who have a booth here wrote a great paper on it called debugging with ID that tells you everything you want to know about advanced heap exploits but the idea here is that in the past there was a primitive called the write for which essentially gave you a generic technique for exploiting a heap well that's gone there's heap protections and it never existed on BSD because they keep their metadata out of band that is there's no function pointers that you can just overflow into to leverage arbitrary code execution so what that means in plain English is that you have to understand a lot about how the application allocates things on the heap in order to exploit something successfully so you're looking for function pointers you're looking for any kind of application specific data that you can overwrite with a heap overflow that's going to cause you to own the application so on other platforms there's lots of tools to do this immunity debugger is a great one on windows Gerardo Riccardo from Core wrote a great open GL visualizer of the heap that's based on trust that I think works on Linux and works on any of the BSDs and Solaris so you have stuff there the problem was you really had nothing on Mac before this that could help you do that so the idea here is that we have these arbitrary hooks on any function in the system with Dtrash right so let's use them to keep track of what the heap looks like and what are the contents on the heap so quickly you can of course you can use Apple's standard instruments tool for memory leaking to identify double freeze and double mallocs that are going to allow you to maybe you could leverage that for arbitrary code execution spot off by one errors and you can do all kinds of heap visualization so the comparison to something like Ltrace which could also hook malloc operations is Ltrace is like bonds on the giants so it's Ltrace on steroids and the idea here is that you can create a heuristic for your specific application remember I said it's all about application specific data you could create a heuristic that says if this pointer is ever on the heap next to somewhere that I know I can already overflow then there's my exploit so you can do all that kind of really interesting stuff there's tons of tools on OSX that will help you do this that will set up guard pages on the heap and you've corrupted it but none of them are going to allow you to have the application specific intelligence that you need to really write these sort of advanced heap overflows so quickly this is what a directed graph if you were just interested in what some of the allocation patterns are you could quickly create a graph with allocation patterns included in Dtrace itself though we've created an automatic heap smash detector that will instrument IDA and basically how that works is we keep track of every allocation made to the heap and if anybody ever string copies memory or does a mem copy onto a chunk that we know about so we know the size and the location and that right is too large we know there's going to be a heap overflow and rewrite it into IDA so let me quickly show you that probe would look something like this so in this case we're looking at the entry to string copy we're looking at the arguments and then we'll check that probe there against our known locations in the heap and see if they overflow so I'll show you a quick video there so real quick essentially what we're going to do is show you a vulnerable C application here it's just standard they malloc something that's not large enough and then we do a string copy onto it and if you can see through the transparency in the background we have a copy of IDA going on so we're interested in owning this application what we're going to do is we're going to copy a bunch of A's on the command line and we hope that that triggers a heap overflow so just to show you and that's what it looks like we've attached the heap smash and we sent a bunch of A's in via command line this is our IDA disassembly of the same program so we're just looking around there and we're going to fire it off and if all goes well any heap overflows that are detected will automatically be in the disassembly of IDA so we'll know everywhere that has a problem in this app using another detrace script to exploit it so here we're starting up the IDARoob server that's going to give us a connection to the OSX this is all in a VM you can see it's in VMware fusion so we're setting up our server here go back to the command line fire off those A's and hope it triggers a heap overflow so amazingly it does catch the heap overflow you can see there that's the probe that found it tells us what EIP was, what the destination was the interesting thing to note there is the size of the buffer was only, what is that, 15 bytes and we copied 30 so obviously we smashed the heap there and now we can go into our IDA disassembly and it will pinpoint that so where that would be useful is if you had a browser or something like that and you're running a fuzzer against it you can let that run for a couple days or hours or whatever come back to the IDA database, it's going to tell you everywhere there was a problem and now you can sort of vet those and figure out which situation would be exploitable so there's a comment and the marking in red there so it's really powerful for combining static analysis and run time we're kind of running out of time here so let's shift this over to so we have some sections here on using this defensively, some things you can do to stop based on by seeing system call patterns that it's not supposed to do again you have performance issues there you guys can check out the rest of the slides here we also talk about some kernel level stuff not particularly related to detrace but you see this screen you have no idea what happened, you want to figure it out it turns out that there's these logs that get dumped they give you a lot of information so you don't actually need to do the kernel debugging traditionally but if you do you have to set up a remote server and it's kind of a pain so let me skip to the end let me make one point here about tracing higher level application probes because this is a cool idea so what you can do here is trace some action that it's a high level thing like a whole page load or an SQL query or a DNS look up so these are not particular functions but they're actions composed of lots of functions so this makes sense for IO performance tracing but also for pen testers we can use this for our own purposes for instance we want to fuzz an application front end that has a web front end and then examine what's going on with the SQL database in the back so look at the particular SQL statements and are they sanitized or not the idea here is that on the OSX platform because Dtrace is implemented in the kernel it's really trivial for anyone running an app on OSX to add Dtrace probes that will allow us to hook them so we could hook JavaScript SQL injection all kinds of stuff that are beyond sort of standard memory corruption and I'll show you real quick where you can get the code here you go pop pop ret email us if we don't put it up in the next couple days we've been known to lag and thank you for your time


The following is a presentation of TFNN. The TFNN Bull Bear Training Hour. Every training day, live at 10 a.m. Eastern. Call now toll free at<PHONE_NUMBER> or internationally at<PHONE_NUMBER>. The TFNN Bull Bear Training Hour. Now, Tom Ants, Tommy O'Brien. Welcome, folks. Appreciate your growl and a problem with us out here. We have the Dow Industries down 51. NASDAQ off 32. S&Ps down 9. Gold. Gold contract up $5 trading at $14.25 an ounce. We've got Silver up 4 cents. $16.48 an ounce. Light Sweet Crude up 44 cents. $57.31 an ounce. Notes and bonds. You get the tenure down 5 ticks. 97.09, 30 off 5. $154.20 a king dollar. King dollar up 104 ticks. 97.900. The Euro is at 108.66. The pound is at 1.21. And the Euro is at 1.11 to 1.00 U.S. Dollar. Let's get over to our man, Mr. Kevin Hicks. A TD Ameritrade. Think of what we're going to do each Tuesday, Wednesday, and Thursday. And don't forget, folks, every trading day right here, 11 to 12 Eastern Standard Time, you want to understand options, option strategies, futures, great program. If you haven't test-driven yet to think of Swim Platform, it's really easy to do. Come over to our website at TFNN, hit the banner, bring it up. You'll get a lot of trade with paper money. You can follow Kevin and his team each and every trading day. And let me tell you something. You better have some defined risk in this program in this market right now. This S&P, you know, yeah, you get a handle that goes 16 handles, but I'm telling you, we're at 3012 and this baby wants to finish this ABC up at 3055. And if it does, it's going to be wild because... 3055. 3055 coming at us, baby. We'll see what happens. The Fed's coming at us and Kevin Hicks is coming at us. What's going on, brother? Good morning, Tom. Good morning, Tommy. You know, this is... we're kind of getting what I thought. You know, we're getting a lot of data. We're getting a lot of opinions. And these stocks and these markets are trading all over the place. So everyone who's interested in these markets is getting something to look at. It's in these days. I thought the income and outlays, data that came out at 830, your time was pretty dull. Didn't get my heart rate up very much. Bonds didn't move very much. But it certainly didn't give Jerome Powell any reason to pause in terms of lowering rates, even though I thought this number was probably too late to affect their decision anyway. But, you know, a 1.4 PCE year over year in the core of 1.6, that's not getting it done. So he didn't get any reason not to move on rates tomorrow by this number, for sure. And you know what's amazing, Kevin? You know, Tommy and I were talking about it yesterday. So they haven't gone down on rates since 2008. That's 11 years, right? Right. And, you know, in our careers, I've never seen the Fed just go once either way. Are they going up or are they going down? You know, it normally turns into some kind of a trend, okay? So that's the thing that's really intriguing. It's like, okay, you know, we're going to get down one. Well, what are we going to do next month and the month afterwards? Because the market's going to be looking for that. Right, yeah. And, you know, it's going to be interesting. They're going to second-guess the Fed on this one because I don't think they're going to second-guess this move. But they're definitely going to second-guess December's rate hike. That's the one that they're going to be heavily scrutinized for. So, you know, I'm interested to see what it does to the U.S. dollar. I'm interested to see what it does to bonds. I think the rhetoric coming out of this meeting is going to be as important as anything you'll hear this month. His rhetoric going forward, which is this going to be one and done? Is this a one-rate cut? Wait and see, go data-dependent, you know, because some of the numbers, again, the inflation numbers aren't giving us any reason to worry about rates, but the economy is strong. I mean, you know, this is one of those odd markets. They're going to be writing about this time in history books how the market got so strong without inflation ever raising its head, at least yet. No doubt. And, you know, this dollar, listen, folks, the dollar's at highs and gold's at highs, and that's an anomaly, okay? You know, the bottom line is that, you know, gold is priced in dollars, so it's like, okay, you know, and we'll find out. We'll find out where this goes. I mean, the last couple of days, the way this dollar, the volume is so anemic, it's insane.  But you can see the British pound, that thing is getting smoked. You know, so when you look at that aspect, I mean, if the euro doesn't get going, well, guess what, the dollar can go higher. And think about this, guys. Procter and gambles earnings killed in terms of earnings.   So, you know, I understand why foreign governments want their currency lower. And I understand why the U.S. government should want our dollar lower. It makes our goods and services cheaper to foreign buyers. And you can make a case, 27 of 30 Dow stocks are multinationals. So, you think that doesn't affect these companies? It does. Sure.  That's like, you know.  You know, my favorite thing to do at this time of year is when you look at these companies like Procter and Gimba and look at all the brands that they own and control. Yes. It's amazing. I mean, every day you stay in your house, you have at least two or three Procter and Gimba products. Oh, yeah. Yeah, look at Gillette. I shaved this morning. Head and shoulders. Exactly. You don't realize how powerful these consumer staples are until you start looking at them. And man, they have a big portfolio. Yeah. Bounty Charmin, Don, Dye, Tide, right? I mean, Febreze, Mr. Clean, Old Spice, Swiffer. I love that. Checking them off. Boom. You know, it's so funny about this one, Kevin. We're reading this.  They have competitors. And they help both of them. And guess what? You're okay with that, right? It's amazing. It's kind of like a Facebook Instagram. Yeah, you don't want Facebook to want to go to Instagram. That's okay. We own that, too. I was doing the same thing as I was going through that. I was like, wow, those are competing brands. And I'm comparing in my head often in the store. I do the same thing. Yeah. It's amazing. I mean, you see some of these companies, it's just amazing the depth and the range of their portfolio. Yeah. I was going to say, people are buying stuff if P&G go now because they just got stuff. They do. They do, you know. So what are we going to be talking about today, Kevin? Obviously, today is going to be all about AMD and Apple. We'll go over the Ralph Lauren and Under Armour trade. Remember, we came in short Under Armour, long Ralph Lauren. So Ralph Lauren was actually up pre-market. Nice. But our position did fine. And we're short Under Armour. So, I think we're doing great. I think we're doing great. Yeah, man. I'm down 15%. Yeah. That's a huge move. I get, you know, it looks like their conference call didn't go well either. You know, it was down early because of a miss on earnings, but then they got on their conference call. And I believe someone told me they guided lower in the conference call as well. Yeah. You know, we always talk about it, Kevin. I love the thinkorswim charts. And that's why I want to pull up. And it's because you can see when the earnings come out, which was 7 AM Eastern time. Yeah. And then the stock was back up to about $22, Kevin. 1 AM, I can see exactly when that earnings call out at $730. So you trade from $22 to under $20 on whatever they talked about, which definitely, yeah, they got it. That's such a good point, Tommy. I love to look at the one-day, one-minute chart on the thinkorswim platform whenever any event comes out. I know. You see how big the candle is. You see the move. You know, it's just a great way to see the range of development. It is, man. Awesome. Folks, right here, 45 minutes from now. Kevin, you have a great one. Safe one. We look forward to the program. Great talking to you guys. You too, Kevin. Stay right there. Tommy and I come right back, folks. If you're not currently using the TAS Profile Scanner when looking at setting up your trading opportunities, then your arsenal is short a mighty weapon. The TAS Profile Scanner is a standalone piece of software that instantly filters over 2,500 global financial markets such as stocks, ETFs, commodity futures, and forex. Heated by Steve Dahl, TAS understands that in today's technological world, the use of top-flight software for communications and technical analysis expertise is essential to successful trading in today's market. You also gain access to the webinar that Steve Dahl and Tom O'Brien just hosted, the best way to use the TAS Profile Scanner to profit. This webinar archive is available for all subscribers immediately upon signing up. All new subscriptions also come with a 30-day money-back guarantee so you have nothing to risk. Start your subscription by visiting the front page of TFNN.com today and you'll find the TAS Profile Scanner under the Services tab. Sign up today. Are you in the market for buying or selling real estate in the Bay Area, including the surrounding St. Petersburg, Tampa, and Clearwater markets? Tiger Real Estate LLC is a firm that has extensive experience in the Tampa Bay Area. Whether you're looking to sell your current property for maximum value or you're in the market for a second home or investment property, Tiger Realty has the experience across all areas of real estate in the Tampa Bay Area to help buyers and sellers make the most informed decisions across all price levels. From the price you should be paying per square foot in certain up-and-coming areas to the type of cash flow investment properties are capable of creating, Tiger Real Estate can help you make the best decision when it comes to all areas of the market. Before you make one of the biggest decisions of your financial future, call Tiger Real Estate LLC today at<PHONE_NUMBER> or email us at Tiger at TFNN.com. That's<PHONE_NUMBER>. Call us today. Many of our new listeners have heard about the Tiger's Den. The Tiger's Den is a lively community where professional traders and investors can meet, exchange ideas and information in a comfortable moderated atmosphere. Hear all of the TFNN shows, plus see all of the charts as they happen live and have access to archives of all of those charts. You can test drive the Tiger's Den absolutely free for 30 days and greatly enrich your knowledge of these markets and how to make your money work for you. Details on the Tiger's Den are on the front page of TFNN.com. Check out the new TFNN.com now and experience all the upgrades. TFNN.com, educating investors. Call now, toll free at 1-877-927-6648 internationally at<PHONE_NUMBER>. Welcome back, folks. Now down 61 Nasdaqs off 32. S&Ps are down 10. And BYND. Okay, so check it out. They're going to take everyone to the cleaners here. So they came out with numbers. First off, it's down 25 bucks. Trade 196. Come out with numbers beat by about 10 million bucks. The gross sales. That being said, guess what? They're going to do a secondary and they're going to allow a few insiders to sell into the secondary. One of them being the CEO. Yeah, so how, you know, this is when you look at this game, folks, and most of the time you get a lock-up and what ends up happening is that the lock-up doesn't have, like, a master lock on it. I guess not. I thought it did. Well, it does. And this happened with GoPro. It happens with a few others. Goldman Sachs let the CEO of GoPro sell. Now, that way that was done is that he had to put it into a trust. But the bottom line, he might take a chance. He got away with just everything, okay? Because he sold at the very high and GoPro went to $6. He was selling at $77. The board has to approve it, too, correct? Well, the board has to approve it. Because that's who I really put it on. Yeah, the board has to approve it. But then the broker-dealer that brought it public, like, I sold it to you. I'm the broker-dealer. They have to approve it, too. Now, here's where my opinion, though, is that, of course, the broker-dealer's going to do that. Because guess what?  Oh, yeah. So the governance part is not on the broker-dealer. Just saying, of course, they're going to. So do you know who it's supposed to be on? The board. They're supposed to represent the shareholders. In what good is it to let your CEO get out of the position after it's shot up in an ordinate amount of money before a standard lockup period has expired? And there's your board. So you got... Seth Goldman is the chairman. I believe he's CEO, too, maybe? Probably. Yeah. Now, what you can do with this is that I could... We don't have enough time, but I could pull these down and then you can see what they do is that they show cross-boards, also. Like, some of these... Sure. You can see where they've been. Because I do this on the gold market all the time. It's to see where someone has been to see are these pump-and-dump stocks or they're good stocks. You know what I mean? Sure. So it's kind of cool watching other shakes out. So I guess that's the... So that is President and CEO. That's like 32 million... No, 320, I was going to say, but there it is. There it is. Yeah. Now, that's as of the close yesterday, because I was doing to add $200. It's about 32... 320 million, excuse me. Right. So let's just look at a few others. Let's just pull this guy up. What? Look at that. These board members have some shares. I mean, it's went up 800%, right? So divide that number by eight in terms of what these people were all worth only months ago. Right. So you can see why. I mean, you know, being worth 30 million is amazing. You never have to work again. Being worth 300 million is a different stratosphere, right? So I understand why they want to sell, but that lockup man is supposed to be here. Very intense. Yeah. Let's go to our man, John and Philly. What's going on, brother? Good morning, Tom and Tommy. Morning, John. Hope you're doing well. Good, man. Good. So... Tom, I wanted to ask you about GDX. You've documented and tracked this day by day, week by week. So thank you for that. Specifically, I want to share with you something I saw yesterday in the GDX options. Okay. And let me just... Without digging into it, let me just say specifically, yesterday in the morning, a block of call options on GDX expiring September 20th with an out-of-the-money strike up at 32. So it's 28 right now, roughly, so 32, four bucks above. Yesterday, 60,000 call options were purchased on that 32 call at 17 cents each. Okay. So somebody spent over a million bucks for just a boatload of out-of-the-money GDX calls expiring September 20th, which is one of those triple-witches, quadruple-witches, actually. So that is just a fact. My question... Do you have any comment on that? Does that sort of activity say anything to you based upon what you've seen in the past, please? So what... I don't follow the volumes inside of the option market, John, okay? But what has happened is this, which is really cool. We know that from the futures market that two weeks ago, what we had is that we had funds come into the silver market in a huge way. It was the biggest they ever came into it. And the way that was structured, folks, the reason we found out is that every Friday, the commodity futures has to basically say who's in and who's out. And so what had happened is that they came into the ETF sector, but when they came into the ETF sector, they also went into the futures sector. So the bottom line is that they went into the futures, we'll get that exact information as to... when the CTFC comes out, you don't know exactly who it is. When the 13F filings come out, you know who it is, but that's 45 days after the end of the quarter. So that being said, it totally makes sense to me that, you know, guess what? When you have large players that are coming in, it doesn't take much inside the GDX, all the gold market in general, to run something, you know, three dollars. I mean, whoever bought those already, we just looked at the quote, they were already up three cents to four cents, and that's a lot on 17 cents. You know what I'm saying? Yeah. Yeah, you just bought it. It was 20 by 21. Okay, we got it. Cool. Yeah. So you can see that if they want to run this thing, if they plan on putting more money. Now, the way... Okay, so if I bring you back to 2001, folks, okay, what had happened at one point in the marketplace, I actually owned probably three quarters of the calls on a couple equities, a couple gold equities. And the way that if you're going to really... If you really think, number one, that you get a run that's going, and you get the momentum with you, what ends up happening is that a trader in general first would go into the option market, which I did, which they did. Then what's going on is that with the understanding that you're going to go in the equity market and drive the price. And that's very well what they could be doing, because that is the way that you really make some big bread. First, you lay down the option market, right? Let's say you said it's a million dollars, you lay down the option market, right? If they know they're going to be coming in in the next couple weeks and they're bullish on it and they're going to buy it, well, guess what? They're driving their own price. And then what would end up happening is that as you're driving the price, what you do is that you already have the order in to sell the options. So this gets... It's really simple, actually. It's not that technical. Because what happens is that as you drive the price of the equity, the option has to go, and the option market maker has to buy it. Because they have to cover it. They have to go delta neutral. So let's hope that that's what they're doing. Because if that's what they're doing, they're going to drive price here, man. And it would make sense, because I would say that for all of us that are in this metals market, whatever Powell says tomorrow is going to be really important. You know? I mean... Tell me, I knew I would get something interesting out of your memory banks with your work and the gold report on those equities dating way back then. So that's a very interesting hypothesis. Thanks for sharing it. I appreciate it. Okay, man. Have a great one. Have a safe one. Thanks, Joe. Stay right there. Tommy and I are coming right back, folks. Our phone number is<PHONE_NUMBER>. We have the Dow. Industrial is down 70. NASDAQ down 37. SAP's off 11. Gold's up 670. Silver's up 710. So come right back. Hey, folks. Tom O'Brien here. If you'd like to get my daily newsletter market insights, then now is a great time to sign up for a 30-day free trial. Every morning by 9.30 I send out my morning letter to subscribers with market commentary on a variety of markets, currencies, and commodities to keep investors up-to-date on the day's trading action. Included in market insights are specific buy-and-sell recommendations for stocks, ETFs, and even options, which stops and price targets included for every trade in my newsletter. If you'd like to try my newsletter at risk-free for 30 days, then head over to the front page of TFNN and you'll find market insights under trading newsletters. I use my years of trading experience to bisect and dissect the market every morning and give my subscribers the most important information they need to know for the day ahead. I even issue afternoon updates for my subscribers whenever warranted with important market action. I'm always scouring the market for the next great trading opportunity. Sign up for your 30-day free trial to my daily newsletter market insights today by visiting the front page of TFNN.com. Well, go get them, folks. The path of least resistance is David White's daily trading newsletter, and if you're looking for active trading ideas, then now's a perfect time for a 30-day free trial to this powerful daily trading advisory service. David uses his years of trading experience to offer his subscribers his trading ideas each morning in his path of least resistance newsletter. Using a combination of equity trades along with options, David keeps his subscribers up-to-date with all pertinent market information with intraday afternoon updates when warranted. Don't miss out on this great chance to get a 30-day free trial to David's daily newsletter, the path of least resistance, with no obligation to pay anything. David has been delivering solid recommendations for his subscribers recently, and if you'd like to see the type of newsletter he delivers every morning, then visit the front page of TFNN and you'll find the path of least resistance under Trading Newsletters. For all the details, and to start your 30-day free trial today, log on to TFNN.com now. TFNN is excited about our new software charting program, the Art of Timing the Trade Chart. In collaboration with Tom O'Brien and using his best-selling book, The Art of Timing the Trade, your ultimate trading mastery system, David White has programmed an outstanding piece of software that will complement any trader's methodology. Using this first-of-its-kind program, the Art of Timing the Trade Chart allows you to scan thousands of stocks for Fibonacci formation setups, including Gartleys, ABCs, Butterflies, and much more. The Art of Timing the Trade Chart is designed to help you when scouring the markets for stocks just beginning to form the trading patterns that many investors spend days, weeks, or even months searching to find. And right now, we're offering licenses available at only $79 a month. We are so confident that you're going to love this new charting software that will even give you a 30-day unconditional money-back guarantee. Don't miss out on this incredible new piece of software. Get your copy of the Art of Timing the Trade Chart today by visiting tfnn.com. This segment is brought to you by Think or Swim. For more information, just click the Think or Swim banner on the front page of tfnn.com. We're live. Go ahead. Welcome, folks. Dow. Dow Industries down 73. Nasdaq off 36. S&Ps are off 11. Let's go take a look at some of the higher-volume equities out here. Okay, so FISA. FISA is... Oh, look at that. It was up yesterday. It gave it up this morning. Down $2.30. Oh, look at this one. Okay, so yesterday we were talking about the energy sector, right? Coming out. Now, this is pretty intense, folks. So, this is another oil service company. And look at the... I mean, we're talking about a oil service company that does $2 billion in revenues, but yet is losing money hand over fist. Yeah, I think they're only a billion-dollar company, though, so... $2.1 billion in revenues. For 90 days. They do $10 billion a year and they're only worth a billion dollars. Look at that. Yeah. So, now, Weatherford already went bankrupt. This is, you know, this is in trouble. You know, you're pounding lows here. 608 we're at. That's 627. I gotta bring this back more than 15 years. Look at this. Well, we'll see how this shakes out, man, but it looks to me like you get trouble in paradise here. It's sticking out like a sewer fund. 42 percent. Yeah, quite a crash. Huge. A couple of the other higher-volume equities you got underground we already talked about. Procter & Gamble's a big one. Beyond Meat, down 22 bucks. Not bad, though. If you want to get it to Beyond Meat, maybe just pull up the chart because it's been quite a little pop, even. When I did the 10 a.m. update, I think it was trending at, or at 9.45 this morning, it was trending like 190. Yeah. Look at that. 183 is the low. Yeah. Yeah. I mean, look at that chart chart, man. Yeah.  This is, they're gonna pull this off and I believe, so listen, this is what's really amazing and this is how they really can get this together so fast that this is gonna be done is tomorrow 31st? Yes, it is. Okay, it's gonna be done today's Wednesday, no, Tuesday. Tuesday? It's gonna be done Thursday. This is how quick it is. So August 1st? Yeah. August 1st, August 1st is that this secondary is happening. Okay. Which is pretty intense, man. Yeah. You know what I mean? It's like, okay, we got it here, so the broken deal of the community just has to hold this up until tomorrow. Push the stock out. The thing that blows my mind is that, like, they're selling skills that they could. That, I mean, they have to get on the phone and they have to sell this story to someone else that is gonna buy it at a cut. Sure.   I mean, they give three or four dollars and that's about it. Yeah.   You know what I mean? They're always different. Some funds will turn around if there's not a lock. I'm gonna say, okay, I'm gonna make $2 and 10,000 shares, or 50,000 shares, but they're taking a risk. That's for sure.  We're only gonna have 250,000 more, which is nothing. You know, so it's not gonna change that short position too dramatically. Yeah.  It would be P-U-R. P-U-R. Are they public? Are they a brand of? That's sort of, they'd be funny if Tyson owns Purdue. Right? Yeah. I think it's just because it's Purdue Farms and they probably are just a brand of a conglomerate. You know, because when you look at those numbers, those numbers, my God, they're just day and night. Definitely. You know, there's no doubt about that. Now the note and bond market, okay, so if we take a look at the note and bond market, what you're gonna see is this. Now yesterday, we went up on tremendously lighter volume and that would be looking, it'd be saying that, I was saying to me that, okay, Powell's not gonna say what, you know, he's not gonna be as dubbous as the market might think. So this is gonna be a big day in the bond market today, as is tomorrow. We're gonna definitely get more volume than yesterday. Yesterday, we only got 867,000 contracts and this market, you know, likes to do a million, 1.2, 1.4 million and along with the 30 year, so that was the 10, the 30 year, the 30 year also had a nice contraction of volume and we'll see whether we get volume in here today. So the key would be, yesterday did 181,000. So if that's what you get, that'll be telling me, well, if the volume contracts again, it doesn't look like it's going to, but if it did, that'll be telling me that Powell's statement is gonna be more hawkish than dubbish because that'd be saying that these bonds wanna get down versus going up in price and up in yield. So as we come into the, as we come into the end of today, tomorrow, that is gonna be a big number, no doubt. Yeah, Apple, so when's Apple coming out with numbers too? They are today, I believe. Yes. Ooh, that's good. Okay, after the close today and look at this D.H. Horton. D. D.H. That's quite a, they come out with numbers, that's quite an expansion. So that's up, well, it's up 5%. Now you get a nice pop there. Yeah. So they came out this morning. Okay. Let's see, so the estimate was $1.18, year over year, they made $1.26. Cancellation raised to 20%. Sales orders rose 8% in value to 4.7 billion. So just that was the, that was the year over year comparison? Yes. So that was actually 106. So they actually beat it by a much greater degree. Yeah. Yeah. Oh, and they're buying $1 billion in stock back. Oh my God. These, They're showing the club. These buybacks, man, are something else seriously, right? Yeah. The revenues, $4.75 billion and $4.9. That's what they're looking for next quarter? Yeah. Okay, so let's see where they do business. They, the company operates in the Midwest, Mid-Atlantic, Southeast, Southwest and Western regions of the United States. They also do financial operations, provide mortgage financing. Yes. They sell single family homes. Yeah. Yeah. Just trying to see the, oh, there it is. Average price, $300,000. Yeah. See, that's, that's a good average price. That's, you know, that's an affordable average price for the first time buys. That's just going on. So 80 markets, 30 states, 75% of their revenue from the Southeast, South Central and Western regions of the US home builder by volume constructs single family homes that range from 1,000 to 4,000 square feet. Wow. Okay, so let's see if it's putting any juice in the rest of these builders. Yeah. Toe brothers up 51 cents. No big deal there. That's a percent and a half. That's, let's see. Taylor Morrison, what's KB? So the strongest ones out there is L-G-I-H. I wonder if it has to do with that same exact area. Yeah. That's company because regionally they might be right there. Right. Yeah. Stay right there. Tommy and I come right back, folks. If you're in the CD market and looking for a secure investment, the Tiger First mortgage program may work for you. The security for these first mortgages are building lots in the tax opportunity zone in St. Petersburg, Florida. The tax act of 2018 set up tax-free zones across the country where you can build and hold for 10 years and pay no tax on the profits. Which makes these lots valuable. The investment is anywhere from 30,000 to 75,000. The interest paid is 7% yearly paid on a monthly basis. According to bankrate.com, the best rate for a four-year CD in the country as of February 20th is 3.1%. A $50,000 investment at a normal four-year CD rate of 3.1% would give you income of $1,550 per year or $6,200 over the four-year period. That same $50,000 investment in the Tiger First mortgage program would give you $3,500 per year or $14,000 over the four years. Which would you prefer? $6,200 or $14,000 of interest on your investment? If you'd like more information about the Tiger First mortgage program, you can call me at<PHONE_NUMBER>. That's<PHONE_NUMBER>. If you haven't checked out the newsletters page of TFNN.com, what are you waiting for? All of the TFNN newsletters are informative, up-to-date, affordable and a must-have for every trader looking to gain a competitive informational edge in today's markets. TFNN newsletters cover every aspect of the markets to offer you the very latest in market news. Plus, new subscribers get to test-drive our newsletters risk-free for 30 days. From all aspects of the markets, including stocks, bonds, metals, commodities and tech, there's a newsletter to fit your needs exclusively from TFNN. Stay informed each day you trade and get the competitive edge that will help you stay ahead of the game. Visit our newsletters page by going to TFNN.com and click the newsletters button near the top of the page. TFNN.com Educating investors. Visit directioninvestments.com slash biotech today. An investor should consider the investment objectives, risks, charges and expenses of the direction shares carefully before investing. The prospectus and summary prospectus contain this and other information about direction shares. To obtain a prospectus or summary prospectus, please contact direction shares at<PHONE_NUMBER>. The prospectus or summary prospectus should be read carefully before investing. An investment in the funds is possible. The funds are designed to be utilized only by sophisticated investors such as traders and active investors. Distributor Foreside Fund Services LLC. Don't forget, you can listen to TFNN live on your mobile device 24 hours per day. Go to TFNN.com then hit watch Tiger TV. That's TFNN.com then hit watch Tiger TV for the latest market information. Folks, down, down right now nine and a half. And if we take a look at, we're just talking about the housing market. If we take a look at this, evidently, you know, lower rates, which totally makes sense, folks, will get people out there. So, U.S. pending home sales increased by most in the three months. Contract signings to purchase previous owned homes rose in June by the most in the three months indicating demand may be picking up lower rates, man. Index of pending home sales increased 2.8% from the previous month. Exceeding the most optimist forecast in the Bloomberg survey, the gain and contract signings is a welcome sign, of course it is. Yeah. The report stands in contrast to recent data out over the last month pointing to weakness in the sector. Existing home sales fell more than expected in June, while new home sales missed estimates at the same time. Housing starts dropped to the lowest in three months. Pending home sales are often looked at as a leading indicator of existing home sales. The contract signings increased 5.4% from the prior month in the west, and you can see, listen, sorry folks, excuse me, we take a look at that 10 year, this is when we take a look at three months, this is a dramatic change. Yeah. Big time, man. You know, so about three months ago, approximately right there, right, 2.5 and now 2.05. But when you get down into the threes, you're talking, I think psychological too, it's a whole, you know what I mean? Right. And then, you know, maybe people get in there, they run the numbers and it seems more affordable or it seems just affordable. And it is more, definitely more affordable for a lot of people. Because what ends up happening is that you can't have your expenses, well, you can, depending on how loose they are with the money coming out and would, you know, basically bank or mortgage company to deal with.  Right, right. And so that makes a dramatic difference because a couple hundred dollars can make a difference and on two or three hundred thousand, a half percent, there's a couple hundred dollars, you know, pretty quickly. What else do we got out here? So you got, you got dishes now pretty good. Oh, Capital One, what happened to Capital One? Do you like your data? Do you like sharing your data with anybody on the internet? Oh, really? Okay. Because you lost a hundred million people of data. Oh. And I guess it has to do with their information being stored on the Amazon Cloud, I believe. Wow. And a employee actually somehow doing something. So they're talking about, yeah, analyst, no, no. Okay, yeah, but let's see what, yeah, data breach. Yeah. And so that's why it's down today and it's a huge number of people in terms of a hundred million. So let's see, these are, mind if I click back, I just wanted to try and get the real, yeah, see, former Amazon Web Services worker accused in Cloudhack of Capital One. Holy cow. A hundred million people in the U.S., illegally accessed after prosecutors accused of Seattle woman identified by Amazon as one of its former cloud service employees are breaking into the bank servers. Well, the complaint doesn't identify the cloud provider that stored the data. They mentioned a reference to simple storage servers. Amazon Web Services popular data storage software. So they're saying that this data, and we can read it and pick the lines that, you know, wasn't been used, hasn't been used, maybe they like corraled it. Okay. But you really can't be sure, right? Right. The second one person gets a hold of it in the span of .2 seconds. Yeah. It can be in everybody's email box across the world. Six million Canadians as well arrested Monday. This is Paige Thompson appeared in federal court in Seattle. Data theft occurred between March 12th and July 17th. That's a pretty broad range of dates. She last worked at Amazon in 2016. And look at the information that they have, folks. This is like, this is why this is like, okay, the largest category of data stolen was supplied by consumers in small businesses when they applied for credit cards from 2005 through 2019. Yeah. It included personal data, names, address, phone numbers, date of birth, self-reported income, credit scores. That's a big number, man. Yeah.  I mean, that's, yeah, you put down all that information when you're applying for it, especially. Right. Excuse me. And they, I think they pulled, I, there's the line in there somewhere that they don't believe the data has been used for to, you know, to, I can't remember the verbiage they used, but I didn't believe it whatever they were saying. Yeah. No. You know, the amazing part about these public companies in general, the first time that something happens, they always deny, deny, deny. Sure. Then it's like a couple months later, then a little comes out. Then by six months folks is like, oh yeah, it did happen. But guess what? You know, it's old news by then. And, you know, you know, in this case here, what you, what you definitely have is that the market is looking at that very seriously. Right. Yes. Yeah. Oh, six, seven percent drop. Right. Right. Yeah. Let's go back into the housing because let's see what they're saying. This is going to be about low mortgage rates. Okay. So that the America's housing is looking at that land. What began on the coast in New York and San Francisco is now radiating on the nation's hot land from Las Vegas to Charleston, South Carolina. Entry level buyers are scrambling to purchase homes that are in short supply. Yeah. Land is going up, man. More people, right? Yeah. Yeah. Yeah. Most many buyers in the expense of West Coast cities have already retreated after a surge of prices.  No. No. And that's where, you know, you got to start pushing across and cities expand and cities get next to bigger cities and, you know, you got to push out to areas that are more affordable. Right. All signs point to a housing market that should be doing really well and it's not. That's chief commerce realtor. The number one constraint despite low mortgage is that people can't find housing that they want, you know, and so you have to make that choice to move. That's a tough one. Look at this. This is pretty Louisville, Louisville, Kentucky. Okay. Yeah. Well, I thought that said $800,000 first. I'm saying, okay, it's $200,000. So 29 year old worker trying to buy a starter home less than $200,000. Yeah. And just an anecdotal kind of, but, you know, that three occasions houses plan for a tour snapped up before he could get there. He was out there on another. Finally had above asking offers, but did Sunday on a house list for about $199,000? Let's see. You know, the after his agent locked the door. I don't know. Some of these gets sensationalized when I hear about people that, oh, I set up all these appointments. Well, just go to the house then. What is the delay between you setting up an appointment and getting there? So it happens once. It happens twice. It happens the third time. And you're still like, can I see it in a couple of days? No. I mean, you know, at $200,000, it's only $800 a month. So I have a hard time, sometimes, comprehending that they're not doing numbers. Yeah. You've got to add on the other payments, though. You've got to add on the insurance, the taxes, because it's not an $800 payment in fairness for people who are buying their first home. It's not. What do you think it was? We'll figure it out. That's $200,000. I'm just saying it could be $14,000 or $15,000. Easy. Taxes could be three or four grand. Insurance could be two or three grand. You got to limit that out.  I'm certain you are or strive to be one of the best of the best at everything you do in life. It's the most common trade that we tigers and tigers share. If you're looking to become the best of the best when it comes to managing your money, let me teach you to do what most wealth managers tell you can't be done, which is how to time the markets. I'm Steve Rhodes, author of Mastering Probability. And for the last 12 months, Timer Digest has been tracking my newsletter signals, which have earned me the ranking as their champion in the nation for the S&P 500 for the last 12, 6, and 3 months. Timer Digest also ranks me as the number one market timer for gold as well. The fact is, markets can be timed. And I'll teach you the exact set of tools that I use that has transformed me into one of the best at what I do. Sign up for Mastering Probability today by clicking on the newsletter tab on the homepage of TFNN.com and get immediate access to workshops where I take you step by step how to use an extraordinary technology that allows us to provide great market calls to. Sign up today. Tom O'Brien published the 900th issue of his weekly newsletter The Gold Report on July 22nd. It's amazing he started the Gold Report more than 17 years ago when Gold was trading at only $252. To celebrate, we're having a special tiger dollar sale. Right now, you can spend only $495 and we'll give you 200 extra tiger dollars. So you'll get the yearly price of the Gold Report. Tiger dollars can be used for any TFNN newsletter or service and this offer is open to new and current subscribers. With gold making 6 year highs and gold mining equities trading higher, this is a great time to sign up for the Gold Report at a dramatic savings. For all the details, visit the front page of TFNN.com. This deal ends July 31st so don't miss out. Get your tickets now. Thus was born the Chapman Wave sequence. Using the Chapman Wave methodology along with other indicators, Basil Chapman advises his subscribers of his expert market opinion each market day with his opening call newsletter.  For more information, just click the Think or Swim banner on the front page of TFNN.com. Welcome back folks, Dow. Dow is down 47, Aztec is off 29, S&Ps down 9, and this market's trying to claw back folks. That's the bottom one. You know, we take a look at this S&P. You know, my take is this S&P still wants this 3055 which is the ABC structure. 3055. Sounds like a nice round number. Totally. We hit 301 out here today at 313, you know. So, we got plenty of news coming in. You know, the Fed, we got the window dressing and then, guess what? Speaking of high numbers, man. How about 900?  Tomorrow's the last day. Tomorrow's the last day. Okay, right. July 31st, we got a Tiger Dolls sale going on for two more days.  You can spend 495. You end up with 695 Tiger Dolls and then you can use them for any newsletter, any service. All right. This is just a Tiger Dolls sale. We've just designed the price around the Gold Report. If you're thinking about signing up for the Gold Report, you want information on the equities out there. Current subscribers, you want to take advantage. A year of the Gold Report right now is $695. So, you take advantage and you end up with 695. You can spend them on anything you'd like, but we've designed it right so that you can afford that Year of the Gold Report and the price of the Year of the Gold Report going up August 1st. Man, I don't think we went up on Gold Report prices in like five years, 10 years. I mean, that's where it's yet. I can't remember. So, going up on prices as well, August 1st. So, great time, man. You can really get a full year subscription for 495 bucks and you got Gold Rockin' and Rollin'. Can't beat it, man.  You got something else.  You save money right away on those subscriptions. Stay right there, folks. We get Fast Market coming up next and we get out out at Mr. Basil Chapman, Steve Rhodes, Dave White. Be back this afternoon. Thanks, man. Thanks, man. Yeah! Go get them, folks!