He's coming back, there he is. Yeah, thank you, thank you, we're here. So hello and welcome everybody to a long overdue of hair feeling. Ah, wow, look at him run. Jesus, you could tear down a house. So, if you didn't know already, Jurassic World Alive has had a big update. They've added ray battles, they have refunded everybody, you don't have to do it yourself. But look at him, he's right on that spot. Let's look at him walk around, beautiful. There is ray battles. This is the raid battle. This is the Mamatherian boss, level 19. This is where you can, you and up to three other people, do a raid battle against a giant boss like this to win air soon rewards. So this time, this is the guaranteed. Then after that, you win a different incubator. So I thought you'd only be able to win like, you know, this maybe two or three times, but you win it once, and then there's like 20 smaller ones, like really tiny ones, at least there was a Sino. So well, before we get into it, there's so much to cover, I'm really excited. Now, do not expect this to, like before we start, I just want to say, don't expect me to make a video like every, you know, every week or every, you know, something like that. I'm going to cover this game when I feel like I want to. I don't want to box myself into anything like that. Big changes, big, big, big changes have came to Jurassic World Alive in the form of stats. Normally things get nerfed or they get buffed. This time, some of them have had the changes like that. I don't know which ones, because that bloomin', you know, is now 1,600. I don't know what that means. That's really complicated, but you can click on a dinosaur, and we're really going to click on Trico, because Trico I've heard is the new MVP. So, oh yeah, also some of like 30% armor, 20% crit chance, some of that's changed as well. I think we covered that last one. So now instead of saying if it does one times attack or 1.5 times attack, it tells you exactly how much damage it's going to do. And as you may see, I'm going to touch my hair a lot because it is so long and it has no idea what it wants to do. Yes. The new thing that happens with this game is that when you play it, you'll end up like a million and one thing has come up. So it'd be like positive, negative, ba-da, ba-da, ba-da, ba-da, attack. Like it's just absolutely ridiculous. So self-cleanse distraction. So you can cleanse yourself of a distraction. It targets the fastest dinosaur if you're in a battle like multiples. It removes cloak and dodge and speed increase, reduces their speed for 50% lasting one turn. And then does how much damage? Defends shadowing and all things change. Instant invincibility taunt, which means that once you do the taunt, that you do your instant invincibility.   You, what is it? Remove speed increase, dodge and cloak, reduce speed by 50% lasts one turn. So this is now the counter for Indoraptor. Indoraptor Gen 2, I'm now expecting to not exist. It's going to go like it's dead. But not only have we got new moves, there is resistances and actually Trico is very easy because it's only got one 50% resistance to vulnerability. So let's have a look at something that's, you know, immunity, right? Remember, magnetator was always immune and I keep having to change this. I don't know why it's like, I click it and then it goes like super bright. Probably getting more sunlight. That's probably the thing. So magnetator has taken a hit. I think actually all of its attacks are the same, but here we go, a long list. So basically if you want to speed look at this, anything that is a solid block of blue is 100%. That's the way you go up. Okay. So instead of being immune to everything, it is swap prevention. 75% chance of an opponent stopping this creature from swapping out is reduced.  So if you're immobilized, you still might be able to get out, but it's risky. You'll notice Interruptor now is not on my team because this is the because, right? So cautious strike, Ludia did it. They did it. I told them what they need to do is stop it from piling on for two turns because that means that players can go up the stairs. Players can go for cautious strike, cautious strike and then do something else and still have the speed boost. This time increased speed by 10%, but only last one turn. 75% chance to dodge 66% of damage, one turn. So as soon as you've done cautious strike, if you're faster in the next turn, it's gonna be, you're gonna lose all the positive effects, basically. Mutual fury is still a thing. Instant, sorry, distracting impact instead of the defense shattering impact is there and evasive. But this is the thing. Now there's a chance you can stun it and now you can actually distract it by, you know, what you can actually distract it. It's also not resistant to anything. Everything has an effect on it. So tricor, if this is against tricor, tricor's counter reduces its speed. Done. There you go. There you go. It's done. There's no, like Indoraptogen too. Now I will, in about a week or two weeks or so, I'm not expecting to see it at all. I'm really not. It's pretty much gone. But how about we check out the new rain battles? This is what I'm excited for. There's a lot of dinosaurs that have changed. So comment like, you know, ones you'd see around about. So irritator, irritator, the one everyone needs for magnetator. I darted that the other day, 300 DNA. There's a lot of other things. So mammoth now isn't one that's gonna show up on the map, but woolly rhino will. We're gonna see a big change in, you know, dinosaurs that were so rare and hard to come by and that are now easy to get.  So you create a lobby here. So I will go into my friends list and just select anybody who is, now this is the thing. Select all these guys that have green. Yeah, nobody's accepting the invites because I honestly don't think people are getting them. Nobody's getting them. Invitation limit has been reached? What? Okay, so apparently according to killer raptors, which are some of the best players, the one to go for is Alleraptor, Dilaranus, Trago and Trio. So we've got Trago, we've got Dilaranus. I don't know why this guy's used the supermimacy things. Okay, so what can this thing do? There's 19,000 health. It can bellow definitive power rampage and it's basically immune to stun, rend and damage over time. Okay. All right, okay, right. For whatever reason, we can't get the fourth player. So we're gonna jump in with the three, ooh, it's a day raid. Oh, I've never seen a day raid before. This'll be interesting. Okay, so there's a lot to overcome when it comes to doing raids. Not only just trying to invite people, but then they have to respond. Oh my God, okay, here we go. Here we go. Come on. Oh, it looks so cool. Oh, little galamimus. Okay, okay. Dodge minion. Ooh. Waiting for teammates. Okay, so what's he gonna do first? So they're doing ready to crush. I go after him. So I might as well just do a heal. I go after the boss. So he's gonna, the galamimus is gonna instant distract somebody. Oh, it's me. Oh, that's fine. That's okay. Cause I'm just healing people. And then is that ready to crush for everybody? Oh, it is. Oh my God, cleansing, increase attack. Now he's gonna hit somebody. A group power strike. Okay. This is why I needed to heal. Cause look at that damage. And then I'm healing. Okay, here we go. Healer, lesser group heal. Do I cleanse as well? I do cleanse. And then, hey, back to full health. Oh, it's so much fun. I love it. Lesser thug advisor. Okay. That's gonna do. Oh, he got a crit. Okay. So you can see at the top, there's two rounds. First one has like the full health and the second round has like half health. Ooh, the thug. Okay. So what, what should I go for here? Now is he immune? I think he's immune to it. Do I just want to heal? Where do I go? I go after his big hit. So I might as well heal somebody. Oh, wait, why did I do that? Oops. Oops. I forgot his priority. I forgot it was priority. I'm about, oh, it's bellow anyway. Oh, okay. He got a shield. Not so good. Oh, a taunt. Okay. So we're all gonna attack him because he's taunting. This is gonna do a lot of damage. Does he get a crit? No, he doesn't. 2,700. Okay. Okay. Superiority. Gonna slow him down. That's good. Oh, it's loads of fun. But now the galamite was with an invasive strike on the tank. Okay. It's still a lot of damage. Like 600. No, sorry. My hair is all over the place today. It's like, it's not playing balls. It's like curled in. Oh no, it was just like put, look at that. Ha, ha, ha. Oh, this is so funny. I know something God knows. Okay. Well, there's nothing I can do. I might as well just go for the nullifying. Oh, he's doing a big hit. He's doing a big hit. Let's see. Okay. He's distracting. Instant distraction on that thing. Oh, but that's okay. Cause he's already done instant invincible. Because he did the taunt. That's right. So refresh. Regenerates his own health. Increases speed. Okay. Here comes the big hit. Oh no. Oh no. Oh no. This might hurt. Oh no, it killed him. Nah, we're done. I think we're done here. I think we're done. I think we're done. Is there anything I could have done? Could I have reduced it? I maybe I could have reduced his attack a little bit. I think I, oh, there's two of us left. There's flipping two of us left. Okay. I might as well go for a hit here. I'll go for a hit. Target the one with the least amount of health is it? I think. Cause he's going to go for a dig in. He's going to heal a little bit. I mean, as long as I kill the galamimus, at least then all our hits are going to be triggered of regenerated 1000 health. See, there's a big difference between three and four. Okay. Also, I've got the taunts turned off. You need the taunts on. Cause there's loads of new taunts. Okay. Is it going to go for the galley? I think I am. Yeah. Okay. So galley might be dead. I think galley's dead. Yes. Okay. Galley's out of it. That's good. Okay. So it's just us two taking on the mammoth theorem. He, oh, should I just do a minor heal? I think I'm going to do a minor heal. I'm going to do minor heal. Minor heal. Gonna have to here. So he's doing ready to crush. He's getting ready for a big hit. There's still 30,000 health on this bugger. Oh my God. Group power strike. Okay. Is that everybody he's hitting? Oh, it is. Okay. Okay. That's okay. That's okay. I'll do the healing. It's all up to that Tristor next. It's completely up to him. Oh, I don't even remember who it is though. Okay. So he's doing a bellow. So might as well just go for a big hit. Okay. Maybe 10,000 damage this turn. And then he's probably going to go for a digging, cleanse, shield. Right. Taunt. So already shields getting rid of for Tristor next. That's good. Fierce rampage. Okay. How much damage do you get a crit? No crit. Damn it. 2,700. Oh wow. This really puts it in perspective. Look at this, man. Look at all of the different things that pop up. Oh my God's sake. So we did 3,000. Oh dear. Okay. Now he's going to do the big one. It's probably going to be on me. Oh no. I don't know how much damage it did, but it did a lot. It did so much. Oh, there's the crits. I 1,700. Okay. Let's see who's going to go. Oh, he's going for that dude. Okay. I'm going to have to do the, hope he's not dead. Okay. Emergency heal. I'm going to have to do the emergency heal. So you do have 20 turns as well.  I couldn't go for the emergency heal. Nine hundred. Slowly whittling him down. Okay. Now I'm going to have to go for the emergency heal on him because he's not looking too good. And I need to get, like, if he's gone, that's it. That's it. He's gone. Looks like Dilaranus is definitely going to be one of these dinosaurs that people are going to use because it's a healer. And it's, you know, it's pretty darn good. So close. He just healed. For God's sake. Okay. Emergency heal. Medic coming through. Time to heal. Group shield. Oh, did he heal himself? Oh, okay. I was going to say, I'd heal you. Okay. So what's he going to do? Hmm. Hmm. Should I go for a minor heal because he's going to hit everybody? I'm going to go for a minor heal because he's going to hit everybody. So try Stonix is just like, ready to crush? Big hit. And then hopefully heal. So we're basically fully healed at this point because he's going to, he's going to do a big hit. Oh, he's going for him as well. It's a lot of damage, man. Oh, okay. Oh, he hit me as well. Oh, there you go. Well, that's that. So we're going to heal ourselves. Oh my God. Yay. Okay. Now I can do big hit. Big hit. Big hit. Here we go. 10, less than half health. Okay. So he's going to do his big hit and then I'm going to do my damage reduction on him. Oh man. Yeah. I know we need to use that distraction. Otherwise we're just going to keep on healing ourselves from his attack. Come on. Get a crit this time. Come on. Come on. Yes. 3,400. Good, good, good. Oh, that's total health. Okay. So he's almost down. Come on. Please do a lot. Please get a crit here or something. Come on. Damage. Oh, so close. He's got a tiny bit of health left. No. No, he's got a tiny bit of health left. Okay. I'm going to have to. I'm going to... It depends who we attacks here because we're going to have to do a big heal here. Big heal here. I know. I don't know if we're going to do this. Oh my God. This got absolutely bulldozed. Okay. We did it. I don't know how I restart my thing and we're pretty good to go. Come on. We can do it. We can do it this time.  Come on. Round one. 3,800 health. Only certain total. Yes. Okay. Let's be good. Let's do this. Target the boss. Okay. So instant invincibility. Ready to crush. I'm nowhere on that. I'm last. So I'm going to make sure I heal everybody. That's what I'm going to do. If I'm going last and we've got an instant destruction coming through, he's the mammoth boss is actually going to... Who's he distracting me? Okay. Does that... Wait, why do I vanish? Is it because we're going back to him? Okay. Yeah. Everyone's got a shield. Oh, that's awesome. Ready to crush. Here we go. It's like Avengers. Oh, look at this. This is nuts. This is crazy. These are wound.  Is he a hundred percent resistant? I don't think so. I think he does some damage. Okay. Now he's going to hurt everybody here. Okay. Okay. How much damage? Oh, 700. But, but in comes the healer. Come on. Am I okay? Is it going to heal everybody? Oh, yes. There you go. Thank you. Thank you. So much fun. He's still got. We need to use distraction. Okay. I'll do it. I'll do it. I'll distract. Okay. What's going to say? So now, right. I'm going to use the big distraction now. What does he even do this one? Reduce damage 50% for two turns as long as he doesn't cleanse himself. Okay. So we've got a big hit coming through with salmon. Salmon. Salmonella. Is it Salmonella? Salmonella, I think it is. And then a big hit coming through from the tristor, which is raw. Okay. So that's fine. That's fine. Okay. Here we go. Here we go. Taking down the shield. Now is it going to, it's attacking the boss. Okay. That's good. Here we go. Oh, a crit. 3,400 damage. And in comes the second big one. Also targeting the boss, I think. Yep. Here we go. Wobbush, 2,200. Now we've got a slowdown. Decrease speed. Okay. Just, is it for everybody? Oh, it does hit everybody. Here we go. This is what I'm talking about. So as we kill the boss, who cares about the minion? Minion's not going to do much. And then in comes the distraction. And it's like, remove, remove, remove. Yeah, we got this. Is that a thing? Nice. Oops. Oh no, no, no, no, no. I didn't mean to do that. I did not mean to do that. I apologize. I clicked the taunt, and then it went straight to my battle. Well, I'm going to heal the, the trago sticks, whatever, I guess. I didn't mean to do that. And, oh no. Oh no. Oh, this isn't good. Because the boss is now going to do a huge attack. And I needed that. Okay, well, the galamimus is out, I suppose. But a big hits coming through to somebody. Oh, I'm so sorry. I'm so sorry. I released that heal, though, I suppose. Oh, but then I need that. I needed to heal him. Can I do my heal? I think I've still got one more cooldown. We might lose him. We might lose him. No, we won't. Okay, good. Oh, okay, we're not going to lose him just yet. We're not going to lose him just yet. I apologize. I did not mean to do that. I was clicking the taunt, and then it went straight to the attacks, and it was already there. Nice was right on it. Okay, well, he's healing himself. That's fine. So we got a get ready to crush for everybody. That's good. However, it depends how much I heal him by, because I'm going to have to go for... I don't even know. I think he's going to die. I think he's going to die, because I should have used my priority heal. Oh, he's going to heal. Yeah, two lesser heals for everybody. He's healing himself, and then I'm going to heal him. Oh, fantastic. We're back to full strength, boys. There we go. Woo-hoo! Yes! Damage over time? 2000 is still a lot, actually. There's a lot of damage for free. Okay, okay, I'm going to use destruction. Don't worry. Don't worry. He's fast, though. Okay, I'll use destruction. I'll distract. Okay, so he's going to do a big hit to hit everybody. But hopefully we can take him down here, because we've all got, like, extra attack. So here we go. He's going to hit everybody here for a big hit. What? 2000? Oh, my God. Oh, oh, it's going to be close. I think we've killed him. I think we've killed him. Oh, 3,400.  Really need a heal, man. There he is. Okay, so this is what happens. Once you take it down to the lowest it can go for the first turn, no more damage will be put on. No more damage. So I messed up there, because I should have healed the Trigostis or whatever it's called. But we're slowing him down, as long as he doesn't heal in the next turn. Like, he nullifies it all. Okay, yeah, it's definitely time to heal. Time to heal. Okay, but he slowed down by a lot, so hopefully we get to go first. Minion revive. Okay, I don't know if I can heal, man. I don't know if I can heal. I can heal one person, but that's it. That's really it. Okay, okay. If I can survive, one more hit. It depends. What's he going to do? Oh, I have to. I have to, or else we're all dead. I'm going to have to heal somebody. I'm probably going to be out at this point, though. So in this instruction, is that a heal for everyone? It's just a heal for himself. It's just a heal for himself to try Stonix. But I'm going to have to emergency heal. Damn! Okay, well, there you go. You've got your health back. We're getting a shield. So I might just survive, maybe? Because we both, Trigostis and me, we both did our heal. Shadow, we both did a heal at the same time. Refresh, so he's getting his heal as well. Oh, lowest HP is going for the galley. Precise rampage. Ah, it's not enough to kill it. And here we go. Here we go. A boosted attack. He is nullified by a little bit. But, am I out? Oh, I survived! I survived! I survived! Damage over time. Yes, okay.  Heal these. I'll do heal these. I'll heal. I don't know if I'm going to survive. He might go first. Oh, this is fine. This is fine. It depends if the Galamimus goes for me. It depends if the Galamimus goes for me. I think we need Trigostus to go for a heal. I think he did. I think he went for a heal. It's- Oh! Oh, this is tough, man. Oh, he's going for a base of strike on him. I think I would have just survived, but he had armor. So I might have died. Okay, so a fierce strike. Here we go. I think it's... We're all getting health back, but the next turn, that mammoth is going to go for his big hit. But both me and Trigostus did a heal. We've got two healers. I'm kind of more healing because I've got that emergency heal. So here we go. Healed a little bit, and then we'll heal from mine. And it doesn't... It depends who he attacks, though. How much health do I have? Ooh, if he targets me with his big hit, I'm done. I'm done here. But I do have a shield lasting a little bit longer, hopefully. It might be gone, actually. The end of this turn. We needed to nullify him. I'm going to nullify him, and I'm not quicker, unfortunately. He's decelerating? Or is he speeding himself up? Okay, yeah, he's going for a heal. Thank you, Shadow. Shadow's going for the heal on everybody. The Galamimus has gone for instant destruction. This is what I wanted! Like, everything I've asked, like, Looted to do, they've really come through. Like, thank you. Like, I wanted, like, multiple dinosaurs, like, on the ground fighting, like, in a rotation kind of style. And I wanted Indoraptor to be nerfed, because sawed it. And they've done it! Oh! And I actually mentioned in one of my videos about what's it called, about me losing my Dragon's Rise of Burke account for whatever reason. And they emailed me. In the Jurassic World Alive video I did, they must have seen it. And then, oh, my God. Thank you, guys. Like, I do rag on Lodur a lot about the microtransactions. And I think a lot of them understand it. I think they do. But, no, that's like, amazing. Oh, come on. So at least, oh, I got a crit! Ah, I got a crit! And he's done so much time, and he's distracted a little bit. I think we're all good. I think we can all take a hit. I think at this point we've won. At this point we've won. It just depends by how much. Okay, yeah, he's going for a cleanse, heal, and a speed up, and a shield. So Tristorix is going before me, which is great, because that's going to get rid of the boss's shield. Then, Salmonella. It is Salmonella. It's going to go for the precise rampage or whatever it is. And then I'm going to distract it. But it's probably, my distraction's going to kill the Galamimus, I think. Because the Galamimus, what's the Galamimus do? It took eight, we're waiting for the damn Galamimus there. And Shadow Slayer's going for the vulnerability. So the Primal Dig in here. Primal Dig in, coming through. Oh, this is loads of fun. It's a shame that it takes a while, like, or whatever it, like, once I restart on my iPod, or my iPad, sorry, I, everyone joined instantly. So, don't know what happened there. I really don't know what happened. Ooh, there you go, 2700. That's almost, like two more of those and he's gone. Okay, here we go, precise rampage on the Galamimus. Ah, damn. Didn't realize it was going to hit the Galamimus. But at least my distraction's going to go through onto him. So that's good. I wonder if you can stack distractions on him. Okay, so there you go. Oh, I'm doing some damage. I'm doing some, and a vulnerability, and a speedup? Is it? Is it a speedup for him? 740, this is it, 710. Here we go. Here we go. He's vulnerable. Attack! He goes last as well, we've definitely killed him. Now, I think I might deal the final blow, or Salmonella is. Oh, it depends. Oh, it really does. It depends here. Who's going to deal a final blow? I think Salmonella's going to do it. If Salmonella doesn't get it, I'm going to get it, I think. It's just shadow. What shadow going to do? It's going to go for vulnerable. Why not? He's pretty much dead now. Okay, here we go. Defend shadow. We'll roll, get the finisher, get secret. He does. Oh, it looks like Salmonella's going to get it. Otherwise, I think I might have done it there. And boom, 500. Yep, I would have got it. There you have it. Oh, destroyed. Yes. Good job, guys. Yeah. Woohoo, awesome.  I love that. Ah, here we go. Let's open it. So we get 1,000 of that, 180 of that. Oh, 100 Spinosaurus Gen 2. And the one we wanted, 50, 125 of Ethereum. Beautiful. And if we do that again, what's the next reward? 10, 32 DNA and 95 in total. So what's really good about this is if you want to help out your alliance and you don't want to just spend books on rattling through these incubators. You can just do loads of raids. It's a shame that you have to have four people because it's not something you can do by yourself.  But I'm going to wrap up this episode here. Wow, the whole recording is like an hour and 10 minutes, but the video is probably only going to be half an hour. Something like that. But here we go, that's loads of fun. I'm planning on doing a Q&A on Discord at some point. So if you aren't on the Discord, go to the link in the description below, find it there. And wow, yeah, I'm definitely going to get a haircut. Jesus, I'm looking more and more like a, I don't know, a caveman emo. It's very strange, it's a weird look I got going on. Anyway guys, thank you so much for watching this video. And hopefully you're enjoying the raids. Hopefully you're not finding it as broken as the first bit was, Jesus. But anyway, until next time, I'll see you later. Oh, buh-bye.


Common question that I get in investing is how many accounts do you need if you're just starting out in the investing Or you have an interest to enter into the investing game You're gonna want to stick around for this because a lot of the pieces that are gonna help contribute to your financial Future is going to be how you enter into Identifying which accounts you're gonna need especially on the onset a lot of people will enter into and start their first two Accounts as they're saving and checking accounts I do not underestimate the importance of these two accounts and we'll get to it as to why that is But do you need multiple accounts? I've been investing my whole life I've grown my accounts up north of 20 and I do that for a very very strategic reason and each of my accounts have their own Specific discipline attached to them. I have a bond account. I have a dividend growth account. I have a passive account I have an employer sponsored through a 401k type of account So if you guys have some of the pieces through those accounts I would charge each and every one of you guys that follow the independent investor message to entertain the idea of continually Trying to identify those areas of improvement in opening a new account It cost you nothing and I think to diversify your strategy across your portfolio and earmark different accounts Can maybe help organize because what ends up happening for a lot of people is they start their initial Savings and checking account and then they're going to enter into the investing game And they segue into the broker that's attached to their bank and they start one account Okay, and that account they may put an ETF into and they start growing that ETF And it starts to grow and then one of two things happens either they start to compound on top of that investment within that account to try to diversify their strategy and They start to really muddle Down the amount of strategic vision over that account, right when you start to mix single stock with index funds or ETFs and it starts to get a little bit out of control and you start to maybe Introduce some of that single stock that may underperform and you don't have any other choice But to cumulatively look at the underperformance in that account and and it can really set you up to out to Underpace the market because those holdings start to pull down the other holdings now I'm not suggesting that the single stock if it underperforms in another account and your account that has the passive investments that have at least matched the market What won't be similar in nature as a matter of fact, it's the exact same it just becomes easily more Identifiable for those underperforming assets Maybe to be looked upon as an area to put a little bit more strategic or aggressive funding to Okay, and while those areas of the portfolio are outperforming like your passive investments Like the S&P has done really well over the last few years It's rolled off as of late But you know that roll-off as of late would have been a nice indication to anybody out there to fund that particular passive Strategy in the market, and I think it's really easy when you're looking across your suite of accounts to actually identify what is working and what potentially may be going through a little bit of time of volatility or or You know anemic growth in the portfolio, and I think it just helps keep you very very organized I think there becomes a break point for new investors that start their account and they build that account up and you know The S&P 500 isn't enough. They want to add a small cap ETF to that and then they want to add single stock to it And then they want to add bonds to it and then they want to add big-tech growth And then they want to add Hypergrowth to it maybe a couple of micro cap names to that to the portfolio And I think it can really muddle what you're trying to do with your strategic vision within that account And I think a more clean Streamline type of approach will really really help you now remember on the onset where I talked about your checking and your savings account I'm in a default and suggest that the majority of the investor audience that tunes into my message already has those accounts established I Utilize my checking account for my inflow and my outflow all of my bills are paid through my checking account All of my accounts I use it as my my my my linking account if I ever need to cut a check I can do that I do that about twice a year If not, I'm waiting for that one year where I can make it through the entire year and don't even have the need to Write a check anymore, but it really does serve the purpose of the receipt account for my paycheck And then the deliverables for all of the bills that I have to have and then the transfer out of that account to my Respective other accounts investment vehicles credit card payment that type of thing So my checking account serves as my dynamic account thousands come in Thousands go out okay It's not as if the thousands go in and the thousands go out in way of spending the thousands go out in way of strategic Allocation and so I would suggest if you wanted to use my strategy You could do that and use the checking account in this capacity and that when I get paid all of that Allocation is made within the first, you know half a day It's already done So the inflow predictable inflow and the outflow predictable outflow is already set before it even happens and it's a good strategic tool to use on a checking account that most people have and Potentially cannot earmark any type of strategic use for that account I've just given you some ideas about how I use it now the savings account I advocate for people to really embolden their savings and personal wealth This is one of those areas where a lot of financial institutions will disagree with my perspective on this That's too bad My independent and thought has led me to believe that having all of your Investment dollars tied up in the stock market is great when things are great But when things are not great people are really scrambling to find idle dollars not only to survive But also idle dollars to maybe inject Into the stock market when it's probably more opportunistic to do so They just don't have the savings to to put those strategic fundings to work And I'm not suggesting that you overweight to your savings account I am suggesting that you have a strategic goal over your savings account to have on a ray as a rainy day fund There's some golden rules out there six months of your paycheck It's arbitrary and from my perspective any amount that you earmark that you're comfortable with whether it be You know ten thousand dollars on the low end or maybe even fifty thousand on the high end depending on your income and Depending on the how maybe volatile or uncertain you are about your level of employment Maybe it's a sales job. Maybe it's something that's a little more tethered to the economy I would suggest that you have a little bit higher of a savings rate and don't apologize for that Okay, that savings will pay dividends And it will pay dividends at the time where you most need it And it is easy to scoff at that savings account when things are all hunky-dory in the stock market And you're making 20% of a year, but what about times like this where we're off 20% and It would be a great time to strategically inject some of that capital Nobody's coming forward and saying hey cash isn't king right now because it is I look at a little bit more Nutrally, I find that there's value in it So I pursue it as part of my holistic approach to wealth building savings account super important For you guys that have the 401k 403 feet 403s 457s those employer sponsored. I think they're great I think for a lot of people they need to educate themselves up on where they are allocated within those plans They are not easy. There are a lot of very very confusing retirement plans It's as if they make them that way on purpose and I find this to be extremely troubling I had to go into my wife's she just took a job with CBS and I had to allocate her to what was An insufficient fund that she was defaulted to in that fund and you know You need to understand where your money is if you don't want to understand and you want to stick your head in the Sand well it could be to your detriment by not understanding where your money is in your 401k and How important that could be especially if you are earning some matching funds over that 401k to max those types of Funding schedules for yourself It can really be a lot of free money that you're able to put away without a lot of wherewithal and out a lot Without a lot of knowledge of the stock market because those programs are kind of meant to be funded and forgot about But to not take advantage of the free money. I one do not get a match with my TSP with the military So that would is absolutely incumbent upon all those investors out there that have that to earmark How they can leverage that and get the maximum benefit and that's really the core of this message is Identifying the strategic maximum potential over each of your accounts and extrapolating that value over time It's very very important It just goes with the investor IQ of paying a little bit more attention than the average bear And you will be been a more benefited for it over the long term by understanding How to best utilize your accounts have them earmarked for win and how that value can be realized and maximized When you come to that impasse in your life a very very important now in addition to the 401k You want to look at the possibility of starting individual retirement accounts? Individual retirement accounts are the best thing going They are important more important than any of the previous three accounts that I disclose to you The Roth IRA of a self-directed nature again self-directed. I will repeat It's very very important that you understand not to subject your account to Managed Roth IRA. There are two different products there the self-directed will ensure that you are taking ownership over it and Not allow the institutions to subject that account to fees So it's very important that if you're going to become a self-directed investor that you own the account That it is indeed Independent to you and not subject to the fees the annual fees the brokerage fees everything that goes into owning a managed account When they put those products inside your account, it is indeed on an island. It's independent You're not subject to the fees you get to keep all the appreciation within the account It's super important for you guys to start along this line If you're single get to contribute six thousand a year to it if you're married double that to 12k And you know a lot of people need to be getting to that maximum funding per year And if they're not there then it stops right there Those are the really the accounts that you need to begin on your wealth-building journey You could accumulate millions of dollars into your future with just those four accounts Those four accounts right there are the core fundamentals. Okay, we don't need to be talking about crypto accounts We don't need to be talking about brokerage accounts. We don't need to be talking about Robinhood accounts Why do I suggest Robinhood as being omitted from those initial four because Robinhood does not offer retirement accounts And I think that's a real fallacy on their part And it's probably a large reason why the investor sentiment over Robinhood has gone into the tanks And those four accounts right there if you're able to have the two Self-directed Roth IRA accounts that can be great that can really double you up for the married couple between you and your spouse As well as your your 401ks now if that's doubled up between you and your spouse then you can double that Okay, and if you double up the checking and savings account You could have as many as eight accounts between the two of you that that right there is the suite of the buckets That is the core nucleus of success Now the real tipping point here when you've maximized the potential in each of those eight accounts That is where you're max funding your Roth IRA That is where you are funding your 401k to the extent of getting the maximum match within that account That is that you have a savings account that is earmarked on the top end of what you've identified as being your sleep easy cash between ten and fifty thousand dollars Depending on your income and finally your checking account that you have dialed in on the inflows and the funding stream that looked to fund Each of these accounts on a monthly basis a bi-weekly basis or a yearly basis whatever you choose In your repertoire once you get to that point where you're max funding your Roth IRAs With some certainty year over year that is where you can look to layer on Additional brokerage accounts. Maybe start a crypto account. Maybe leverage your segue into a crypto Roth IRA I have that with I trust capital the one if not very few of the Roth IRAs that you can house crypto in and Have that crypto asset and be tax protected into the future But you don't need to be talking about that kind of stuff within your primary accounts You really don't but there's going to be a lot of people out there that ask well What next and what is it that it makes me eligible to go ahead and start a brokerage account or a joint brokerage account Start housing assets in there nice dividend-paying companies total market ETFs Along the accounts of what I share with you guys and how I've built out my comprehensive wealth And it's super important for you to understand that by earmarking those additional Pieces of the account you can really identify that you probably have a lot of work to do And I would break it down in these two as we close down the video if you're in the preliminary building your first four accounts Make sure that you're identifying the strategic benefit of each of those four accounts and make sure that you understand inside and out What strategic maximum potential that you want out of those accounts and number two If you are it at that impasse where you have those accounts really firing on all cylinders Perhaps maybe you look at identifying maybe a brokerage account with some bond accounts of crypto Assets in there. Maybe you want to put a hybrid strategy into a brokerage account all kinds of different options that you could do But most people are not eligible for that Okay, and I find all the time the fallacy of jumping toward those those latter brokerage accounts when they have failed to Identify the core strategy in their initial four accounts guys if you appreciate the information coming through the channel Make sure and subscribe at the notification bell You'd be notified of future videos that I put on YouTube leave your comments at the bottom of this video and subscribe to the message guys Thank you so much for tuning into the video and good luck in your investment future


Hello and welcome. My name is Dmitry Vyukov, I am very excited to be here and today I'm going to present TOKOL Dynamic Program Analysis for Fun and Profit and I hope to give you some useful information about Dynamic Analysis Tooling that you can use to find very real bugs in programs as serious as the Linux kernel. So first I will give some overview of what is Dynamic Analysis and compare it with Static Analysis because I know there were several talks in this series about Static Analysis. Then I will give overview of existing Dynamic Tools in the Linux kernel and then I will talk in more detail about KSN or Kernel Address Synutizer which is one of Dynamic Tools that we developed. So for the past 10 years I work at Google in the team that is literally called Dynamic Tools and we do a large set of tools for bug detection. Those tools work for user space, for kernel, for different languages and find a large set of different types of bugs. I will also do some fuzzing tools for user space in kernel and different languages and we do some production hardening tools that can be used right in production to detect or prevent some types of bugs and we will also do some other tools, continuous fuzzing coverage and so on. So I know a little bit about this area. So first question we want to answer is why? Why do we want to use Dynamic Analysis? Why it is useful? Why it is good? And the answer is bugs and bugs can lead to security issues which is a very hot topic today. Bugs can also lead to stability issues and they just result in low quality and we don't want to produce low-quality software, we want to produce high-quality software. Bugs also can result in wasted time by developers because fixing bugs after some period of time is much more expensive, it involves reporting, debugging by section and so on. And bugs also mean moving slow, you may need a long stabilization period before you can release and use software to shake out all bugs. And Dynamic Analysis is a cost-effective way to find bugs and later get rid of them. So what is Dynamic Program Analysis? It's analysis of the properties of a running program. What properties can be analyzed? So the first one is bugs or absence of bugs and this will be the focus of this talk. But there are other properties like performance, we can analyze say execution speed or memory consumption of a program, also code coverage or we can build a dynamic call graph of a program to understand if it's possible to say get from this function to this function and how exactly we can get from one to another or we can track data flow throughout the program and so on. So if Dynamic Program Analysis is analysis of properties of a running program, then static analysis is analysis of the properties of program code, which can be source code or binary code, it doesn't matter. As a result, Dynamic Analysis proves properties that hold only on a single execution. We of course can run several different tests or the same several time and check several execution but still each time we test on the single execution. And in contrast, static analysis proves properties that hold on all executions at once. And you may think that proving properties that hold on all execution is just strictly better, right? Because why would we want to prove on the properties only on one execution? So this is true in theory but it is not true in practice. And to explain you why we need to consider two things. First is called true positive. It's when a tool reports a real bug. So this is a good thing. We want tools to report all real bugs. And the second thing is false positive. It's when a tool reports something that is not a bug. And this is a negative property. We don't want tools to report something that is not a bug. Ideally, we of course want a tool that would report all true bugs and don't report any of the false bugs. But unfortunately, in reality, it's not always possible. And in reality, what we usually have is we have this kind of slider where you can balance between on one side reporting not reporting false positives, but also reporting fewer of true bugs. And on the other hand, you have tools that can report more real bugs, but at the same time, they may report also more false bugs. And the degenerate case of reporting all true positive would be a tool that just flags every expression in the program with all types of bugs. And of course, it will report all true bugs, but it also report lots of false positives. So it's not very useful. And the degenerate example of on the other side would be just an empty program that doesn't report anything. It does not report any of the false positives, but it will also not report any of the true bugs in the program. So it's also not very useful. So in practice, we want to find some balance where we report some amount of true bugs, but also not report to many false bugs. And if we try to compare static and dynamic analysis in this respect, then generally we can say that static analysis is better for true positives because it analyzes all executions, all possible executions. So it can give us more true bugs, but on the false positives, usually in practice, dynamic analysis is much better just because it turns out to be much easier to analyze properties of a single concrete execution rather than trying to analyze the source code in general. And to explain this, let's consider a simple example. So let's say we have this function that allocates a block of heap block of 10 bytes and then writes at offset 20. And this will cause out of bounds Texas, which is a bad bug. And static analysis hopefully can find this bug because the bug is very local. We can actually see that the size of the heap block and the actual offset. And we can prove that we can prove that this is a real bug. So we would like static analysis to report such bugs and there are tools indeed that exist that will report this looking just at the source code. However, if we make this example just a little bit more complex and use a dynamic index to access the heap object, then you can see how things quickly become much more complex for analysis. So is it out of bounds access or not? And let's consider that to calculate the index, we take some offset in a buffer and then convert it from string as a string representation to an integer and then use this as an index. So now to prove that this is out of bounds access or that out of bounds access is not possible, we would need to figure out what actual bytes can be written to that buffer. And then if those are converted to an integer, can they be larger than 10 or not? And we also don't know the actual offset in this buffer. So we will also need to figure out what offsets we can have and where this buffer is written and what bytes are written to that buffer. And only then we can try to prove that this is an out of bounds access. So you can see how hard it becomes very quickly. And this is reasonably realistic code. You can find something similar in basically every program. And in reality, it's usually even more complex because there also can be some unions that are known to be hard for static analysis. There can be arrays, threads, there can be function pointers and crypto algorithms that by definition are not possible to reverse engineers statically. So if you use static analysis, it's very likely that we will either miss a real bug here or report the false positive. Now let's consider what we can do with dynamic analysis in this example. So when we will execute the malloc call, we will memorize size of this heap block somewhere on the side in some meta information. And then when we execute the index in operation, we will fetch the size of the heap block and compare it with the actual index because during this execution, we know the concrete value of the index. So we just need to compare those two numbers. And if index is larger than the size, then we report the bug. So you can see that it doesn't really matter how the index was computed. If there was involved any conversion from strings, if it involved any unions, or if actually the malloc and the indexing are in completely different parts of the program, it doesn't matter. We will also never report the false positive because we have the concrete values of the heap block and of the index. And we will always report the true bug. But the caveat here is that we will only report the bug on the test that actually triggered this bug. So this is the downside of dynamic analysis. And to give you some idea of a number of false positives produced by static tools, I run four static analysis tools on all yes config kernel and collect that number of unique warnings they produced and the amount of CPU days that were required for the analysis. So this table is not to show you that this tool is better than that one. It's completely apple to oranges. To begin this, those tools find different types of bugs. But you can see that say Clang produced more than 10,000 warnings. And you can guess that most likely not all of them are true bugs. Probably a majority of them are actually false positives. Some tools, you can see that some tools produce significantly fewer warnings. So they probably on the other side of the spectrum, but they also may report few of the true bugs. And you can see that say for smash the amount of CPU time required full analysis is almost two CPU days. So it's significant amount of CPU time that we could use. If we use dynamic analysis, we could use this time to run a significant number of different tests also to find bugs. So dynamic and static analysis, it's not that one of them is better than the other, they would say they're complementary and each of them has own strength and weaknesses. And yes, and one thing is that most static analysis tools, they analyze not the source code as these, they actually analyze concrete compilation of this source code. And for kernel, it means a particular configuration of the kernel for a particular architecture. And there are more than 12,000 configs. So you can get something like two to the power of 12,000 different kernels. And of course, each architecture is significantly different and affects say size of pointers and size of longs that again can introduce some bugs. So Dimitri, this is Joak. Can I have a question on the previous slide? So client analyze seem to have a lot of warnings. However, does it indicate the coverage it provides compared to GCCF analyze? Does it look at more things that it also ends up giving more warnings? I'm looking to see if the coverage is safe. I'm pretty sure. Yes, I understand the question. I'm pretty sure they do just different types of analysis and probably find different types of bugs. I didn't really look at details. I'm pretty sure I'm so for Klangen, analyze that it produced one type of bug very frequently. Maybe it was a potential null pointer, the reference or something. And I suspect that those Klangen GCC, they just choose kind of different point and the spectrum between reporting more true positives and more false positives. Thank you. So as I said, static and dynamic analysis are complementary. It's not that one is better than the other. So static analysis is better for simpler and more local bugs, as we've seen in the example. And it also has a great advantage of giving more code coverage, because it immediately tests, analyzes all of our code. And it's also generally faster and provides more deterministic feedback, which is not subject to producing, say, flaky tests or failures or failures that depend on timings or on a concrete hardware that you use, which is a very nice property. And dynamic analysis tends to be better for finding more complex bugs. And its great advantage is that it generally has no false positives. And because of this, it also allows a simpler usage model, especially for projects like Linux kernel where we have lots of contributors and code is changing very fast. And what I mean here is that if we know that the tool produces no false positives and we are getting you failure, say, on introduced by a commit, we can be sure that this is a true bug. So we can mark this commit as bad and mark that it should not be merged. And if a tool produces false positives that we cannot do this, because maybe it's just a false positive, so we should not really block merging of this commit because of the failure. And also, in the kernel, we have lots of accumulated false positives. And as we've seen in the table, something like thousands. So when you run the tool for the first time, you need to analyze all of them. And actually, other people already analyzed probably all of those warnings before, but now we need to analyze them again because the information, if it's a false positive or not, is not really recorded anywhere. Okay, so the main disadvantage of dynamic analysis is that it only finds bugs that are actually triggered. So we need to get more coverage to make dynamic analysis more useful. And there are several ways to do this. So first of all, you want to run all of the tests with dynamic analysis enabled, unit tests, system tests and so on. Also fuzzing or randomized testing proved to be very great in combination with dynamic analysis. And it finds lots of bugs. So we have a kernel fuzzer called syscaller, but it will be a topic of the talk next week. Also, you can use dynamic analysis just when you do development. So for example, I have lots of dynamic tools enabled in the kernel whenever I just build and use the kernel for just anything.  And actually, sometimes I see such cases when other commits introduce bugs that are very easy to trigger, but I see that the change was just wasn't tested with the tool enabled. And there are more interesting ways to get coverage. For example, some of the tools can be enabled in pre-production servers or servers that say handle some portion of a real traffic or maybe in dog food clients. For example, we use Android phones with heavy instrumentation enabled to find some bugs that actually happened during use of those devices. And also have Chrome builds with some of the heavy dynamic analysis enabled as well. And some tools can even be used right in production if they introduce overhead that is suitable for production. So dynamic analysis is only as good as your tests are. And you want to run as different and variety workloads as you can with dynamic analysis. A few words in the kernel tests. So I will not go in details. I think this topic probably deserves a whole separate session. But there are two kernel test suits available in the kernel. One is called KUnit and another is called KSelfTest. So those are right in the kernel tree. And there are also set of test suits that are out of three. For example, Linux test projects, XFS tests and some other ones. So I found those somewhat harder to use because each of them is located in different place and each of them is built and run in different ways. So I would suggest you to start to concentrate on KUnit and KSelfTest first. Okay. And this is end of the first section on the overview and general information on dynamic tools. And if you have any questions so far, I'm happy to answer them now. Do we have any questions? We do not have any questions yet. But just a quick reminder. You are welcome to unmute yourselves and ask a question. Or you can raise your hand and we will ask you to unmute yourself whenever Dimitri pauses. And you can also submit a question via text in the Q&A box. Okay. So I will have another Q&A, another after the next section as well. So let me move to the next section. It's called DIY tools due to self-tools. And it's about set of, let's say, simpler tools that are available in the kernel. So dynamic analysis doesn't need to be very involved. And it can be, in fact, it can be quite simple. For example, there is a thing called config debug list in the kernel. And if you enable this config, kernel will do some dynamic checking of linked lists. So there is a structure in the kernel called listhead. And as you expected, it contains necks and previous pointers. And if we enable this config, what will it do? It will add some additional debug checks for all list operations that will check consistency of this list that links make sense and notes appropriately linked rather than just causing silent memory corruption. And if you enable this and the kernel code will try to execute some bad list operation, then you will see something similar on the console. You'll see a report from this analysis tool. It will say that there is a list corruption that happened in delete operation. And it will give you a stack trace. And hopefully, this will be enough to actually analyze and pinpoint the problem and fix it. There is another one called config fortify source. And what it can do, it can find out of bounds access in the simple code like you can see on the slide. For example, if we allocate a buffer of 10 bytes in a stack and then try to memset it with the size that is larger than the buffer size, then it can catch it. And how will it do it? It will inline memset function and use compiler magic that is called built-in object size and ask the compiler if it can tell the static size of the buffer we are trying to memset. And in this case, the compiler will tell us that the buffer is 10 bytes because the buffer is declared right here. And then memset will compare the size of this buffer with the size of memset. And if we're trying to memset more than the size of the buffer, then it will report the bug. Dimitri, we have two questions. Do you want to fill them now or later? Yes, let's do it now. Okay. The first question is, I want to hear about the future of these tools referring to your previous slides about the tools, SISBOT and so on. So let's do this question at the end, I think. It's just better for at the end because I will yes. Okay. So there is another question. How are you dealing with the timing issues introduced by dynamic analysis instrumentation, like print case causing solving kernel races? We do not. We generally just test the execution at SIS. And yes, dynamic analysis can change the timing somewhat. So we rely on executing just the test over a cloud multiple times and eventually getting the right timing to find the bug. So yes, it's possible that because of dynamic analysis, timing has changed and some bug that was happening actually frequently starts happening infrequently or the other way around. Actually, that's that's what we see more that the bugs that can happen very infrequently, they actually start happening more frequently. But still, if something is possible without the tool in your production bill, it's also can happen with dynamic analysis, maybe just with lower probability. And as I said, we just rely on on repeating the test enough time so that eventually we will catch the bug. Have another question. Yeah, I think that's probably that's that's what probably they're looking for. This is the question coming in on chat. There is a second question on Dmitry, are there any classes of bugs that are not possible to spot by runtime analysis in principle, just due to the fact of change to runtime? It's a kind of a follow on question to to the print case introducing changing the timing. I don't think it's possible to change runtime. It says I said that the probability can be much lower for some bugs. But also interestingly, because we're on same virtual machines, it's it's possible that in some execution, the virtual machine or the host actually also changes the timing significantly. And so that the change between two threats introduced by the dynamic dynamic analysis can be offset by the slowdown introduced by say virtual machine or some, you know, I interrupt arriving at right time. So I think in the end, all bugs still can be triggered. And in some cases, we actually try to additionally disturb timings, both to provoke more unlikely bugs and to kind of recover bugs that we masked because of the slower execution due to dynamic analysis. Thank you. Okay, I see that I don't see any other questions. So let me continue. Okay, so config fortify source can find this simple type of box. And the simplest one is actually a macros called back on and warn on. They just check that they accept the condition and they check that the condition is true at runtime. Those cells are known as assert macro in CNC plus plus. And those are super simple. There's nothing involved here, but they also super useful because this condition will be checked in all kernel executions out there during all testing. And now and in future. And there's another good thing about them is that they serve as a great comments and code. For example, here you can see example from kernel do group exit function that is called on process exit contains a bug on related to exit code. And it has a comment saying core dumps don't get here. And this is the comment that we actually can trust that it is true because it is checked in all kernel executions out there. So if it would be if it would be failing and some corner cases, we would know about this. And you can trust this comment, but you may not necessarily trust normal comments because they may not cover some corner cases or maybe they were true when they were written, but then become not true in future. So encoding your assumptions in this back on and warn on macros is very useful both testing and to communicate your assumptions to other developers. And there are actually lots and lots of similar configs in the kernel. So I tried to compose more or less complete list of those. It's probably not complete, but it's it's complete enough. So there are configs related to lists. There are configs related to check in user copy operations. There are set of configs related to detecting some lockups and hanks. And there are more of them log depth, for example, is super useful. It's a tool that finds potential deadlocks. And there's whole set of configs that can find misuses of synchronization operations. And there are even more of them that can find other types of bugs and more of them that can find even more bugs. So it's for all of those you just need to enable them in the config and you don't need to do pretty much anything else. The kernel will analyze itself for all those different types of bugs. And if anything fails, you will get a bug report on the console. And there are other configs, debug configs that you need to do something to actually use them. For example, KMM leak, you need to run periodic scanning to find leaked objects. And there's also fault injections config that super useful for finding bugs in error handling path. And there are lots of such bugs. But you actually need to enable and set it up to tell it how to inject the bugs, when, and how many, and so on. And there are some auxiliary configs. For example, you want to enable debug info so that you can get line numbers for your bug reports. And in some testing, we enable configs that make the kernel panic whenever it detects any bug, just so that's simpler to spot the bug. So I will not go in details of all those tools because configs, because there are lots of them, but you will be able to find this list in the slides and use it for your kernel testing. And there's one small thing, which is a script called the code stack trace SH, which is very useful for dynamic testing. And it allows you to get line numbers for your crashes. So normally in the kernel crash, you see lines like this, which tell your function name and then some magic hex numbers, which are not very useful. And what this script does, it will add file name and line number to this entry. So you can actually look up this line number and follow what crashed where. And that's it for the next part. Do we have any other questions? A couple of comments more like questions. Maybe you can, the question is about how to bridge static and dynamic analysis is a hard question. I answered saying we do some of that now with K-Cal coupled with the Sysvat triggers. Maybe you can elaborate on that, Dimitri, if you. But I'm not sure what is meant by bridge static and dynamic analysis. What do we want to do? Dave, do you want to unmute yourself and ask a question or elaborate on that? Hey, great presentation so far, by the way. Thanks so much for giving it. I guess one of the things that you have a ton of experience in and that I've always tried to work really hard on is finding a way to minimize the effort once you have a vulnerability or a bug in this case that you've detected.  And then you also have your dynamic analysis and finding a way to trigger the static analysis generated warnings with dynamic analysis is always really valuable in my opinion because now you have a test case that you could in theory use to help triage and help analyze the event. And so I guess one of the things is you've got a very broad overview here but I haven't yet figured out how some of these things connect, I guess is where that's kind of what we were talking about in the main chat. So I see what you mean. There is some research on doing roughly what you described and using static analysis results to try to guide dynamic testing to actually trigger that bug at runtime. So this research, well, it tend to be in my opinion quite complex. So this type of thing is frequently somewhat hard to incorporate into in the actual production bug pipeline, testing pipeline. So we don't use anything like this so far. So I don't know what to add. So, but yes, it's possible. It's just quite non-trivial and it may also depend on type of the bug. I guess I know that it's somewhat easier for data races. For example, if static analysis pointed to locations where a potential data race can happen, that what you can do is you can run dynamic tests and then just pose threats at those points and see if you can pose them at the same time. So if you catch both of them at those locations, then they keep proof that it's actually possible that those memory access can race. So that's one way of doing this, but this specific for data race detection. And there are other ways how dynamic and static analysis connect. For example, dynamic analysis instrumentation frequently uses static analysis to, for example, prove that some constructs cannot cause a bug and then we don't need to actually check them at runtime. For example, if we allocate a buffer on the stack, we see the size and then we access this buffer and we see that the access is probably within the bounds of the buffer. We don't really need to check this at runtime. So this can be used to remove some of the dynamic checks and make execution faster. Well, thanks so much, by the way. Okay, so I don't see any other questions. So let me continue. And the next part is about KSN or kernel address sanitizer, which is one of the tools, dynamic tools we developed. So first of all, pillars that we use for our dynamic tools. First, we absolutely don't tolerate false positives and explain why they're nasty and why we want to remove them. So whenever we have a choice between, say, choice between reporting a false positive or not reporting a true bug, we tend to go to the side of not reporting false positives and also maybe missing some true bugs. So we consider this to be better than reporting more true bugs, but also reporting false positives. We try to make our tools work out of the box and be easy to use. Don't require any special tuning or setup. And we try to provide informative reports that give developer enough information to understand what happened and to fix the bug. And we try the tools to have as low overhead as possible so that they can be used more widely. So what is KSN? KSN is a tool that can detect out of bounds access, use of the free box on heap stack and global variables, and it's enabled with config KSN. So what is out of bounds? Out of bounds happens when we allocate a buffer and then we try to access it outside of the bounds of that buffer. And use of the free happens when we free a pointer and then try to access it after we freed it. And those are bad bugs. And what you might expect to happen is when you do this, there will be some kind of loud boom. And I don't know, something will happen, program will crash. But unfortunately, in reality, in most cases, actually nothing happens. So we just write, we just corrupt some other memory unrelated when we write out the bounds and nothing happens so far. Later, maybe the program will crash and then we'll get the loud boom. But at that point, it will be very, very hard to understand what happened, what caused the corruption and so on. So it's known that some of such bugs required basically months of developer time to debug and to understand what happened. So what the KSN does, it actually makes the program boom at the point of the bad memory access. And here on the slide, you can see an example report produced by KSN for use of the free bug. So you can see here in the title, it says it's use of the free in this function and that it was a write of size eight done by this task. And then you see the call trace where the bad memory access happened. And then the tool tells you where this hip block was allocated and where it was freed. So this information is hopefully enough to pinpoint the problem and fix the bug. Okay, now let's consider how the tool actually works. The tool has a notion of shadow memory. And this shadow memory for every eight bytes of aligned eight bytes of kernel memory, the tool has one shadow byte. And this shadow bytes encodes if this kernel memory, if the corresponding kernel memory is good or to access or bad to access. So if all eight kernel bytes are good to access, which means this memory is not freed, it's not, it's within bounds and so on, then the shadow byte contains value zero. And if only first n bytes of the kernel memory are good and the rest are bad, then the shadow byte contains the corresponding number of good bytes. For example, if first five bytes are good and Romanian free bytes are bad, then the shadow will contain number five. And the bad memory means that this memory was either freed or it's outside of the bounds of the allocated heap block and so on. And if all eight kernel bytes, sorry, if all kernel bytes are bad, then the shadow contains minus one. So now where this shadow memory, shadow bytes are located. Kernel memory virtual address space has particular layout. There is, for example, a region called physical memory at particular address. There's region called Vmalloc memory. And then there is a kernel text, program text at some address. But we're not actually interested in all those details. What we're interested in is this new region called case and shadow. And this region holds all those shadow bytes. This region is quite light. It's 16 terabytes, but it's only virtual address space. It doesn't actually consume your physical RAM. And this memory has shadow bytes for all of the other kernel memory. So there is a mapping between kernel address and the shadow byte. And because this shadow region is a single continuous address range, this mapping is actually very simple. If we have a kernel address, we need to divide it by eight and add some offset. And this gives us mapping from the kernel address to the shadow byte. And we divide it by eight because we have one shadow byte for eight kernel bytes. Now the next thing we need to consider is red zones around heap objects. So normally without KSN, all heap objects are allocated next to each other. And what KSN does, it inserts red zones between those heap objects, those red chunks. Those regions, shadow for those regions is marked as bad. And if kernel will try to access those red zones, we will be able to detect out-of-bounds accesses. And compiler also ranges red zones for stack and global variables. The next thing we need to consider is quarantine for heap objects. So when you free a heap object, normally without KSN, it will be used in last in first out manner. So the next Kmalloc call of the same size will most likely return the same object that we just freed. So what KSN does, it puts freed objects into so-called quarantine, which delays reuse of the heap blocks. And while the heap block is placed to the quarantine, its shadow is marked as bad again. And this if kernel code will try to access this block while it's in the quarantine, we will be able to detect the use of the free. And the last piece we need to consider is compiler instrumentation that actually checks validity of memory accesses. So if we have a write of eight bytes, it doesn't matter if it's a write or read, it will be the same actually. The compiler will add the following code before the memory access. So let's consider what it does. First of all, we will compute address of the shadow byte based on the original address kernel tried to access. And we'll do this by shifting address by free or divided by eight and add in a particular offset. So this gives us address of the corresponding shadow byte.  And if it's not zero, we will report a bug. And only because the access is eight bytes, we want all eight kernel bytes to be good to access. And all eight bytes are good are encoded as zero. That's why we compare shadow with zero. And if the access is smaller than eight bytes, for example, it's one, two or four bytes, and we're accessing say bull or short or integer, then the code will be very similar. But there are this additional part that will actually try to figure out if we're accessing good or bad bytes within those eight bytes. Because, for example, we can have first four bytes are good, and the last four bytes are bad, and we're accessing two bytes. So we need to figure out if those two bytes actually bad here or good here. So this code looks at the offset of the pointer size of the memory access and compare it with the shadow. And this is basically it. This is like the main algorithm, how KSN works. So to recap, we have the shadow memory that marks kernel memory as good and bad. We have red zones around heap objects, and red zones are marked as bad. And this is what allows us to detect out of bounds accesses. And we have quarantine, which delays reuse of freed heap objects. And again, objects in quarantine are marked as bad. And this what allows us to detect use of the free box. And we have shadow checks before each memory access that are inserted by compiler and that actually allow us to detect bugs when they happen. So let's look what we've got. We've got no false positives by design because we basically, because of how the tool is built, if some object is freed, and with kernel code tries to access this object, there's no way it is not a bug. The tool works out of the box. You just need to enable the config. And it gives relatively informative reports. It provides allocation free stacks. It describes heap stack and global objects. And lately, it even do cool things like giving you the last call RCU stack for the heap object. And it has a relatively low overhead of about 2x slowdown and 2x memory overhead. So this is a visible slowdown, but it's usually fine to run any tests. So now you may wonder how good actually is this dynamic testing? Is it fine in any box? So we use dynamic tools with fuzzing with our syscaller fuzzer. And we test kernel continuously for about five years now. So we have this syscaller upspot.com dashboard with all the bugs we've found. You can see an example on the slide. And so far, we reported more than 5,000 bugs and more than 3,000 of those bugs were actually fixed and accounted more than 4,500 backports with fixes in long-term stable kernel releases, which I would say pretty good numbers. And the types of bugs we're finding they're different. For example, I counted about 1,000 bugs detected with KSN, and then 370 bugs detected with KMSen, which is another tool that we developed that finds uses of initialized values. We detected about 480 data races with KSN and log depth detected about 170 dead logs. And for warning plus bug, we found about 1,000 of cases where they fire about 500 null pointer, the references and some other types of bugs. So it's really a mix of different types of bugs. We don't try to use just one tool, we try to use all of them. Dimitri, do you remember when KSN went in? It's a while back, right? It's about 4.5.5, I think, something like this. Oh, no, it's older than 5.5 for sure. I'll look it up. Somebody asked a question, how older versions? So KSN was introduced quite long ago in 4.3, I think, and KCSN relatively recently, in I think it's 5.5 or 6. The question was about KSN. Okay, so about 4.3 for KSN and KCSN is 5.5. Okay, thank you. And for KSN, I think people ported it to all the kernels as well. There should be some patches for, I remember, up to 3.8, I think. Okay, so to conclude, dynamic tools are your friends. Use them, enable all of those debug something configs, enable log depth, enable KSN, use it during development. As I said, I have almost all of them enabled basically all the time. If you develop new code, insert bug on warnon, those are useful macros. Also add and run tests. And this decode stack trace, create this, is your friend for add and line numbers to crashes. Also bugfix is usually a perfect first contribution. So if you're just looking for contributing to kernel for the first time, that may be a good thing to do. Because bugs are usually, bugfix is usually relatively small and they don't require lots of high level design. And bugfix is something that's always welcome and it's not controversial. So you can look for example at syscolor dashboard to find some bugs that are not fixed yet. And try to fix them. And there's also Linux kernel bug fixing, Linux foundation mentorship program that run last year. And maybe it will run in the future, but it's something that requires you to sign up before, but it may be a good opportunity to learn how to fix those bugs. Yeah, we just started one starting spring. We just selected 10 candidates for spring for the Linux kernel bug fixing. And we might have one coming up in summer and fall. Check out the last slide, we'll have all the information. Thank you. And if you want to go hardcore, you can also contribute to the dynamic analysis tools themselves. For example, we have this Lounder release in kernel bugzilla with various feature requests and improvements for KSN and other tools. And you can make a KSN, for example, find more bugs or produce better reports and so on. So contributions here are also welcome. And last but not least, the sanitizers that we are developing, they are also available in user space, both as part of Clank and GC compilers. You basically just need to add a single flag to your compilation and you can detect wide range of types of bugs. So if you don't use them yet, that's the first thing to do. And with this, I would like to thank you and I'm ready to answer any questions. We have three questions in the question and answer. So the one question is, what's the status of using Clank to compile the kernel? Where can one find information on using Clank to compile the kernel? Are learnings from getting the kernel to compile with Clank generalizable to other code bases? So kernel can now be compiled with Clank just fine. There was indeed some struggle for a long time, but I think ready for multiple releases, it can be compiled. The upstream kernel can be compiled without any additional changes to Clank or the kernel. And we actually have a Clank build kernel on our scolar testing. So we continuously build and test those kernels as well. And I know Linaro and some other companies are also doing this. So basically, you can just do it and use Clank with Linux. I'm not sure I can answer if the findings generalize to other code bases. So I wasn't directly involved much in this effort. I've seen some bugs. Generally, it was bugs like assumptions of GCC use of some GCC specific extensions that are not supported by Clank. I think it also found lots of latent bugs that were just bugs in the kernel code, but they happened to work and not fire loudly with GCC, but then code started breaking with Clank. I think it also uncovered some bugs in the Clank as well, which were fixed. So overall, I don't think there's a general answer. Basically, if you port in batch code base, there will be some set of different issues and each of them just needs to be debugged and fixed in the code base in the compiler. Maybe code needs to be changed to not use compiler-specific features and so on. We have a question in the chat as well, Dimitri. Does a scolar consider that kernels are non-deterministic? How does that affect the POC generated by scolar? Do you see many false positives as a result? Yes, kernel is very non-deterministic code base and it makes things much harder. So lots of user space testing and fuzzing in particular, it just assumes that the program is completely deterministic that the same input always gives you the same coverage and that if you found the bug, it can always be reproduced. It's not the case with the kernel for lots of reasons because of timings, because of inherited non-determinism in, for example, random number generation interrupts arriving at random times. Also, lots of accumulated states, so it's not really possible to make test cases isolated. So it affects design of scolar and number of ways. For example, when we collect coverage, we need to run the test multiple times and see what coverage we're getting on each execution because, for example, we can get some flaky coverage when execution went and the mutics locked slow path, but it happened only once and then next time it will not happen. But it's actually not an interesting coverage for fuzzing as well. Or Kmalak can suddenly start doing some memory, trying to free kernel memory and call into file system and so on. That's also the coverage that we will not see next time most likely. So we run each test multiple times and then try to figure out if we're actually seeing some stable coverage as a result or not. It's the same for crashes. We can't always immediately figure out what crashed the kernel. We try to reproduce and trigger it again, which is somewhat complex procedure. We try to run the same things we run before the crash, but sometimes it succeeds. Sometimes it doesn't succeed. Sometimes it was the interaction of two tests that were running at the same time. Sometimes it's related to the sequence of how the tests were run because there are some accumulated state in the kernel. So we try to run different tests and different combinations and see if we can trigger the crash again or not. Sometimes it succeeds. Sometimes it doesn't succeed. Then we just try later. Maybe the next time we will be more lucky and be able to trigger the crash. Lots of crashes are just flaky because there are some races involved. So they crash say one out of 10,000 times. And then when we try to reproduce it, we may be lucky or not lucky. Yes, so it's different and this non-determinism affects lots of things in CISCOLOR, and there's still some unsolved problems. Another question. It's a follow-on to the same question. Well, I don't mean false positives, but I mean reports slash POC that are impossible to follow. That is, Kaysan finds a bug of some behavior elsewhere in the kernel. I think you might have already answered it, but go ahead. Can I read this question? Where is it available? It's on the chat. It's in the chat. Okay, I'm just... Yeah, it's probably... Oh, okay. Whoever asked said that you have already answered it, but yeah, go ahead. Okay, so we have several more questions in the chat, but if you think that you have something more to add to that question, please do. Otherwise, we have more questions. Yeah, so sometimes we just can reproduce the crash at all, but we still collect the crash because we know that the crash itself was true. We actually crashed the kernel in some way. It's just that we may not provide a reproducer. I'm not sure if this answers the question. So if we provide a reproducer, then we know that this reproducer actually triggered the bug that we report on a freshly booted kernel. So if this caller provides a reproducer, it's not a false positive. It may not trigger the bug reliably, or it may also trigger other bugs besides this one, but at least kind of the reproducer and the bug, we know that that combination is valid. Okay, so another question we have in the question and answer box is, do you do any analysis of the components in which the bugs are found? For example, are certain components more prone to bugs? We don't do this analysis directly. We, I think, seen some components that contain lots of bugs. This may relate just because those components are large. For example, networking is very large, or USB is very large because there are lots of different drivers. We also have different coverage for different subsystems. So we don't do direct classification of each bug, and we don't do rate of bugs per line of code analysis at this point. There are some requests, feature requests, to actually try to classify bugs by subsystem, and then we will have those numbers, but not yet. Thank you. There is another question. This is a longer one. Something that I have been trying to do in is run since scholar on a Samsung Android phone, but I have been having troubles compiling the Samsung kernel with K-SAN plus K-Cow. I have followed the instructions on the Android K-SAN K-Cow guide. The thing that I don't understand is modifying AOSP code section. It doesn't help with other devices. For example, it's not obvious how adjusting bold parameters for a device, is there any logic in increasing these addresses, how to calculate new values? It's in the question and answer box. It's a bit longer. Yes, I see it. So I think we need to take this offline to mailing please. And I'm actually not sure what mailing please. So there is K-SAN dev mailing please, but it's mostly for upstream kernel. So if it's Android specific or specific to particular device, there are not necessary people who just have experience with that. Generally, K-SAN doesn't need to be adjusted in any way. So that shadow region address, it should work for all kernels and for all boards and configurations. But there sure can be other issues related to, I don't know, bootloader and other things. So it's hard to talk abstractly. Thank you. There is another question. How hard is it to prevent exploiting out of bounds and use after a few bugs in the kernel? Is anyone working on this? How hard? It depends on what runtime overhead you can tolerate. So it's very easy to prevent if you're ready to tolerate, I don't know, 10x slowdown and 10x memory consumption increase. There are techniques called, for example, Fed pointers that can do precise bounds check and just prevent all of those bugs reliably. But generally, it's not, this amount of overhead is not okay for production environments if you're in production. So there's actually techniques. There's some hardware support, which is called memory tagging, and it's being developed by ARM. It's already in ARM specifications. And we hope that other CPU vendors may provide something similar. And this hardware support allows to have case and like detection with very low overhead. There are no physical hardware yet. So we don't have exact numbers, but maybe somewhere from, I don't know, 5% or something. So that is our closest hope and the most realistic hope for preventing exploitability of those types of bugs. It's essentially moving the case-on type functionality into the hardware so that it happens quickly. Have another question. Is it possible to educate SISBOT at some reinforcement learning with manual SIS duplicate? SISFIX commands for better performance. So there is actually some work on incorporating reinforcement learning, but in the FASR logic, so that the FASR come up with more interesting programs and triggers more bugs. But this was understand this question about duplicating bugs. Marking bugs is duplicate. So for FIX commands, we do by section and this handles some amount of missed FIX commands. Marking duplicates with reinforcement learning. Maybe it's possible. Hard to say. It may also, it will also have some false positives, I think. And I don't know, this needs to be evaluated. For example, if 80% of duplicates will be marked correctly, but then 21 will be marked incorrectly and we just make some bugs disappear, but those actually not duplicate. They're a unique bugs. Is it acceptable or not? I don't know. So I would say it's some open research and somebody needs to try to build prototypes and see what quality we can get and what results we can get with this. There is a question. There is still the last question about future of the tools. But before that, based on the follow on question to Android case on, Adam is wondering if he can reach out to get resources on where to get help, offline help. So let me post this case and dev mailing list address to the chat. I think it's this one. This may be a place to start at least. And I think there was a number already of questions about ports and case and to some Android kernels and dealing with some boot issues in Android. So maybe it's already answered there. So I personally don't have lots of expertise with backporting and enabling case and on specific Android devices, but maybe there are other people on the list. Thank you. Another question. Best tool for dynamic call graph. I actually don't know. I know something called Gcov. It may do this. I mentioned dynamic call graph just as an abstract thing. I didn't actually mean any specific tool for the kernel. So sorry I can't give more info. So now we are to the last question. I want to hear about the future of these tools. Future of those tools. So for case and it's mostly done besides some local improvements. We do KC-SAN, which is data race detection tool. The issue currently with the kernel is that there are too many benign data races or intentional data races. And they confuse the tool a lot. It detects those races, but those are not actually bug as considered by developers. So that's where we currently stuck with deployment of the tool. So the future on this direction would be actually somehow marking all those intentional data races, and then the tool will start finding non-intentional data races that are bugs. I also have a tool called KM-SAN, which is memory sanitizer, which finds uses of initialized values. And we already use it, but the thing is that it's not upstream. We never managed to actually do this last step because it's actually quite a large step to upstream and incorporate it into upstream kernel. We are also apparently working on a set of tools that can detect bugs right in production because of this problem with, you know, getting coverage. If you were on tests, we're on fuzzing, but still, we're not doing that. We're covering everything that's important for production, so we want to deploy some tool right to production systems. And for that approach, we currently use some sampling, use high rate, low rate sampling, and check just some small subset of heap objects for use of the free and out-of-bounds bugs. But the idea is that if you deploy this tool in a large fleet of devices, for example, a data center or all of the phones, and each of those devices checks just a handle of heap objects with very low overhead, then you still find bugs on this whole fleet of devices. And this tool is called KFANCE, and it should be upstreamed basically within this week, at least we very much hope that it will be sent to Linus and Linus will merge it. So in future... Okay, go ahead, sorry. In future, we also want a tool that detects initialized memory in production, but we don't even have prototypes for user space, so for kernel it's long future plans. Yes, and memory tagging I mentioned, so that's... There's also active work in the kernel to support memory tagging and actually be able to do all of this checking without sampling, checking all of the heap objects in production with acceptable overhead. So that's the word to support the so that's the word to support the Syncernal and support the Syncernal for using user space and we're also waiting for the actual hardware. Yes, I think that's it. That's KFANCE, Dimitri, that you mentioned. I can, you hopefully can find it, I will post the name to the chat. Okay, there is somebody posted a LWN article as well, Link. Okay, it's there. Okay, sounds good. And then you mentioned that benign racists, do you mean that means that intentional, are those need, do they need to be tagged in some way to ignore them? Did you mean is that what you meant when you said benign racists? Okay. Yes, yes, that's what I meant. So the tool just requires some kind of abstract model that would allow it to distinguish between box and not box and if those not distinguishable, if bad race looks exactly the same as intentional, not bad race, then the tool just can do anything, it can't distinguish them. So the idea is to just tag the intentional racists. Right. So something like what static analysis tools do to ignore false positives at times with the tagging, like Kavarati does that and similar to that, I think. That's kind of... Yes, yes, to some degree, yes. So what is the nature of these benign racists? Do you have any examples on, in the Cardinal that would tell us more about those benign racists? Yes, we have lots of examples. We actually have lots on the CISCOLOR dashboard, the cases on reports. So lots of them related, for example, to statistics counters when multiple tasks increment some statistics variable at the same time and they don't use atomic increment, they just use normal C-level plus-plus expression to do this and they're okay with, say, some statistics increments being lost. But of course, if you say do this for an index in an array, then that can be a very bad bug, but the tool can tell the difference. Lots of those also related to, say, setting some flag in one task and then checking it in another one. But again, if you analyze the code, the code is actually fine with, you know, say this update being somewhat sloppy or it ensures that multiple threads don't try to modify the same variable at the same time and so on. So some of the lossiness is, like for example, static counters. I have been looking at those in the past few months. So those are, lossiness is okay. So you don't really care about those. The others are, if you look at the flags, they might actually hold a lock which might not, Casey-San might not pick up to update the flag or is it a real update without a lockhold, but it's okay. So Casey-San catches two concurrent accesses that happen exactly at the same time. So it won't be confused by, say, missing lock or missing some synchronization that ensures that it's not actually a race. So when it points to a race, we know that those actually happen at the same time. But say it's one write and another is read and the logic is arranged so that it's okay. It's this type of cases. Okay. You have one writer and multiple readers, sir. Yeah. Maybe there's actually a mutex for all of the writers. So those are serialized and those don't corrupt the variable. But on the read side, it's read and done without the lock and we catch the race between read and count one writer. Okay. Great. Thank you. Any other questions? How are we doing on time, Christina? We have about nine minutes left. There's any other questions? This is a great presentation, Dimitri. Just awesome. Thank you. Thank you. Yeah. Thank you so much. Well, if there's no other questions, I just want to thank Dimitri for his time today and thank you to all the participants who joined us. As a reminder, this recording will be on the Linux Foundation YouTube page later today, and we will also be posting the slides on our website. We hope you are able to join us for future mentorship sessions. Excuse me. Have a wonderful day. Thank you. Bye-bye.


Hello, this is Laptop Media, and today, we will show you how to open the MSI Katana 15 and what's inside of it. To open this device, you need to undo 13 Philips head screws. Then, pry the bottom panel with a plastic tool, starting from the front two corners. Please remember, it would be of great help to us if you just hit the like button and subscribe to our channel. That would motivate us to make even more and better videos for you. Inside, we find a 53.5 watt-hours battery pack. It got us through 6 hours and 30 minutes of web browsing, or 5 hours of video playback. To remove the battery, unplug it from the motherboard, and undo the three Philips head screws keeping it in place. Thankfully, there are two Sodom slots, which work with DDR5 RAM, ticking at 5200 MHz. The maximum supported capacity is 64 GB. Storage-wise, there are also two ports. They fit M.2 PCI-EX4 Gen for SSDs. For heat pipes are shared between the CPU and the GPU. Two more take care of the graphics memory and the VRMs. In addition, you get three heat sinks and two fans. If you'd like to see more disassembly videos of the latest notebooks we would highly appreciate if you hit the like button and subscribe to the channel.