So my name is Josh Phillips, I have a surprise guest who did not show up in the schedule, his name is Michael Donnelly, I'll let him introduce himself in a little bit. I don't know what it is but generally I always get the last slot at the conferences I speak at and so hopefully I don't tell everybody too much of a tiring lullaby. Yeah, yeah, okay. I mean there is somebody after us and I feel really bad for him but, you know, what are you going to do? So, let me see if I can check. Okay, there we go. And, okay that's the right slide. Stuff's not working for me. I've heard that all the presenters have been having really bad luck today. No demos are working and stuff like that so hopefully ours will go better. So, about me, in real life I play a malware researcher at Kaspersky.   That was my biggest achievement in life so far. Underground, I was a gold farmer, wrote some bots for some games that people might have heard of but I'll let people guess as to what that is because I know what Blizzard does to people. I'll let Mike talk about himself right now. Alright, I'm Mike Donnelly, otherwise known as Mercury. I created the Glider software for World of Warcraft. Sold about $4 million worth of the software. Got sued, lost, I think it even says right on there, badly, lost the $2.5 million in damages, personally liable. Appealed it, got most of it, flipped over. But overall the process was, I would say, less than fun. As far as my underground identity, I have none. Once you get sued, everything about you winds up in court record, all your deposition, all your addresses, everything. But on the plus side, I did have a Glider customer bring beer to my house. He looked me up, dropped the beer off and then he posted a message on the Glider forums. He said, hey Mercury, go check outside your front door, there's a six pack of beer. That was pretty nice. And there actually was the beer, I'd go through the garage so I didn't see it and I went out and got it. It was only Budweiser, but free beer is free beer. If you're going to get smoked for $6.5 million, at least I got some free beer.  Yeah, I am married, but yeah, so I'm not so lucky. So our goal of this talk is to not make anybody like an expert at game hacking. If you came here for that, then we're going to disappoint you. We plan on just giving you some overview. If you don't have any technical skills, we assume you have some to get at least something out of this talk. But if you don't have technical skills, we hope that some of our game hacking war games will be entertaining for you guys. Something I will say is we don't really have any zero days. So if you're looking for zero days, then you're also going to be disappointed. But we don't really feel we need to give any zero days because it's really easy to find them. Every game that's ever released is going to have a buttload of stuff. So here's a nice quote from Sun Tzu and I think Mike has some experience with this. He actually chose to fight. He's actually the only person I know that actually did choose to fight. And I guess you can ask him about how that's going. That could be better. Could be better. Could be worse. Yeah, it could be. So here's a brief legal blurb that Mike has experience with and he's going to talk about that. Yeah, yeah. And one thing I wanted to say is, of course, everybody knows I'm not a lawyer. So I can't give you any legal advice. But I'm a person and I can give you personal advice when it comes to lawyers. And when you get lawyers, you're fucked. If it gets to that point, you're in a lot of trouble. Chances are it's going to end badly. A lot of people, such as myself, you might think, well, I've got a good legal theory for what to do. You know, I've got Section 117, owner of a copy. I've got DMC 1201F, interoperability. You know, let's go, man. You can't take me down. It's incredibly painful and expensive to get that far. So even if you have winning arguments, the chances that you get there are slim. I'm not saying you should never do anything where you might get sued. I'm saying you need to understand the seriousness of getting sued. It's bad. So you should take steps to avoid it if you have to sell from Nevis or Neptune or the seventh dimension.  That's a good place to be, though. I'm sorry, I didn't hear you. I'm good. So my disclaimer is we're weasels. I guess maybe I'm a weasel. Mike chose to do everything in public. I think that might have been a poor choice. You guys can decide. So the names have been changed to protect the innocent. So why do we hack? I think it's mostly obvious. We want some women's. Did I mention that Mike's single? Come on, man. So really, there's a lot of money in this. Mike made $4 million. My first competitor was making half a million a month. That's pretty real money. Sometimes people might want revenge or cheating, but that's not really important. Kids being kids. Child play. So raise of hands, who would like to go to this school? I mean, I really wish that this was offered in my college, but it really wasn't. So we're going to get through some tools of the trade. If you don't know any of these, maybe you should start looking at them. So I think most reverse engineers can't live without it. It should be pretty obvious what you do with that. Reassemble some code. Ollydbg. Let me go back. Olly debugger. If you don't know what a debugger is, then you probably shouldn't be here really either. You need a memory, something to search memory. Most people use something like art money or t-search, something like that. They're pretty popular. 010 editor. If you are doing anything with file formats, this is like God mode. I think that anybody doing it without 010 editor is failing. It also helps with packet captures if you want to see what the structure of a packet is. And something that's very important are your custom tools. And once you get serious about game hacking, if you don't have your own scripts for IDA to do all these sorts of magical things, then you are wasting your time. One thing I wanted to add is these are the tools that you're looking at if you're doing something professional. If you're going to build a big piece of software and sell it or run it or take this on as a business, you can do a lot with nothing. You can duplicate items. You can find bugs in games just by being clever and tinkering. So this is, I don't know, pro grade or what you would use to make money. Part of the panel is hacking for fun, so I'm not going to completely focus on profit.  That's where your tools come in. So I've got a bit of classification. Basically like some, there's like cheats, bots. I'm not going to go into really detail about the stuff. I'll talk more detail about it when the stuff comes up later on.  One of my competitors in China wrote a custom client for World of Warcraft and pretty much destroyed us. You know, they could run hundreds of clients per computer and it's really hard to compete with that when you can run like three or four. What about, there's one custom client that in particular is funny. Just by raising hands, how many people here have played the game Hellgate London? Okay, how many people that have played it were playing it six months later? One? I feel sorry for the people who play it. Well, the reason I mention that is I know a guy that works with World of Warcraft, German guy. And he got the game, he got the Hellgate London beta and he thought it was awesome. So he wrote a clientless bot. He reversed engineered the entire protocol, everything, their key shake or their handshake, all the encryption. He had it ready for game at launch time and then, thousands of hours. Yeah, he's like, man, this is going to be the next while. This is going to be the next while, yeah.  Yeah, that was a lot of wasted time. Then there's things like exploits there.   Asset hacks aren't really worth it for the most part. You know, you can do some like pathfinding if you can reverse engineer the, you know, map formats and other assets. But pathfinding is super hard unless you're going to do something like use recast navigation, which is easy mode for solving a really, really tough problem. So this is where we separate the haves from the have nots. People might not be able to follow. Hopefully they can follow. So the skill set that you need, you're probably going to want to at least know x86 assembly. If you don't know that, then you've got a lot to learn. That's going to be a pretty big steep road ahead for you. This stuff isn't really necessary. You can write some like lane pixel reading things. I think somebody presented that a couple of years ago here. It was pretty well attended and I wanted to punch the dudes because it wasn't very cool. Noobs need not apply. So anybody know this guy? His name is Rich Thurman. He was, I think, one of the first guys who actually came public as a gold farmer. This picture is from an IEEE article that they wrote about him. Around 2000, 2001, he made over $100,000. That's what he admits. I think he made a little bit more than that. Just doing some hacks for Ultima Online. Basically his tips were play with memory editing, key data structures, and profit. I guess it's up to you. You forgot the question marks in there, yeah. Memory searching is an arcane art, but it's a skill that you definitely need. If you cannot master memory searching for finding things like hit points, etc., it's going to be really difficult to do some static analysis and find these things. I mentioned some games here. I'm sure everybody is familiar with World of Warcraft. Anybody not? Okay, I think everybody is. They're one of the first games to actually use a commodity script engine. Most games make the mistake of rolling their own, but they chose Lua. One of the side effects of Lua is you have this string embedded in your binary that tells you the name of the function. If you ever are reverse engineering code and you want to know, hey, how do I cast a spell in World of Warcraft? I then look for the string like cast spell and it will pretty much instantly take you to where the code is a cast spell. So I'm going to go through a... I was going to add one more thing on the Lua thing. That makes reverse engineering the game incredibly easy. What you can do is you can create a Lua script to do what you want as a test harness to show the spell ID that a unit is casting. Make sure it works. And then you can just load up the game, drop your break point right where the Lua is, hit your test code, step right through it, and just right there on a platter. Yeah, script engines can make things definitely easy mode, reverse engineering. There's really no technical challenge there. So brief history. I'm going to go through some of these things pretty quick. So Ultima Online was probably the first major MMO. I think they had around 225,000 users at peak, which is I guess pretty chump change compared to World of Warcraft and I guess even some of the Facebook apps that have like 30 million people. Anybody play like Farmville? No, okay. I don't believe you guys. So Ultima Online, like hackers had a heyday. I mean dupes, cheats, people, you know, see invisible people, walk through walls, etc. World of Warcraft I think definitely deserves a mention here as you know it was the first like super big one that had millions of people. It's not so big compared to some other ones anymore but it's still pretty big. Chinese games are massive compared to, wow, if anybody knows. Yeah, I got news, no Chinese, you're good to go. Yeah, yeah. So the thing about Blizzard though is they do more than send just seasoned assists, might can attest to that. Most other places just sent seasoned assists. Right, right, actually Blizzard doesn't, well sometimes they don't send a C and D at all. They just show up. Like, your lawyer, here's a draft complaint, sign this paper and cut off your thumb or file in this. That's how they work. But World of Warcraft is a big game. There's so much money there that even if you're only getting 1% market penetration it's worth the risk because it is a risk. But if you're going to take a risk it's got to be for a big enough game where you have some kind of profit base. I'd like to add sometimes Blizzard will show up on your doorstep and if you don't happen to have a brother who's in a Polish mafia to chase them out with a baseball bat then you're going to end up like Mike. That really happened by the way. It did really happen, yes. So, also a little bit. Mike, even if your game is really small you can still make a couple grand a month which for a lot of people is worth it especially Eastern Europe, South America a couple grand a month is still living like a king. Oh, yeah, absolutely. If you just get into it to make, you know, a thousand bucks a month, that's where I started and I thought, hey, this is a mortgage. Yeah, definitely. Car payment. Depends on the car. I mentioned Eve Darkfall so Eve was I think the first game to, sorry about the slides, the first game to actually use a commodity a script engine, I think they were out before World of Warcraft. You know, the decompiled source of Eve was released. I mentioned Darkfall because it's pretty massive half a million lines of code. Aegiconan, I think it was a big flop. I think a lot of people were excited about it but the interesting thing here is they left a lot of debug strings. So I wrote a script with search IDF for something like class name, colon, colon, method name and then I would have my IDF script rename all of the functions in my IDP with, you know, the string so that made it also pretty easy mode. Then you have something like Ion who tries to step up, you know, the barrier to entry for game hacking but they failed pretty miserably. So Game Guard is actually a pretty formidable foe, so is Tamida. But if you don't use any of the advanced features of either of these things and it's actually still pretty easy to bypass them with Ion you could, you know, just patch out a call and make it return one and then you defeated their patch guard. Or not their patch guard, their Game Guard, sorry. So this is some, you know, brief overview of like the types of hacks or exploits that have been in games that have been released.  And I guess that's why they've canceled like three more MMOs. They're probably afraid. So it's like super powers, speed hacks have been around in every game imaginable. They're, you know, still available if you know how to do them in World of Warcraft for example for anybody who's interested. I'll be in the QA room. 2D games like UO or Ultima Online have solved this but 3D games, it's really CPU intensive to track the movement of like 20,000, 30,000 people. So they still really haven't done that great of a job. Yeah, they just trust the client. We all know how smart that is. Yeah, we should anyways. If anybody here trusts the client then you probably leave. So dupes are like what the Federal Reserve does when they go to the Treasury. They're like, hey, can you print me a million billion dollars? I promise we'll have the American people pay it back. But yeah, that's really how you get rich. I've got a friend who did some hacks and was making, you know, close to a million a month. He at one point had two Lambos, twin turbo Gallardo and a Marcellargo. And now he's stuck with just a lime green Gallardo. I mean I feel sorry for him. One thing on dupes before you go is this is a good display of just some of the tinkering. Like figuring out how to duplicate an object is very much a non-technical thing. It really comes down to finding like an edge condition that the game developers didn't think of. That's how historic they've all been done.  It's somebody doing something weird. Like, you know, maybe you're in World of Warcraft and you're crafting an item and while you're casting the craft, you trade one of the ingredients and another player summons you.  But the point is that this is really just tinkering, which all you guys know how to do whether you're, you know, pro-reversers or not. It's really just tinkering and thinking outside the box. When you see the game, you see it zone or you see a pause and you think, well, what if I'm in the other order to find, but it really just does come down to tinkering. I'd like to add this isn't like real world security research where you find like some bug in like Adobe and then you spend three weeks figuring out how to exploit it and bypass ASLR in depth. This isn't like that. This is, hmm, I wonder if they check, you know, whether or not I can substitute an ID with, you know, some other random thing or whether I can tell them that I just bought a million, billion things for free.  So I'm going to talk about some, I guess, more detailed methods of hacking. So like what you would try to do to say write a teleport, et cetera. I'll go over these things in the next few slides. So basically for a teleport hack, you look for the player's position in memory and then you use your memory editor and change that value. And if you're lucky, then you teleport. It's really complex. Yeah, not really. Or you get banned here. Or you get banned or disconnected, yeah. That's in an old game when they've realized that, oh hey, wait, people are going to do that. It's actually really surprising at how naive a lot of game developers are. They generally don't have any clue about a game that's hard to hack. So you can go into more difficult ways. If your game is more mature, like World of Warcraft, that's had to deal with this stuff for, I guess, seven years and they still haven't done it correctly, then you have to modify movement packets and forge the timing, stuff like that. Yeah, the timestamp. It gets more complex, but it's still doable. Speed hacks. Again, you can get these off the shelf that will work with every game. And if you're lucky, then it still works with your game. And I don't know what squeezing network code means. I didn't write that. That's mine. Well, that's actually just what I was talking about with lag hacks. And this still works in World of Warcraft. This works in every game today. Where you can literally unplug your Ethernet cable, move around in the game a little bit. And if you plug it back in before the network decides the TCP connection is dead, then the game client will simply tell the server, oh, here's where I am. It's dealing with their congestion code. They have to accept some latency. So in a lot of situations, you can pull out your Ethernet cable, walk past a monster, and all the logic to have the monster hit you is on the server side. Of course, the server doesn't see you near the monster. Then you plug your Ethernet cable back in. Good to go. You pass the monster without triggering anything. Don't try it on wireless, because when you disable it, it will actually close the TCP connection. But if you can physically interrupt it just by pulling the cable, it actually works. It's ghetto, but it works great. That's pretty high-tech dog. Seriously. Dude, that's kind of lame. I think you're going to mention this, but that was used to get a lot of chests in various dungeons. In World of Warcraft are the five-man dungeons, and you could kind of eek your way along deep into a dungeon just by lag hacking past the monsters to get to a chest. You can just loot the chest and exit instance and money.  That's why there are no more chests and instances anymore. Yeah. Yeah. I know who's responsible for that. So dupes. Anybody don't know what a dup is? Basically, you duplicate something and you get a million billion of it or something like that. Basically, this is the key to making a lot of money, and this is how my poor friend with the Lamborghinis, this is how he got them. And it took the game that he was targeting almost a year before they figured out how to deal with this stuff. They're like, hmm, I think we have a problem in that gold is really available to everybody now. Nobody has to work for it. I wonder what happened. Yeah. Like I said, these game developers are pretty naive. They're like, wow, these guys are good at playing my game. So, a lot of games have multiple servers and things like that. So, you just try to do things back and forth and hope that if you do it fast enough, maybe sometimes the server will lose track of your items and they magically start filling up in your backpack or in a game where if you can die and your items go on your corpse, you have your friend go loot your corpse before his character is saved and then magically when you guys both log in and server up, you each have your items. These are pretty basic. Like we said, tinkering. Sometimes there's no skill involved or maybe just really a lot of creativity. You don't necessarily have to be a god reverse engineer, but it definitely helps. Integer overflow and underflow things are also really awesome. You can get from like zero to unsigned int max pretty easily. That's a pretty big number. Yeah, and that just comes down to tinkering too, where you might take your armor on and off and notice that one of your stats isn't going back the way it should. And these things happened in World of Warcraft. We'd have a guy sitting in Orgrimmar taking his helmet on and off 100 times and then all of a sudden he's got 2 to the 32nd minus 1 strength and he really did happen. Or maybe he just used like a memory editor and took a screenshot and tried to sell his account, but yeah. My favorite is like GM mode. The company will ship their game out with the ability to reverse engineer and flip a bit and now you're like a GM. You can teleport to people. You can kill things. You got like the commands and whatnot. It's pretty interesting. Or like stealing from NPCs. Age of Conan was one that was really rife with vulnerabilities.  I don't think they were very happy. Yeah, yeah, yeah. Well that was the source player ID thing, right? Yeah, yeah, you just, you know, tell the game that, yeah, I'm this GM and I just died. Right, yeah, like each packet coming up with all this item and your player ID was in there like kind of like a source address and somehow the game server would believe you if you said you were someone else. You're like no, I'm so and so and I'm selling this. Okay. Yeah, and that's just basic tinkering. Yeah, did I say that game developers are naive? I mean they work hard, but so UI hacks are pretty much worthless unless you want to zoom out really far. That's pretty much what you're going to get from UI hacks. You can get like ghost mode where you can fly around the world and you stay still, but it's not very beneficial. Well, yeah, you can also do the wild language translation because they had the thing where alliance players couldn't understand what the board players were saying, so that was all client side, so the actual text from the opposing player was sent to the client, it would just choose not to display it. So it's actually a pretty easy hack to see it, but it's not really marketable. I don't know who's going to pay for that. Yeah, good luck selling that, but it's not very powerful. Wow, you can talk to humans if you're an orc. I'm in your base killing your mans. It's dudes. Dudes? No, it's mans. It's mans. I'll look it up later. I don't believe you. I don't believe you. I really don't care. So I guess I'm going to tell you exactly how to write a teleport hack. Okay, I didn't hear you. Whoever that was. So the easy way to do a teleport hack is you're going to have to find the player position in memory. Use write process memory to overwrite that, and then you'll teleport. I pretty much said that again, so it's kind of repeat. You can also, if you know in the code where it's responsible for updating your player's location, you can call out directly with some functions. Is there teleport spell?  That's basic tinkering. It's not going to work today, but that kind of stuff is out there, and poking and prodding at it is actually pretty fun to find. Yes, it definitely worked in some games. The hard way is when you actually have to get down to forging movement packets, and this takes, you have to do some math and figure out how they're sending the updates. You have to reverse engineer the structures for their movement packets, and maybe adjust the time stamp and so that you can teleport or run faster. Logic attack, this is what we were talking about in Agent Conan. You could give fall damage to anything in the game, and that's how you killed a GM.  That was funny. So this could also be used maliciously in Agent Conan in that you could force somebody else to trade with you and they wouldn't really know that they just traded with you. But you could also force an NPC to trade with you, so it was still useful and not mean. So I don't feel bad stealing from computer characters. I don't think any of you guys should either. They're just digital tears there. They're fine. They're okay. All right, so item dupes, basically exploit, I talked about this earlier. I'll say that server lane issues, Agent Conan had some zoning, EverQuest had zoning, Final Fantasy 11 had zoning, Ultima Online just had these server lines where if you cast a spell on one side and cross the server line and you were fighting somebody, then you were fucked. Repetition attacks, I talked about you just basically move things back and forth from say a trade window to your backpack a thousand times a second. I mean, most people should do that right by hand. Yeah, and the server eventually loses track of stuff and they start filling up in your backpack.  Asset hacking I mentioned is definitely not worth it unless somebody else has published their work for you and you can borrow it. But yeah, so basically what you do here, maybe some people have played World of Warcraft and somebody has magically appeared on your side what's that called? Battleground. I never actually played World of Warcraft. Yeah, too boring. I'd much rather bought it. Yeah, I should have bought Glider. But yeah, so those people either use teleports to go from one side of the Battleground to the enemies base and he's in your base killing your mans. Pretty confident it's mans. I'm never wrong. Or maybe he used Noggett and modified the map to have this tunnel so that he could run underground and nobody would know or see him. Maybe you could see his little name on the screen or dot on the screen as he's running there and you're like, wow, where is he? Yeah. But otherwise it's not worth it. They're really complex. Gamehacking 4.20. Real profit is definitely dangerous, a quote from Machiavelli. You can get sued. I think... So you can have a ghetto bot. I think somebody talked about one a couple years ago. I wanted to punch him. It wasn't very interesting. Basically you do pixel reading. There's something with, like, auto it. And there's really no RE reverse engineering required. You just, like, read that your hit points are red when they're full and they're not red when you're dying and you make it send some keystrokes. It's very limited scope but most likely you're not going to get detected and detection is something that is not your friend. Actually, real quick, just by show of hands, does anybody know why detection is so bad? I mean, you all understand this, right? I don't want to gloss over client-side detection. Everybody appears very wise in regards to detection. We don't really care about what you say. We can't really hear you. I'll go over just real quick. Obviously the game manufacturers don't like everything we're talking about, hence the lawsuits. So what they do is they try to detect your software in the game and if they do, then they ban you.   So avoiding detection is really important. We're going to get into that a lot more later, but client-side detection of your software is very important. Also, I'll say does anybody ever wonder why, you know, it takes like three months for a band wave to happen? That's because when you ban like 50,000 accounts every week then those people who are re-buying those 50,000 accounts never actually re-buy them again because it gets expensive.  That's true. So we got some code injection.   I mean you can really easily detect that and then you have something like DLL injection where you've got some pretty big blob of code written in a high-level language, like C or C++ and it's really easy to detect that and so you get into this game where now you write this, you know, DLL loader that fixes all your imports and stuff like that and it gets really complex and you're still pretty easy to detect. Or you can go to the network or packet level and do some really good work like reverse engineering the network protocol which is very time consuming. I think there are very few games or maybe there's a lot of games that have complete, you know, analysis on this. But it's still not easy to do. Or you can go write your custom client if you think that you're really good. Not many people think that they're that good. It takes a lot of time. He thinks he's that good. Oh, the guy leaving? No, no, no, no. Oh, damn. I didn't think I was that boring. Sorry, guys. But if you write a custom client if you're at that level then you're probably going to make a lot of money. Like the guys that destroyed me I think we're probably making at least a couple hundred grand a month. And writing a custom client isn't something you're going to sell. This is, you know, gold farming, real money. So you're writing a custom client so that you can have your partner run 10 million instances of the game on a server farm. If you don't have a custom client, that's way too much 3D rendering. But if you can just take the game out of the equation, I just don't render anything. So it's all a matter of scale for gold farming at this point. You go from like two or three clients per computer to two or 300. So it's pretty big scaling. And stuff, this stuff gets difficult sometimes. I can't emphasize enough that it's very important to not be detected as in you lose. Alright, yeah. What I want to talk about on this is not so much the technical aspects of detection but how you approach this strategically. This isn't in the book on MMO hacking. I think there's a book. Yeah, one of my friends wrote it. Yeah, I think it was written by the guy that was eliminated by the first. Something like that. So this isn't in the book, but strategically what you're looking at is you have two main things to worry about with your software. You have the attack surface, which is how hard your software is to detect. And that's going to work in a couple of ways because it also is going to make detection code bigger. Secondarily, you have what I'm just calling intelligence which is how much of what they're doing that you know. You don't know what they're doing. If you don't know how any of it works, how are you going to keep from being detected? And they work together such that if your attack surface is very big it's going to be really hard to tell what they're doing because the effort that they have to take is so minimal. If they can write one line of code to detect your bot, you know, you're never going to find it when they do. I don't show that code yet. Alright. Sorry. The other, the only other thing with attack service is that of course that's a constraint on your features. So when you think of something really cool like I'm going to have my bot, you know, react within 2 milliseconds every time a monster does something you might be setting yourself up for some detection. So that's a decision you have to make when you're choosing your features and handling what your customers are asking for is, you know, do I want to risk increasing my attack surface by adding this? Not yet. The next slide, I want to talk about something that happened with me and another software developer with World of Warcraft. This guy, we'll call him, we'll call the software interspace because that's what it was. It worked by injecting a DLL into the game which is pretty big but the guy that wrote it is a very competent reverse engineer so he had taken all of Blizzard's detection code in Warden and he had it wired up as soon as they sent it down to 15 million break points and it was pretty neat stuff but he still had a DLL in memory which he tried to obfuscate and more importantly he had to patch one of Blizzard's functions so he'd go to the beginning of the function and just stick a far jump in there and he's like, well I got Warden covered so they're not going to find it. Are you ready for the code yet? Okay, I'm ready for the code. Can you zoom on just like the top function? I'm trying.  No, no. Thanks, Josh. Wow, dude. Look, we all have that fixation, right? I think some of us do. Alright, so this is an example. This is a piece of code that would be inside the game. This is not actually from World of Warcraft because... He's being sued by Blizzard. Right, I don't think it would be a good idea to post that and I would just be posting a dead listing from IDA and that's not fun to look at. There's a piece of code here that the game uses to request, say, your buddy's list. And as you can see, it has a parameter, optional parameter we never used before and it takes like a packet number, you know, the command number, B-O-O-B, hey, what are you going to do? Sticks that optional parameter in there, sends it up to the server. Pretty simple stuff. So the way that code used to get called, scroll it down a little bit to the two-line comment, as you can see where it says old code, ask for buddy's list, just passing zero for the optional parameter we never used before. So one day Blizzard says, you know what, we're going to get this guy, we're going to find his patch function and they changed that call to the little sample code there. This is again slightly paraphrased. They load up a register and then do some math on it so that IDA won't see another reference to that function. Reach into the function that's being patched, pull the first byte of their own code and send that as the optional parameter we never used before. So what this is doing is just sending out one byte of their own code every time they make that request. And of course on the server side, they just comb through it, find the E9, gone. What's interesting is in the software here, you don't see anything like if this guy is a bot, you can grab this byte and send it up. And it's a tiny piece of code and it doesn't even change the underlying network code. There's no new parameters, no new nothing else. The only way you would find this is if you were somehow watching that data going out and say, well, it used to always be zero. Now it's E9, that can't be good. That's a far jump. So when they did this, he lost all his customers. They waited a few weeks, because Lex hated me, but I'm pretty confident he lost a pretty hefty chunk of change. Yeah, I don't know how he did business, but hopefully he did okay. But they did this, they just hammered him again and again with this. And I found this way after the fact. And as far as I can tell, he never found it. But it's a good explanation of how much your attack surface matters. I mean patching one function turned into this. All right, now I'm ready for the next slide. The point is that if you think you know where all the detection code is, there's always a chance it's not where you think it is. In the case of Blizzard, they had never put detection code outside of Warden.  So it's incredibly important, A, to stay hard to detect, because if they had to make a new call, maybe he's running a private API monitor, not that I ever did that, and he would see a new kernel call. But because they can just get him with one move, poof. So it's really important to stay small, and it's really important to keep an eye on what they're doing. Building tools to monitor their systems, building tools to monitor what the data stream is supposed to look like, and then if it smells funny, maybe you have a problem. With Glider, we actually had tools that would page us. And that, you know, it didn't look good. It would actually page me. So, you know, Warden's supposed to have eight entry points. Oh, now it's got nine in the V-table. It would page me and I'd run down to the office and freak out. When he's wasted. Right. Well, I can always just turn off Glider. I'm too drunk to fix it. Glider's off for a while. So there's always a way out. But it does come down to you can't do that. I think we've both had a couple of, like, all-nighters, 36-hour shifts trying to find out what they're doing. Oh, yeah, there's the Rickroll too, but I'll say that. Oh, yeah, definitely. You got to tell them about the Rickroll. Yeah, you can do it now. All right. We won't try not to bore you guys too much. At one point, Blizzard updated Warden and they added a new scan. And the way the scan worked is it would take an encrypted string inside Warden, and it would decrypt the string, and then it would call getPROC address, kernel 32. If I'm losing you, don't worry, it gets funny. And they would take whatever that string was, and if it resolved to a function, you know, the getPROC adder liked, they would just call it with no parameters. So I was looking at this code, and, you know, the game is down for a patch, so I can't see, I don't have the key to see what it's going to decrypt to. And I'm looking at it, and I'm like, well, what are they going to do? What are the parameters? What's the point? And of course, if the getPROC adder fails, then it just does nothing. So I sat there looking at it for hours, and I was talking to the Hellgate London smart guy, and we couldn't figure it out, and so I'm like, well, let's just bring it up. So, you know, we bring it up, stick some break points in, and they send the key down right away. I'm like, oh, here's the key. Let's see what the string is. So you see it, you know, it decrypts it, and it's a URL. All right, so they pass the YouTube URL to getPROC adder. Proc adder says no, and nothing happens. So of course, I'm like, I got it, no.  Like, they Rickrolled me, and I don't know how many people they got, not many. We're at five? Yeah, bro, I think you got worked up pretty well. We're almost done. Anyway, that was epic, you know, and it was really well done. So that's all I got to say. That is the most epic Rickroll ever. Yeah, I think so. Oh yeah, we are pretty much done, aren't we? I don't know if we're going to make it through in five minutes, though, but we'll try. So I'll go quick. So there are some client-side things that can be pretty powerful. They can use packers like Thamina obfusc... I won't say that word. Obfuscation. Thank you very much. Oh dudes. Yeah, the biggest thing that you have to worry about if you're really, you know, professional in this is server-side data mining. Some analyst at Blizzard gave us a really big bone and was like, hey man, this is how I detect people. I just write some SQL queries and I walk in the next morning and I ban people. And we're like, well, thanks for telling us that. I mean, now we can modify our stuff, but I don't think he realized that I think he was just trying to be cool. So you have things like that are both client and server-side and basically what these things are like command and control things that botnets use. You send your game client, in this case, 10 million World Warcraft customers, this blob of code that they're going to execute and trust on their machine. Oh yeah, this is like a botnet and malware to detect a bot. Yeah, it's pretty funny. A little irony there. Yes. So, punkbuster... I won't go through... Well, I'll go through this story. So, punkbuster basically looked for strings to ban people. I mean, they could be strings or they could just be some binary data. A lot of the times they would be strings like a window name. And this group discovered that.   And then I'm going to go back in game and watch them all get banned for cheating. That worked, yeah. Of course, punkbuster was like, no, no, that's not how it works, but it really worked that way. Yeah. Yeah, I just skipped to the D3. Well, this is where you get into money. If you're not an expert by now, I hope you guys are all experts. Then... Yeah, we're going to skip this a little bit. We've got two minutes, I think. Yeah, there's one thing that came under development before. Oh, yeah. Yeah, this one. This was released last week. This is Diablo 3. This is the Diablo 3 auction house. How many of you guys have seen this news about the RMT?  There it is. That's a dollar sign. That's a dollar sign. That's Blizzard endorsing you selling items for money. So you can wire up like a third party payment system to your Blizzard battle net account.  Or you can buy gold, you can sell gold. You're not going to have to compete with me because I'm done with Blizzard, but this is very interesting. Yes, very interesting. So we'd like to thank all of our friends in Poland, Germany, New Zealand, and Australia. They couldn't be here. It's really expensive for them to all fly. They'd probably get arrested anyway. Yeah. So we've got, I guess, time for some questions, maybe? No. All right. Well, we're going to be in the Q&A. Hey, thanks for coming out, man. Welcome to DEF CON.


Hello, good evening everyone. Once again, my name is Ali Hmedi, a consultant working with Tickmill on their webinar series for futures, the way futures are used, and the variety of sectors that they're involved in. And tonight's topic is an interesting one to me, specifically where our getting out of let's say the mainstream of, you know, your gold, your metals, oil, and so forth. And we're going to be getting into the agricultural sexual sector specifically with wheat, and we will get started into the series now. Now, for those of you that have been following and joining along. As you all know, I like to keep things informal and in a conversational dialogue and format and try to relay and dissect information in that way. Once again, we'll be discussing the wheat futures and the particular outlook and forecast provided from several various institutions and financial firms. Now, once again, I find this topic, or this specific, this specific commodity very interesting, specifically because of the time where we are right now currently with the market, and the geopolitical tension with everything taking place in that aspect, as well as what's taking place with inflation and the rise and costs, dealing with all commodities in general but specifically this one because it does affect the population globally. Since it is something that we consume as an edible and as needed on a daily basis from a food perspective. This is taken from earlier today. Let me make this a little larger so that we can see this is the June of 2022 futures contract. Where we stand right now it was priced at the time of this particular slide at 846 spot zero. You can see the trend from May, we had a bit of a spike, and then since then it's been going downhill. This is a snapshot basically of where we stand as it was traded today. Now if we look out into this particular, these two slides in comparison. These are the July 2022 and December 2022 so the current month that we're in the contract and year ends contract and if you look at the graph and the chart themselves. You can see a lot of similarity with what they're projecting the July 22 contract is priced in at make it a little bigger. There you go at 831 spot two, and the December contract is priced in at this little bigger for you. Let me show you this conversation points before we get into what the forecast and different organizations have to say, but the December contract is priced in at a 62 spot 40. And one year from now, we're looking at this is the July 2023 contract so 12 months out it's priced in currently at 875 spot zero. We're looking at what's taking place in the market right now we're having another bloody day yesterday was a holiday in the United States, the fourth of July was celebrated. So the markets were closed in the US, but today's opening is very bloody. Everything seems to be down gold oil, and all the major indices are down as we're speaking right now. So it's continuing to provide this stress and pressure on on the downside across all sectors. Now what we're going to do is get into before we come back to these graphs and charts is we're going to get into different organizations and firms with their specific outlook for wheat specifically. This one is coming from bill from trading economics calm. The Chicago wheat futures fell to 8.3 dollars $8 and 30 cents per bushel remember getting back to in our previous webinars when we're introducing how futures are priced. So wheat is each contract is worth 5000 bushels, etc, etc, depending on if it's a large or a mini. You also have to take a look at the chart and it's tick value, but according to what Chicago wheat futures it fell to $8 and 30 cents per bushel mark extending from 5 to levels not seen since Russia's invasion of Ukraine as fresh us da this United States Department of Agriculture, planting data pointed to green acreage and stock levels that were above market expectations. It's added to projections of higher supplies as North American farms are ahead of schedule into harvesting season at the same time, a strong crop from Russia the world's top exporter point into a record amount of wheat available for shipment Ukrainian grain exports for the first 22 days of June, or 44% since shipments were halted back in February of this year. Now the biggest wheat exporters globally are China, India, Russia, United States, Canada, France, Ukraine, Australia and Argentina. Now Ukraine and Russia, they both account for nearly 30% of the global wheat exports combined before the Russian invasion of Ukraine. Now wheat is expected to trade at 854 spot 71 by the end of this quarter and looking forward we estimated to trade at 942 spot 73 and 12 months time. So, we at this quarter now we're looking at July, August and September. Okay, they're looking at an 854 price target as their forecast and 12 months from now they're looking at 942 price target. Well, if we look at the target or the actual where the futures are trading for July 2023. We're currently trading at 875. So, if we were to take solely only this specific piece of data and research and say okay well, this could be a bargain. Let's buy now we expect it to go up, you know, a significant clip, and we can make a nice profit barring that this is accurate. We all know and as I've mentioned in previous webinars that we have to access and look across the broad spectrum of all what the market, the data, the research and the analysts have to say, and we have to come to our own conclusions. Capital comms website. As a result of the war in Ukraine, the sowing area was reduced this year. Sowing area was reduced this year and the harvest is expected to plunge in 2022. Now this is specifically related to Ukraine and its wheat market. There are some reasons with them being involved in conflict with Russia. They're not able to operate on all cylinders as they would like to be doing specifically when it comes to one of their major exports, which is wheat. But due to what's happening with Russia at the moment, they're not going to be able to produce as much wheat as they would like to, which will have an impact on the global wheat supply because they are one of the major exporters and producers of the commodity, but we have to keep it in context, as we'll see in further slides. So the Dutch bank, Rubble Bank, as a result of tight supply, their forecast and analysts and outlook for the commodity is not as bullish compared to their previous forecast. This obviously has a lot to do with what could happen with Russia, with them being a top exporter of wheat, how deep and how far will the sanctions run against Russia itself. Ukraine itself not being able to produce as much as it would like, what kind of impact will that have on the market as well. But there are other major, let's say, providers of wheat, as mentioned, globally from India to China, Australia, to the United States and Argentina. So we'll see if those exporters and producers will be able to fill the gap, so to speak, for the shortfall that Ukraine will end up having and what ramifications will end up having with the geopolitical sanctions and to what extent will they play out on Russia's wheat exportation for the coming months of this year and in 2023. Moving onwards, this is coming out of SAS wheat, which is the Development Commission out of Canada. Wheat futures plummeted on a combination of risk offselling, a rapidly progressing US harvest and improved conditions in Canada and questions about the demand outlook. World wheat futures fell to their lowest weekly close since the first week of the Ukrainian war. They note that new crop wheat fell more sharply than corn, you know, we're staying within the agricultural domain here, and it remains overpriced to corn. The big question currently is high inflation strikes, huge government debt, threats of stagflation, and I'll get to stagflation here in a minute, and energy gouging have caused consumption come back cutbacks to previous demand projections for the grain and oil seeds, which are overstated. Now stagflation, very simply is, it gets to a point where, if we just take the US economy, for instance, where they are currently raising their interest rates to combat inflation. But at point, you know, stagflation, it is a possibility at some point in time where the Federal Reserve will say, you know what, we are not willing to go back to the Volcker days and hike so aggressively to get it to where it's in the team percentages of interest rates to really fight head on inflation, and they might just throw in the towel and say, you know what, we started combating inflation a bit late, we're behind the eight ball here. We're still going to raise interest rates to a certain extent or to a maximum limit per se, and then inflation is going to do what it's going to do, and then it's just going to get stagnant, where inflation is at, you know, a specific range higher than where it's wanted to be, and interest rates will cease to increase to combat that due to economical pressures, political pressures, etc. And then you get that stagflation, that's what they're referring to, and stagflation. But if you look in the first paragraph here, you know, US harvest is on par, they're ahead of schedule, they have things moving on all cylinders. But the sell-off has been clumped in, so to speak, with the overall market sell-off. The market decline, the S&P down today, 57 points, it's down over 20% year date, and forecasted or projected to continue its downward pressure or sell-off throughout the remainder of this year. Now, Q1 2023 and Q2 2023 will be very, very important, will be a very important timeframe to take into consideration regarding what the Fed will do, the Federal Reserve out of the US. Are they going to continue to fight inflation head-on, or are they going to throw in the towel and start focusing on political reasons, because 2024 is an election year, and try to make the economy, help the economy back up again, which right now, in my opinion, as again, this is not investment advice, this is my opinion, is very dangerous. We are in a very volatile and on thin ice regarding the overall market outlook, regarding how much money has been printed from the Federal Reserve, how much debt is out there. Geopolitical tension is at an all-time, I shouldn't say at an all-time high, but it is at a very high level since the 70s, and the overall market sentiment from the ability from the US being the wealthiest nation on Earth, savings levels by households have decreased. Credit card debt is increasing, the US debt is increasing, Jerome Powell, the Fed Reserve chairman himself earlier this year was very concerned at the national debt being at plus or minus 25 trillion, and since then, we're above 30 trillion and counting. So, it's a very, very difficult and volatile market to be very wary. That doesn't mean that you shouldn't be involved, but if you are involved and or are going to be involved in the market, specifically with futures, they can be advantageous in these types of market conditions because with volatility it's an opportunity. This is coming out of Reuters. Relative to estimated global demand, wheat supplies for the upcoming cycle are seen dangerously close to all-time lows and notably below this year's reduced levels. When excluding China, world wheat stocks to use for 2022 and 2023 falls to the 14.9% level this year, and it would be the fourth lowest ever. The record of 14.3% was set back in 0708, and the average from the mid to the last decade was at 19%. What they're saying here now is that the supply or the upcoming supply is decreasing and they're excluding China, we'll get to that in later slides, is down, and for the last decade or so it's been at 19%. And now it's at roughly 15%. So it's down and this could keep white wheat prices elevated into 2023. So if you have less wheat, the demand is always going to be there because of what it is. The commodity is needed globally, whether you are an exporter or importer, all nations need it. It's impacting food prices for consumers globally and ensuring continued higher costs for the importer countries. Ukraine's situation also brings great uncertainty to the wheat market as the Russian military still occupies parts of the country.  Now China is, which is often excluded from the global grain analysis due to its stockpiling habit is later to have a record 53% of the world's wheat storage by mid 2023. Now, China, they don't include them in most of their analytical data because they stockpile and they hoard and they can manipulate the data of how much wheat that they have stockpile. So there is always that gray area of how much do they have, how much have they produced, how much have they exported, etc, etc. But most of the analysis when it comes into factoring in forecast, they often exclude China out of the equation. But if you look at that staggering number of 53% of the world's wheat storage by mid 2023, you're talking over 50% of the global market need that they would be able to supply if needed. So depending on how things play out with Ukraine, Russia and the US economy, as well as the other major exporters being France, Argentina, and Australia, as well as Canada, so this is something to take into consideration. This is from the United States Department of Agriculture, otherwise known as the USDA, the US wheat production is forecast at 1.737 billion bushels, which is up 8 million bushels from the May forecast and 6% higher than the previous year. On Thursday, July 1, this is just this last Thursday, just a few days ago, the USDA pegged the world wheat ending stocks for the 2022 and 23 marketing year at 267 million tons, a six year low well below analyst estimates of 272 million tons. This is a note to take into consideration. Almost two months ago now, in its world agricultural supply and demand estimates report, they supported a bullish outlook for the 2022 and 2023 commodity with reduced supplies and higher prices. And that bit of information combined with what they just came out with last week with it being at a six year at a six year low below their forecast, well that's naturally going to cause the price to go higher, and the demand will always be there. So this is from wallet investor. Once again, they're an algorithmic based management. Other wheat production, for the most part, if you've noticed throughout when we started getting into market outlooks, specifically with gold, a few weeks back. Gold last week. Copper. They've always been bullish and they're always they're bullish here with we help their projection in 12 months time is at 970. So in the previous slide with with one of the forecast for 12 months time I think it was at 942. And if we look at, you know, the actual futures contract for July 2023 it's trading at 875. So, if you've done you if you do your research, and you are involved in this specific commodity or using it to either speculate or hedge and and you come to the bullish mindset. Well, the forecast one year out being 940 to 970. Well the futures contract here earlier today was trading at 875. So there is an opportunity there, if, if they are accurate, or even close to being accurate, getting back to wallet investors, the wallet investor, their five year forecast puts it all the way up at 1448 spot 35. So that's extremely bullish from where it's trading now I mean it's, it's almost double. And once again, depending on your own dynamics and how you're digesting and, and relaying this message that this research internally yourself. If you come to the conclusion that, you know, wheat is a good opportunity now because of the sell off and enhance sell off due to the markets being sold off, and it's being plumped in based on US data there in good shape. China stockpiling, Canada's report, somewhat positive from a from a harvesting perspective. But then you have the unknown coming from two of the top five exporters being Ukraine and Russia, which those will remain as an unknown variable. And it will be released today and for the foreseeable short term future until that conflict is resolved nobody knows how long that will continue to play out. But this is a very. So, market, getting into bear territory recessionary territory bear market territory, high inflation. And then they're known coming out of China. It's very difficult for analysts in general to come out with a longer term or mid range term 2025 is two and a half years to three years out. They'll be reluctant to provide any type of forecast or expectation that far out. Moving on, the key takeaways from the market overview in general as I said this is a very interesting topic to me. Due to everything that's taken place in the market, and as we've seen from various analysts, the wheat market seems to range from being well supplied in 2022 to dangerous lows heading into 2023. And then coupled with the market sell off and the supply chain disruptions there's a lot of selling pressure at the moment, which we've already discussed. Even though a rise in demand is present and needed mainly from importers, the supplies available, including China stockpile. The geopolitical choir mile will be difficult to sort out in the short to midterm future. So, there are a lot of moving parts that nobody really has an answer to, and if anyone comes out and says, No, this is 100% accurate this is what's going to happen. I'm very wary of these type of analysts because there are too many moving parts, and it's above a lot of people's pay grade and knowledge grade sensitivity to geopolitical information, etc, etc. And then what do we have to do we've got to do our research. This is a good opportunity in my opinion, with the current market sentiment where the market is, and what wheat actually is, and what it, what it, provides what you know because it's needed. It is a commodity that most, if not all of the world is an importer you have several major G seven to G 20 countries as exporters that that provide the globe itself with wheat. And it is a necessity when it comes to to consumption when it comes to food consumption. And so the demand will always be there. It's just a matter of finding the right time using chart analysis on historical data, looking at the current sell off if you go back and look at the charts that I pulled up on, where June's future contracts were traded, where July and December contracts were traded, and when you're out, you know, it's just a very, there's a decline in all of them, and it's you've got all these red candles going down. But how far down will they go. That's not known. We understand the dynamics of the necessity of the commodity itself. This is a perfect opportunity to hedge, take a position, and, and most likely, hopefully profit from in the future, but being wary of what happens if you know the geopolitical relationship between Russia and Ukraine results overnight. Well, Ukraine goes back to being a top five exporter Russia, depending on if they're under sanctions or not, goes back to being a top five exporter. In the market, we'll see enough or even more supply to handle the demand that's needed from importers, which could further put selling pressure on the commodity itself, it's already seeing selling pressure in the in the recent months. But if things stay heated in the market with the downside pressure, we could easily see the higher costs come into play, and the demand for wheat will always be there as mentioned, and it could drive these prices back up very quickly. That's why I like to end with a quote from famous investors, you get recessions, you have stock market declines. If you don't understand that's going to happen. Then you're not ready, you won't do well in the markets. This is coming from Peter teal is a famous American investor mutual fund manager and philanthropists. I'm not sure exactly what we are right now, we are heading into a recession. We're in recessionary territory. As I mentioned in last weapon in the last webinar that recession data has a lag, and you've got to wait to quarters on GDP reports to actually see if we are in a recession or not. But if you just look at where the market is now. And you, there is a different feel this is not the COVID pandemic crash. That lasted for a couple of months, because everybody was in the pandemonium not knowing what's going on. This is different from the housing bubble because it was ice, it was isolated, even though it was a massive bubble with that. The, the, the housing crisis of eight in the United States. It was pretty much pegged into one sector, and you have a lot of fraudulent activity, the bubble expanded and when it popped, it almost created very closely to a full financial collapse without government intervention. It came into the, in the form of tarp the troubled asset relief program, where they doled out billions and billions of dollars to financial institutions so that they could stay liquidated and or stay liquid rather in order to, to stay viable. Now, what's happening now is not just one thing. It's not just one bubble. It's an all consuming type of bubble. You've got an overheated stock. You've got an overheated stock market. You've got interest rates increasing you've got inflation you've got geopolitical tension, and then you've got in 2024, a, a presidential election in the United States. So there are there are a lot of factors that are factoring in to us taking place for us just to say the market is having problems because of, for instance, the housing crash. We go back to that timeframe from 09 until now we've had nothing but a full market except for one year in 2018 and that year the market was only down 5%. So, you know, we do have to be very wary, and you have to understand that when you do have the market declines, and we're in recession territory that doesn't mean you should be out of the market. So what you need to do is if you're in the market, you need to be more astute be more aware of what you're doing within your portfolio and at the same time, understand where you can make specific position takes take specific position and make specific plays within your portfolio that could pay off very well. So I'm going to show you in your profitability column. With that being said, I'm going to open that up now to any questions if anybody has any questions. Please feel free to go ahead and send them to me via chat have any questions. Perfect with that market is down today. Nasdaq just turned a bit green. It's supposed to flat but a bit green. It's turning around a bit but for the most part, it's going to be a choppy week coming off of a holiday so it's a short trade week. Stay on top of the market. Do your research. And if you have any questions, as always, let me know until next week. Have a great week. Good luck in the markets, and we'll see you next week.


Hi guys, welcome back to my channel today's video is going to be my week 27 updates of my fitness journey I know this is going up a day late, but you will understand why when I kind of run down what I did this week I actually still have some exercises to do today But I decided to film this before I did the workout so my hair could be down and look a little bit better I will also have a video coming out on Tuesday, which is normally not an upload day for me But I'm publishing a video on Tuesday at 11 a.m So you don't want to miss that. I'm doing a collab. I almost never do collabs on YouTube So I'm really excited for this one and I'm collabing with a really good friend So I really hope you guys have your post notifications turned on because that would mean the world to me Anyway, let's just get on to what I did this week. I'm gonna do this a little bit different I'm just going to read and then I'm gonna put the time lapses with music. So I hope that's okay I know it's a little bit different, but you'll see why in just a second. So basically this week I did Pamela Reeves workout plan I stuck to the plan and I Did all the workouts that she has on like day one day two day three day four, etc So the workout plan I did was week 14. It's the 45 minute slash fat burn home workout plan I'll put the screenshot on the screen while it's going on and everything And it should be up now On the screen so you guys can see the exact one I followed, but I didn't go in the order of the days So that's why right now. I'm just gonna read to you what day I did everything So you guys can kind of know how I did it. I always did the hardest workouts first So I didn't necessarily do the six pack workout before the 20 minute full body For example on day one, I did the 20 minute first So I kind of did them out of order, but I stuck to the plan like I did all the videos each day Okay, so Saturday the 25th I did nothing because I don't like working out on Saturdays. So Sunday the 26th. I did day one Monday the 27th I did day three Tuesday I don't do anything because it is my day. I take off Wednesday the 29th. I did day four Thursday I didn't do anything. I was planning on doing a workout So I wouldn't have to work out today on this Saturday, but I just said screw it I don't want to work out on Thursday because I normally never work out on Thursday So I didn't do anything Friday the 31st I did day five and Saturday the first I did day two I'm going to do day two like right after I film this pretty much But that's what I did and let's get on to the little time lapses So you guys can just see me working out if you don't want to see me working out you can just fast forward On to some updates like this It's really organized and it just tells me have my specific days I work out and I don't necessarily work out five days a week is what I've learned I think I would just stick to what I was doing before because I liked it It was kind of more my style and like the way I like to do things So I don't know I really like this plan But I don't know if I would keep continuing on doing it is what I'm trying to get at Okay, it was your girls time of the month and I'm just gonna say I was weak I was so weak doing all the exercises this week I don't know why I chose to do following her fat burn program During my time of the month because that wasn't the smartest thing to do. I don't think But I did it but as you can see in some of the videos If you go back and look I had to stop so many times because her workouts are very like muscular based I don't know you have to use a lot of your muscle to like hold and to do certain like pulses and stuff And I just couldn't do it this week. So I felt a little defeated, but that's okay food-wise though back to the food Saturday, I don't know why I think it was Sunday night last week I was craving some Starbucks like I don't know why but I wanted Starbucks so bad So on Saturday, we did end up getting Starbucks and if you follow me on Twitter Then you would have seen that post but I got Starbucks and I also had a pizza that night We had peed as a pizza on Saturday and it was so good We get the cauliflower crust so it's a little bit more healthy, but still it was a big cheat day and I'm still on my Trisket kick. I love the garden vegetable Flavor and the garlic. I also wanted to add her butt workouts Like some of her workouts hurt other parts of my body like my back like when I do some of the butt workouts When you press up your hips and you're in that like weird pose not doing a good job explaining it But it really hurts my back especially when you only are doing like one leg It really really hurts and then also when I was doing this leg workout It hurt my neck like I don't know why I strain my neck so much like when it comes to abs and other stuff But I swear I feel like out of all my body my neck is probably the thing that's probably the most strong because it's like so tight I don't know if that's just me or not Also keep an eye out because this is my first week working out with my gym shark set I'm gonna have a review coming out on that soon. I think that's pretty much about it I just felt really like defeated and weak this week weak this week. That's funny But anyway, let's move on to the photos So this is Alex last week on the left and on the right is Alex this week. I'm a little bit more bloated down there Just because and then here is the side view of that and then here is pre-workout Alex So pre-workout Alex is on the left and then current Alex is on the right and Here is the side view of that. So I hope you guys enjoyed this video Make sure to give it a thumbs up Don't forget to subscribe to my channel and turn on the little bell icon So you know when my Tuesday video is coming out and I will see you guys in my next video. Bye


Why do, um, why do little girls squeal? What? My children, little girls. Yes. Like my daughter. Reminds me of the Oingo Boingo song, little girls. Do you know that song? No. Why do they squeal? No, she can, like, Leland and Killian, they don't squeal. They scream and they yell. She squeals. For the same reason that when they go through puberty, their voices will be lower. It's- She's a girl. It's piercing. It is. It pains the earlobes. Does she do it when you're holding her? No. Oh, that's good. It is when I'm not holding her. Well, if you were holding her, then that would be right in the earhole. Her brothers are trying to take something from her. She goes, Yep. Yes, no. It's definitely, yes, girls- Little girls squeal. Ear piercing. Hey, welcome back to our Stubborn XCub Corbin. I'm a little girl. You can follow us on Instagram, Twitter for more juicy content. Thank you very much for watching. Patreon, follow us to the account and subscribe to like button. Yeah. And today we're doing a movie review. And it's of the new 2023 film, Joram. Hello, Shahrukh. Oh, sorry. Yes, Joram. Joram. And we actually got to see this because of Indian Film Festival of Los Angeles. It comes out, it might already be out by the time you're seeing this. Waited to put the review out. Yeah, I think it just opened. Yeah. We got to put the review out closer to the time of its release. But it's a new Manoj, our Dost Manoj Bajpayee's film directed by, say that name for me please. Yes, Devashish Makija. I hope I pronounced that correctly. Also wrote and produced a part of it. He was part of the producing team as well. Yes. And this was part of the lineup of the Indian Film Festival of Los Angeles. Yes. So, since this is very new and also very probably underscreened as well. Yeah. I'm sure there's not going to be a huge amount of screens, like animal or something like that. But, so this will be primarily non-spoiler. And then if we want to get into the spoilers, we will tell you before we get there. Right. But since it's new and it's limited screens, I'm sure that's what we're going to do. Rick, your initial thoughts, non-spoiler thoughts of Joram. I sent our Dost a message. Who? Manoj. He's our Dost. After... When did we interview him? Yeah. Oh, wow. Cool. And the message I sent to him was, just watch... I do better. I said, just watch Joram. Thank you so much for consistently choosing to do such elevative and artistically superior projects. Can't wait to review this on our channel and encourage everyone to see it. A wonderful film at every level. I've been so excited to do this review so that we could start telling y'all, please go support the film. Yes. I loved it. I loved it. It was an absolutely... I really enjoyed it as well. It was a fantastic lineup for Indian Film Festival Los Angeles. As you guys know, even though it's not out yet, Berlin also. I don't know when that comes out. It was part of the Indian Film Festival Los Angeles. Yeah. And then there was a Malayalam one as well. Yeah. And another one, but I forget. But, yeah. Joram. Sorry. I shouldn't have popped a candy in my mouth. No, I better start talking. Okay. Yeah. What'd you think? I love Minoja. He makes choices that an artist makes. Obviously, he's at a point in his career where he can do whatever he wants, obviously, right? Yes. And you do... Why were you... You were joking when you said... When you were questioning... I just thought it'd be funny. Oh. If you said do... Like do... One of our do... Just do better. No, no. Before that, he's... For a split second, I thought you questioned if he was a ghost. It was a joke. Oh, okay. Stop. Yes. Stupid. But he makes choices that an artist makes. Yes. Obviously, he can do whatever he wants. Obviously, and I'm sure has and will do stuff because money. Because you gotta make money. But he's clearly at a place now where he has enough projects to work on where I don't think that's something he has to consider at all. He's at a beautiful place, I think, where he has the luxury that all actors strive for to be able to choose projects based on the fact that it stimulates you artistically. In order to be able to do these projects, you do need to be able to make money. Yeah, you need to make a living. These do not, obviously, pay. No. You know, let's say animal, or the one that most recently came out, right? No, but I would really hope that if you've asked... Well, no, it's bad for you to be in a film. You're gonna compensate him well enough. Yeah, but these are independent films that he probably just wants to do because it stimulates him artistically. For all we know, he didn't get paid to die, man. Maybe. Who knows? But yeah, that's my favorite thing. Other actors of his echelon of noirs, we've seen do big commercial stuff because obviously money, right? Sure. But obviously then he'll do other things that are... Like the one he did earlier this year, Hadi, right? Mm-hmm. That I'm sure are more artistically stimulated him.  Yeah. And he's such a phenomenal actor. Like I know Irfan is the most effortless actor around, but Manoj, man, is he right behind him? Yeah, and there's a lot we can talk about, not just for him, but I thought the story and script were fantastic. It's a human interest story that we'll talk more about in a minute and I'm especially captivated. Every frame of film that Smita També was in was, I didn't want to stop watching her. She's... Everyone in the cast is fantastic and it's not a surprise that another dose of ours. If you ever see the name Abhishek Banerjee attached to casting, the acting is going to be superlative. It just always is. And this is the same for this. It's a great story. The best thing about this for you to know going in if you haven't seen it, and I think you could expect this because this is pretty much the hallmark of a Manoj Bajpa-e film in recent years, is that what you're gonna get is just a nice page unfolding interest story that you're just gonna want to continue to pay attention to because you care about the people, you want to know what's going on and it never leaves you disinterested and I just enjoyed it from start to finish. Yeah. It pretty quickly brings a... I don't know if it's called a twist per se, but something that happens in the film and you're like... Yeah, it's unexpected. And it's very sad. It's unexpected. I would say it's not necessarily a... Maybe it is a twist, but it is. It's very realistic, it's very justified. And they automatically care for it. They automatically care. And you feel for them. You feel for them and it's interesting because one of the things I wrote down in a description of the film is that it shows you, this isn't a spoiler, but it does more than show you in this human interest story for more than one character. You're watching these characters and it does more than go into the nature versus nurture prospect of psychology of what makes a person a person. But it goes into what I wrote down is the greedy machinations that chew people up and spit them out and what happens when they are put into impossible circumstances. The kind of thing of what would I do if I was put in that circumstance? How far would I go? To the point of someone who would say, for example, I would never steal. Is there a circumstance you'd be put in where you would?  That's what I'm saying. Is there a situation where you say I would never kill somebody? Well, is there a person... I would never say that. Is there a plate you could be in? That's the kinds of things that this gets into and there's some stuff done with... There's so many I love simple profundity. And there's a lot of that in this film, especially toward the end. There's some things done with show don't tell, just some cinematic things that are shown that tell you so much about what the story is wanting to convey. It's a really intelligent, nothing but superlatives for the film. And at the end, it also leaves you with questions of what exactly and who exactly. Yes, what now, who now. And did, didn't. Right. Am I... Who was I? Yeah, exactly. You start wondering, oh, was I rooting for the right person? Yeah. And so it leaves you with questions and it doesn't spoon feed the audience. Not at all. It's so intelligent. Into what it wants. And it also doesn't give you all the answers. It lets you as the audience kind of determine for yourself what you think happened, which I enjoy the style of films. The analogy that goes into my mind about this film, so the ocean floor is littered with oysters. And I mean that in regard to the cinematic universe right now is littered right now with screens filled with things. That if you open them up and look into them, there's nothing there. This is the one that when you open it up, there's a gem inside. And I would, in my dream of dreams, I would love to see this thing just launch itself into the top spots of box office success. It's not going to get it primarily because it doesn't have the distribution, but this is the kind of film that deserves all the box office love it can get because the producers deserve to see return on investment and be told, please make more films like that. Yeah, I would caution people in terms of don't go. And I actually didn't see the trailer because obviously we had our, it's from the Indian Film Festival in Los Angeles so we didn't react to it. But the, it's not an action film. And so don't go in. Did the trailer maybe show up that way? I don't know. Yeah, it's not action. It has some action sequences. It's a drama. Yeah, but like it's a drama. I'd say 95% plus drama. Yeah, I don't know why. On IMDbPro it shows action and adventure. There's some suspense. There's some suspense. It's primarily a drama. But don't go in expecting action, please. It's not that. I would not classify it. Yeah, no. Go in expecting a great story that keeps you engaged. Fantastic as good as it gets acting. And I don't know how you can't walk away from this and not like it unless you just, you know, have your attention span is three seconds and you need to be stimulated with more than just great stories about people. I did appreciate the slow, like the director didn't seem to be in a rush. Yeah.  I didn't want to cut anything out of it. But more than like, I'm good with this moment. I'm good, I'm good sticking with this moment where there's maybe not even any dialogue. And you just stay in the moment. And keep it small. It's beautiful because with that being said, it's still trimmed all the fat. The run time is perfect. Yeah. It's barely just over two hours. And it just goes by. Because like I said, there's just so many moments you just can't stop. You want to watch and see what's happening. You're a fly on the wall in these people's lives. There's so much you don't know. And then you find out something else and you want to know more. It's really, really good. Obviously, Manoj is Manoj, but I just genuinely what did you think about the other roles? Particularly, I mentioned her, Smita. I thought she was just... You're saying the villain. Yeah, the main... Is she an actress? The woman out to get somebody. Yeah, yeah, gotcha. Is she an actress or is she... She was in Joanne. In Sacred Games.  I think so. Yeah, I think that's her. I think that's her. No, she is not. I could be wrong. All I remember... There's no delay.  I don't remember. I just know that... If you've seen Sacred Games in our reaction, you know what I'm talking about. For me, she... You know, sometimes you watch a role in a film and you enjoy the role and you think they're great and you think of some other actors that you would have loved to see the role, not because they didn't do a good job, but just because, wow, it would have been interesting to watch them portray that character. And then there's some characters that no one else should touch that role. That's how I felt about her. She was so perfect in this role. This is how good I think she was because I am shocked that she's actually an actress. I thought she was like a local tribal higher. That speaks volumes about how good she was. Because she looked it. And the way she just... Her stillness... Is beautiful. I don't know if she was directed that way or that's what she decided to come with. Whatever it was. But it was like a normal... Especially if you're an unexperienced actor, the tendency is to do more. Because you're like, I need to fill the screen with action. And even you make that choice, but also there's the points where once you get on set and it's time to go, you feel excited as a person. You're on set, you're doing the work you love to do. It's very difficult for a lot of people unless they get the experience in their training to turn that off. Because the camera is just going to see it and it's going to come off as big and performative. And I thought her stillness especially was great. Her, she had great eyes. Great eyes. Yeah, she did a... Just... I think everybody did a very good job. I don't think there was... I loved his wife in this. Yep, me too. She did a fantastic job. There's one. There's Vanu. That's the character name. I'm looking back to her. Look at it here. Yeah, Tanisha Chatterjee. Yeah, his wife. Tanisha Chatterjee played Vanu, his wife. Oh, she was imparched. Oh, wow. Yeah, another great acting job done by her. Oh, yeah, she was great. There's one... I don't know if you'd really call it a flaw, more just a... obviously they had to do it so they can continue the story. Wait, are we getting the spoilers? Yeah, I guess we can. Okay, so anyways, if you haven't seen it, please go watch it. Please do watch the film. Once again, we don't do this. This is not a sponsored video. We don't recommend something unless we love the film. But please go watch it and then come back. We're going to get into some spoils. There's probably not going to be a ton because I would like everybody to watch the film. But if you haven't watched it, please go watch it. Come back, okay? Spoiler, spoiler, spoiler. Spoilers now. The one... I'm looking at her. The one thing that I did throughout the movie, I was like, boy, is that the most agreeable baby I've ever seen. I have children that were recently around this day, and they said she was three months, she was way older than three months. Well, you always have to do that. That's normal for film. That's not what I have an issue with. But this baby is constantly running on the chest, on the back, and let me tell you that having babies in that, they are good for a limited amount of time, maybe mostly while they are asleep.   It's a good baby. I get it. They had to do the carry on the story. That was the one, if you want to call it a flaw that I saw in the film, because I was like, I would have liked to see a little more struggle with trying to keep this baby a little quiet because it would be a struggle traveling with a small baby like this. Yes. It would be a big struggle. I think they make up for that because I see what you're saying. It didn't bother me. It didn't bother me, but that was the biggest flaw I could see in the film. But I think they made up for it in the fact that it's very, very, very, very, very difficult to maintain believability if a baby is a primary character in a film. It's really difficult because you often times, especially in a film like this, there's a lot of times where there's no way they're using the actual baby. They have to use a dummy baby. And it didn't ever leave its believability. And that's also a testament not just to the director and the team that did the creation of the fake baby.  That would never happen. And that didn't happen. But I agree. Really well-behaved baby. Very well-behaved baby. Having three myself. I had young ages right now. What did you think about just cutting to the chase? Basically right when they arrive at the mines from that point to the end, what did you think? Because that for me just was a fantastic climate. I really, really enjoyed it. Also, I love that it left you with the question of... Obviously, he didn't do it in terms of killing his wife. But he also technically killed quite a few police officers. Technically, right? And was the one holding the rope? Yep. And so I think it left you with more questions of like, one, how good of a... What do they call these? The rebel fighters. The rebel fighters. Yeah. How good of... Because obviously he said he left it. And was kind of forced into it. Yeah, because he wanted to give up the gun. One, was he telling the truth there? Right. Or did he do something? Well, I think that's one of the reasons why we're shown him... The last shot is basically him shooting, kills a guy that's obviously trying to kill him. But then you just hit off into the sun. I thought for a second that he jumped over something and it was like a cliff and I thought he was... Because it left me, it went blank. And then in the credits that he was running. You heard the sound, right? But at first I was like, did he just die? And then obviously that's not what happened. But yeah, it was... I liked that it left you with a bunch of different questions of like... Yeah. Is he who I thought? Even in the end. Why? Does he get away? Yeah. I love that we don't know if he gets away. And they gave us enough for us to see there was a side of him that clearly wasn't doing what they were doing to the son of the woman and that he's trying to offer some compassion to him which makes you empathize with him yet at the same time we don't know how deviant was his behavior. Is he genuinely repentant and contrite about it? Or is he pretending repentance and contrition to get away? I loved a couple of things about the climax sequence. First of all, I loved the symbolism of us seeing the machines eating the ground and what that means in terms of, like I wrote the word machinations, of government taking what it wants to feed its appetite from the natural resources of the land and it's been that way for ages. I mean, it's just nonstop, this greedy... All over the world. And it was more than just capitalism. It was just pure greed being embodied in that moment in the mind at the tree where he used to swing with the love of his life. That place for the people is now just this dead, empty place being devoured by the machine and I loved that car sequence. The way that the director and the DP decided to shoot that scene where the other cop is outside the window, he's on the other side and he's wanting to get into the car and she's there and there's the tension and you don't know is someone gonna get shot or someone not gonna get shot and they don't let us see it all the time and they just feel like we're in the car with them. And there were points I caught myself, it goes like this and I don't get to see her face because Manoj is blocking frame and I wanted to look and I thought, genius, that's called making a frame dirty where you want to not frame it cleanly and it worked and then the gun goes off and who got shot? Did Jorm get shot? Did Manoj get shot? Did the cop get shot? Did she get shot? It was just so good. It was the end sequence specifically because it was when he came in and his wife was brutally murdered. Heart breaking. Both me and my wife on that scene came because it was not really something that you expected that specifically. No, you don't.  And it's a tell-tale sign because we've seen that position before and it's a signal, it's like the calling card saying we know who did this based on the fact that she's hanging upside down like that. And I was sad because I had already gotten attached to her and attached to him and the fact that they're trying to survive and it makes you at that point think, okay, they're the protagonists and the person who did that's the antagonist but then it starts to do this. And I'm sure because it sounded like he definitely altered his dialect. Obviously I can't tell specifically, we're still not there. I saw the comments on the Dunkey trailer and people getting pissed at SRK's Punjabi accent. Oh, really? Yeah. We would never know that, unfortunately. It was like Gully Boy. Everybody said he nailed the... It sounded good to us but there's no way we'd be able to tell Indians can, obviously. Probably never will. Yeah, exactly. Obviously we can. It's probably as obvious to you guys as a Boston or a New Yorker accent. She's the one for watching something. Ask Androni and say, is they nailing the accent and she'll know. I can tell that his voice is different and that he definitely... It wouldn't be shocked if he nailed where he was trying to be from but it sounded good to me. It's Manosh. He brings such effortlessness in a similar way but a different way that Yerfan does. Yeah, there's just... So there's a level of expertise in acting. So the first level of expertise, in my opinion, is whether or not you're believable doing what you do and you have people who you're working with that can affirm that and confirm that, whether it's a teacher or a coach or other actors, right? Then you actually do it in front of an audience or you do it on film and you get feedback from other people that you have believability and then the next level is you're doing it enough that now you're working as an actor. And then there's the next level and that's the Manosh Bajpayee. That is the Radhika Aptes. That is the Nawazid and Siddhikis. The Kamalasans. They're the ones that... They're not just working all the time but they're just consistently as good as an actor can be. It's like watching... You know... You can't get any better at the instrument than Astaji Sakir Hussein. You can't get any better at dancing than Prabhudeva. You can't get any better at acting than Manosh Bajpayee. Just as good as it gets. Just as good as his recent string of films. He's just a beautiful, wonderful actor. Obviously he's our Dost and we are excited for everything that he's going to do in the future. I haven't even looked what he's got in the hopper. Obviously Family Man. Kira. Good, good, good. These shows they've got episode 3 in the can. Oh, Soup is one that... We saw a teaser of that. We saw a teaser for Soup a while back. It wasn't even this year. It was 2022. We saw it in 2022 as a tease and I texted him because it's a TV series and it was like a Quentin style. It felt like... What did he tell you? He said you're going to love it this year. Weird, right? Anyways, let us know if you've seen it already. What you think about it and what should be the next Manoj Bajpayee film that we should watch. Let us know down below.