Hey James, how would you look at tonight from a defensive standpoint?  Defensively, we just got after it. We're all on the same page from the beginning of the game, that first five, and then even the guys that came in off the bench knew the game plan, executed the game plan, and our results showed. At first half, they missed shots, and we made them miss shots. We contested every shot, we rebounded the ball at a high level, and that's what we need every single night in order to give ourselves a chance to win. Second half, they made some shots, but once we're already up 30, that's what we kind of expected. But you've got to have that mentality every single game to come in defensively with the mindset that we want to shut teams out, because offensively it's easy for us. How big will that be, speaking of bringing it every night, finding that consistency, you guys are welcome, Kevin back, finally headed this weekend. How big will consistency be as you get ready to play on the road for a West Coast trip? Huge for us, and hopefully tonight, before going on this West Coast trip, going on the road, this is a great start for us. So we just got to build this momentum defensively. Like I said, offensively it's pretty much easy. We got shot makers, we got shot creators. But defensively, if we can tie in like we did today, then we can start winning some games consecutively. Brian Lewis with the New York Post. Hey, James, this is two-fold. Apparently, I guess Jeff talked to you guys after the last game. What kind of message did he deliver in terms of this kind of defensive intensity? I guess the second part is how many games do you think it'll take before you guys can realize and say, alright, either this was a one-off and we just kind of had our pride stung and it was a one-off reaction, or we really turned a corner in terms of our consistency. Jeff basically said that we had to basically have pride and guard. The way we've been losing, teams that we've been losing to is unacceptable, especially the goal we're trying to reach. Like I said, we've shown signs of pretty good defense. We just have to be more consistent. We can't make excuses of who's in line-up, who's not in line-up. We just have to, whoever's ready to go, whoever's on that floor, whatever defensive scheme we have, you have to be ready to go. Whoever checks in the game, you've got to be on that same type of time. That's what we have to have. I can't speak on the pass. Tonight we did a really good job. Now we just have to have some carryover and be consistent with it. Greg Logan with Newsday. James, Joe Harris talked about the importance of communication on defense through. But then, tonight it just seemed to me that guys stayed in front of there. They just did a better, more committed job of staying in front of their man the whole time. Was it just, did everybody just sort of take it personally tonight? That is one of them, but we all know this league is very, very difficult. So communication has to be a key. And our bigs, especially DeAndre, did an unbelievable job of communicating. When at Pick and Roll, we know how important that brogdon and the bonus to Pick and Roll is. And our communication was unbelievable, and it showed. So, you know, one-to-one, one-to-one defensively obviously we have to be pretty silent and be great, but our Pick and Roll defense was great tonight. And we have to have communication from all five guys on the bench. I mean, on the floor and they have to be on the same page. And like I said, we just got to have carryover and consistent communication, consistent effort. And know what we're trying to accomplish defensively and who we're guarding. Malika Andrews with ESPN. James, yesterday DeAndre said, you know, he was kind of disappointed in the way he played. What did you observe from him as the difference tonight? Just energy, you know, his energy, defensive intensity. I think for DJ, you know, our team is great when he, you know, he's talking, he's communicating to us. He's defending like he did tonight. He's rebounding the basketball, blocking shots and just doing all the intangible things that we need him to do every single night. And so tonight was, you know, DeAndre Jordan, he was great. But we just have to continue to talk amongst each other on what we need defensively, positioning, who we're guarding. That takes effort, that takes, you know, sometimes, and sometimes it gets uncomfortable.  So, you know, like we talked about, DeAndre was great tonight. Now for our team, we have to be, you know, that same way every single night. Bruce Beck with NBC New York. James, you've talked about energy, effort and intensity.  Yeah, because, you know, if we don't have that, we don't have a chance to win it. More often than not, when we can bring that, you know, possession by possession, quarter by quarter, game by game, you know, I don't really like talking about offense because we can score with the best of them, you know.  And then we just show signs where we just don't, you know, we're not on the same page, just like individuals out there. And so that's my job. I got to do a better job of just communicating, maybe watching more film, making, you know, communicating more on where God should be. Just using my voice a little bit more, you know, so guys can be in their spots.  You got to be five guys locked in on the same page and making sure you accomplish, or wanting to accomplish the same thing and know your personnel. So as a leader, one of the leaders of this team, I got to do a better job of communicating and I will be. Last question, Matt Brooks with Nets Daily. Hey, James, as you mentioned, you guys were, you know, from the beginning kind of come out with a lot of fire on defense, the communication was there. So I just had a question about that communication. Is that something where one or two guys are leading that communication and everybody follows? Or is it something where you guys just all come out and the communication is just there from the get-go as a group? Communication is there as a group, you know. We got a lot of shy guys on this team, but we got to get out our comfort zone. We got to be more vocal, you know. We got to talk because it helps your teammate. It helps your defensive positioning, you know. You're guarding in the offensive teams like, well, these guys are talking and they put a little doubt in their offensive skill as well. So, you know, we just got to get out of our comfort zone tonight. I mean, you know, throughout the course of the season and over-exaggerate our communication. I think if we do that, we'll have better positioning for, you know, each other and then we can rebound a basketball and then that's what we can get on transition and then everybody scores.


Thanks. Thanks for attending our talk. Uh, today we'll share about how we exploit the COCOMW line and the modem all the way, all the air. And finally compromise the NINAS kernel. Uh, about us, uh, we are the, uh, security researchers from the Tencent and Blade team. Uh, Tencent and Blade team, uh, is founded by the Tencent and the security platform department in 2017. Uh, we focus on, uh, security research in the areas of AIOT, mobile devices, cloud visualization, blockchain and ATC. Uh, this is the agenda. Uh, firstly we'll introduce some, uh, related works. Uh, we know that, uh, WLAN security is a hot topic in recent years. Uh, the norm you exploit on Broadcom Wi-Fi ship is on 2017 and this year on our, today our talk is about COCOM. As we know, uh, there is no public exploit on COCOM Wi-Fi ship, so how secure is the COCOM Wi-Fi? There is a simple, uh, illustration about the architecture of COCOM Wi-Fi. Uh, there are two important things. Uh, the first one is that, uh, start from Snapdragon 835. The WLAN firmware is integrated into the baseband subsystem. So the WLAN and the modern firmware are wrong in the same processor now. The second thing is that you can see, uh, in COCOM's, uh, implementation, most of the functionality is implemented in the NINAS kernel driver named QCA CLD. Uh, there are plenty of vulnerabilities in this driver. That is the well-known WLAN host vulnerabilities. Our talk is not about the WLAN host issues, it is about the WLAN firmware itself. Uh, we know that, uh, there is no public talk on the COCOM WLAN firmware previously, so how about the security status? Uh, we will answer this question. Before we go into the details of WLAN and, uh, modern firmware, we need to reduce the debugger we use to debug the firmware. This is the key step for us to analyze the modern and the WLAN. Uh, there are, uh, modern bot authenticator and the modern images in file system. You can see, uh, mba.mbn is the mba image, modem.mdt and modem.bxx uh, modem images. These images have a specific format according to COCOM's official document. Like, uh, application processor, modem processor also has its secure boot flow. The flow is like this. Uh, firstly, NINX kernel will load mba and, uh, modem images from file system to physical memory. The second, uh, uh, NINX kernel will set the start physical address of mba and reset the modem processor. Modem pbl in rom will verify the mba image. If success, it will jump to the mba code. Finally, mba will read and verify modem images. If, if success, it will jump to the modem main code. Uh, the pure boot function in NINX kernel describes the boot flow of modem. Uh, it will load, uh, mba and modem images to physical memory and then check mba and modem images to be verified and executed in modem processor. NINX kernel can restart the modem processor at any time. And it will hit pure boot function each time when restart. Uh, the modem bt we use to bypass, uh, the modem secure boot is a time of check, time of use back. When mba verifying modem images, it doesn't lock the physical memory region. Means that NINX kernel still can modify the modem images. So after mba verified one image, NINX kernel can still modify it, which means that we have bypassed the secure boot check. Uh, the port code for the, the only meaning is quite simple. There is the, uh, def, def file of pure boot function. We just let the, uh, pure recline main function after we modify modem images. Uh, after we have ability to modify the modem images, we can inject debug server to modem side. Uh, we injected, uh, demonstrated to, we did for commands from NINX side. The commands and the results will be exchanged using shared physical memory. Uh, we now can, uh, issue debug commands to debug WLAN and modem firmware. Uh, now we have the, uh, debugger. We can analyze the modem and WLAN firmware much easier. And, uh, she will introduce the following details. I'm going to introduce the reverse engine alien and the vulnerability and exploitation of WLAN. And finally, we'll get into the NINX kernel. Okay. Next, we use the architecture of Qualcomm WLAN. Uh, the WLAN is now in the business band of Switzerland. And it's hexagon architecture, a lot of octagon architecture. So we can analyze it and if we control the WLAN, we have actually controlled the base band subsystem. Okay. Uh, here is a simple figure for the WLAN architecture. Uh, from the figure, we can see that Qualcomm WLAN is not a full mark firmware. Most of the functions of WLAN, WLAN, uh, implemented in the NINX driver. You can see here in the QCAC driver. Okay. That's leading to a smaller attack surface than the other windows. The work to be done here, you know, from where you'll call the offloader. You see the offloader mic layer. Uh, the module attack surface here in the offload handler. The offload handler is actually, uh, a table, a function table. And if you inspect the OTA package and if you interested in, you'll pass the package and do, and do some job. So the attack would happen here, uh, when the offloader handler handle the package. So you can analyze it. Okay. Give an example for how the Wi-Fi access point is displayed on the Wi-Fi list. Right? If you, uh, turn on the Wi-Fi, you'll see a list of the access point. Okay. Actually, when you turn, turn on the Wi-Fi, the Android firmware will, if you command to the driver, and the driver will command the firmware to scan the nearby Wi-Fi hotspot. Finally, the firmware will be used to handle us into the handle table. When the other hotspot or access point send the package. Yes, if you have a, uh, access point, it will send out the beacons and other packages. So our handle will receive, receive the data and pass it. If you, into the management become, it will transfer it into the driver. And finally, we'll notify the, uh, user space application so that you can see the SSID and, uh, other informations. Okay. Okay. So now we have some basic things about the Qualcomm WLAN. Uh, let's start the reverse engineering. Uh, this is the firmware load by modern. Uh, this is the WLAN firmware. It will load by modern from this position and this is the distance simpler. And this is the wonderful SDK, uh, provided by Qualcomm. And, uh, instruction reference for the hexagon architecture. Okay. Okay. So, uh, the WLAN firmware has more than 8000 functions. It's a difficult task to reverse these functions without any knowledge. Uh, likely Qualcomm have got some hint. You can see the most useful thing is the string table. Uh, we can find a lot of function names. And, uh, the other thing is the import function because the WLAN firmware will load, load by the modern as a shared library. So the WLAN use, use a lot of functions from the modern and they leave the function names in the import function table. Quite useful. The string table and the import function. Okay. The target we are going to reverse engineering is the off-road handler. Uh, the module tag surface is the off-road handler. So the question is how to find the handler table? Uh, the answer is that you can first find the string from the string table, uh, that is this string, uh, non-data off-roader. And then check the reference of the string to find the function name and find the function named the non-data handler. Uh, you can see this is, this is a bigger function. Actually it's a, it's a big loop and fetch the address in the handler table and then call the functions to do the job. Okay. So this is the, uh, module tag surface. You can find the table here and find the functions. Uh, this is a sample function. One of the functions looks like this. The most important thing is to find the data pointer. If you send the data, uh, if you want to tag the W line, you first send the data. So how to find the data, the data flow. This is the entry, the one of the handler. You can see here, this is the data pointer. Uh, all cases 5B, 5A, 5-line, 5-8. This is the data pointer. So you find this function and find the data pointer. And analyze the function and the first source of the, uh, uh, data pointer then you know how, what is the function doing and handle vulnerabilities. Okay. Uh, I think this is the most important study in this, this talk. You can find the function and find the data and the handle vulnerability that you want. Okay. Okay. So let's start the exploitation. Uh, this is a load map. Uh, we are here. We can send out some signals using the Wi-Fi dango or something else. Uh, we are here. We can send out the signals, Wi-Fi signals and we are going to compromise the W line. And then we are escape into modern and finally, uh, we are into the linear kernel. Okay. To compromise the four, four linear kernel. Okay. So, before we go, let's check the uh, medication status of WN to set up an exploitation strategy. Okay. From the medication table, we can see that there are lots of medications. Uh, for example, the heap, heap have ASLR. The address of the heap is not a pixel. And the heap have practically heap cookie. So, uh, the overflow on the heap is very difficult to exploit. And also, there are DEP. Uh, you are unable to jump into the data segment. Uh, also you are unable to write to the code segment directly. If you want to do so, you have to change the memory attribution. Okay. Also, there are frame limit, frame limit to protect the SP. The frame key to protect, protect the return address. Uh, so, uh, if you wanted to use some technical like ROP, ROP, it doesn't work because the protection here. Mm-hmm. But we are very lucky. The code ASLR is not enabled. So the code address is fixed. And the CFI is not enabled. So, if we, uh, although we cannot use ROP, we can use something called the, uh, FOP, function oriented programming that is, um, in the, uh, the gadget of the ROP, all the gadget are used, uh, uh, function core, not a return core. Uh, return is a function core that is function oriented programming. Okay. And we are also very lucky. The issue we found in the global data area that is here is also low ASLR. So the address of the data is also fixed. Okay. We know the address of the data, the water around the data address. Okay. Let's see the detail of the vulnerability. Uh, it's a CVE 2019 10540. Okay. This issue has already been announced in the Android and the Qualcomm August security briefing and uh, has been patched. So if you are interested in about the detailed information of the vulnerability, please check the security briefing in August 29th. Okay. Uh, this issue has been fixed already. Uh, uh, this issue is in one of the offload handler. Uh, you, you remember this table, the offload table, there are lots of functions, uh, called offload handler. One of the handler has a problem and it's a pre-ass friend handler, uh, handler, or he, uh, what is pre-ass? Uh, pre-ass means you don't have to connect to a specified access point. You don't have to connect to, connect to a whole, whole support. You just turn on the Wi-Fi, the, then the, um, phone is one level. Okay. It's a pre-ass vulnerability. Okay. Uh, this is uh, uh, vulnerability code. I will transfer, transfer the data into the C code. Uh, this is, this is just forward. You can see this loop. And uh, uh, this low checker about the length and your copy and the amount of data into the, uh, destination, uh, your copy copy. So, uh, endless loop if you have ER for data. Okay. This is uh, vulnerability. Okay. Uh, mm-hmm. Okay. So, let's check the data around the overflow address. You can see, it will overflow from here, global buffer. And uh, uh, if you want to into a copy, all case, 44 data into each item. From here, the group of buffer into here, you can see 44 bytes of data. 44, 44, uh, it's a loop. Okay. You know, this is a loop. Okay. You see the global buffer in the global study area. So the address we, we are already low. Because there is no SLR, the mid-tech table, you remember. There is no SLR. So we know the address of the overflow data. So, it's very convenient for us to exploit. Okay. We can analyze the data around the overflow address. We can analyze the data here. And uh, uh, quickly we can find out the after set a C. This is a very useful data. It's a very useful function, uh, data pointer, pointer to, uh, something we can, uh, need to do some useful job. We call it the smart pointer. Using the vulnerability, we can overwrite this smart pointer, over, overwrite the content of this pointer. Okay. See how we use the smart pointer. We can send out a package and uh, goes into this, this is code flow to use the overwrite data. You can see, this is a smart pointer. We overwrite it. So we can, we can change it to our determination we are interested in. And uh, if we call into this code flow, finally we will overwrite these two bytes, uh, actually these three bytes, C, D and 14. We overwrite these three bytes. Okay. Let's see the detail. We overwrite the smart pointer using the vulnerability. And it will, uh, have two tests. The first test is to test our determination equal to one. And the second test is to test the smart pointer plus six equal to the mark address of the sender. And finally if the two tests are passed, it will write to the, uh, three bytes using the data from the OTA package. Uh, this is uh, the data we control and the sender. And the mark address is also we control and the sender. So the only constraint is that if we pass this, this, this check, we can write arbitrary code to the destination we are interested in. So we can overwrite something like a function point, a data point or other thing we are interested in to do the job. Okay. So we have a, uh, global write, write the primitive. So we can write it to anywhere we want if we can bypass this check. Okay. For example, uh, we overwrite the smart pointer to this address X, X, X. And the notice the bit is one. So we can bypass the check here. Uh, we can bypass the check here. Okay. And then we can write it to the offset of C. Uh, 56, 7, 8. We can see here. We can write C and D. That is uh, uh, 6, uh, 5, 6, 7, 8. We can write it to here. So we can write here. We can use, we call it the primitive global write with constraint. Okay. We can write it to anywhere if the notice the bit is one setup. So, uh, meaningful address or data is always four bytes. So how to write four bytes? The answer is quite simple. We just use the right choice. The first time on the node who writes, you know, the 5, 6, 7, 8. And the sixth time we move, move the smart pointer forward offset by two. And this one, this bit is, this bit is still R1. We can write 1, 2, 3, 4. Then 1, 2, 3, 4, 5, 6, 7, 8. Uh, 8. Uh, that is 4 bytes. And there is still another problem. You see, we want to write it to here. Um, 5, 6, and uh, the problem is this bit is not, not equal to 1. So how to solve this problem? You can set it up, set it up. And if this is 1, then we can use the global right to modify this, this, this bit. Okay? We can set up, set up it to 1. Then we can write to the target. So, this is the, this is the view. So, for this complex figure, actually, we want to control the PC and R0. R0, we have, uh, 8 bytes. The first 4 bytes is the PC. And the, uh, second is R0. But we search up from, on the memory and find this place that we can writeable and reachable by our remote packet. Okay? Then, you see, there are a lot of one, a lot of one. We can move, move the smart point forward. Move on, move on, move on. And then we can overwrite the target PC and R0. Okay? So, we have controlled the PC and R0. Uh, we can, um, we can then run some FOP to do some complex job, such as to run into the, uh, FOP and uh, mapping the WX page. This is to map some page to, uh, modify the code segment. And for example, uh, this is a code segment B-0-0 and, uh, uh, originally my phone from 9-3-6, uh, we wanted to, want to write the code segment. So, we, using the FOP to, uh, map it to 4-2-4-2, uh, using this FOP. So, now we can, uh, write to the code segment. And, uh, we can write to, we have a habitual write. So, we can copy, copy our shell code into the, into the code space and trigger it. You can see, we copy the shell code. The shell code is originally in the data package. So, we copy the data package of data into the destination. That is 4-2-4-2. Then, we trigger, trigger this function. Okay. So, now, we have running our arbitrary code in the WLAN. Actually, we have now in the WLAN, okay, we are going to the modem. The WLAN in the different process in the base binary modem. You can see the corner in the Q, U, R, T, O, S and the WLAN and the modem in the process in the running in the USB space. So, how to get into the WLAN, uh, uh, into the modem from the WLAN. There are dangerous actions such as modify the code segment and write, uh, modem data or call complex functions. Uh, but uh, uh, all illegal. If you, if you call, uh, if you do these dangerous actions, the base binary subsystem, you are crashing. Okay. But you remember, you can map memory. So, how about we map the modem memory directly into the WLAN. Okay. Just like this, we map the modem, um, memory from on the WLAN. Okay. It's a memory map. We just map the physical memory into the WLAN virtual address and then we can modify the memory content. Okay. So, we can modify the code of the modem. So, we are control the modem. So, the last step is to escape from the modem into the Linux kernel. This is the little map we are going to do. Okay. There are a lot of attack surfaces. So, if you are interested, you can read the value paper for detailed information. Okay. This is the issue, uh, the 3E, uh, 2019 and 10538, which has already been fixed in August, I'm just, I'm just, I'm just going to do the security bleeding. Uh, you can see, there is a check from the data pack, coming from the modem. Okay. Uh, what's this doing? Uh, actually it's about the memory management of co-com multiprocessor. Uh, it's a very big topic, in fact, about, about memory management. So, it's a simplified, true figure. Uh, there are two things you need to know. The first thing is, uh, the Linux master model. That means the whole system, uh, the memory of the whole system is managed by the Linux kernel. Uh, so, the peripherals such as Venus, modern, WLAN, or Bluetooth, other peripherals of system, the memory is all managed by the, by the Linux kernel. And the Linux kernel will use the SMM, MAU to, or protect the memory. For example, if the modem owns, owns this, this memory, uh, every time, and other, other peripherals such as Venus visit to this D-RUN, the SMM, MAU will check the, uh, permission and, uh, find out that the Venus doesn't have this, this permission and then the whole system is done. So, this is the two things you remember is the Linux, uh, Linux master model and SMM, MAU to protect the, uh, memory. So, the problem is here. Uh, in fact, it is, uh, a mystery log, logical. Generally, Linux will decide the address and decide to, uh, assign to other peripherals of, South-Sistam. But here, you can see the address and the size are determined by the modem. Uh, we don't know why, but if, if the modem send out the address to Linux, then Linux will use this address directly and use the size directly. So, uh, if we, we set the address to the code address of Linux, so the address will be, uh, the, so the address will be mapped into modem and then modem can modify the code address of the Linux kernel. That is the issue. Okay. So, now we are actually in the, in the Linux kernel. So, we are going to talk about how to send out the payload. Uh, actually, uh, before we are using the SCAPI and, uh, Wi-Fi dango, but it's not, not very stable. So, finally, we are using a pixel tool to send out the payload and using a pixel tool to attack the pixel tool XL. So, you can see the pixel tool send out the Wi-Fi payload and then pixel tool XL, we are receiving the payload and, uh, being a compromise. Okay. This is the whole roadmap. We are using a pixel tool, send out this and finally, we, from modem into the Linux kernel. Okay. Into WLAN, into modem, into Linux kernel. Uh, let's use some demo here. Uh, can you see? Okay. Uh, this is on the left is the pixel, pixel tool. Uh, it is, it is sending out, uh, packages, sending out the payload to attack the, the left is the pixel tool XL. Okay. You can see it's a version of the system. So, the whole process is about three minutes. Can see. Uh, now we are, we are in the shell and the, uh, the SC Linux is enforcing. So, we have no permission to do the, uh, dangerous things, such as the D-message. Okay. So, it's still sending out the payload, payload and, uh, let's, let's speed up, speed up, speed up. So, the SC Linux is still enforcing, you know, enforcing. So, the pixel tool is still sending out the payload. Okay. It's, it's about three minutes. It's probably done. Okay. Can see. I wait for about one minute. You can see. Finally, we have get into the Linux kernel and disable the SC Linux. So, uh, now. Okay. You can use the D-message. So, actually we are running a bitually called in the Linux kernel from the remote WM. Okay. So, time is up and, uh, please note this, this issues are already been fixed in the August, the briefing and the pack. Uh, you can see the detailed information here. And today we talk about how to remotely into the kernel from the OTA pack into WM and the modern, the four, four chain and the vulnerability and the exploitations and the baseband subsistence. So, thanks very much for your time. Thanks very much. Okay.


Liberty Chroniclers, I have good news. The Cato Institute is about to debut a new podcast called The Pursuit on May 31st. It is a podcast about government action and individual liberty. The Pursuit is a serialized, serial-style week-to-week story about the very real ways governments infringe on people's totally normal lives. It is a six-show feature about individual property rights and government takings, or to make you seethe with activist energy. It is produced by Liberty Chronicles' very own, Tess Terrible. Frances Whipple was born into the quintessential American aristocratic family. On her father's side, the Whipple line included Rhode Island heroes like Abraham, who led the burning of the British ship, Gas B, in 1772, and some of the earliest settlers of the colony. On Frances' mother's side, the Scots included some of Roger Williams' earliest and closest associates in the foundation of the Rhode Island colony. In 1815, though, nature leveled the Whipple clan. A storm called the Great Gale ravaged Providence, flooding wharves and destroying crops within a 40-mile radius of the city. It was also the year without a summer, thanks to the Tambora volcano in Indonesia, which erupted so violently that the ash clouds actually cooled the planet. With a future of nothing but drought, sooty clouds and gloom, her father sold the family farm in 1816, and Whipple was destitute. Frances supported herself through odd jobs and self-education. She became a very different sort of Whipple, and over her lifetime, she helped make America a very different sort of place. Welcome to Liberty Chronicles, a project of libertarianism.org. I'm Anthony Comegna. The 19th century was one of the great eras of reform movements, and Frances Whipple dabbled in just about all of them at some point in her life. From loco-focuism and Dorism, two forms of early libertarianism, all the way to spiritualism, feminism, and abolitionism, with a few others mixed in from time to time. It was an age when Americans were still discovering who they were, and where they fit into the world around them. Whipple called it the New Age of Reform, and its bounds were limitless. Radicals like her believed there were few, if any, natural limitations on what human beings could achieve. And Whipple lived this principle every day of her life. Early in her career as a writer, Whipple contributed to a literary magazine called The Original. Gaining some prominence, she came to the attention of a Rhode Island women's benevolent society, hoping to raise funds for the relief of one Eleanor Eldridge. Eleanor was a free black resident of Providence, recently embroiled in a vexatious legal battle for her home and property, virtually bankrupted by the fees incurred. Whipple was tasked with writing The Memoirs of Eleanor Eldridge and Eleanor's second book, both of which sold tens of thousands of copies. They were astonishing successes that made Eleanor Eldridge a folk hero of African-American feminism. Francis Whipple became a Rhode Island literary legend, positioning her well to agitate the related issues of suffrage and slavery. Throughout her life, interracial sisterhood was a key theme. In 1844, Whipple published Might and Right, her history of Rhode Island's constitutional crisis, the Door Rebellion. Whipple had long been involved in the effort to reform her state's government and vigorously supported Thomas W. Doerr's movement to spontaneously replace its constitution. After a standoff between Doerr's government and the old state government, the radicals lost and opted to compromise for a new constitution approved by the old government. When Whipple published Might and Right, Doerr occupied a prison cell charged with treason against his state. Meanwhile, his followers were busy clam-baking Van Buren, then pulp into the White House, losing sight of their principles each step of the way. She dedicated Might and Right to Doerr, the true and tried patriot, the fearless defender of human rights. But she was plainly reacting to the movement's military failure, the weak wills and cheap manhoods that apparently occupied the land. For her, the Door War was a struggle for all humanity. Her first task then was to rally the firm Republicans of sister states to come to the aid of liberty-loving Rhode Islanders. She adopted the definitive language and sense of certainty found in all expressions of manifest destiny. To Whipple, the Loco-Dorite Revolution would literally spread like wildfire in the winds if only the people chose to make it so. The pattern she foresaw closely followed the Free Soil election of 1848 and the Republican Party's route to victory in 1860, but more on those later. In 1845, Francis Whipple, now Francis Green, edited Liberty Chimes, a collection of anti-slavery writings. Thomas Dorr was one of the state's most prominent abolitionists and defenders of free speech, but his reluctant ascent to the whites-only clause in the People's Constitution alienated much of the abolition movement from the Dorr movement. Francis connected the two and offered Liberty Chimes as a call for unity to refocus on the ways powerful people impact our lives, especially our families. In The Slave Wife, Whipple wrote with shocking realism about the fact of master-slave sexual violence six years before Harriet Beecher Stowe's Uncle Tom's Cabin. For Whipple, women's liberation and abolitionism were one and the same cause, points along the way in the great continuum of liberty and power. Her other Liberty Chimes story, Ahmed's Letters, told the story of a Barbary traveler to the United States, disgusted by the annexation of Texas and the expansion of slavery within a supposedly free country. History was not supposed to go this way. Over the next decades, the fruits of war drove single-issue wedges between the diverse factions of the Loco-Foco movement. Francis Whipple married and divorced Charles Green within two years, likely the victim of domestic abuse and spousal neglect. At the highest point of tensions between radical political factions, her own life took dramatic and unexpected turns. After her divorce, Whipple lived in Pomfret, Connecticut with her sister's family until meeting Samuel Britton, one of the founders of American spiritualism. She lived with Britton's family in Bridgeport for some time and immersed herself in the new faiths of the industrial era. Transcendentalism, Mesmerism, Magnetism, Swedenborgianism, and Spirit Mediumship. For spiritualists, their religion was not only authentically American, it was the quintessential American faith. It was one small variant of the larger existential crisis in Jacksonian America. A drift in a swiftly changing, ever more complex world, many Americans embraced radical new answers to old questions about man's place in history and the cosmos. Most cultural institutions weathered the storm, but new scientific learning was everywhere, accessible to more people than ever before, and disciplines like geology clouded all traditional knowledge with doubt. In place of the traditional Christian God were the deists, divine clockmaker, spiritualists saw godliness in the operations of nature, especially electricity. Darwin's discoveries expanded the issue further while telegraphs transmitted one's thoughts electrically around the globe. During the 1850s, Americans everywhere experimented with telegraphy and spirit mediums like Whipple's mentor Samantha Metler practiced charging their auras with electrical energy. Experts claim they became spirit batteries communicating with the dead by telegraph. The movement began with people like Britain and Whipple in the 1840s and reached its peak in the 1860s. Whipple wrote for Britain's spiritualist publications including accounts of clairvoyant magnetic healing to lessons for young people in botany. In 1860, spiritualists held a large convention in Providence and Whipple was advertising her services as a healing medium. She was one of two people marketing mediumship in Rhode Island at the time and Providence became known as a leading center of spiritualist thought in the country. Francis moved to San Francisco in 1861 just a few months after the Civil War began. There she wrote for the award-winning Hesperian and the Pacific Monthly. She regularly lectured on her prophetic visions of California's destiny at churches and reading groups. Soon after she arrived, Whipple became famous for channeling the spirit of Union Colonel E.D. Baker killed at Balls Bluff, Virginia in October 1861. Whipple claimed that Colonel Baker's spirit communicated a funeral oration he wished her to deliver. Using Francis Whipple as his medium, the spirit of Colonel Baker became the first major politician on the West Coast to advocate emancipation. Over an unknown amount of time, Colonel Baker's spirit made its presence known to her somehow and engaged her in long conversations about how to properly communicate his message. She delivered the oration personally at Platt's Hall in San Francisco. Baker, through Whipple, began his speech with an explanation of mediumship and spiritualism itself. And we should note, in keeping with the new science, it was a material explanation. Crude, of course, but materialist nonetheless. Baker assures the audience that a proper understanding of spiritual existence would near immediately set mankind aright. He tells them moreover that he did not come alone tonight. He brought with him into the hall a gaggle of history's greatest statesman, a group of the wisest of the wise spirits, calling themselves the Spiritual Congress on American Affairs. Mrs. Francis H. Green, the Baker oration, power and permanence of American institutions, delivered at Platt's Hall on Wednesday evening, March 5, 1862. Ladies and gentlemen, citizens of San Francisco, before entering on the main subject, permit me a word of explanation concerning the reasons of this reunion. I was, as you well know, called away abruptly and from the midst of life. A memory of promise rather than of great achievement lay behind, a mountain of unattempted work towered up before. The yet unabated power of life had been germinating, growing, clasping whatever they could reach, still putting forth toward the unbloomed blessings of the great, unexplored beyond. Think ye that any bullet, blade, or bayonet could in an instant of time sever all these, germs, buds, blossoms, tendrils of the soul? Nothing is more false than this assumption. The uncompleted life is attached to everything around it, by the radiation of 10,000 vital interests which are, so to speak, offshoots of the soul and partakers of its own immortal energy. If the life be a working and aspiring power, it will reach out still farther, still more resolutely, and shape the future by the irrepressible emanations of its own will. You cannot crush all of life at one blow.  Their unexhausted vitality will assert itself. They will push forth at random and live their allotted term in some shape or by some means. But if the tree dies of itself altogether, either by old age or disease, the separation is complete and the transition perfect. The human soul, as you may see by this, is not an abstract essence or organism boxed up in a 6x2 or 5x1.5 apparatus of insurmountable outline. By its love, its hope, its faith, its will, I by its necessities, more than all, it creates and sustains innumerable relations with things all around as well as beyond itself. And these ties are not independent abstractions, but they are actual emanations of its own substance, essences of its own power and hence partakers of a nature immortal and indestructible as itself. When the spirit is prepared for transition by the gradual operation of age or disease, it retracts its tendrils, it reabsorbs its emanations. Like one about to take a long journey, it calls home all it may want by the way. It gathers back all that properly belongs to it, that it may go forth free and leave no essential thing behind. But when the cord of life is severed suddenly, there is no time for retraction. The process is wholly unnatural and the violated law claims its own. This is the secret of ghosts and apparitions, with which the history of the world teams. The spirits of persons who die by accident, crime or any other untimely means come back because the unsevered ties of earth draw and compel them to return. It has been the subject of regret with many intelligent and benevolent minds that I ever exchanged the forum for the field. But however disastrous it may seem and in fact is, by that movement I have been thrown into the line of a truer promotion. I have been translated from the lower to the upper house, where not the affairs of the nation only but of the world are discussed and ordered. Imagine if you can, the August character of that assembly where Cicero, Clay, Chatham, Demosthenes, Emmett and Webster are among the speakers, where Solon is secretary, where Sidney, Washington, Milton, Franklin and Toussaint are a committee on American affairs, where William Tell and Leonidas are doorkeepers and the glorious old Greek who sang Freedom with the Morning Stars, Homer presides. What could be given or expected more than the merest shadow of the scope, aims and plane of thought that must distinguish such an assembly? This is no fable, no picture of excited imagination. There are absolutely organizations of spiritual power where the affairs of earth are continually canvassed and measures are taken to regulate and control them. And it is something more than mere egotism or even patriotism to declare that the present war in America is the subject of all others that now most engrosses the attention of these August minds. Could you enter into the spirit of their councils? You would enlarge your ideas of Christendom, you would pull up your old stakes and stake our larger for the boundaries of the civilized world. Here are many representatives from heathen and savage nations and many also from unfortunate conditions in the so-called civilization. Their very names may have died out from earth and perished with them, in their limited spheres of knowledge and use they lived and died unknown to fame and unhonored by history, and yet in their genuine love of good, in their aptitude for truth and above all in their reaching and aspiring power they have unfolded beauty and wisdom that rank them with the highest. And this should comfort and strengthen all earnest and aspiring souls. They know not the power that is in them.  Statesmen, philosophers, prophets, poets, martyrs, heroes and demigods, they who lived and they who died for the genuine love of right. Could you see and know them, the house would not hold you. The city would not hold you. You would flock from every quarter to salute and entertain guests so glorious. Could you only comprehend how they are working in and through you to repress evil, to unfold good? You would not so contract. You could not so debase yourselves. Could you see how benignly they bend from their beautiful spears to reach and move you? You would come out with one mind to meet and to work with them. The temptations of policy, the corruptions of lucre and all the belittling finesse of world craft would be left behind. I will now endeavor to translate or transfer to you the sense of the house which I have the honor to represent. The Spiritual Congress on American Affairs. In a general way, it may be said that the sentiment of the spirit world in regard to this subject is the sentiment of the Declaration of Independence, of the American Revolution and of all clear-seeing, right-minded people since that period and before. It may be resolved into one word, humanity. This, in its most liberal sense, includes everything of right, power, possession in the individual, in the nation and in the race. It involves the security of life, liberty and happiness. Whatever comports with or promotes these, at least in a general and generous sense, must be in harmony with it and therefore true whether it be national, sectional, social or individual. Being true, it is founded in the indestructible elements of things and therefore cannot be lost. Whatever conflicts with or is subversive of these is false, unnatural and monstrous and though, by a forced power, it may be sustained for a while, it must ultimately pass away and perish. Baker dwells at length on the argument that the American Revolution was in its entirety an abolitionist movement. He marshals quote after quote from that great generation of heroes, Washington, Lafayette, Jefferson, Hamilton and on and on and on. He argues both that the Constitution was an anti-slavery document that it nowhere recognized slavery and then chastises them for fetishizing a piece of parchment. Moral laws, spiritual laws transcend the merely human made and treasonous as it may be, no one was required to support an unjust law. Northerners had long abandoned their duties to their fellow human beings, preferring instead the much easier work of voting once or twice a year. Meanwhile, the slave power was always on the advance, gobbling up a sleepy public's last liberties one by one.  It was undoubtedly a horrifying tragedy, but it did offer a chance for redemption. It has been a grand error of our people that they have regarded protective documents, which are the work of finite human beings, as irreversible and final. They have been invested with a sanctity which does not belong to them. Constitutions and laws may represent the ultimate of wisdom at any given time and place set free, but there is no more obligation to keep and follow when we have outgrown them than there is to keep the old spinning wheel or sickle or stagecoach when machinery and steam are ready to come in and multiply the old unit of hand and horsepower by hundreds and by thousands. This blind subservience to written documents has in it, indeed, a taint of the old time, when the supreme state was the grand idol on whose bloody altar humanity was immolated. It is contrary to the whole spirit of American institutions, whose original aim and scope, whose fundamental spirit and power were all intended to unfold and cherish and protect the man. You must go down to the very root of the Tree of Liberty and cut and cauterize before you try to heal.  You must crush its many heads. You must burn it on the spot. You must gather up its very ashes and cast them into the depths of the deepest sea lest by some horrible necromancy they be restored to life and bring forth a new brood of curses. We have been beguiled. We have been paralyzed. We have been led by unwise and unworthy motives and now we are paying the penalty of our weak and insane stupidity. We are paying it in rivers of blood, in floods of fire. And the fact that we are able to pay it is not due to the policy of leaders, to statesmen or politicians, but to the great heart of the American people. This, amid all corruptions, has yet retained enough of truth to save it, enough of humanity and manhood to move and control it. Aye, and it is this that must conquer. It is this that must wear forever the laurels of unfading freedom. The Spartan, the Grecian, and Roman republics perished and passed away because they were not founded on the broad principles of humanity and justice. And so must ultimately be dissolved all governments that do not recognize the absolute sovereignty of man and the inviolable sanctity of human right. They have invoked their fate. Hour by hour, they hasten to their doom. The most stupendous drama in the history of time is now unfolding. The world is the stage. The nations are actors. And it may be that the scenes will be centuries. And the acts, ages. But be it longer or shorter, it must be played out. All the powers of human nature and human destiny will there meet, not only shoulder to shoulder and thigh to thigh, but thought to thought and soul to soul. And so long as slavery is able to stand against freedom, error against truth, or wrong against right, so long will the contest continue. The sacred books of almost all people teach the final subjugation of the powers of evil. There is a grand truth in this doctrine, and now the world rapidly hastens towards its fulfillment. Remember that in the coming contest, nothing but the genuine armor of right will sustain you. Everything will be tested by Severus Trial and no shams will then pass muster. Shortly after delivering the funeral oration, Francis married William McDougal, a Scottish Ohioan, former California state representative and wealthy local minor. For the remainder of her days, Francis Whipple McDougal enjoyed a modest lifestyle and domestic peace while producing a vigorous stream of new publications on spiritualism, mediumship, and a mystical liberal vision for what America and California could make itself. Whipple closed her life and career in relative isolation and obscurity, though countless Americans felt her influence.  Whatever women at home could accomplish, women at the ballot box could fritter away. Her undoubtable feminism is exactly what attracted her and many other literary women of the day to spiritualism. Amorphous as it was, it was the only contemporary religion that offered women full equality. Women as mediums channeling spirits escaped the long series of sociopolitical restrictions on their behavior. The spirit spoke through them and the medium's words were not necessarily her own. In fact, audiences might have an impossible time distinguishing between a true believer medium and a woman with her own opinions and soapbox. Every individual regardless of gender, race, class or any other distinction could witness the mysteries of spiritualism and the individual knowledge of his or her own electric relationship with nature. No need for clergy, political or religious. She lived a new sort of Americans life, fraternizing equally with both sexes. She was an empowered, individualistic feminist and she was a radical loco-foco and libertarian before either word existed. Liberty Chronicles is a project of libertarianism.org. It is produced by Test Terrible. If you've enjoyed this episode of Liberty Chronicles, please rate, review and subscribe to us on iTunes. For more information on Liberty Chronicles, visit libertarianism.org.