तुधे विवल प्रफार्म दिसेक्षन अप फ्रोग, फ्रोग बिलोंच तुफाईदम कोर देटा अप खलास आमफीभिभिया. फ्रोग बेसिकली आमफीभिभियंच है, क्योंके ये सोयल और वोटर दोनो के अंदर रह सकते है. उसकी सब से बटी रीजन ये है कि इंकी तुज किन और वोगता लाईमि होती है. उसके उपर मुकस बिलानच मजुद होते है. और इंझो मुकस बिलानच की विदासे इं कि जो स्किन है, उरट रहती है.   बोँ की मेसन पीज़ नहीं यहने36 मेंगरेन सी अशा बत्त SaaSम � qualities strategic मेसन पीज़ मेंगरेन आप सब दूफात, औरगेन्र soft ज prolong को वहान करेणाड ती मेसन पीज़12, �笋य मेसन पीज़ की ञार कम रचुग देचellen more आप दीश वीन दिच साड़़यान करते इसाड़याना साड़याना जब करतेन करते और बआफ लोगी रड़ा something power to cut it. खरड़याना खरते खोग 나오� आपने चाह्छना आब रवटा, आपने खाशने, लिए आब वौबई , ఎమన్మణిస్ర్వికాలి మధర్స్యావాచాదిగ్తి పికోవాలి మన్వికికార్న్టిఆర్లింమిది. As you can see this is the heart of frog present on the anterior side heart is covered with a layer of membrane that is called pericardium as you can see the pericardium here is the layer of the pericardium I have caught it with the arrow head needle and I am pointing the needle over the cardium of the heart when we perform dissection we can see the blood of the frog it colours red due to the presence of hemoglobin in the blood all the arteries in the skin and the skeletal muscles therefore white oxygen to the organs this is the ventricle of heart if we turn the heart then we can observe the artery of heart here is the artery heart is three chambered structure that contains two artery and one ventricle as you can observe that heart is beating even though we have performed the dissection of the heart after the observation of heart we will observe the structure of lungs that are connected to the heart these are the lungs as you can see these lie very close to the heart lungs are present in the frog single circuit circulatory system present in the frog all the blood that is collected into the artery of the heart enters into the ventricles and then it goes into the lungs for exchange of gases as you know during respiration carbon dioxide removes from the body the heart takes oxygen from the lungs so that cells can survive in the presence of oxygen and can take energy in the presence of oxygen after this we will observe the structure of liver liver consists of three loaves this is the left lobe this is the right lobe and the middle one is the median lobe attached to the liver is gall bladder gall bladder helps to secrete the secretions that helps in the digestion of the food in the stomach and small intestine apart from the digestion of food liver also store glucose in the form of glycogen so that it can be used at the time of high consumption of energy when no food is available for the animal after doing observation of the heart lungs and liver we will do the observation of the organ that is the part of the digestive system of the frog for this observation we will first remove some organs so that we can clearly observe the organs that are behind the upper organs on the lower side that are present on the lower side to remove the organs we will first attach the skin with the common pins we will take common pins our dissecting tray to put our organs in this tray we will first take common pin and attach it to the skin after assembling the skin of the frog we will remove the liver so that we can easily observe the stomach of the frog after removing the liver we will observe the parts of the digestive system first of all we can see that there is a large sac-like structure that is called stomach stomach is connected to the esophagus esophagus is connected to the order cavity food enters into the mouth then comes into the esophagus after entering into the esophagus it enters into the stomach initial digestion of the proteins takes place in the stomach and this is the heart structure that is the pyloric sphincter of stomach stomach leads to the small intestine all the absorption of the food that is digested completes in the small intestine this is the small intestine attached to this stomach part and the small intestine is the pancreas pancreas helps in the digestion of food small intestine is the most elongated structure that is present in the digestive system small intestine leads to the broad part that is called the large intestine large intestine leads to the rectum rectum stores the waist of the digestive system and it leads to the opening of the frog that is called Kleoka Kleoka is the opening that not only for the release of digestive waste but it also helps to release the gametes of the frog as well as the waist of excretory system like urine along with the small intestine and large intestine the plane is present it is not only the part of immune system that helps to fight with the extra bodies that enters into the body and can cause diseases but it also helps in the formation of blood cells after this plane we can observe irregular shape dark reddish color curved organs that are called kidneys and along with the kidneys oval shaped structures are present that are called testis and they are two in numbers they help in the reproduction of frog this heart structure is the vertebral column of the frog that helps to the frog in the movement along with the vertebral column as you can observe there and the stomach mizin freeze are present and also a very major blood vessels that leads from the heart to all the organs of the frog so that blood can be supplied to all the organs and survival of the frog can be possible students today we have performed frog dissection dissection is the most important thing that we have to take the frog is life frog and before dissection you can apply two methods you can do the pitting of the frog you can damage the brain of the frog or you can give it chloroform and disable the movement we have first observed the frog's external parts what was present in the external parts we have observed we have observed its dorsal surface, its ventral surface, its limbs, its mouth, bulging eyes, external nears we have observed all this in its external part after that we have performed its dissection what we have observed in its first dissection is the blood vessels which were attached to its skin after that we have observed on its abdomen thick layer of muscles that is called calytal muscles after that we have cut the calytal muscles and we can see its internal organs first we have observed the heart with the heart we have observed the lungs after that we have observed the liver with the liver attached to the gall bladder all these things help in circulation and digestion after that we have seen that we can see a slight structure which is called stomach it is connected with esophagus and below it is connected with small intestine small intestine leads towards a broad part which is called large intestine large intestine is used to store all the waste in the rectum and it is used in the colioca after that we have observed some parts like the pancreas which helps in digestion, thepline which helps in immunity as well as in the formation of blood cells after observing all the internal organs what we have to do we have to remove the pins which are attached to the limbs we have to take a plastic bag and we have to discard the frog properly we will remove thumb pins from the limbs that we attached at the start of this dissection we will take help of foresap to accurately remove the pins we will take a plastic bag to discard the fog we will just pick the fog, carefully put it in the plastic bag we will discard the fog like this and we will put it in the dust bin now you have to wash your dissection board and all the operators that you have used in your dissection and clean the table with 70% ethanol thank you


Hi everyone, I hope the afternoon is treating you guys well, and you're in conference room 2 right now when we're going to hear a Conference title trick-or-treat and veil this freedom of the mining pool So if this is not what you were expecting now is a good time to head to room one Our centers today are Emilia and Jean-Tel. He's a security analyst for certEU since four years and also responsible Monitoring and hunting activities in certEU and Yana Andrada Tadirica She's working in Brussels for the certEU as an IT security administrator previously working as an IT systems administrator for the Romanian Ministry of Defense and Passionate about information technology.  I don't want to steal your tender So without further ado So I do everyone. Thank you for being here for talk. So we'll talk about crypto miners So crypto mining malware or mining malware. I don't know which one you prefer for that And we'll speak especially about the stratum mining protocol and Yeah, so my name is Emilia Jean-Tel. I'm a security analyst in certEU. I used to be a pentester So more for red team activities I also work in the threat intelligence team in certEU, but no I'm after small time as an incident responder I'm not responsible for everything related to threat hunting and Monitoring of our sock. I'm Yana Tadirica. I'm from Romania for those who don't know about Romania Romania is a really small country in Europe known as Dracula's land or the the house of the vampires. I Worked previously for the Romanian army as a system administrator and like The last three years I moved to Brussels to work as a security administrator for certEU Okay, so mandatory slide about what we are what we do So certEU is a computer emergency response team cert of the European institutions bodies and agencies So it means that it go from European Parliament European Commission to small agencies Like the medication agency is a transport agencies. So or cost insurance are around 60 plus different organization that's very interesting Let's say work environment because we have different maturity level between our constituents So we can have very small entity big one with their own security team And so it's pretty cool to work there in certEU and to help the European institutions to get protected against cyber threat So what we do is more or less what every search are doing so it go from incident handling Which is the team I part of we have very good strategy agents team We have some developers also to help us on the automation on task And Johanna is part of what we call extended services, which is some kind of infrastructure team Plus red team plus VINAT assessment plus a lot of stuff That we so we actually provide more services to a constituent like helping them deploy sensors and stuff like that Okay, but no, let's jump on the real topic so Crypto mining malware is always something. I mean, it's really on the rise since more than two years You actually kind of replaced run somewhere attacks. So no, it's actually more profitable for So a doctor to infect machine and have them mining for them instead of trying to run some people And the thing is we often Have people asking us Okay, but the price of bitcoins and other crap Torah currency is actually crashing So is it still a thing and if you look at the news just last week trend macro released a blog post about vulnerability of confluence being exploited and then they were installing some crypto miners there in order to mine some money Oh, and if I look at the analysis we are doing I see more and more samples So the thing is for threat actors if the price go down just infect more machine And then you will still make money and I mean free money. It's not your infrastructure. So it's cool The other thing is it's pretty easy to deploy you have a lot of proof-of-concept code online on github on past been I mean very basic script So you find a vulnerability Which is not patch you use services to actually find Venerable services you deploy your user exploit you deploy your script and then you start mining and making money out of other people infrastructure so the thing is What we want to do is to be able to detect Crypto mining activities and inside of our network and so for that we will use something which is Specific to crypto mining for mining activity is that most people most miner will actually do not do solo mining But they will use mining pools. So I will quickly explain In very basic explanation of a mining pool So you have these mining pool servers So usually you have a website and then you have a different services which will actually communicate with a blockchain every participant will actually connect to the mining pool and Participate to the proof-of-work in order to generate To find some blocks and to generate rewards and based on the participation of each entity to the mining pool They will kind of devise of the reward to the different participants and the thing is that it can be any type of device It can be Smartphone it can be laptop. It can be servers. I mean you can mine on any devices, especially that you have some Cryptocurrencies which are kind of not depending on use GPU so they can be mined with those very small CPU So even a device and what we will speak here is about crypto mining malware There is another kind of crypto jacking activity, which is leveraging JavaScript in browser, but that's not what we'll speak about today We will speak about malware infecting machine and having them participating to the mining activity of the mining pool so to actually distribute the job between the different Participants the mining pool will use a protocol called stratum. So stratum was released in 2012 and it was replacing an obsolete Protocol called get work which was based on HTTP And so it's way more efficient. It's basically a gson RPC Protocol so it's just TCP connect you send a gson receive a gson and then you distribute your work like that And it's good because in most cases. It's an encrypted not always but in 99% of cases people are too lazy to put SSL on So that's cool for us okay, so What we do or work was to actually try to identify stratum servers on internet So meaning the configuration which is needed by the miner in order to connect to the mining pool and Because that's the only way for them to participate to the pool. We want to see exactly Where they connect which port? Is it using SSL or not, but mostly domains IP port that's what we want So we developed four different strategy to do that the first one will be to process some Malicious samples and to extract configuration from them The second one will do to use some search engine in order to find directly servers But also to extracting from the mining pool websites the configuration they use For the stratum protocol and finally we'll speak about about actually scanning the internet at the end. Oh And we have some snort rules. It's available on our github account. You will have the link at the end of the presentation So, yeah, okay, so Crypto analysis of samples So we have different strategy to capture the first step is to capture some samples I capture something like 20,000 unique samples since more than a year something like that So we have different sources it can be from malware repository like various total for example or online sandboxes like any run hybrid analysis all those kind of Open sandboxes that you can use but also from internal incidents that we manage absurd you and In order to identify interesting samples for us, we will use Yaraul. We will use List of interesting domains list of interesting behavior like which we reference either the stratum protocol itself or Wallet addresses so wallet addresses is when you want to get paid in Monero in Bitcoin You provide your wallet address to somebody the thing is that most mining pool will actually use a wallet address for authentication to their pool That's pretty cool. So it's very long string. So I have nice regular expression In Yaraul to detect actually existence of those of those address in samples And so I know that something interesting will be on the other side Something else Which I will go into details and the next slide is the use of specific mining software. So People are lazy You have very good tools which exist to do the mining the most well-known is XM rig. So most threat actor will just embed the miner itself So the software doing the mining inside of the inside of the malware that will deploy in the infected Infected target and they will just make it run. So if I see reference to those specific tools I know that's that probably something related to crypto mining. So the workflow to analyze them. It's More or less fully automated. I mean with some bugs, of course, I mean it's Python script. So So I take those samples and I try to Decode it as much as I can. So for example, I will look for base 64 encoded block inside of the samples that we decode them Sometimes it's not encoded at all and sometimes it's packed So for those case I use open source tools mostly red deck the compiler Which was released a year something ago and for 32 bits samples and snowman for 64 bits The thing is that last month the developer of red deck announced that knows are supporting 64 bits Samples for internal Intel architecture. So I think I will use it more because I prefer the output of them So there and they have some kind of Unpacking embedded unpacking Functionality which is pretty pretty cool for us. So then I'm using your rules. So to actually find some specific Pattern inside of the file and I'm looking for two main things. The first thing is a mining software They are using so is it xm ring is it CPU miners in some class and also reference to configuration files I mean all they will actually Configure the miner to start participating with with a mining pool and finally I have a shit lot of regular expression More or less correctly written in order to extract those configuration passing it with some kind of Python script to actually make it compliant and then store everything that I'm interested into a json file Okay, so you don't have to read everything We like some stuff is just to show you that what we did is we did an inventory of all the most used a mining software That we can find in samples Oh, they start it because you are usually two way of starting the mining process either It's having a command line when you will specify the stratum server. You want to communicate with or a configuration file So if you take xm rig for example So you so that's basically on Windows or you start the mining process So you have these like usage you want to use so 85% you will not put it happens We'll not put 100 because you don't want the machine to be completely killed and then everybody will figure out Everybody will figure out something's happening in this case 85% is already kind of tricky I mean if you start doing that on web servers, it may have issues And the minus all will specify those stratum server you want to connect to with a port and the minus who is the wallet address The other way around is to actually use a config file Format so when you will specify the URL of the pool with a port and then the wallet address you want to use for authentication So some samples are packed obfuscated. So we are not necessarily capable to extract directly the configuration So then we have all those strategies So we're not going to too much details to those a bit more on the network capture But what we do we just send them into sandboxes or we look for actually Online sandboxes which actually executed a sample. I will extract the sandbox report So you have interesting stuff like command line executed on the machine Which kind of IP it's connected on which port and stuff like that So we will actually extract from those sandbox report the data we want But also some sandbox, especially the one we are running internally give us a possibility to get memorandums So for that we will use volatility with the same year our rule We were using previously on our static analysis to identify which process is actually doing the mining And then I will use exactly the same technique from the unpacked malware in memory So then I don't have to start doing some reverse engineering to just get stratum address so that's pretty efficient and finally We can have a network capture and so we have those nice pickups and I will explain a bit more all the stratum protocol works to show you how easy it is to extract the information from a pick up So it's basically I have my infected laptop It will initiate a gson fpc request to the stratum server with the IP and the port or the domain and the port and Then the stratum server will just give it back like okay, so welcome to the pool. That's your job Please send me the result when you have it So the login request look like that So it's just a login the path X may look at I Password, but actually 80 90% of cases Mining pool do not check the passwords so I mean why if you want to participate just participate, I mean I don't care and We have the user agent which is pretty cool and Okay, so that's that's a basic stuff So the answer look like that so the stratum server say okay cool. Welcome. That's your job. That's the job ID That's the blob you need to analyze and that's the target you need to reach once it's done Give me back the result. I will compile it with the rest of the participant and if we find a blocker then we will get part of the reward So we have the port we have the IP because we identify I mean the The packets which are containing those specific gson RPC request in your pick up And I just have to look back into the DNS query which was made by the sample in the sandbox to identify At least the domain attached to the IP are previously identified Okay, so for this part, I will give the floor to your honor which will speak about the next strategy we use to identify the service Okay, so I'm land talked about having the samples already. We would like to find what's online there What's already active so as he talked before nowadays mining by herself It's not pretty efficient in the end like yeah, it's really hard to mine your own block until you get it It takes a lot of time. So what we are planning to to do is just to scan them over the internet Using services like on if senses show down to look for those stratum servers or mining pools which might contain configuration of the stratum servers for Those who don't really know what are those search engines that I'm talking about like on if senses or shut down those are like search engines which are Mapping all the connected devices to the internet and they're gathering information about about services protocols They have different filters depend on what are your needs? You can get the results through their API for us. We just needed we search only for Basic keywords. We didn't need to filter like it on on other stuff. We just wanted to look after specific stratum protocols so okay, so Initially we wanted to look for stratum servers which are already already there online and We've done this through we found it like some standard messages. For example, if you If you'll do a request there is a respond with like mining servers online. This is a standard standard message which Stratum server will say, yeah, I'm you know, I'm a stratum server waiting for you to connect Another interesting case you will see like they will respond with their in their HTTP header with x stratum Where you'll have the the configuration as you can see here like stratum plus TCP You will have the configuration of the stratum server word where you can connect Emilean talked also about the xm rig miner The xm rig miner has them you can enable the HTTP API so for example if you search on those engines it will give The configuration of the miner so for example, you can see there in the connection there's the pool which gives you exactly the stratum server you're where you're supposed to connect to start mining and Another one which we identify is this a terrum stratum proxy, which is a transition between the Old protocol get a get work to the to the new one so those were like Scanning directly on the on the internet for a stratum servers now what we want to is to Identify the mining pool online, which might contain the configuration of other stratum servers So we found like common keywords for basic pools like mining pools top 10 miners if you search for those you'll find plenty But also we identified I would say like here around five Mining frameworks I would say which are open source and there are available on I think all of them are on github and You can install it by ourselves. It you I like in many cases that you don't need much knowledge of it It's pretty pretty simple simple to do it. So what we went to we Try to see the what's specific for each type of pool and to extract the configuration of the stratum server On this one we used the scanning services to extract the pool website, but also we used you can find online Websites which have which are listing the mining pools So we exactly extracted the URL from there and we just parsed it and checked if they apply to to our searches So we found around three basic techniques of Extracting those mining pools that I was talking about so the first one is like node crypto note and Node.js pools. They're like used for most mostly for crypto note coins and The interesting thing you go you just parse the HTML page and they just just look for a configuration file What's really interesting about it in the configuration file? You will find the API which you can connect and you will just as you can see here You can take the pool hose directly and the port so basically we found a configuration of a stratum server So what we're doing we're gathering those Those details and for later to see if they're gonna be online and if they're available for mining For Node.js, there's like a slight difference the the configuration file is called different It's like global.js and when you do the API call it's it's not slash stats. It's just Pool and I think it supports something like this But as a method it's yeah You just parse the file you look after a configuration file and then then you just connect to the API call and you take here your data For those ones like NOMP and open a Terrain pool We It wasn't that straight for I would say like they have an API But they don't have the the data that we're looking after so what we are doing we're connecting to the to the page and Trying to okay, we've done some engineers some regex around to to steal the port and the IP or the the name of the pool host For the open a Terrain pool. It's a pool only for the Ethereum mining so if it's not It's a bit more straightforward. For example, I don't have to search for the port I there is like you have to serve for stratum port and stratum host you'll have them there It's much easier to you know to to go and serve for it here It was a bit complicated yet to engineer some regex which will filter the the data Okay, this is like the last technique that we identified and I think it was one of them which required a lot of parsing in the background So we have this imp pool Which basically in the in this page it will give you How to configure your miner and to like it will give you okay, we need to The stratum server is there. You just need to replace like the port and the algorithm that that you want to put so basically initially I'm filtering the first the first page and the I'm taking the stratum plus TCP then I'm doing a call into the Page then to find the API then after I find the API I'll get the Algorithm name and the port so I'm extracting there and in the end. Yeah, I'll just I'll just have the the final stratum configuration what is interesting on this one you on big mining pools I've seen offer like types of for imp. We've seen that They might mine on the same port more coins or on the same algorithm But on different ports so it depends on the configuration that they initially initially have I guess Okay, so we gather all the all the data. What are we gonna do with this one because you know That's that's a lot of data. So we wrote a scanner in which we Wanted to see okay if I'm gonna send job to the server Let's see if it's gonna respond or not in the end. So we identified like two responses We have like either an error Which okay, so say if we create we crafted a message, which is like, you know buggy There's just a random pass or nothing like real there But the funny part as a million was saying we just if you look on the second one on the job We just receive the job. So you just they can okay You can start mining so a Few statistic about the data that we collected in the end So we identified around 8,000 stratum servers Yesterday morning, I think it does when we scan them last time we had around 4,000 live servers You can see here. They're like only 1,000 unique IP hosting Well, as I said you earlier on the same IP you might host Different type of coins on different ports, but the IP is the same Also, like I would say a good indicator of compromise. It's most Like a good one.  So, yeah, those are my the most reliable I would say and yeah, okay, the rest we had like 6,000 from mining pull extraction, which yeah, it's not pretty bad compared to To the to the rest as we found directly in the end Okay, then there's one thing here. You can see like unique domains. There are like a lot of them if you compare Okay, we found only 1000 Well, why do we have 12,000 unique domain? So Emily and we'll tell you more about this one Okay, so as Yana said We have those samples which were I Will not say malicious, but we know that those mining pools has been used by malicious samples So it's not that the mining itself is malicious But we know that we identified specific samples which will use those specific mining pools once infected machines So these 11,000 stuff it comes from one simple trick that we've seen being used by a lot of malicious actor is they will actually Register a domain name pointing to the proper IP address of a mining pool without actually telling the owner of the mining pool Some people will use you you have some available Domains of mining pools for example So you will look in your DNS locks in your proxy locks if you have connections to those specific domains Not necessarily looking for IPs So in order to be undetected what they will do is they okay I will just research this totally random domain and make it point to the specific IP address So then your DNS based detection is totally useless. So that's why by doing passive DNS passive SSL looking in search engine like being have a functionality when you can do some kind of Passive DNS query and also through the sample analysis we identified that a lot of those stuff So for example the crypto pool.fr, which is one of the biggest mining pool online for Monero cryptocurrencies actually have a very cool and funny domain registered to this IP like this video porno azo.com or Test test QE or I don't know. So those guides were kind of imaginative in order to line behind it We have some false positive, especially if you have this kind of share IP hosting services like OVH or sometimes Amazon is doing like But at the end what we do we will retest with those specific domains with a scanner to see if it's actually It's if it actually can be used to start the mining process So some of the data we decided to take out of it was okay Is there a default port because we're looking at the documentation about those About those mining pool open source projects, and I think NOMP had some kind of default port configured which was 5 5 5 5 I think but most of the others do not have that and So we started doing so if you look on the left side say, okay, it's quite distributed There is nothing very specific But you can see that there is this kind of four times the same digit like 3 3 3 3 5 5 5 5 7 7 7 So I'm my idea that people are lazy, and you know they have to configure the stuff. Okay. Okay. Okay four times the same stuff And it works. I mean why not? So we did another statistics based on all the ports So it's not just based on the top 10 but all of the ports identified and we can see that roughly more than one third of them is using these four times the same digit and Also, you have sometimes some deviation So for example if you have two type of coins that you mine or if you have two type of difficulty You want to mine on the same coin the first one It will be 4 4 4 4 and then say okay Let's change for the second one because I cannot use the same one 4 4 4 5 Then for 4 4 6 and so we observe that we have also a lot of those Like I call it there there x x x y Some guys with other use HTTP standard port 80 80 80 4 4 3 in order to hide be Behind legitimate traffic and the others. I mean, yeah, we have very different stuff, but we have some kind of patterns there so So we work I work with Patrice of red, which is a French secretary searcher working for on if And actually I provided him a payload which is more or less the Python script We developed for the scanning and I asked him okay Um, can you check on all those four times the same digit port if you see strut on mining protocol? So he's sending the json looking at the answer and So when I checked this morning, no yesterday yesterday evening, we identified 1000 1600 something But the thing is the scan is still ongoing So we'll probably get more so once he tell me that the first scanning is done Then I will integrate those IPs into our list and to see if there is like the duplication and stuff like that so it's pretty cool and So there you have an example for example of server refund So something pretty cool here is you see some error message invalid payment address provided now It's because that's a fake Login I'm sending to the mining pool. So some of them answer by responding with my Fake bug us Authentication results and the interesting part is some of them actually do not care about authentication Hmm. Yeah. Yeah, but the thing is that I I request by scanning them I request a job But I will never answer because I'm just sending a json a PC getting the answer But I'm actually never do the job. That's something I didn't test because it's a bit offensive Would be to actually take one of those mining pool which do not care about authentication and spam them with job requests And I don't know if it will drop there. I don't know That's something I didn't test because not really allowed to do that offensive stuff against people so We have regulation in Europe and stuff like that. So my boss So the head of the Some response tells me okay. It's really cool. You do research you find stuff. So please know make it actually usable So there is some way we actually Use this data to detect or block mining activities in your constituent So on ideas APS level, for example, we will use the list of domains and IPs We also have the snort rule we developed so that we deploy so in order to detect such activity We can also use domain and IP on proxy level and on DNS level as well in order to see if we have connection to those specific domains and IPs that we identified and Finally based on the work we did For analyzing the static analysis of the sample we developed a list of my shoes hashes of course and also specific common line So for that, I don't know if you know sigma I mean you may look on it if you want, but we have some kind of pattern of common lines They are using to start the mining process. So if I detect an endpoint of a server running a lookalike Common line which looked like a mining process It started and I can generate alert on my sim and also we have Yara rule when we do a wipe I mean a swipe of all of our workstation for one of our constituents We will actually use some Yara rules we developed to get new samples to see actually if we have such sample already Installed in one of our constituents. We're using MISP as well to share with our constituents and our partner if you don't know MISP You should it's pretty cool. So it's open source project to exchange Indicator of compromise and analyze this with your peers So you can get like for example here. We have the hashes of the files we identified We also put the wallet address And actually Rafael Vino Vino from circle, which is one of the guy developing MISP added new tags for very specific Cryptocurrencies so you have so you can do correlation Inside of it. We also put the domain even if they are not malicious by themselves But they can be good indicators to detect that something malicious is happening in your network. I will let you know Okay, what's our plan for for the future so we would like to Dig more into the pool extraction technique. I have to say that we started with two big mining pools and then we reached to five and I think the last one was bringing the most results So I think we will go and continue will discuss for sure will discover Other mining pools which will get us more stratum servers Also, one of the things as Emilia talked about MISP. We need to really integrate it with Mitre attack and do a proper tagging and correlation on them on the events that we're having there and One thing which yeah, we're really working on it is to have a better automation of what we're doing Okay, we're having like a script, but they should look you know better than and Trying to improve and make you know do regular scanning without the human Human interaction I would say and also it would be good to have like a storage of the historical data to be able to do Some statistic on it and see what's the trend and how other things are gonna go For for the future do we still have some time? Okay, good, so yes So one interesting stuff that we found during our search while we're using the scanning services for XM rig minor as I remember we found those those Docker Boxes and we're like wondering what what what's about them? So we've seen that they're listening on on port two three seven five and If you look closely to it, okay, it looks like an image which is yeah, okay It looks like an image which contains a Monero minor, which the first only looks pretty legit. Okay, you have a Minor there already configured you don't care, but the second one it's a little bit Looks a little bit weird suspicious. I would say So yeah for the for the first one, okay, you can see that you can you set your minor you can as you can see you can See the the domain of the stratum server and the port where you can mine the pass or whatever but on the second one it's Yeah, it looks a bit Fishy, why would you put it in coded like why would you want to be like that? So the moment we we tried to decode it. Yeah, we discovered. Yes, it's still a It's it's a minor who's yeah sending Some requests to a to a valid stratum server. So the thing is We didn't have yet to explore it. But what if they are exploiting like Docker? API like for the stations which are not properly patched and just you know sending Infecting random Docker stations just yeah because they found it easy to to be exploitable. So we're not really sure yet about it, but Yeah, we're thinking this this might be a suspicious case like why would you put it in an encoded format? In the end if you if you have a legitimate legitimate image Okay, I'll let him learn to he has a nice example about XM rate minor Yes, okay, so we analyzed a lot of samples sometimes we find something cool So we look a bit more into it and that's a trick I've seen used several times and I really like it because it means that we are not the only one doing threat intelligence So you have the partial version on the left and the bash version on the right So what those guys are doing is they will kill processes based on specific name or specific strings like IP addresses wallet addresses Reference to the stratum mining protocol before starting the miner. What those guys are doing is are scanning internet for let's say Vulnerable web logic server, okay They connect there and they kill everything they know about competitors and then they start the mining process Probably for two days or let's say 20 minutes maybe before somebody else do the same, you know So that's pretty cool Thank you for the indicators. I would say because then I can integrate them into my threat intelligence database But I really like the trick that you know those guys know that if they want to make money They have to to beat the orders and it was very cool trick So I know they're very cool samples. So, okay, I will speak a little bit about the Mitre mitre attack framework. There were a presentation about it this morning. Yeah So persistence mechanism I found this very cool sample you have the hash on the back I will the slide will be shared. You can take a look Which actually at three different persistence mechanism. So once in fact the machine it will actually create a schedule task then use WMI so to Subscribe events in order to create them for persistence and then it will actually Registered itself in a registry run keys. So I don't know why they need three because I guess if they are detected once The other will be cleaned as well But the guy really wanted to be sure to stay there even if the guys in fact the machine as well So it was pretty cool case and that's where the Tagging with a mitre attack framework could be very cool because then you can kind of highlight automatically So it's kind of very strange samples and which looks cool when you do a presentation and I think that's it for us So we have the code repository Where we have most of the code we are still in the phase of cleaning a bit of it like removing our coded API keys and stuff like that and Also, we will find the full papers that we submitted to Norsak To get accepted to the conference On this GitHub repo. So expect maybe in the next few days Middle of next week to have all the codes we actually produce to be put there and probably cleaned and maybe documented We're doing our best


Okay, so we'll start today by asking if there's any questions. Yeah. Can you post a PowerPoint before class, because I'm right now. Can I post a PowerPoint before class? Yeah, I will try. I didn't get to you today. So, yeah. Any other questions? There, I guess I can reiterate a question that came up before class. The question was in the form of, there's some error or something is wrong with the lexer. I changed one line in it, and it doesn't work on this completely new grammar that it wasn't designed for. So this responses, yeah, that sounds like a problem. It sounds like you should look into the lexer and figure out why it's not doing what you want it to do. So it's a great quote. Oh, I don't know. Okay. All right, so we're going to go right along this here. Yeah. We're allowed to use, like, I modified the old lexer. Yeah, so that's fine, right? Yeah, yeah, so you can use the lexer that was given to you previously. You're allowed to do that. You have to remember that that lexer is not for your grammar and your specific tokens and language, right? So it's up to you to make that work with whatever you want to work with. Yeah. You can do whatever, you can do whatever you want. You can have it as an external file. You can copy that code directly into it. You can rip out functions from there and use those directly and throw away all the rest. I don't care. I'm just saying, like, it's not plagiarism if you use that code. That's basically all that statement says. Any other questions? Yeah. You got to speak up. So I don't understand a lot. So you uploaded it and the testings didn't pass? So it sounds like you have a bug in your code and you're not implementing a spec correctly. So you have to read through the investigation and understand what your output is supposed to be. All right. Anything else? All right. Okay. So just to refresh everybody's memory since, well, maybe I don't need to since we just have a midterm. So hopefully you're all full of knowledge on everything that we've done up till now. Or has it all been empty onto the page? I just don't all know. I don't all knowledge. That's exactly what I as an educator want to hear. I learned just enough to pass your midterm and I forget everything as I go forward. Awesome. Well, more things to learn so that you can forget them later. Okay. So we talked about how to represent how we can draw memory diagrams with the box and circle diagrams, right? So that helps us visualize and understand the semantics of assignment and how assignment works in a program. The one thing we didn't talk about and this will help finish us out on semantics is what about memory allocation? So we kind of looked at, like, now offered some other things at a very high level and we didn't really get kind of into the details about what they mean, what the semantics is. So memory allocation basically refers to very generally how to create new locations, the new boxes in our box circle diagram, new locations and reserve that associated the address, the memory address that is associated with that location. And so we're not going to go into the details of the memory allocation system. But the basic idea is we need to be able to, our program is going to find some memory that's not currently reserved, right? We want to make sure our, the memory allocation needs to make sure that it's not giving up the same memory to the same parts of, to different locations, right? Because then you'll have a huge problem when you try to dereference or access that same memory. So and after memory is out and so after some memory is found that's not currently reserved, it's either going to associate that memory with a variable name in the case of the declaration, we'll see. Or it will somehow reserve that memory and return the address of that memory to our program so we can use it. So in the case of malloc, this is essentially what malloc does. It's finding us a free piece of memory, an address or it's finding us a free unreserved location in the memory and then it returns the address to that location. So then deallocation is really pretty easy, right? It's the reverse of this process. So deallocation says, okay well this is how we release this location back and say this address can be reused. So how to release it? Because otherwise if we never were able to release memory, right? Our program would just keep consuming memory over and over and over until they eventually consume all the memory in the machine and then crash. So this is kind of a high level, the two concepts that we think about when we think about memory allocation. Questions here? Okay. So there's three main types of memory allocation. So these are very important because it's going to help you think about how long are these allocations valid for? So one is global allocation. So this would be global variables. So I think about when is it allocated and when does that allocation end? So global memory is allocated once. It's done once and it's never deallocated because various parts of the program could use that memory. Because that address or that variable is global, right? It's accessible to all parts of the program so it doesn't make sense to never deallocate it and give it back. And to say unreserved that memory address. The other really important type of memory allocation is stack allocation. And so this is when memory is, so the name comes from the memory being allocated on the stack but as far as I know that distinction isn't super critical. But what's important here is that this memory is done automatically when a scope comes into scope and is deallocated when it comes out of scope. So this is things like nested scopes or function calls. So when you have a function call, those local variables are stack allocated. So they're allocated on the stack. They're available to the program. And then when that function ends and returns, those are automatically deallocated by the program, right? And this is kind of, you can think of it in some way as this implements the scoping rules that we've been talking about, right? So the scoping rules in C are variables are valid in the scope and in the block that they're defined in. And so here this is why. So we have to, when we declare a variable, right? We need to have some memory, some address, some location that's associated with that. And so this is done on the stack. And then when the function leaves, we leave that block, then that gets cleaned up and it's no longer accessible. So it essentially gets, that memory gets released back to the system so it can be reused. That's the one? Okay. The third one is heap allocations. So this would be something that you're all very familiar with. So this is when allocation is explicitly requested by the program or specifically the programmer, right? So this is using functions like malloc or the new. You're requesting, hey, I want to create a new location, create that new location and give me back the address to it so that I can use it. And what's not said here, what's implied here, if your program is explicitly allocating that memory, well, it's up to you to explicitly deallocate that memory, right? So that's why you have to, in C, I'd call free after you malloc something when you're no longer using it because unlike these previous two allocation types, stack allocation is just done based on scope or function calls. So as soon as that scope is done, the program knows they can clean up all those variables and they're no longer being used. Whereas with the heap, when you malloc something, well then you're saying, hey, I want this memory and I will be responsible for deallocating it and giving it back when I'm no longer using it. Questions there? Okay. So now we look at some examples and try to identify what types of allocations are being used in the program. So this is, I believe, from the practice midterm, I want to say, both from there. And so let's think about some of these variables and think about where they're allocated. So what about this variable up here at the top, which of those three types of allocation is this? Low ball. Low ball, yeah. So it's allocated once and that memory is never deallocated. So it's always valid throughout the entire execution of the program. Cool. That's pretty easy. Okay. Let's assume that we're in Maine and we're about to go into this block. And then so where is this care star X? Where is that location? How is that allocated? SAC? Low ball, heap? SAC. SAC? Why? Was it? Yeah, so we did request new memory. So we're going to call malloc. So it's clearly not a heap allocation.  It's a variable whose scope is this block. So we know that it's only going to be accessible during this block. So after we leave this block, we know we can get rid of it and automatically deallocate that memory. So I actually didn't go into it here. But what's the value inside X? Was it? Testing. Testing. No. Yeah. So it's a memory address and the location that that address is associated with has the actual bytes testing followed by a zero at the end. And actually what the compiler does is it sees this literal string and actually turns out into a global variable of actually kind of by X. So that's actually how it does this here. Cool. But I forget the details here. OK. So let me execute some stuff. Doesn't really matter. Then when we leave this scope, what happens to care star X? It's deallocated, right? It goes away. That address, whatever address was there at care star X, whatever address that location had is no longer there. What happens to wherever testing is? Does it get deallocated? What was that? Yeah, it's a global. It's a global. So no. But it's not explicitly global. But yeah, if you're looking at how this is done, that's actually how it's done. It's kind of cool. Yeah. So after care star X was deallocated, can you assign another variable to the phrase testing? Would it find that testing in the global? Or would it create a brand new one? It depends on the implementation, I think. I think in C, it will probably reuse it because that variable is probably a redundant memory, so you can't write to it and change it. Because that's the big problem, right? Because if you were to change this, use X to try and overwrite something in testing, would you actually do that? I'm not 100% sure. But depending on the language, some languages will do that, is they will make sure that any reference to testing is going to point to the same object, basically. So yeah, they'll try to reuse it. That'd be a fun thing to test. Okay. But then we get into a function like, let's say, var. So where is var C stored? What's the type of allocation? Stack. Stack? Yeah. How are you going to stack? It's a local. So you can either use process elimination, right? It's not global. And it's not being mallocked. So it's stored on the stack. Here, we actually have the value, right? So the value inside the location associated with C, is going to have the value of C. So that's actually going to be there, as opposed to, in this case, we had a pointer, right? So there, I have the address of the string of testing. And then we get to the end of this function. And it gets to the end of this function. And what happens to C? The allocated. Yeah, goes away. It's no longer, it's, whatever address is there, can be reused by the programmer. Okay. Then we get into var. So what kind of memory allocation is int star x? We'll say stack. So int star x, what is int star x? But x is the name, and it's bound to what? A location. It's bound to a location, right? There's a box. And so that box, is that box stack allocated or heap allocated? Stack allocated, right? So we have to make room for int star x, wherever we're going to put the address. Right now, when we put into it, where did that, where is the address that we end up putting in x? Where is that? How is that allocated? Heap. Heap. Yeah. So remember, we have to make the distinction between, okay, malloc itself is heap allocating a location. Right? Returning some location. Returning the address of a location that it creates. But int star x is stack allocated because it's a local variable just like care c. Okay, so then we get to the end of this function and then what gets deallocated automatically? Int star x. Int star x, why? Because it's on a stack. Because it's on a stack, it's stack allocated, right? So int star x goes away, what about the malloc, the memory that we malloc? No, it stays, right? Yeah, we told the program, hey, give me the sort of technically, well, I guess it depends on the exact system, but most systems are going to be, hey, give me four bytes of memory and that's that size of the value that we can store in this location. But by calling malloc, we're telling the program, hey, we'll out, we'll free this. Don't worry, I definitely know what I'm doing. But then we end up, well, we'll get into it in a second. So this leads us into memory errors, which are everybody's favorite programming problem, especially if you're in a place like C or C++. So I don't know, for global memory, is that deallocated when the program ends or is it just picked up some time by the operating system? It's an interesting question. So the question is, does global variable get deallocated when the program ends? I guess it's kind of a philosophical question as to what happens when a program ends, right? So the memory does go away, but you're not executing anything in the context of your program that could ever access those. So if you're thinking about it in the context of this program, there's never a location in this program where X is not allocated. I think that's how we can think about it, right? So in that sense, no, there's no possible way that X could ever be deallocated during the execution of the program. As far as your other question, I mean, yeah, technically that memory goes back to the OS as soon as our program terminates, but that's all memory that we use in our program. Any other super weird tricky questions? Not that those are discourage, definitely encourage. Okay, memory errors, super fun errors. So there's basically two classes of memory errors we're going to talk about here. And one is what we call a dangling reference. So this is when you have a reference to a memory address that was originally allocated, so that was allocated at some point, but is now deallocated, so now it doesn't really refer to anything valid. Like the thing about in the circle box diagrams, we have a value in there that doesn't point to any box, it just points somewhere, right? So it's dangling, it doesn't have something that it's actually pointing to. So in the second big memory error is garbage. And so this is when we actually allocate some memory, usually typically on the heap, right? Because of global allocation, we don't have to worry about deallocating. Stack allocation is done automatically. So this is when we allocate memory on the heap, and it's not then deallocated, but it's not accessible by the program. So there's no way for our program to access or reference that memory. And this would be when we... Well, we'll get into examples of this, but so yeah, this is memory that we've allocated, we've said, hey, give me a certain amount of bytes, the program goes, yay, give us a location, and then we, well, we'll see in a second, we forget about it, or we have no way later to reference that memory. And so then it's garbage. There's no way for us to clean that up or to deallocate it at any point, explicitly ourselves. Questions? How does garbage clean up work if you don't know where it is? The question is, how does garbage clean up working? We don't. So the difference here is we or the program doesn't know, has no way to access that memory. So if you have a garbage collection system, what that does is track all memory accesses, and then it can see, it sees what you can see and calculates the set of all memory, essentially you can think of it, you calculate the set of all memory you can reference, which is something here, and then the set of all memory that's been allocated, and if there's anything that's not overlapping, then it knows that, hey, you've allocated something and you can't actually reference it. So it can go ahead and clean that up for you. So it's very, it's intensive. It can be expensive, yeah, but the flip side is you don't have to worry about automatically, you don't have to worry about explicitly deallocating memory, which can be nice. So it's got trade-offs, but. So if you're running, would you want to garbage more on smaller programs or larger programs? What is a smaller program or a larger program? Like a program, yeah, it's tricky. So there's like a whole field of research in the garbage collection. There's some ways you can do it in parallel with another thread or on another process, and so how can you do that and deal with same processes and things? So, well, we can't work, but right now we've got to deal with at the bare minimum, or what does garbage mean? We need to find these things. So let's look at an example. Okay, so here we've got a function at the top foo, we have a second function bar, we have another function main, and main is going to declare an int star, so called dang, and where is dang allocated? Stack. Yes, exactly. Okay, so dang is going to be set to the return value of foo. So we know that foo returns an int star, so we know that that's good. We're going to recurse into foo, and foo has a local variable x, and so how is x allocated? Stack. Stack. And it's out here on the stack, and the value 100 is placed in the location associated with x. Right, so we have x that's then stack allocated. Then when we're returning is the address of x. So address of x returns what kind of value, an l value and r value? R value, yes. It's going to return to r value, which is the address of the location associated with x. Right, so it's going to return that, fine. Then we get to the end of this function. What happens to x? Deallocated. Yeah, it gets deallocated, right? We've reached the end of the scope where x is valid, and so we get to the end of the scope, and now x is deallocated. But, you know, we're still fine on all the types, right? We've returned an int star. We've returned an r value, which is the address of an integer. And so we're going to take that r value that we get from foo. We're going to copy it into the location associated with dang, put it in the value there, and say, good, okay, well, let's continue. So now we get to the next statement. We're going to print out some information to try to see what's going on. So the percent p, print f. Anybody know what this does? Print a pointer, what does that mean? Yes. So it prints the value in whatever you pass. So it prints the value there, it prints it out in x. That's the only big difference. So you can see, kind of, it's a lot easier to think about memory addresses in terms of x values, but I'm going to start looking at enough of them. Okay, so it's going to print out the value of whatever's in dang as a percent p, so as a x value. And then the percent d is going to do what? Print out what? Print out a character, a frame, an integer. Yeah, an integer, right? And so star dang, what's that going to do? Yeah. Print out a character. Wow. What are the semantics of what's right here in front of us? Print out values associated with the address. Right, so yeah, the star, right, the star operator is going to take the value that's in dang, look up that location associated with that address, and then this print out is going to print out that value there. So yeah, that's all it's doing. Then we'll call bar, bar comes in here, creates values x, y, and z, where are these located? Stack allocation, yeah, so we're going to print them out. We're going to print out y and z, and then we return, then we return what happens to y and z. It is beautiful. They get deallocated, yeah. Yes, they get deallocated. Okay, let me get into here, here's the next print out statement. It's the exact same thing. We're going to print out the value that's inside the dang as a hex value, and then we're going to print out the integer that dang is pointing to, so star dang. Okay, so what's going to happen when I compile this on a CentOS67 operating system? So is it going to compile? They say no, but will it compile? It'll give me an alert, maybe, we'll see, yeah. Everything is absolutely not going to compile. Okay, so yeah, so it's going to give us a warning, and it's going to say in function foo, function returns address of local variables. So actually the compiler does kind of see what we're doing here, but it allows us to do this just fine. It still compiles it. This is only a warning. So it's still going to actually compile this program for us. And then when I run it out, what's it going to output? So are we going to know what's in here? Are we going to know this percent P? Yes, no? So are we going to argue for one side? Yeah. So what about this percent P? Right here. So this is going to be a memory address. Whatever memory address is inside dang. So basically you can really think about it whatever if returned by foo. So I guess the question is, can we guess what that's going to be before name? No? Before name. Before we run it. Right now. Could you tell me what that, what is how it's going to be? No. Okay. No. So how did I already hit it? Okay. So star dang. Ah, that's fine. Okay. So star dang. So it prints out a hundred. But does it have to print out a hundred? No? Yes? Maybe you can find it. Well, just a question. I'm asking the questions here. I guess with respect to C then, when you deallocate memory from the stack, it doesn't do anything with the values, right? So a hundred still could be in it, or something else could have already written to it in the background. So yeah. So from the semantics, right, we're using, we're trying to access memory that's been deallocated by the program. So really the semantics here, anything can happen. It could give us an error because we're trying to access memory that's been deallocated. It could return the value that was in there. Or it could return anything, yeah. The way the program is certain space of memory that is, that belongs to it, so since there is no other allocations between when you store the value into X and when the value in that location is printed out, then yes, it's going to be. But as a guarantee by the C standard, if you rank this on every single C compiler, is it always going to be 100? No, because you can't rely on this behavior, yeah. What happens if I thought the 100 would be more of a local? This 100 here? Yeah. So this X here is local to this function foo. So it means every time you call it, a new in X is allocated on the stack. So stack allocation, 100 is copied in. And then when this function returns, that memory is deallocated. And then you can bring it back to the system to reuse. Not only personally, but just like we had earlier. Oh, so basically you can think about it, like I'm returning the address of a variable that's only valid in this scope. So the high level console, this is, so dang here would be a dangling pointer because it's pointing to, or dangling reference, because it's pointing to something that the system has already deallocated. I'm guessing this is going to be referenced if you call bar, but I'm guessing because it's a stack, it popped off the top, let's just say a dereference, right? So when you try to allocate something else locally, it'll replace that 100 with whatever value that is. It could, who knows? So that's kind of the thing, right? So the big thing is, and the reason why that's a compiler is because you can't rely on this behavior being consistent across different compilers. You can say, well maybe on this specific system, I think I know what it's going to do, but actually the compiler could be smarter than you and could say, well, I'm going to actually inline this function foo so it's no longer an actual function call, so the stack is actually never changing, so then maybe x is something else, and so it can do all kinds of objectizations. It can just return zero, I mean that's a valid thing to do because an address isn't valid after you dereference, or after you deallocate it. So yeah, so the compiler could just say replace foo with like a, I don't know, return zero or return 100 or whatever. So yeah, okay, so what's the next thing that's going to print out? The next line. Yeah, 10,000 and zero. I guess I'm using these. I actually count every time. Yeah, 10,000, so it's going to, so it'll print out this line, right? It's going to go into bar, call bar, printf is going to output 10,000 and zero. So yes, that's what we expect, right? That's no funny business going on in here. It should work just fine. So the next line, what's going to get printed out? So same address and what's going on? Hopefully another value. Maybe another value. Is it going to print out 100? Probably not. Probably not. I guess you're wrong. You're considering a set of all possible values that could print out, then yes, it's probably highly unlikely it's going to be 100, but okay, so just happens to be, so same memory address, right? So the value inside of dang did not change, but when we dereference dang, it now points to something that has a value of zero. Very weird. And the reason is because that memory has been deallocated and it just so happens that this system reuses that memory very quickly. So it actually is accessible and it got changed somehow when we called bar. Now we don't know if that's exactly from this line of z, so that z happened to have the same memory address as what we pointed to here. It could be, it could not be. But now we can look at another example on the Mac here. So this is running the GCC that's probably claimed. So is it going to compile? So why yes? Why don't you say like, definitely yes. What's that? Yeah, that's actually a good answer, right? So it's a valid, I mean, okay, I guess, so it's a valid C program, right? It compiled on one compiler. It should definitely compile on another valid C compiler. Otherwise we would have problems with our compilers or problems with our program. Okay, but it's also going to give me a warning. It's going to say address of stack memory associated with local variable x return. Now of course the compiler here is being very, actually this is kind of nice, it's being very helpful and showing me the exact code where it's doing that, which is kind of cool. But I could, you know, I could be smarter than a compiler to get around these warnings, right, and create code that looks kind of funky but was semantically exactly the same and it wouldn't do complain at all, it would just do it. Okay, what happens when I run this? Is it going to be the same address that you saw previously? Why? Because, no. Because what? Why is it not going to be the same address? Yeah. Doesn't it have some kind of like queuing system like, hey, you want memory, take this one, and then now you're at a different place in the queue. Ah, maybe at some level. So there's a couple different layers in here, so we're going to adjust this program layer. So the short, I guess, answer is no. There's no guarantee that we ever get the same memory. Like the layout of memory that we get is not guaranteed at all by the C semantics here, right? It could put us at, I don't know, starting at zero and going down, it could put us at wherever it wants to. Yeah, you could compile it again, right? Yeah, you could compile it again, it would be completely different. If the computer cuts you a slice of pie, you could probably be in a different part of the computer, right? No. So there's also, the other tricky thing, operating systems, are you taking an operating system yet? No, I think it's over. Is that in here in it, or you kind of took it? Okay. Yeah, so there's also virtual memory. So there's a physical memory of the actual bits on the memory chips in my computer. Those have addresses, but if every computer can reference, or every program that's running could maybe mess with each other's stuff, you basically want it so that each program thinks it's using all of the memory, and the operating system maps between them and says, oh, actually, in program X, your location 1,000 is actually on this chip, in this specific memory location, where program Y, your memory address 1,000 is actually a completely different part. So you have two programs with the exact same memory. They think they have the same memory location, but it's really different physically. So that's kind of a long answer to say. I mean, they could have it, but really we're running it on a completely different operating system, and modern operating systems have stuff like ASLR, which is called the address-based layout randomization, which explicitly randomizes where things are in memory every time the program executes. So not even each time it's compiled. So, yeah, so here we get a different address. We get 100, which is interesting, it's the same. So then the next print, what's it gonna do to that? 10,100, yeah, that's not gonna change. So what about next? So what's gonna be printed out? Same address, and something, that's good. Okay, so same address, yeah, definitely same address, but now it prints out 10,000, so weird. Yeah, so specifically why it prints out 10,000? Yes, so it may have to do with that, it may have to do with what other things it could put onto the stack in between function invocations, it could do with how optimizing the compiler is, it could be a lot of things. The big point here is that, like, here we're trying to access memory that's been deallocated, so the results of which are undefined, unknowns, this is a really bad memory, this is a really bad error, because if you were reliant, if maybe you made this mistake, and you're reliant on that value changing to zero or not changing, but now it changes when there's a function call or depending on what functions or what compilers, right, you have a program that's doing weird, crazy stuff, so this is why it's a really big memory error. So if at a point in a program execution, like I said, okay, here, does anything have any dangling references, like what variables have our dangling references, you'd be able to say, oh yeah, dang here is a dangling reference, yeah. Could you use it as a random factor? It'd probably be a very poor random factor and maybe the same every time you run it, just it would be different on different systems.  Okay, so this is one thing, so this is returning stack-allocated memory, returning the address of stack-allocated memory and trying to use it. So there's another way we can get a dangling reference. So here we have some code, so we're declaring now two variables, stack-allocated, so dang and foo are both stack-allocated, and they're both in stars. So we have dang and foo, and then we're going to malloc, so this is what kind of allocation? Heap allocation, yeah, so we're explicitly allocating an object. We're malloc-ing an integer, we're saying give us an integer, so it creates a location, it assigns the address of that location into the value of dang, then we say foo equals dang, so after this is executed, what's going to be the value in foo? The address of what? The value. So yeah, so this line before is going to take whatever the address of whatever location that malloc creates for us, it returns that address, it copies it into the value of dang, the location it says there is dang, and so this line is going to copy that value into the value associated with foo, so now foo and dang are both going to have an address in their value, and that address is the address of the location that malloc created. Okay, then if we call 100 equals, a star foo equals 100, what's this going to do? Yeah, set the value, so copy the value of 100 into the value associated with star foo, which is our star foo, which is the location returned by malloc. Okay, then we call free foo, so what does free do? Yeah, so this is our explicit deallocation, we're telling the system, hey, we're done with this memory, take it back. So we call free on it, now what happens when we print out star dang? So what's inside dang? What's inside the value of dang? Which address? It's actually returned by malloc, but is that a valid address? Why? Right, because it's then deallocated, that address has been freed with free foo, right? Free foo doesn't mean, hey, free this value that's on the stack, it means hey, take the address that's inside foo and deallocate that memory, and it happens that dang foo will point to that same location. So we print it out, it's gonna try to be here if that prints something out. Then we're going to malloc a new, a new pointer, set it equal to foo, and what's star foo, so 42 is going to accommodate the value 42 into that location returned by malloc. Then we're gonna call free foo to deallocate what? Yeah, the new malloc memory location, so this malloc, perfect. Then we're gonna print it out again. So, when I compile this, is there gonna be any errors? Are there gonna be any errors? No errors. No errors? Yeah. Did you find string literal? Did you free a globally defined string literal? No, because it hasn't been heap allocated. It has to be malloc. So the way this is working internally, malloc creates some bookkeeping to know the size that was initially created and all that stuff. So when you give it that same pointer back to free, it knows how to look up and say, oh, this means I'm freeing and then that pointer plus the next eight bytes or whatever, and now that's free and we can use it again. So in that case, no. So, okay. Any errors? No? I don't think so. No. So, no errors? What about warnings? Yeah, why? I think we'll tell you that you're setting the value. What line is it going to give you an error on? Or a warning on, let's say? Yeah. This one? Yeah. So what do you think? Who thinks it's going to give us a warning on that line? Who thinks it's not? Who's on Facebook? Okay. So it turns out it doesn't give us any warnings or anything. So this is actually a very kind of classic problem with languages like C. So here I have two pointers, dang and foo, and they just happen to point to the same location, right? So the compiler, to understand that there's a problem here, would have to keep track of that and have to keep track of, oh, these are pointers that actually point to the same thing, and that means when you free one, like here, that means the other one is now dangling pointer and is pointing to unallocated memory. In a simple case like this, it may be able to do that, but for an entire program, thinking of all the possible memory allocations, it just becomes crazy. And so this is why it's actually very difficult to statically analyze a program like C to say, hey, are there any security vulnerabilities? Well, it's really difficult because these pointers can point to the same things, and you can free things and change things, and anyways, it gets crazy. So this is actually, I think, why it just gets in the errors. Yeah? You mean it's going to give us an error or not? Yes. I also don't know. I have to test it. It'd be one of those things. It definitely wouldn't give us an error. It may give us a warning. It couldn't possibly. So when we run it, what's it going to output? How many lines is it going to output? Let's start with easy questions. Two. Two? Okay, what's going to be the first thing that's going to output? A number. Big correct. Most likely 100. Most likely 100. So most likely 100. What's another likely candidate? A random number? Zero. Zero? We should just shout out numbers all day. So it turns out, in CentOS67, when I compile this, it outputs zero first. And then this next start dang, what does it output? Zero again? It does output zero again. Why? I actually don't know. Well, I have a suspicion of what it's doing, but let's compare it to what happens on the Mac when we do it. So is it going to give us any warnings? Maybe. It doesn't, though. And when we look at it, so it outputs, so it actually outputs 100 first, right? Which is kind of weird, because we freed this memory. So even the next output is? Zero. Zero? 42? 100? 42. So yeah, it actually outputs 42, right? Which is pretty crazy. And so this is because the malloc can freeze, so the memory allocation here thinks that the address that it returned before has been freed. It can reuse that address now, right? So it's perfectly valid for it to return that address on a subsequent call to malloc. So just as a little aside, I'm pretty sure this is putting zeros in here, because it actually helps your program if it zeros out the memory when it frees it.  Whereas here, if it's the same value after you free it, you're probably going to have this bug in here for a long time until something weird happens or something changes, and you don't wonder why that happened. So hey, it's a small segment. Okay. So these are the two different ways that you can have dangling references. Do you have a question? So that's the crazy thing. So that's what, so dang is pointing, so the value inside dang is not changing. So that's the address returned by the first malloc, right? But once we call free, malloc is free to reuse that address because the free says, hey, release this address, release this location. You can now reuse this for whatever you want. And so when we call this next malloc, it just happens to reuse that and say, hey, here's some memory. Here's the address. It returns it to foo. Then the star foo sets that equal to 42. And then it just so happens that those happen to point to the same memory location. So yeah, it's just a weird implementation detail. That is absolutely something you shouldn't depend on because we have a dangling reference here in our program. And so it's outside the C specifications. Whatever happens is essentially random or could be guarded, whatever. Any other questions? Okay. So these are two types of dangling references. Now we're going to look at another one, which I can't remember what this example came from. I think it was an earlier one. Maybe this was. Okay. Okay. So for example, we have main. So we have an int star star of q. So this is what type of allocation? Global. Global allocation. Global stack key. Q is global. Okay. We started executing in main. So we're going to have an int star A. What type of allocation is this? Stack. Stack. Okay. And then we go into this block. We have an int star B. What's this location? Out here? Stack. Stack. Okay. Now here we're malloc-ing memory, memory location A, storing the address of that location into the value in the location associated with A. Then we're malloc-ing a new piece of memory that happens out of the memory address of the two. We're putting it in the value of the location associated with B. Then we're setting star A to be 42. So at this point, do we have any dangling references? No. You could maybe say that a Q may be dangling because we haven't put anything in it. We'd probably specify something like we did on the midterm where I assume all pointers are pointing to null so it's not really dangling at that point. Okay. So no dangling. Do we have any garbage? No. Maybe not. No? You talking about for Q? For B. For B. If it zeroes it out, it leaves it as it is. What do you mean by that? Yeah. Are there any, so to rephrase that, so garbage is any, are there any locations that we can't access? No. So there are, at this point in the program there's five locations, right? There's Q, there's A, there's B, and then there's the two locations returned by malloc. So remember we can access the locations returned by these mallocs with star A and star B, right? So we can actually access all the memory that's been allocated at this point. Now when we hit this line, so now what we're doing is we're calling mallocs. We're creating a new location. Its memory address is three. We're copying that three, that value into the location associated with B. So then we're going to do, I don't know, star A is equal to star B. Star B is equal to star A. So we're taking, what, 42 and copying that into whatever just got returned by mallocs, whatever's at location three, or whatever's at memory address three is going out of the value 42 inside of it. Then we're storing the address of A and putting it in Q at the top. So we get here at point two. Are there any dangling references? Yes. Yes. What? The first B. What do you mean the first B? There's only one B. What does the dangling reference mean? Three times? Yeah. No, dangling reference. Just spend two slides with me. Yeah. We're pointing to something that's been deallocated. Exactly. So we're pointing to something that's been deallocated. So we're pointing, do we have any addresses inside of our pointers that have locations that have not been, that have been deallocated? No. No, so we have Q, right? Q is pointing to A, so it has the address of A. A is still valid. It hasn't been deallocated yet. We have B. B is pointing to, has memory address three. This is still allocated. And we have A, and A is pointing to this allocation, which we have for free. So we have a dangling reference. Do we have any garbage? Yes. Yes. Which memory address is garbage? Two. Two. Right? So here, after this, we can no longer access this memory location. There's no combination of stars or address operators that would get us to this memory location, too. So then we go over here, and then we say, ask the same questions. Are there any dangling references here? Yes. Yes? What's the dangling reference? B? So is Q dangling? What's the address in Q? A. Is A been deallocated? No. So Q is not dangling. We'll say A. What's the address in A? Memory one. Is memory one been deallocated? No. No. So that's not dangling. Is B dangling? Yes. Is it a nonsense question because B is out of scope? Yes. Yes. So right now, if we're talking about what a dangling reference is, right? The only things we care about are Q and A because B has already been deallocated because it's on the stack. Okay. So that's dangling references. So Q and A are both not dangling, but do we have any garbage references? Yes. Which are the garbage? What are the garbage references now? Memory two and three. Why not one? Yeah, because A has the address of one. So by accessing star A, we can get to memory one, whatever the term by this amount. But this malloc went away already, right? We lost our reference to that. It became garbage when we assigned B to this one. But now B was just deallocated. So now we have no way of accessing memory three that was allocated here. So now that's gone. Yes. But it would create a location. So it would put the address of whatever was malloc into in star star, in your in star star. And then it would just create a location with no value. So you could get in star attack as a pointer, but you're not pointing at anything yet. Does that make sense? These are the daggers. Let's check out the daggers. Okay, so yeah. So at point three, we have no dangling references, two garbage locations. Yeah. So you could think of these as symbolic addresses. So yeah, so maybe you're trying to get too well. Could we take the address of one of them at one, subtract one, and maybe get to the other one? Right. Yeah. No. So the thing to think about now, that's still garbage, because we can't access it. So these could be completely random numbers. They could be in no relation to each other. Our purposes, they are pretty much symbolic. All right. Any other questions on this? In the program, and will the heap memory be delegated to the application? The same response. So yeah, it's, yes, the heap memory will get free by the program. It's not like it's going to hang around forever. Yeah. But you need to be careful, because I mean, a lot of the programs that you write are longer in programs, right? If you're writing a GUI application, or you're writing a server application with two of the main types of applications, right? It's going to be running for a long time. Any garbage that you create is going to accumulate over time. And then all of a sudden your program, which was using 50 megs, is now using five gigs, and it's destroying your whole system. All right. So now we're going to briefly touch on one thing. So we're going to kind of, it's going to feel like we're going to go back to assignment semantics, because I want to show you different types of assignment semantics than what we've been talking about. So we've been talking about copy semantics up until now. So we've been thinking about A is equal to B. Where are the semantics of this operation? Do you want to go? Assume the voltage is, yeah. Yeah, so I'll be more specific. So copy the value of the location associated with B into the value of the location associated with A, right? Exactly. So that's what we've been talking about. So this is copy semantics, where the assignment semantics is copy. Take that value, copy it to this other value. There's another type of semantics that maybe we haven't thought about, but it's called sharing semantics. So in this case, we have A is equal to B. So now we're going to actually, instead of copying values, we're going to bind the name B to a location associated with A. So here in our circle box diagram, we're going to change the bar of the binding of A to a different location. And so kind of a famous language that has this kind of semantics is actually Java. So we'll look at an example. I will admit right now I did not compile this in Java. So if you see any mistakes, let me know. I'm pretty sure it's mostly right. So we'll see. So let's see how sharing semantics actually changes this and how we do the circle box diagram for something of sharing semantics. So we have an object A. So do we have a little kick? So we know we have a name A, right? Do we have a binding for this A? Not yet. Not yet, because we haven't assigned it to everything. And do we have location associated with this A? No, it's just the name. So yeah, we have A bound to basically nothing. And we get to B, same thing. We have B bound to nothing. And now here we have the assignment operator. So it's similar to malloc. So it's creating us a new object, a new location. And now our sharing semantics say bind the left-hand side, bind the A to the location returned by new. So let's say it's some object, whatever. So now we finally have our binding. Then when we do the same thing with B, so we're going to create a new, new is going to create a new location with an object and the values. And it's going to bind B to that new location. Now when I create a new object A, now I'm getting rid of this binding. I'm changing this binding dynamically at runtime. And I'm going to say, OK, well, there's a new, create a new object like this. And then I'm going to bind A now to that new object. And so have I created any garbage at this point? Yes. Boxes, one, two, three, starting from the top. Which one is garbage? Box one. Yeah, the top. So there's no way I could reference this location anymore. OK, then I get to B is equal to A. So before we had copy semantics, I would copy the value in A, copy it into the value of B. But now with sharing semantics, I'm going to change the binding of B to bind to whatever A is bound to. So now I'm going to change B. So now it's bound to A. And now they're both bound to the same object. So any changes I make to A are going to change the same object when I access it through B. And so now you have two pieces of garbage. So now I have two pieces of garbage, right? Object one and object three. So this is what you remember about Java? No. No? OK. You should look at our program for Java. So at this point if I do A equals 20 and print B after that, would I get a 20? Yeah, so now if you change A, so accessing A is going to access this location. And then accessing B afterwards is going to access this location.  Or do most average programming languages work this way? Like does C plus plus work this way when it comes to objects? Or does this can be? I think the answer is it depends. So Java doesn't have raw pointers. So that's why you can think of a semantics in terms of this. You can also flip it around and think of, it has copy semantics where everything is a pointer except for primitive types. But it's actually, this is kind of a cleaner way I think of thinking about it with the object model. So I believe C plus plus, it's still copy semantics. Which is why you have to deal with pointers and everything. Right, and you're creating new objects and all that kind of stuff. Any other questions here? Alright, good to make the time. Okay, we're going to finish semantics. Could you ask a project question instead of starting with material? Because you had chances at the beginning of class that's probably a question. Okay, good. Type systems. Super important. So you talked about semantics. So I mean, I guess technically type systems is a part of semantics but the semantics we've been talking about are really kind of basic semantics. So what does assignment mean? What does, oh jeez, I don't remember. All the pointer operations, what do they mean? What are the semantics? What do they mean behind these programs that we write? And so the type system, type systems are all about, well, kind of, I don't know, they kind of restrict in some sense the set of programs you can write. So if you think about all possible programs you could ever write, the type system actually restricts what you can do. There's some programs you just can't write because the type system won't allow you to write them. So is that a good thing? Maybe? I might think it is. Is that a good thing? That thing? Type systems. You find yourself loving the type systems. You find yourself hating it and fighting with it. Depends on yourself. Depends on what? I don't know, I'll move that in. I'll move that in. You think I'll move the compiler, is that it? Yeah. I hope not. Yeah. Sometimes I feel like I have to jump through loops to get my programs to work how I feel like they should, especially when I start getting into pointers and addresses. So yeah, so there's some time where maybe you feel like you know what you're doing and the type system is in your way from trying to do what you want to do.  And then you realize later that oh, actually I now have a bug because I like asked this to a thing when it's not really that thing and now I have a huge problem. So man, I should have listened to the type system. So does that ever happen? Yes. No? Yes.  Okay. Yeah, so it kind of works both ways and it really depends on the specifics of the type system. So sometimes it can be overly restrictive to where you feel like you're in a straight jacket and can't code properly. Sometimes they can be almost too expressive and not restrictive enough where it's easy to write programs with bugs in them or maybe you don't know there's a bug until you actually try to run the program. I actually kind of felt that way the more I go with Python. Not that the type system is bad, but it doesn't do the type checking statically before it runs. So oftentimes my fat finger variable or something can make the types don't compare, right? I don't go until I run and hit that piece of code which may happen today and it may happen a week from now. So yeah, it kind of depends. But here we're going to talk about type systems generally and talk about what are all the components inside of a type system and what kind of decisions does a language designer have to make about the type system. So informally we can talk about a type system, a type in a programming language specifies some set of values and operations that can be applied on these values. And so a type can be associated with either a variable or a constant. And when we talk about values, so we're not talking necessarily numeric types, we can specify function types that we'll see in a second. And so there's four, is it four? Okay, looking ahead. Four major components when we talk about a type system. And these are all the decisions that the designer of the language has to think about and you, the programmer, have to think about understanding, well, will my program type check? Is it compatible with what the language specifies? So the language is going to define some basic types, right? So what are some basic types? Integer. Integer. In what language? Does C have an integer? Would you define it as an integer? Or about like a long, or a wide int? Yes? These are all integers? They are all basic types, right? So this is kind of the difference, right? So C has the basic types int and they have car and they have byte and they have long. Those all have, so once again, these types have a set of values, right? So an int can store a set of values that are actually machine dependent on what values can be in there. So most of the time, it's a 32-bit integer, but on different systems, it can actually be different, which is kind of crazy. Yeah, so, and on different systems, it's different, right? So some systems, like, if you're going to be like modern one, but I know like CommonList actually has an integer type and it is, represents all possible integers. You don't have to worry about, ah, is this going to be more than 2 to the 32? And then I'm going to have to like cast that to a double or a long or something, or a 64-bit int. You don't have to worry, like the compiler and the system will take care of that for you about changing and dealing with the type. So sometimes, right, the language designer has to deal with the machine, has to make that trade-off between, well, what are the types on the wrong machine because if I give the programmer that power, maybe they'll be able to write more performance programs. Whereas, like, well, really, if I want an integer, then I don't want to stop at 2 to the 32. I want to represent all possible integers. So with basic types, we'll just make it great for a good type system. What do you need on top of that? Is this all you do every day? Just use basic types. Yeah, use a defined type. So the programmer needs a way to construct types, right? Because if you can't create your own types, then you're stuck dealing with whatever the language designer thought of, and that may not be, you know, that's going to restrict you, and it may not be expressive enough. Another thing to think about is can the compiler and or the interpreter infer types? So we'll get into exactly how this is done. We're actually going to go really in depth into here. But even in the case of, let's say, I don't know, what's the result of an addition operator when you add an int to a float? What is the result of that? So the program has to have some way of inferring oh, that's the result of this operation. And then the big thing here is how does the language define type compatibility? So when are two types the same and when is it going to give you an error and say, hey, this doesn't type check. This is wrong. So type declarations. So the program language is going to have basic types which we talked about, which is included in the program language and is available to any program written in that language. So you don't have to do anything special to use these types. Whereas type instructors are a way for a programmer to define new types and really help you to define exactly what you're trying to do. Okay, so type constructors. So in addition to types, we're going to kind of define here a little bit just so we can talk about these things. Kind of a general type constructors so we can think about type systems without thinking about specifically the C type system or the Java type system even though we will kind of talk about those things. So we can construct a type that's a pointer to T where T is some type. So in C the syntax for this is in star, in star, star, in star, star, star, star, star, star, star. The star indicates it's a pointer to whatever that type is without the star. We may want to also be able to define a struct. So what? So how do you think of a struct? Basic types or what? I don't know, I'm just curious. How do you think about a struct? Do you think about a struct as like a new thing? Do you think about it as... I always think of it as like a package. Information. When you use it you're saying give me all of this information. Right, so... Think about a struct as has fields and each of those fields has types. So I kind of think that if you're grouping up these types that you wanted to this specific group. So the classic example whenever I talk about a point on a plane I'm always going to talk about a double X and a double Y and those are going to be my types but more generally we can define a struct as having some fields a1, a2 all the way to ak that have associated types. So here the syntax is field name, colon type semi-colon, new field name, colon type where every ai is a field name and ti is a previously defined type. We can talk about defining arrays so we can define an array as a range of a specific type where range can be either single or multi-dimension and we can specify the length in here specifically and how we address the elements. I'll get into this in a second to show an example. But here we're specifying that that array, all the elements in that array are the same type and they're this type t whatever we say here. Then we can talk about functions. So functions are type t1, t2, all the way to tk that returns some type t and so this means that we're defining a type of a function and the types of the parameters are t1, tk, and the return type is t and we'll get into this more on Wednesday.