.We have completed our discussion on waveguides and resonating cavities. What you want to do now in the remaining lectures that we are left with in this course, we will be discussing the theory of radiation. Now, when electromagnetic waves are sent through a waveguide, now it is necessary that we convert them into freely propagating electromagnetic waves which can propagate in free space and so that they can be picked up by a receiving mechanism. And the things or the devices which do this they are known as antenna. So, basically the way it works is the following that we know that we have studied electrostatics and we have seen that when we have charged at rest it generates an electric field, we call them electrostatics field. However, if you look at charge in uniform motion then in addition to the electric field because this is a current and we have seen that the current is a source of the magnetic field. So, this will give rise to both electric and magnetic fields. However, if we have charges which are accelerating then this will emit radiation. Now, an antenna is a physical device to either transmit or receive electromagnetic waves or electromagnetic radiation. So, this is what we are going to be doing in today's lecture and the next. But before you do that as usual let us recollect our Bible namely the Maxwell's equation. And we had seen that the in this case will be only involved with the two of the curl equations. Namely I have got del cross E is equal to minus d v by d t and so notice that we know that we can define a vector potential curl of which is the magnetic field. So, this is minus d by d t of del cross A. Now, if you bring this to that side what you get is that del cross of this quantity namely E plus d A by d t that becomes equal to 0. This is an equation which we had seen earlier and we have seen that if del cross of a quantity becomes equal to 0 we should be able to express that quantity as gradient of a scalar function. So, that tells me that the E can be written as minus d A by d t and as has been our practice we will take minus of a scalar function. Let me write it as grad v. We had seen that it is possible to formulate the Maxwell's equation in terms of the potentials rather than in terms of the fields. And if we take what we called as the Lorentz gauge in which we had del dot of A plus 1 over c square d v by d t was equal to 0 then we had seen that the scalar and the vector potential satisfied a very similar looking equation namely del square v minus 1 over c square d square v by d t square was given by minus rho over epsilon 0. And if you looked at the vector potential it satisfied a wave equation of this type. So, this is the pair of equation which essentially replaces the Maxwell's equations which are in terms of magnetic and electric fields. So, we have instead written them in terms of three components of the vector potential and a single component of the scalar potential subject to the condition of course that the Lorentz condition Lorentz gauge is valid. Now, so we need to solve these equations. Let me now notice that these equations are very similar and so therefore, I need to only worry about one of them. And once I have solved one the other one can be written down primarily by analogy. So, this is the equation I have got I have got del square A minus 1 over c square d square A over d t square equal to minus mu 0 j. So, in principle these are all functions of the position vector x and t. Now, what we are going to do is how does one solve these equations. Now, to get this we use what are known as the Green's function technique. But let us look at this first we define what is known as a Fourier transform. So, this is written like A which is a function of x and t that is given by a factor 1 over 2 pi which we have been taking in our definitions of Fourier transform minus infinity to plus infinity this is time Fourier transform. So, nothing happens to the space. So, we write it as a function of x and omega e to the power i omega t d omega. Of course, you could invert this relationship and write this as a of x omega is equal to there is no 1 over 2 pi there because of the way we have defined our delta function. So, this will be A x t e to the power minus i omega t d t. So, this is the Fourier transform and what we want to now do is this using this Fourier transform we want to write down this equation. So, let us do that. So, we need to write down how much is del square A minus 1 over c square d square A over d t square. So, substitute remember that del square is a derivative with respect to space and when we wrote down the Fourier transform this was with respect to time. So, therefore what we do is that we write down the expression for A x t and in terms of the Fourier transform equation and take the del square inside because the integration is with respect to time or frequency. So, this is minus infinity to plus infinity. So, I have got del square which remains as it is. Now, since this is going to be A is going to be proportional to e to the power i omega t. So, this d square A by d t square is equivalent to multiplying this with a omega square over c square this times A x omega x is and e to the power i omega t d omega. So, this is this is the way my left hand side looks like and this is equal to minus mu 0 j of x t once again let us write this down in terms of Fourier component of j itself. So, which is 1 over 2 pi integral minus infinity to plus infinity j of x omega e to the power i omega t t omega. So, notice one thing that this essentially is an integration over various Fourier components that is there and if you compare this equation with this it is obvious that we can write down an equation for the Fourier component of A itself which will be del square plus omega square over c square acting on A of x omega is equal to minus mu 0 j of x omega. So, this is this is the equation which we have. So, what we will do is we will try to solve this equation there by obtaining an expression for A x omega which is the Fourier transform of A x t having obtained an expression for A x omega we will take the inverse Fourier transform and find out what is A x t. Now, notice that an identical operation can be done for the scalar potential v and the equations will be obviously identical because the equations satisfied by A and the potential v are identical. So, let us look at what is to be done the way to solve this equation. So, this is the equation that I have got. So, just for convenience let me write define omega over c as equal to k which is of course, the wave vector. So, let us write down omega over c equal to k and in terms of that what we get is del square plus k square A of x omega is equal to minus mu 0 j of x omega we need to solve this. The way these types of differential equations are solved is to obtain solution of a subsidiary equation and that quantity which you get is known as the Green's function. So, let us look at the definition of what is Green's function and what is it that is there in the Green's function that makes the solutions of these equations simple. So, the Green's function will be a function. So, let us write it down I write down del square plus k square the Green's function is a function of x and x prime and that is equal to that is defined as this quantity is equal to minus 4 pi this is this is in 3 dimension a 3 dimensional delta function of x minus x. So, notice that what has happened is the inhomogeneous term on the right has been replaced by a delta function and so what does it actually mean this tells me we will let us write it down and see how it works out that A x omega can be written as equal to mu 0 by 4 pi I will come back to the proof of this and then integral of a convolution which is g of x minus x prime j of x prime omega and we integrate it over this intermediate variable that we obtained namely d cube x prime. Now, this is obviously not obvious as yet, but let us look at how does it go. So, if you take del square plus k square operate it on your A x omega. So, first thing is to notice is this is mu 0 by 4 pi this integration with respect to x prime whereas, the del square is with respect to x. So, let us just put it put in an x there. So, this is equal to this into del square I again put this little x there plus k square g of x minus x prime. Now, notice that here j is with respect x prime. So, therefore, this del square operates only on this k square is of course, a scalar. So, this multiplied by j of x prime omega and d cube x prime. Now, we have seen that this quantity del x square del square plus k square g of x minus x prime is nothing but a delta function. So, I get minus mu 0 by 4 pi integral. So, this is minus 4 pi delta function of x minus x prime and of course, j x prime omega d cube x. Now, notice that this delta function enables us to do this integration immediately. So, that j of x prime omega what I am left with will be simply j of x omega 4 pi and 4 pi cancels out and I will be left with minus mu 0 j of x omega as I expected it to be. So, therefore, once I obtain the solution of the Green's function, the solution for the corresponding equation for the vector potential or the scalar potential can be written like this. So, let us write it down once again. So, what we said is that my Green's function equation is del square plus k square g of x minus x prime is equal to minus 4 pi delta cube of x minus x prime and in terms of this we have seen that a of x omega is given by mu 0 by 4 pi g of x minus x prime j of x prime omega and the integration is over the variable x prime. So, this is what we are interested in and this is the equation the Green's function must satisfy. So, when we look for solving this equation I notice that this equation must be spherically symmetric about the point x prime. Remember x prime is a variable of the source and so as a result g of x minus x prime as we have already assumed must be a function of x minus x prime. Let us denote r as equal to the modulus of x minus x prime. So, this is to be satisfied everywhere other than at x equal to x prime because that is where it is a delta function. So, let us first look at what happens accepting at r is equal to 0. So, if r is not equal to 0 then the delta function vanishes and I am left with del square plus k square of g which is a function of r that is equal to 0. Well actually I should have written x minus x prime explicitly that is equal to 0. Now, since this is spherically symmetric I express the del square in spherical polar and since there is no r theta dependence.  You multiply this r there. So, I get d square by d r square of r g plus k square of r g is equal to 0. This equation is very familiar to us because, but this is an equation which is for r times g. Therefore, let us write that down. ..  It could be in principle plus or minus i k r I will come back to this little later. Therefore, my g in principle can be written as a times e to the power i k r by r plus some other constant b times e to the power minus i k r by r. We need to evaluate this constant, but remember that this is a solution which we have obtained accepting at the origin. So, let us write down r is not equal to 0. Close to the origin if you want to the way the delta functions are handled you take a small sphere of radius r naught going to 0 and integrate what we had. So, this is over a small sphere this equation that we had written down here del square plus k square g r is a delta function this is the equation. What we do is we integrate both sides of this equation by taking a sphere of radius small r 0. So, this is del square plus k square g d q r that is equal to minus 4 pi integral over r 0 delta cube r d q r and since the origin is included within this range of integration. This integration is straight forward it simply gives me minus 4 pi. Now, look at the left hand side if you look at the left hand side I have a term here which is integral k square g d q r and we have seen that the solution for g because I am taken a sphere of radius r 0. So, on the I have to worry about what happens on that sphere and this is k square times g there is no discontinuity there.  So, this is equal to since there is no angle dependence I get k square 4 pi from the angles and there is a r in the denominator I get r square d r. So, as a result I get a plus b integral 0 to r 0 of r d r. Now, this is of course, equal to r square r 0 square by 2 and when r 0 goes to 0 that is as a if I make the radius of the sphere very small this quantity goes to 0. So, I notice that on the left hand side this term k square g d q r integrated is actually 0. So, what I am left with is simply a del square operating on g and integrated. So, let us do that. So, integral over r 0 del square of g d q r must be equal to minus 4 pi. So, we have seen that as r 0 goes to 0 my structure of g has been g is equal to a plus b by r. So, therefore, what I get here is this notice I have a del square a plus b is constant and I know del square of 1 over r is minus 4 pi times a delta function. So, as a result my left hand side gives me minus 4 pi into a plus b and right hand side already has a minus 4 pi and that is simply using del square of 1 over r is equal to minus 4 pi times delta cube over r. So, this tells me that the constants a and b must be such that a plus b must be equal to 1. At this stage I need to look at what my structure is. So, my general Green's function is a e to the power i k r remember capital r is x minus x prime by r plus b e to the power minus i k r by r subject to the condition that a plus b must be equal to 1. Now, I do the following look at the structure the what I am looking for are solutions which are basically outgoing from the source. So, in principle I can take b is equal to 0. Now, this is mind you this is not mathematics this is purely on physical reasons I could take b is equal to 0 because my outgoing wave must go as e to the power i k r by r this is a spherical wave and. So, therefore, I will assume that b is equal to 0 it is also possible to talk about a equal to 0 in which case this becomes an incoming wave. So, this is the solution that you get the Green's function is given by I have written explicitly instead of capital r e to the power i k x minus x prime modulus by x minus x prime modulus which is an outgoing wave and e to the power minus i k x minus x prime by x minus x prime that is my incoming wave and as we have seen that a of x omega is given by mu 0 by 4 pi g of x x prime j x prime omega d omega and here I have simply substituted the expression for g of x minus x prime corresponding to the outgoing wave. .. So, I will rewrite the final expression once. So, I get a of x omega is equal to mu 0 by 4 pi integral e to the power i k modulus x minus x prime divided by x minus x prime j of x prime omega d omega. So, this is this is what I get for the structure of the vector potential and as we have seen that if you want to instead solve for the potential function v then of course, this one will change it will become 1 over 4 pi epsilon 0 instead of j I will have a rho, but other than that because the homogeneous equation the Green's function definition is identical. So, I can use the same Green's function to solve for both vector potential and scalar potential. Now, what good does it do? Starting from this I would go back step after step and my things will be like this I will convert this by a inverse Fourier transform to j of x prime t. Now, if I do that x prime let us call it t prime after this I will use that expression to get a x t by taking the Fourier transform the whole thing. So, let us look at how it does it go. So, this is equal to mu 0 by 4 pi integral I am not doing anything here right now i k x minus x prime by x minus x prime. Now, this is j x prime omega which is and I am going to write down in terms of j x prime and a time variable which I will call as the t prime minus infinity to plus infinity j of x prime t prime e to the power i omega t prime and d t prime. Notice that there is still a dependence on omega. So, therefore, I need now to write down what is a x t which is the inverse Fourier transform of this quantity. So, this is equal to 1 over 2 pi and I had mu 0 by 4 pi integral of d cube x prime by x minus x prime. Now, notice that I am right now not writing the exponential part because if you recall my k was equal to omega by c. So, therefore, since this is omega by c times a distance. So, we will use that. So, this is d cube x prime this integral d t prime j of x prime t prime and an integral of e to the power minus i omega t prime plus i omega t plus i times this is k. So, therefore, this is omega by c into x minus x prime d omega. So, what I have actually done is to combine all the terms which have omega dependence and this of course, integral over omega is doable. It will give you 2 pi times a delta function and. So, therefore, let us write that down that will be mu 0 by 4 pi d cube x prime by x minus x prime integral d t prime I am not being careful to write all the integration values d t prime j of x prime t prime minus infinity to plus infinity and this is a delta function 2 pi times delta function that takes care of this t prime minus t plus omega by c x minus x prime. This will enable us to do this time integration. So, that t prime will be written as t minus this. So, let us write it down. So, my a of x t will be mu 0 by 4 pi integral d cube x prime by x minus x prime integral of that delta function enables us to do this integration. So, therefore, there is no integral actually times j of x prime and t is equal to or rather t minus x minus x prime by c. In a very similar way you could write down the expression for the scalar potential which will be v of x t which is given here in this screen and. So, this is it, but let us look at what does it imply. This remember that x prime is basically the a coordinate of the source because this is integrating the all the points where the current density or the charge density is there. So, therefore, these are source points. So, x prime is the variable corresponding to the source and x is the field variable that is in principle any point where I am calculating a of x t. So, this tells me that the time at which I calculate the current density is not quite the time at which I calculate the potential function, but is an earlier time and this is this time is earlier by an amount x minus x prime by c. Now, this simply tells me that supposing I have a disturbance generated at certain time or I am interested in calculating the potential at a given time t then this potential is influenced by a wave which came from the source at a time earlier than the time t by an amount that by a time duration that is taken by the wave traveling with a velocity of light c to cover that distance and that is your x minus x prime divided by c. So, these are what are known as the retarded potential. The retarded because the potential at a given time t is determined by the potential by the disturbance generated or the current density or the charge density at an earlier time and hence the phase retarded. Remember the other solution of the Green's function that we had which was b e to the power plus i k r over r minus i k r over r. Now, you could if you did that that is an incoming solution. Now, that is something which is not very clear to us at this stage the that will simply give me a t plus here which can be then what we are trying to say is that the disturbance is given by a I mean the potential is determined by a disturbance which is generated later. So, that is the incoming solution will for this moment not discuss that aspect it are these are the retarded solutions that we are interested in. They are fairly simple this is nothing, but the way you normally expect a solution for a x t and the only difference is that the time instead of being the same time that would corresponding to axonite a distance, but or a instantaneous change, but we know that a disturbance takes a finite time and this disturbance which travels with the velocity of light would take a time x minus x prime by c to reach the point where we are interested in calculating the potential. So, with that let me now take some specific examples what we will assume is suppose I have a localized source localized oscillating source. Remember I made a statement that if there is a an accelerating charge it will give rise to a radiation. Well the simplest accelerating charge that we take is a charge which is oscillating with a time frequency omega. So, let us take this j of x prime t prime which is what I want as j of x prime e to the power minus i omega t prime I am sorry that t prime is not written here, both of them should be t prime and likewise a x t is given by a x e to the power minus i omega t. So, let us see what is it that we get going back a little bit this is my a. So, this is this is what we obtained and we are now saying that we will be only confining ourselves to the time variation of a x t which go as e to the power i omega t. So, this is what we want to do now what I have done is to write down on the right hand side the expression for the a that we wrote down just now. And if I am saying that the variation in a goes as e to the power minus i omega t and this was the expression that I had obtained for the vector potential a of x t. So, this immediately gives me a an expression for a of x and remember all that I have done is to say my time variation must be simply a of x into e to the power minus i omega t. So, this is the same expression which we wrote down and. So, therefore, what I do is this I pull out the e to the power minus i omega t there and I left with e to the power minus i omega t into this expression where if you recall k is equal to omega by c. So, this is what I have written down. So, this is my a x t and the corresponding a x or v x will be given by mu 0 by 4 pi integral d cube x prime e to the power i k x minus x prime by x minus x prime e to j x prime. So, this is the integral any one of them that I need to evaluate. Now, before we proceed with the evaluation of these integrals let me tell you that there are three distinct regions that one considers. The firstly we assume that the variable x prime is confined within a small distance. Now, this is like saying what is the extent over which your charge distribution or the current distribution takes place. So, this is essentially my size of the antenna for example, if it is a transmitting antenna. So, the x prime is a quantity which is whose magnitude in some scale is small. So, let me let me say that quantity is given by d. So, d is the essentially the dimension of the source. Now, when we say something is a localized source we compare this dimension with the other scale that I have in the problem namely the wavelength. So, I assume that the wavelength of the emitter radiation is much greater than d. So, d is the region over which the current density or the charge density varies and is non-zero and I am taking oscillating source as we have said. Now, so I have a scale which is lambda I have a scale which is d. Now, I need a third scale which is the distance from the source where you are making the observation. So, based on that I split the problem into three different regions of interest. The first region is what is known as the near field region. So, look at this my capital r which is x minus x prime modulus and lambda as you remember is I am sorry this is a lambda is 2 pi c over omega. So, there is a error there actually it is 2 pi c by k 2 pi by k is lambda, but then k is omega by c. So, it is 2 pi c over omega let me write it down. So, that there is no confusion. So, lambda is 2 pi by k which is 2 pi this is what we got. So, my three regions are a near field region this is the you are looking at the fields near the source which means now notice that I have d is much less than r, r is the distance where I look at the potential and this r where I make an observation is much smaller than the wavelength lambda. So, this is what I would call that is wavelength is the largest dimension next is the distance at which I make my observation and d is of course the source parameter. This will see there is a region where which is called an intermediate field region this requires lot more rigorous solutions we will not really be talking much about it. So, this is d much less than r, but then r and lambda r of similar orders of magnitude. Finally, I talk about what is not as a far field region in fact most of my interest will be in this region which is also known as the radiation zone or radiation field region and here d is of course much less than lambda still, but then lambda is much less than the observation distance r. My primary interest will be to look at this region and this region I will make some comments this is the region where it requires lot more rigorous you know the solutions and we will almost not talk about that. .. So, what happens in the near field region remember that my r which is the distance between the source and the point of observation namely x minus x prime and we had said that well once again the same error per seats. So, lambda is 2 pi c over omega now if I have d much less than r much less than lambda now remember what I am trying to do is to look at that e to the power i k r by r term. So, what is k r? So, k is omega by c. So, this is equal to omega r by c and so that is equal to 2 pi r by lambda and this quantity since lambda is much greater than this r and notice that capital r is just the modulus of the distance from the source. So, therefore, this is much less than 1 now if it is much less than 1 then I can write down e to the power i k r which was appearing in that as approximately equal to 1. Now if you substitute for that e to the power i k r I get a of x is equal to remember the time dependence is only on e to the power i omega t is equal to mu 0 by 4 pi integral d cube x prime j of x prime e to the power i k r is taken as 1. So, this is x minus x prime if you look at this expression this is the expression which was familiar to us in when we studied the magnetostatics. So, therefore, the I may say that the fields are quasi stationary the only variation the time variation in the vector potential comes because of the e to the power minus i omega t. The effects are the same as what one would obtain if I had a steady current the expressions will all be the same I can borrow the entire mechanism of the magnetostatics and simply multiply with that e to the power i omega t to get what my time dependence vector potential is. So, this is a statement that I have been making that the near field is essentially quasi stationary as I said I would not be saying much about the intermediate field. So, let us go over to a discussion of the far field which we also have been saying as the radiation field and this is this is of great interest to us. This will involve certain amount of complicated algebraic manipulation, but nevertheless they are all fairly straight forward. Recall that I am having d much less than lambda much less than r. So, this is my so let us write down x vector x let n be the unit vector along x. So, that I write this as this and let us indicate the magnitude of x by r. So, that this is n times r I am writing this as a small r remember capital r was vector x the modulus of vector x minus x So, in my expression for the vector potential. So, I had that e to the power i k r over r. So, let us write down what is x minus x prime which appeared in the denominator. So, this is as we know is square root of x square which is r square plus x prime square minus 2 well x dot x prime, but x magnitude is r. So, therefore write let me write it as r n dot x prime this raise to the power half and that is equal to r I am just doing a binomial expansion.  So, this one goes away I am left with n dot x prime should be a minus sign there plus of course, this what I get actually what I require is not quite this I require 1 over x minus x prime. So, I need this quantity here same r square plus x prime square minus 2 r n dot x prime raise to the power minus half and you can carry on this the standard binomial expansion I am showing it and you can see that there is no great mathematics here I simply will do this binomial raise to the power minus half and I will get an expression like this. While I will complete this derivation next time let me tell you what I am going to do what I am going to do is I am going to use this expression x minus x prime expression in the argument of the exponential and this expression to divide it and then get an expression for what happens to e to the power i k r over and then do an approximation on the far field and from there we will have an expression for the vector potential and the scalar potential and then by calculating the curl of the vector potential I will get the magnetic field and from the magnetic field the electric field etcetera etcetera. So, we will continue with this the next time.


This paper proposes a novel unsupervised anomaly detection framework for natural gas-fired gensets in district heating networks. The framework uses machine learning algorithms to analyze SCOTA data and identify anomalous behavior. The model was tested on nine major failures of a genset in the Aosta DH plant in Italy, and it successfully detected anomalies before they resulted in unplanned downtime. This article was authored by Valerio Francesco Barnabe, Fabrizio Bonacina, Alessandro Corsini, and others.


All right Cool all right well morning everyone Thursday, hope you all are doing well out there in Quarantine land And Yeah, okay, so a couple things Actually, there's updates on all the assignments so on the web of trust assignment it I'm sorry for some of you that I maybe gave an accidental Heart attack and additional stress too So I there was a bug in my grading script and it missed a whole bunch of your submissions So they weren't included in there. So yes, I know Right away that there's a problem when I got 20 25 emails. No, it wasn't certain users. It was It was just a I don't know. There's a bug in my grading script that it wasn't picking up your And it wasn't importing it into my local key ring where I have everybody's stuff So then when I went to go create it your all your signatures you submitted were not on there I'm not really sure why exactly that happened. It's kind of a baffling bug for me, but Anyways, we fixed it regraded and got that all Sorted out so I apologize for that The other interesting thing that came up with that, of course, we got more signatures Which means we got more scams. So there's actually a person who got 27 Signatures on their adversarial key. So congratulations to that anonymous person. That was actually the winner Yeah, so that was pretty impressive that's roughly I mean less than but it's still not that much when you think about it, right? We have about 350 people in the class and so that's even less than 10% of the class. So that's you know for as For as high as that sounds in terms of scamming you actually all did a great job of either detecting that or and being vigilant Cool, okay assignment five So I wanted to discuss this a little bit. There's something funny actually another bug that happened here a little bit Did anybody so I know some of you did the extra credit part of assignment five How many day people in this in the chat attempt assignment five the extra credit? Yeah, so some people got it a lot of people tried it For the people that tried it one of the most difficult things is that it There was no intelligence given about what the distribution of the key was The funny thing that I want to share with you is that it actually turns out there was a usually the distribution there is I don't know what it's pretty difficult and that I haven't had people. I think only a few people have actually done it in the past What happened was when I was creating the grade scope version I actually had a bug and I duplicated the line from part four So it was actually the exact same as distribution as part four. So it was only five character I think lower case or something like that It wasn't lower it wasn't all lower case, but it was five characters, right? It was uppercase n numbers. Yeah, so that was not exactly what I wanted, but So it's funny. I was thinking about it It's a interesting way when you have no intelligence about what the Distribution of the key spaces it makes it actually much more difficult to even approach the assignment, right? Because if you knew that exact key space you could easily search through that I'm not gonna say what I'm going for because maybe I'll use it in the future But definitely more than that. So no, everyone does not get extra credit. That's not how that works it still fits within the spirit of it because Everyone didn't know what the distribution was so Yeah, it just happened to be easier than I thought it was going to be so that I thought was pretty funny cool, okay So then now On to a new assignment assignment six. So this is actually before I start I guess this is one of my favorite assignments And I hope you'll find it pretty cool too. This is essentially the culmination of all of our This is the culmination of all of the things that we've been talking about here So we're gonna put into play and you're actually gonna do basically hacking of binaries and other types of things so this is gonna combine everything we've learned and done with The bandit levels so the bandit levels will come in super handy here You'll be reversing stuff. Yeah, all kinds of how do I There we go, okay all kinds of fun stuff so You actually have a lot of time on this assignment, but I urge you these are kind of like puzzles and challenges so It's very difficult to keep them all for the end. So please start early on this assignment it's due on May 1st and We're not gonna do any late submissions because finals week is the week after that So I want everyone to just like focus on this assignment and then the assignment can be done And then you can focus just on the the final and So the So the goal so you're gonna be breaking a number of levels. Yes, this is going to be the last assignment and So I'll show you we'll walk through this. Actually, I'll do it right now So What you will do is you'll all be given So assignment six is currently live on the site But you don't have any way to start it yet because you don't have a username password So I'll be providing that with you later today Very So stick with me on that. Okay, so when you get all set up you'll SSH into this machine and From here You'll notice so it's just an Ubuntu 18.04 So this is kind of why we went over those bandit levels. So, you know how to interact with this know how to access this on the command line and What will happen is? So inside the directory LSS LA var challenge So in the directory var challenge, you'll see a number of Different challenges. So there are these are essentially different challenges that you have to break. So For in so and Let's see Yeah, so let's look at one of these. So essentially so if we look and this is where it gets into The why set you ID is important So essentially the way this all works under the covers is in each of these levels here under challenge There is some kind of executable that is here We can see it's set group ID executable the s bit on the group execute And this means that it runs with the privileges of the just dash execute dash meet group And so we have handy tools There's a Utility called score that when you run this will output Who's solved what on which level so this shows you this is kind of like a cool leaderboard that you'll see people moving up as they play the game and The goal is so I'll show you I'll even tell you how to exit Break the first level called just execute me which spoiler alert all you have to do is just execute it So you do this It says who congratulations. You broke this level Adding you to the group just execute me. And so if I run the score now, I'll see that I have I have a check mark under just execute me So there you go. That's how you break this first Yeah, this is the easy one. There'll be a more difficult one It gets more difficult. Let's see And okay, some other tools you need So there's a program if we look a Program called leet so this program the idea is if you trick so You have to when you break this level so If you think about it here, right, we have this just execute me that Challenge so essentially what this is doing is the way I know that I've broken this level is because it adds me to the group Just dash execute dash me but So if I control this binary, I can get it to do whatever I want And so what I want to have it do is to execute this command leet user local bin leet because that will add me to the level So the entire point of this leet command is To help you when doing this So once you break one of these levels and you're operating as that group this leet command adds you to that group forever And that's how you actually count it as your point. So it'll depend. Let's actually look at object dump dash D Actually can't remember what this does. Let's look at it the main function Yeah, so It's calling exec Vee Which is execute with some stuff and if we run strings on it, I'm sure we'll see you what it does Yeah, user local bin leet. And so if we run it with S trace we can see the system calls that it writes So here we can see that it's calling If we go to the very top top top Execute, okay, so this is basically all that just executing does is call User local bin leet That's all it does so it executes that command. So this is essentially so let's say for instance Some of the challenges will call it for you and that's why when you break it, you'll get that Get the level if it doesn't call it then you'll have to force it to call that so that's with Using some of the vulnerabilities. We'll talk about so the idea is you we actually haven't covered all the things That's necessary to break all the levels. We'll do this as we work through the the binary hacking The application security slides But start it now there is plenty of things to work on and to start on now So it's super important Okay, cool Yeah, so that'll be good There's a list of tools here. So if you don't know these tools, I highly encourage you to Check them out object jump gdb l trace s trace Wireshark is what we talked about the network tool SCP is very handy to copy files from your local machine to the server or from the server to your local machine So you can analyze them that way Let's see. Okay, so Let's see answering some of the questions Yeah, you'll get using password combo later today, so I'll make a post on piazza of how to do that and where to get it from Yes, you can change the passwords that you get that's totally fine recommendations on which ones to start Yes, we are still having a final we'll talk about that in a second So Okay, so evaluation so Each so the entire assignment is essentially out of a hundred points each level is worth 12 points With a maximum of 105 points that you can earn from breaking levels So I'll let you do the math on that but essentially it means If you break all 10 levels you would get 105 points Now there is another extra credit, so this is actually just a tool to incentivize you to start early on this assignment And so if you finish five levels just roughly What's 60% of the assignment is that right? By the 24th so basically a week before the deadline you'll get an additional 10 points on the assignment And this stacks with the previous one So this means total the maximum points you can receive on assignment is 115 out of a hundred cool and then Submission instructions so submit Basically if you write any kind of code or anything just like we've done in previous assignments Submit that along with a read me and the read me is really important here because we want to understand that you know how to break these levels so Submit a read me file that has your name your ASU ID and some description of how you broke each of the levels And so there'll be a grade scope assignment where you can submit this and we'll see that there There is a bug bounty on this server So I'm giving you permission if you manage to get root which means You have privileges of the root user then you'll get 50 additional points So I will say The reason why this is here and not part of the extra credit is because this is a not intended thing It's a bug bounty. So it is No, it's never well I'll tell you a story in a second. So Yeah, so it's not intentional, but if you happen if It does happen. I want you to tell me about it and you'll get 50 points so that I can fix it I'll tell you so I borrowed the concept of this assignment from Giovanni Vigna who is a professor at UCSB and when I was an undergrad taking undergraduate security course He had an assignment like this. He had a very similar bug bounty thing and actually the very first thing The very first thing that I did was figure out what Linux version it was I found that it was vulnerable. I downloaded exploit and got root on it basically immediately I mean if you have the ability to get root you should be able to get the rest of the points very easy as well So that's kind of on you So anyways, I've seen it done in the past. Nobody has done it in any of these assignments I like to think I'm more careful in setting these things up, but hey, who knows so It's more there to encourage me to make sure that all the stuff is secure But if it's not I want you to take advantage of this and get all the points Any questions overall on the assignment? cool. All right, this should be fun and now Let's see done with this When should you start for maximum efficiency? Honestly as soon as possible. That's like the because There you can get it's easy to get kind of stuck on some things so you want to You want to make sure you start early, I think that's gonna be the the best way to go We'll discuss the final exam later. I want us to focus on this and then we have on We have an in-class CTF on next Thursday. So I think that's the 16th. Is that right? Yeah So we'll talk about the CTF on Tuesday. Oh, well these I'm telling you I've seen students fail because they start this late and because of the nature of the assignment It's not like a coding assignment that you can just crank out in one day It's very possible to get stuck on these things. And so you need a different You'll I'll tell you this once the assignment gets up it's It's it'll become clear which just which levels are easiest and what things to start with So I don't feel like I need to give you that information It will definitely come up organically with the list of users. Oh There will be and that's on them.  Let's move on. We're gonna talk about XA6 Cool Okay, so back to assembly So to refresh our memory there are What we're kind of focusing on here is how do applications? And how does How does a program that's compiled from a high-level language like see how what is that assembly language that the CPU actually? executes How does that? that happen And so we've looked at how memory operations work So how to move data from a register to another register how to move data from memory into a register and From a register back out of memory There's a number of other operations. So There's move exchange will definitely go a lot into push-and-pop those come up a ton There's also types of ways of doing All our fun binary arithmetic adding subtracting multiplying division increment decrement and Also all the logical operators that we're familiar with we have ands ores X ores knots all those things that we would expect We also have just like in normal programming languages. I Actually don't know the difference between I div and div you'd have to look it up Yeah, a lot of these things. I don't know exactly what the semantics are, but they're all very precisely well-defined So if you look up x86, I div it will tell you exactly the semantics of what that means Then the other thing we need is so When we talk about oh, maybe immediate that kind of makes sense. Yeah, I don't know if somebody looks it up Just link it in the chat so We also need the ability to kind of alter the control of the application So when we talk about control, what are we actually talking about here? Anyone? Okay, I div and div is signed and unsigned Yeah, so the control controlling the flow of the program right the control flow of the program what things execute, right? It's almost second nature at this point, but when we write some line of code like if Foo is Equal to 10 Then print Hello, wow, okay, this is not going great Else Goodbye so So, you know roughly here right where the control what? Instructions get executed changes based on this value, right? So we need some way of doing that in In assembly language as well. So we have a various types of things. We have things Jump is an unconditional jump that just says go to go here. It's kind of like a go-to statement Call and return are going to come up a ton. We're going to definitely go over this. This is how Essentially, we're going to pull apart the covers and understand well when I call it this function print How does that actually happen and how does the CPU know know to go back and where to go back to? Int and irat are interrupt handlers We're not going to get into that a ton, but we can also do things. So these are kind of what we call So these are maybe unconditional transfers So whenever this line of code of this assembly executes always jump to this other instruction Whereas we have other types of conditional jumps. So for this we'd say well jump if not equal jump if equal Jump if I can't remember what ae means jump if greater than or equal I think and The other thing is we can have control flow that is direct. So we're says we say hey If this is not equal jump exactly to this point in the program Otherwise we can actually have indirect transfers. So this says hey if this Jump if not zero to wherever is in this register And then kind of other miscellaneous things and then put output instructions and A not or a no operation instruction So why would we want something like a no operation instruction? It kind of seems silly Why would we want something that does nothing? Yeah, so actually on some CPUs we We actually need a not after a jump statement because of pipe lining, which is kind of crazy We may want to delay certain operations. Yeah different kinds of reasons. So there are actually legitimate reasons why you need this So yeah, it's kind of interesting. Okay, so If we go back to kind of our diagram, right Um, we're not going to get You know, you can take and you will be taking an operating systems course that will go into all the kind of concepts of an operating systems and what it does EAX is a register. So this is the register EAX um And so if we think about we talked about right our app our application is running kind of on the processor And Essentially and this is kind of the very nice thing that we've built up From programming. So you guys have all written, you know applications that have done stuff. Have you ever had to worry about? Talking to a hard drive So the hard drive, right? That's kind of a crappy hard drive, but it's connected to your computer Right. It's uh hdv It has a spinning disk. It has uh, it speaks What is the protocol SATA? I think no, it must be it's some other thing Um SATA is the connection. There's a protocol that it talks to it, right? So there's different. There's hard drives. There's uh SSDs and those are actually different and can have different things your hard drive can be rated. No rate is different It's on top of hard drives Man, I can't remember that protocol I cannot remember what it is, but nvme. Is that it? Okay, we'll go with that for now Scuzzy I think is different too. Anyways, it doesn't matter Okay, cool. Let's uh So the somebody has to tell the um hard drive. Hey get this data at this sector Right. So when you're reading and writing files Uh, what's actually happening, right? So in computer science and throughout all of computing We've essentially created these beautiful abstraction layers So your application doesn't have to say, okay If this is a hard drive connected to it then issue this command to the hard drive If it's a floppy disk do this command if it's a um If it's an ssd do a different command because that's more uh, that has better performance if it's a um flash drive use a different type of command and so We've created this layer where how do you read and write files in your app in c No, that's c++ Yeah, okay, so I'll allow it so open Read And write Or one way There's other ways as we'll see these are um Kind of wrappers around different things, but anyways, so you can call these different uh functions like open So open a file read from a file write to a file And what's actually happening is there's a bunch of logic that's happening in your operating system That handles all of this complexity of how do I actually talk to this hardware device? But your app doesn't have to deal with any of that complexity And so the way this happens we need some kind of mechanism for your application because if you remember Your application is essentially running on the cpu and things are executing So we need a way to signal to the operating system Hey, um, I would like to open a file for reading And then hey, I would like to read 20 bytes from this file that you opened for me or I would like to write 20 bytes to this file that you opened for me I think there's close Similar things happen with networking like we talked about right This is actually the beautiful thing of why our applications don't have to deal with the tcp three-way handshake Because the operating system does it for us all we ask the operating system is hey I'd like to make a tcp connection to this ip address on this port And then the operating system itself will take care of everything Um, and so in order to make this whole thing happen in order to make that these calls happen um We need a way for applications to talk to the operating system and these are through system calls And this is how Your application talks to the os so on and The tricky thing is this varies a little bit depending on the exact architecture and depending on the operating system itself Yes, we are only focusing on 32 bit in this section 100 so what we're doing is so now Uh, when we want to ask the operating system to do something for us, we invoke a system call That our libraries will actually invoke for us, but on linux what we do is we have an interrupt 80 So it's int means interrupt Uh 80 is just by convention the interrupt that says Hey, I want to the application wants to make a system call to the os And then the eax register contains what system call number we want to make so, um So we can actually use this to write our own and I guess we'll do this right now. I think this could be fun Um, we're gonna we can write quickly our own hello world application 100 in assembly So, um, we'd look up. Let's see. I have this We'd look up, uh, linux x86 system call numbers Um Why does this look so ugly? all right, so we can see like, uh, write is Hex four in the eax register And then the other parameters to write the file descriptor to read and write from is an ebx the buffer to read and write from is an ecx And the number of bytes to read is an edx So we can see kind of all of this and we can see there's actually a ton, right? There's uh over 337 Possible system calls that can be called uh in linux, which is kind of crazy But we don't need, um, all of all of this for now This is just to show you where you can get this information from Uh, also, this is exactly how computers work. So if you want to understand security, you need to understand explicitly what's going on Um Cool Yeah, so we can walk through this code.  That's great. I'll install this very quickly cool. Okay, so we have uh We have a dat dot data section and we're gonna make a Uh, the hello world string. So we're saying we want a string somewhere in memory called hello space world slash n Uh a dot text segment Now we're saying, um That our main we're gonna have a main Main label here that we want to be global so when we compile this everyone can see it Uh, so we can actually go through. Let's look at this We'll look at up here Oops, that's not what I want Oh, that's cool. It puts you up there. Okay And the very cool thing is you can use man pages to look at the, uh Manual here is this not uh, is it difficult to read the text? Yeah Okay, how's this? Okay. Well now I have to use vim. So thanks. Um, okay So if we look at what this system call is this is a, uh System call we're writing to a file descriptor um So we're writing to a file descriptor from a buffer that we have a number of bytes So one of the really important things to understand is by default The three file descriptors that are always open for every process in Linux So you have, um, standard input is file descriptor zero standard output is file descriptor one And standard error is fire descriptor two. So if you just want to write to Um, hello write to so essentially what we're going to try to do is Uh, what we want to call is essentially write to file the descriptor one to standard output Uh, the string hello world slash n And we want to write how many bytes is that one two three four? Four 12 I could have cheated and looked at the slides. Uh, this is essentially what we're going to try to be doing So how can we actually accomplish this? So then we can look at our syscall table. This is really small There we go, uh, let's see We can look here we can say okay, right So I need to first move Uh, dollar signed four into eax. So this is the way that I, uh, specify Uh, nope, we will look at this in a second. We're actually going to debug this. It's going to be great. So We're going to move four into eax, which we know here because this says the system call number is four We're then going to move, uh, one into ebx So we're going to move one into the file descriptor. So we're going to write to file descriptor one We're going to move now dollar sign hw So what this is going to do Is the compiler when we assemble this into binary It's going to put this string somewhere and then we'll see it's going to move the address of that string into the The register ecx which we need for this And now we're going to move, uh, 12 into edx Uh, we need to call an int 0x 80 and then at this point it should write out hello world And then now we're because we're very nice, uh, people We're going to exit cleanly. So if we look here It should be one. Oh, that's interesting. Has this been wrong for a long time? Move one, uh, dollar sign eax Oh, okay. No, no, no, that's make sense. Okay And return so we're going to return from this function. So whoever calls us, um, we'll look at this later, but eax Whatever's inside eax when a function returns is the return value. So if we write this out And let's see. Well, let's just compile Oh, cool Okay, and it's all much packages because apparently we don't have all the things here So, okay while this is happening. I will answer the question. So the other beautiful thing that, um The operating system provides is even though an application is essentially executing on our cpu The operating system has Created such protections that it should not be able to take down the whole os So that even if the app no matter what it does because if you remember You'll have different applications running on your operating system So the operating system needs to do super cool things like deciding how much cpu time each process gets So it's constantly switching between them. Also, you wouldn't want it that one application is able to crash or take down the other one So there's protections in place there um So now we can look and we can see we have now an a.out file We can Run it. So we run it. We see that it says hello world is exactly what we wanted Uh, we can use a very cool tool. This is what I showed uh earlier So s trace is a system called tracer. It uses a debugging trace to output all of the system calls that this binary makes Um, so there's actually a lot of stuff that has to happen because you're um, it's loading up all the libraries and everything But we can see as we get to Yeah, wait, huh it says stat one. Why doesn't it say I would have thought it would have said right Okay, but let's uh debug it now Um So now we can just use uh, let's see. Do I even have gdb? No Okay, install gdb Okay, yeah, we can do a few things here. So we can debug uh a.out. I'm going to put a break point on main Uh, there's a great, uh gdb Gdb actually has an amazing manual that has all kinds of stuff of how it works What kind of things it does and can do this user manual? Um, really everything you can learn about Debugging with gdb is in here. It's amazing Um, so what I'm going to do I set a break point on main Uh, so the b is break point. I'm now going to run the program with run Um, and if you're used to gdb, you'll see you'll try to do something like l to list the source code But here we're actually debugging. Um Assembly code so what I want to look at So what I'm using is examine And then I'm telling it I want you to interpret what I'm giving you as instructions And you're going to do 20 of them And it's going to be uh dollar sign eax So now we can see in memory and this is super cool So we're seeing exactly the layout of memory that things are so here At main exactly at 4004 d6 We have our instructions and these are almost exactly the instructions that we wrote we have Move four into eax move one into ebx Now our move hardware This line our move hardware into ecx has been replaced with this. So let's look. What is that x? xss So if I look there I see at this memory location currently inside of our program are the bytes h e l l o and I can actually Uh 12 Is it c? Yeah, so this is outputting each of the bytes. So This is examining the exact same memory location. This interprets it as a string And this interprets it as show me 12 characters in hex. So at the byte level So here it's showing me 48 and if you look up in an ascii table 48 would be capital h 65 is lowercase e 6 c 6 c l l o space w o r l d new line So we can see these bytes are in memory and when gcc compiled our assembly To this l file It told it to load up these bytes of hello world slash n at that specific location So then we can use n i to go to the next line Oh, I see what's happening.  Okay, that's fine. All right Okay, yeah, this is because I uh That makes sense Because I didn't compile it as 32 bit Um So I can single step instruction. So go instruction by instruction I can do n i to do next instruction to step over function calls. So let's single step RIP I can see so I previously moved four into eax I can uh I can do info registers to print out the value of all the registers so I can see an rax I have four in there And my next instruction is going to be move one into ebx Step instruction I can show my registers. I have one in ebx And then my next instruction is going to move That hardware value into ecx And then we can see ecx has the value of our string We're then going to move 12 into ed our edx And then we're going to do in 80 which will print out hello world And then we'll return As you can see so the gdb interface is not great Gf gdb Actually, usually on my machine set up. There's tons of different Configuration things you can use to make gdb better for debugging. I really like especially binary debugging I've got used to this thing Uh So let's install this and see how this changes So now if I go a little bit bigger So now it actually shows me a very nice output. It's showing me at the top, uh, all of my registers Uh rax and I really want to get rid of these. Um And it shows me exactly where I am in the binary so I can single step the instructions and I see that all of this Updates as I'm doing this Yeah, there's other stuff you can use For there's other like reverse engineering specifics. I really like this one. It's it's pretty nice It shows you a lot of cool information And shows you when so like for instance rcx It knows that this memory address is can point to something and it just figured out that this is a string It actually shows you the legend here that says this is some string Uh these the stack locations heap locations All kinds of stuff Cool And I need to Oh, I should do this on the other machine. Okay, that's fine for now Um, cool So, yeah, this is kind of the the brief over Look into how system calls work Um, how we can actually write assembly code that can do stuff and this actually happens all the time So normally in a if you wanted to Uh normally in some function you would say uh main This is not valid, but you'd maybe say printf Something like this, right? Well, what's happening is printf is a library that is a function inside libc and if we figured out Oh, I need the There we go So in this library Provides this printf function, but under the covers printf does a lot of work and then eventually calls right just like this So this is why typically when you write c code, you're talking to a library that does the system call for you So that you have a nicer interface, but this is actually all that's happening under the covers is These things get translated in your library down to these system calls Cool, all right, okay So, okay, so we did that So now So we've seen we can compile this. Uh, we can Look at the file format here.  I'm gonna copy this we're gonna go to All right, uh gcc-m 32 There we go. Now we have a 32 bit binary so we can see that it's an l file. It's 32 bits um Now I wonder if I s trace it Yeah, perfect. Okay. That should be my first sign that something was wrong.  So That's cool. That works exactly as I would want it to s trace showing you exactly what system calls are being called And And now I can kind of step through here. We'll see that the the instructions changed um, but Now I can do things like use the eip register, which is what I thought I was doing. Anyways, okay, cool Okay, so Now as we saw right and this is kind of an important, um concept to understand in your mind and to think about is what Do like what so if we look right remember this a dot out file is just a file on disk, right? It's just bytes that are sitting on the disk. It's actually not different from any other file Like this hello dash s file Right, there's all there's no difference there The difference is that um a dot out is in a format where the operating system knows how to take those Uh bits and bytes in the file put them into memory and then start executing So then our when I run dot slash a dot out it executes that program for me Um So And you can actually look uh, we're not going to get super into it, but if you look at the uh proc File system has a lot of information so ls uh proc Self Let's see. We're looking at maps So if you look at this file you can see I can't scroll There we go So we can see that this bin cat is at various memory addresses and exactly kind of what those look like what's going on here um And so basically this l file gets loaded into memory The operating system lays it out exactly how it shows it here. It maybe does some relocation Which we won't talk about right now And then it sets the cpu instruction pointer at the start address that we saw in the l file. So if we do redel s And We can see the entry point address at 3c0. So that's what it sets as the entry point and then it starts executing okay, so uh couple things so We're going to talk about kind of how the memory is laid out in a process. This actually becomes all this stuff is all intricately tied together when we understand if an adversary has arbitrary The ability to write into memory of a process What kind of things can it do and how does that work and how to specifically the layout work? So the very first thing that you'll notice is In this class whenever we draw memory layout We're going to be drawing it with high memory at the top and low memory at the bottom So that's in all of these types of examples We will always have high memory at top So this would be in 32 bits. So we talked about it The highest memory address will be all f so f f f f f and the lowest memory address will be all zeros Again, this is a another super cool thing that operating systems provide to applications If you think about it, so this application can technically talk to most effectively You know two to the 32 this whole memory range Um But you could have multiple apps that all think they're talking to this whole memory range and The operating system manages this and with virtual memory in such a way that they Actually think they have different views of what memory looks like So the operating system does super cool lies to the system. Um, okay Now Cool So when we write a program like, uh Yeah, I do have emacs. Okay, except you said emacs was ugly. So If I make a little test.c file, um Okay, so what's a typical main function?  Wow argv and actually There's another argument that you can put there that most people don't worry about which is the environment pointer Um, and then I can do things like let's say print f Percent c Percent d argc. So I'm going to print out what argc is I'm going to maybe print f Uh Percent s slash n argv zero Let's just do envp zero See what that outputs And because I'm a good person I'm going to return zero So I can compile. Uh, we're going to compile this again 32 bit So that compiled So if I run this I can see Uh, let's see. So argc was one Um, argv zero was dot slash a dot out and this was envp zero Uh, now if I add foo bar here Three is argc a zero is still a dot out and this environment pointer is this so let's debug this Oh, I want to install jeff again because that's much easier to deal with here Okay, stuff happens. Okay, so we have now our First called a print f. So one of the cool things here So one of the cool things here about jeff you can see it's telling us print f is printing out the first argument is a pointer to that string percent d slash n with argument of one And uh, we can step over the shoot. Okay next instruction. So the print f will print out one and then this next I guess it compiles it down to a puts. Okay, this is not great for this. So let's oh because it's a constant string. Yeah, that makes sense. Okay So no don't you don't you Okay, so um So when we execute this program, right? So the important thing to remember is When we do a dot out, we're actually not doing anything, right? What we're doing is we're asking our shell in this case bash Hey, I would like to execute dot slash a dot out and then it will execute it And if we type in any extra parameters We want it to pass that to the program, but how does this actually happen, right? So this data needs to get from essentially our command line or really from bash into this. So um, what actually happens Is it all comes down to exec ve so if we look up sys call reference So exec ve Is a system call, right? So the other thing that a program can't just do by itself is execute another program It actually has to talk to the operating system and this makes total sense because we talked about um access control and everything else that the operating system has to do the permission model everything like that And how is that enforced? Well, it's enforced because applications can't execute things themselves They need to ask the operating system with by calling exec ve So how do you do that? You pass in the path name and then you pass in a string pointer arg v Which I believe its last argument is null. That's how it knows how many arguments are there and then a pointer to the environment And essentially what happens is all this data gets passed into your program the number of arguments is passed in as arg c Um arg v is what's essentially passed in here and the environment pointer is passed in for you to use So there's a ton of stuff here, but essentially everything eventually calls exec ve And then your operating system Has to then create the process. So when it takes your program and executes it It needs to be able to pass that data. So it first Passes in all of your uh, so your environment variable all of your argument strings are actually in memory This will definitely come up when we talk about how we can use these things to exploit buffer overflow vulnerabilities Um, we have pointers to them. We then have arg c And then we have a section of the program called the stack So why do why do programs? Need varying amounts of memory. So or another way to put this is do programs need a fixed static amount of memory And maybe what are some examples? So what kind of program doesn't need a fixed amount of memory? Chrome that's a good example, but why why is chrome? not a uh Why does chrome need a dynamic amount of memory? Yeah, we need more because we may be reading unknown user input for chrome. We're going to a web page and we're visiting it We don't know how much data it's going to uh, send to us. So we need the ability to Use different amounts of memory. Uh, as we'll see Um, the stack is used for function calls and that'll be super important So essentially the way we're always going to draw the stack and this is again The stack grows from high addresses to low. So it's always going to grow down um And then we have some shared libraries other stuff and then we have another type of data That's the heap that grows up. So We'll see different ways of how this works, but the heap essentially You can think of when we need to allocate like when you call, um Malik or free in c this allocates memory on the heap that's used for you um When you do what's the c plus plus equivalent? Is it new and delete? Is that uh the equivalent I believe? um Yeah, that's allocating things on the heap and so that way that allows your memory to grow in a different kind of manner um And then you have your data sections and then finally you need your text section your actual code So this is kind of roughly the layout of how Memory looks to your applications. And so it's kind of nice. You have this nice dichotomy Where your stack you have two different types of data A memory areas that can grow you have your stack that grows down towards lower memory and the heap that's growing up Uh, so they can each grow in that direction um cool okay So we've actually looked at this a lot. So we've looked at disassembly a ton Uh, so disassembly is this notion and this idea that we want to be able to take those raw bytes. So if we look, uh Right, if we look at hex hex dump, this is actually the bytes that are inside that a.out file So some of it at the top is this is all probably elf header stuff that we don't need to worry about But this stuff in here is actual code and unless you're I guess so well versed in this you can look at this and see the matrix for what it is Really we need something that can decode this for us. So we need Some kind of process and if you think about it What we're talking about here is we originally had a c file that we So we took a c file to assembly And then we'll just call it a like an object file or maybe I will call it an exe for right now like a binary um So you can think of this maybe is like compiled And this is assembled Right and so one way to think about this and this is where this term comes from So this is kind of the forward engineering process right as you make something you have a c file It's compiled to assembly and then assembled to an executable Part of what we're doing is kind of a reverse engineering process where now we have an executable We need to go to the assembly through a disassembler and then we need and then a Great thing to do would be to be able to go back and go here to a decompiler Um Yeah, sorry. This is uh and so as we'll see Disassemblers are Essentially trivial and easy. They're they're fairly easy. I'd say not trivial Um So we saw that with object dump, right? I can use uh object obj dump a dot out Oh, I need to say dash d disassemble everything and here trying to interpret everything as bytes So if I look here at this main function I can see okay, here's The code that the compiler generated that corresponded to my program. Remember this was the prints and the print devs and stuff Um So here I can learn and understand what this program is doing by using a disassembler to look at that So I'll talk about different types of things. Um, so there's actually a tons of Types of tools. I'm going to point you to some stuff right now. So, um Radoware is a um Uh Disassembly tool it has all kinds of reversing and vulnerability analysis Uh, it has really good scripting capabilities. Uh, if I remember correctly It's a more type of a command line tool similar to like gdb style, but much, uh, better um I will say Ida pro is kind of the state of the art tool for reversing. I actually don't think I even have it here. Um, It supports disassembly of binary programs, but it also supports decompilation So it has a decompiler that tries to decompile assembly code to c code Um, this cost well the current hex rays Uh, basically costs like 20, uh, $10,000 for one license Uh, usually to do one type of assembly language So if you wanted to support different things like x86 x86 64 arm, um, each of these cost roughly in the order of $10,000 Um, so this kind of shows how In some sense special purpose these tools are but in other ways, um How but they do have a uh Version that's available for free. So you can check that out. Uh, you can check out Ida pro it is currently um Considered kind of the the state of the art or one of the best tools for doing this. Um Hopper is one that I used to use. It's a disassembler that has a decompiler. That's not great. It's Roughly a hundred dollars Super cool. This is kind of a new Thing is gdra. So gdra is an open source reverse engineering suite that the nsa actually, um released So this is actually super cool. You can check it out. It's written in java. It's um Uh relatively inexpensive, right? So when you're talking about a $10,000 tool or a couple thousand dollars, uh 90 dollars is uh a little bit less So gdra is pretty cool. Um, it has a lot of the ability to do a lot of different architectures Let's see. I do have installed right now um So what i'm gonna do is i'm gonna copy that a.out file From the server locally. So scp is a secure copy From this server and this is the file. I want to dot locally. So this should copy it here Um, and then I think I have there's another product called the binary ninja that also has a free version to use Um, I guess I haven't ran it in a while And so just just to show you kind of roughly what these things look like. So if I go here a.out um So what this has done is it shows me, uh, this is at the start location. So this is kind of a standard, uh, Libc of things that happen at the start I have the symbols over here of all the symbols. It's pulled from my binary. I can go look at main And where's my nice? And i'm still getting used to this so I don't use it a ton. Oh, there is no graph. Okay walls um But let's see cool things here. Okay, one thing you'll know the syntax is different, right? So it's it's uh Default is intel syntax um Cool thing is let's see. I can look here. I can double click I can see Yeah printf This should show me yeah, so you can kind of see here on the screen I can't show it with my cursor But you can see this is showing me the data location at that point and we have the bytes 25 640 a So that's actually percent d new line and then a null byte So this is what's getting passed into my printf. Um Cool thing is you can do things like So here I have cross-reference. So here This shows me everything that calls puts. So if I'm trying to debug like a large program, let's actually, uh I don't know how useful this will be but here's a Say something I was looking at for a ctf challenge No, I want main There we go. Okay. Now you can see more the the power at least here So here is kind of so now what it's doing is it's showing me the graph So each of these blocks is essentially what we call a basic block. So it has no jumps in it Um But here so for instance, um, yeah, here we go So here's something where it's doing some code It's getting something from the user probably f gets and then it has two branches So you can see two branches here if this condition is false it goes this branch if it's true it loops back to itself um, so this gives you kind of a high-level overview of the graph kind of of this this program and what it's doing And the super cool thing is like you, you know, here are functions Oftentimes in the compilation process the names of functions the names of variables these type of things go away as it's compiled But I can do things like, uh, call this main loop And then it will update that so I can see what are all the references of main loop I can see it's figured out. It has different, uh, arguments. Uh, maybe this is the fd. I don't know so I can um Name different arguments I can figure out kind of what's going on And you can see here when it's able to determine that the thing that it's pointing to is a string It actually shows you it here in the output. So there's just kind of one example here of this Um, I will say I'm definitely not if you want to learn more about, uh, reversing you should talk to dr. Fish Wang. He is Uh, no joke probably one of the best like reverse engineers ever. Um, he's Debugged bugs in windows Kernel itself that caused slowdowns of his computer. So he is able to like reverse engineer and understand, um The windows kernel I don't know if he covers it in any classes. You'd have to talk to him. Um Or ask him about that but Uh, yeah, cool. Okay. So that object dump is kind of the the standard thing. Um, I You know I will say you don't need any of these fancy tools, especially for these challenges. It's nice to be able to um To do that and talk about that You can get pretty far with just object dumping a file and seeing what's going on cool Okay Where are we? Um, cool. So as we saw so kind of if you think about it, right And the reason why all these skills are important is if you think about like software that you care about Or systems that you care about oftentimes all that you have is the executable, right for something like, um Let's say powerpoint or windows, right? All you have is the executable So we want to maybe understand how it works as far as reverse engineering We need to be able to use these tools in order to understand, um How it works But also that's not the only tool. So like we saw debugging is actually incredibly useful to Either understand what's going on or identify bugs in a program Um, so it's a really important part of reverse engineering So you can think of like disassembling. We look at it statically to see what's happening We can also debug a running program in order to understand it So debugging is an incredibly important part Like we saw gdb. I didn't even go into half of the power of gdb One of the super cool things is its ability to do to script it So you can, um For instance, like if you're reverse engineering a binary and it's doing some kind of maybe hard coded password check You can write a gdb script that every time it hits a breakpoint It prints out a certain value in memory and then continues And this allows you to do really cool like runtime behavior analysis of what's going on Gdb has like amazing. I highly recommend learning about it and using it for debugging Um, like we said, there's other types of extensions and stuff We actually already saw that so that's great. Cool. That's actually a good place to stop here Because when we get here, we'll talk on tuesday, we'll then talk about different ways to Attack general ways of identifying vulnerabilities and then we'll start getting into actual vulnerabilities And how to exploit them Cool, uh, I guess we do have a minute any questions or are we good? We'll talk about finals, uh as we get closer Yeah, assignment six will be released ctf. We'll talk about on tuesday Yeah, the grade scope for assignment six will go up later today, but you only need that to submit so Username passwords will be given later today and so yeah, keep an eye on piazza. So I'm not sure I'm not sure exactly how the mechanism that I'm going to send you the passwords are so we'll see Uh, yeah, we'll talk about more on Uh The ctf on Tuesday No, it'll be in groups, but we'll get into more details on tuesday Cool. Yes, you can set up public key authentication for assignment six. That's highly recommended Cool. All right See you guys Stay safe


Let's talk about this for a second. Let's just talk, let's for a second. Where are the sweet tea, Southern sweet tea drinkers here? Come on now, I need to hear from you. Right, here's one. I'm another one. My wife and I got pushed to the south, right? Is North Carolina considered the south? South Carolina. Yeah, South Carolina, South Carolina is not. Well, either way, I got something special here that we're gonna talk about. The first time I had, it blew my mind, because when we moved to North Carolina, the sweet tea, I mean, they do it right, right? And now if you all know, I've been low carb keto for many, many, many years, but there's a day back in the day where I was in Florida, I went to Alabama, I went to Mississippi, and I had some sweet tea and it was delicious. And but ever since I've been keto, I haven't had sweet tea. Even in North Carolina, they always would have it. I mean, you're sitting there, you're like, I just want it, I want it, I want it. So we're gonna do a little live tasting of the sweet tea. I'm already gonna tell you, it's amazing, it's great. It's delicious. We can put maybe a water bottle. We're propping phones up here, that's not gonna work. That's gonna work. We're propping phones. We got a phone display of lives across the world. So here we go, sweet tea. Now, before I go any further, where are our sweet tea fans? Come on, I want to hear it. Is this one working right here? Yeah, no. It just, that one's not. What happened? It doesn't work either. Instagram's being funny. Facebook, I love y'all. Instagram's being weird. I think Instagram's mad at me. I think they're mad. So we're gonna be making up some green tea, some sweet, some sweet tea. And if you've never done this, if you've never seen it done before, it's actually pretty simple, right?  Okay, let me ask you another question. I can't see chats in this one because I'm on my phone. So I don't think I can see your chats post comments. Let's see what that has. Oh yeah, there we go. I can see it. Can't post comments, some destinations. Okay, cool. So I'm actually able to see comments now. Very cool. All right, good. All right, so, hey, really quick though, if you're watching this right now, do you like your sweet tea on ice or do you like it more room temperature? Just curious.  So in the chat, block the chat button or the UBD, in the chat below, tell me which state has the greatest and best sweet tea? Hi from Scotland. Scotland, do you guys do sweet tea in Scotland? I'm just curious. I think that's the case. On ice, Deborah says. On ice, which state? So who's excited for me to make this up? Hey, Brendan Lewis just bought some sweet tea. Brendan just bought two boxes of sweet tea. How cool is that? All right, ready to make this thing or what? I'm ready. This is Luis, by the way. Hi, Luis. Hello. Luis, where are you from? From Guadalajara, Mexico. Guadalajara, Mexico. Hey, y'all know this, I just learned this today. Canelo, canelo's from there. Do you guys have sweet tea in Mexico? We did not, no. But I used to live in Texas and in Texas. Texas, yeah. Well, they didn't have sweet tea. They don't have sweet tea in Mexico, or at least the parts that you live in. We're gonna change that in Mexico. We're gonna change that. So here we go. I'm gonna make this thing up.   You gotta check this out.  Sweet tea and ketones can bind. I'm gonna say that again. Sweet tea and ketones can bind. Like, this is the game changer. This is exciting. Is this real? I cannot believe this is real. And it has caffeine. Of course it has, it's got tea in it. It's got to have caffeine in it. You can't have sweet tea without caffeine. I don't even know why that didn't be a possibility. All right, so you rip the pack open. If you're new to this, you've never seen this done before, you gotta check this out. So then you pour it in here. Now, it's really important when you do this in a car that you don't have the air conditioning blasting. I've learned this lesson before where I poured it in and it literally went everywhere. Cause the air conditioning, I was just excited to make my ketones up in the car. We travel a lot. We're on a road trip. Anybody hate, maybe I'll give a, should I give a prize away? I'll give you a prize away. Does anybody know what city we're gonna be in tonight?  I don't know what I'm gonna give you yet, but maybe a surprise. Does anybody know what city we're gonna be in tonight? Does anybody know what city we're gonna be in tomorrow for lunch? Cause I didn't actually announce that city. I announced the city next to it. So there's only three people that actually know where I'm gonna be tomorrow for lunch. We're doing four city, or four states and four cities, four states and four days, four events. Yeah, four events. We just left a little boat in Kentucky. All right, so what you do is you mix it in here, ice and water, you shake it up, and then you go, hmm, Dayton, Ohio, I will not be in Dayton, Ohio. South Bend, that's actually not where we're gonna be. I'm gonna sneak over to South Bend. We gotta see who's been to South Bend. Isn't that where Rudy, isn't that where Rudy played? Rudy Rudiger, right? I mean, I think Joe Montana was kind of good there too, but Rudy really made South Bend famous.  But I think it's all about Rudy, Rudy Rudiger. Word by Rudy Rudiger, Rudy Rudiger fans. All right, y'all, sweet to you, cheers. Cheers, cheers. Let's see, I'm real excited about this. That is, I don't ever cuss, y'all, if you get to know me, I'm not a cusser.  I mean, that's good. Tea, sweet tea with ketones. I mean, I'm just telling you, that is good. Genius and smile right here. This is like super, super. It's like a little Christmas tree. He's like, oh my gosh, so good. It's like Christmas. It's so good.  Plus it's gonna sell out.  Oh yeah, well, we were afraid that it's gonna sell out. We were like, oh, I better tell people about it. If you really need this, you gotta get it now. Otherwise, it's not gonna be around very long. Sweet tea, southern sweet tea, unbelievable. What kind of sweetener is that artificial? 100% never artificial. It's all natural keto-friendly sweeteners. You gotta check it out. Hit me a private message if you have questions. Hit me a private message if you have questions and we'll get ya. That's Instagram there, right? Yeah, yeah, yeah. That's the Keto Pro, or yeah, it's Keto Pro. Instagram, I didn't catch your name. Bolliqua. Bolliqua, chica. Is that chica? Chica, Bolliqua. Chica, Bolliqua. Yeah, hey, hit me a private message and we'll take care of you. How you doing over there, Facebook? What's going on? Peggy, we're on our way. Peg, we're on our way, y'all. We need to get back onto the road, so I need to get off. I just wanna say another one shout out for everybody that participated in the Keto Academy the last three nights. The feedback has been extraordinary. The largest Keto educational event in the world, three nights running. Yes, you said it right. Awesome, thank you. It was pretty amazing. The education that Provid provides for people to learn and get better is extraordinary. You just don't find that. And you just don't find that in really anything anymore where you have scientists and researchers to be able to share their passion, their wisdom, and their knowledge. And not bias towards talking about our products but talking about how to live a better life. And what's cool about that is our products just inconjunctionally help people live a better life. So it's pretty cool. And the other one I would say that was pretty neat was how they all talked about if you wanna have long-term results and find a community of people to do the same thing. And I couldn't express that more at one of the top cardiologists in the country who's a good friend of mine and he's just an amazing individual. And he wanted me to come and present. He goes, what's the number one topic you should talk about? Well, he thought I was gonna talk about ketones and nutrition and all these other things. I go, oh, he asked me, what's the most important topic that you can talk about? And I said, community. I go, they're gonna come to your little convention and they're gonna try to get better. I go, but they have to go home and live with their family and their friends and their coworkers and their bosses and their family. Like, it's tough, their neighbors. I go, a community of people striving for better is the key because you're gonna fall down. The community can help pick you up. There's always gonna be obstacles and challenges along the way, but when you have a community of people coming, it'll help support you in that journey. So anyway, thank you all for the shout outs and the participation. It was pretty amazing. Yes, we just had our sweet tea trial. If you wanna get some sweet tea, get it now. It's gonna sell out. I mean, you gotta get it. It is absolutely extraordinary. It's two of my favorite things. Sweet tea with ketones. It's absolutely amazing. It even looks like tea. It's super good. I will not be in Kalamazoo tomorrow for lunch. I will be in Kalamazoo tomorrow for dinner. We're gonna be in a small town just outside of South Bend. Yes. Notre Dame, South Bend tomorrow. I will be all going over there and seeing Rudy Rudiger's house, meaning the stadium, the touchdown Jesus. Touchdown Jesus. We're gonna be checking out the touchdown Jesus tomorrow. We're gonna be at a coffee shop. I actually don't even know the name of the town we're going to. Do you? Right now? No, the one that we're going to tomorrow. No. No, we don't know the name of the town. I do have the address. I have to find it. But where are you going? We're going there. There's a bunch of people. There's like 50 people gonna be there, but I'm not sure where we're gonna go. So if somebody knows where I'm going tomorrow, I ask that question, I give you a gift so that you can help me get there. That's why I ask the question. Darla Andrews might be the only person that follows me that actually knows where I'm going tomorrow. Appreciate you Darla. Y'all, Michigan, we're coming in strong. Michigan, Friday night, we'll see you Friday night. We'll see you Saturday, Michigan. If you're in Michigan, get there. Come, come, come. Cincinnati, nope. Aaron, we are gonna be tonight. Today, we're gonna be in Montpelier. Montpelier, Montpelier, Ohio. Montpelier, Ohio. That's where we're going. Somebody's calling me from Ripton, Ripon, California. Sorry, Instagram, somebody's calling me from California. Stop calling me. All right, y'all, I gotta go. Stop it. Hey, Kathy Berry, we're coming to town. Dana, we're gonna be there. Lunch, dinner, potatoes, potatoes, Billy Joe. You're so funny. You're funny. If you get a chance to, you gotta go check out Billy Joe's Billy Joe's Facebook page. I laughed so hard. And I tell you, I need to laugh more and I work on that. Samantha, you're on. We were just talking about that. I laughed so hard on her page. It was the funniest thing. I've actually stole off a lot of her stuff. I was like, this is so funny. This is so funny. This is so funny. So there's so many good ones down there. The cat with the roller thing, the limp brush was funny too. So y'all, I gotta go. We're gonna hit the road. Call me in. Dana wants me to call her in. I don't know if I, Dana, I can't call you in on this platform because I'm on StreamYard, streaming to multiple platforms at once, Dana. So if you wanna do a live with me on the road, we can definitely do that and then we can do a side talk. So let me know. Sweet tea lemonade. Here it is, y'all. Don't miss out back to California from Kentucky. Your road trip is taking you from Kentucky back to California. My road trip took me from California, flew to Louisville. We drove to Owensboro yesterday. Owensboro, shout out to Owensboro. What an amazing crew there was. Came back to Louisville, Kentucky, hosted the last night of the Keto Academy and the largest Keto event in the world. Then we got in a car this morning, drove down to, we're driving right now to Montpelier, Plyer year. I gotta learn it before I get there tonight. I practice him. We were hitting there tonight. Spend the night at a fancy Swanky hotel. I think it's a quality inn. It's a nice hotel though, nice quality inn. And not that it gets quality in. It's my wife and I stayed at one that wasn't so nice. This one actually looks really nice. Then tomorrow we sneak over in the morning. We're gonna sneak over, have a lunch at a cafe just outside of South Bend. We don't know the name of that town yet. We have some amazing, Kathy will be there, I'm super excited to see her. Anna will be there. I'm super excited to see her. Darla is friends from Darla, from California. Then we sneak up to Kalamazoo, Michigan to do a promoter guest event for people that wanna help build the business, wanna make some extra money. They wanna help other people live a better life. We're doing a promoter event on Friday night. Saturday is a guest event. Everybody comes that wants to live better, lose body fat, get healthier, change their life. Then Saturday afternoon, Saturday evening is gonna be a little bit different style. We're just gonna hang in more socializing strategically, collaborate on how to change the world. Then fly back to San Francisco Sunday morning to go see the family, the kids and the loved ones. Yeah, that's the four day tour. I've been here. It's all so sweet with this. It's all so sweet with sweet lemon ice tea. Come on, it's sweet tea. I gotta go, I gotta, honestly, stop it. I gotta go. Bye, guys. Cheers. How do you do it? And that's fine. This is cool. It's working. It works on Sabari? Yeah, Sabari. That's awesome. They're cool. And so in yours, share it to the share it, that one. Let's...