Andy Grant here to talk to us a little bit about, uh, Mac OS packaging. Thank you. Awesome, thank you, yeah. So I'm gonna talk about the packages used to install software on Mac systems on Apple software laptops. First, I'm gonna start a little bit about myself. I've been doing professional security for 11 years focusing on application security. I've been doing security as a hobby for 20 plus years. I came to DEF CON 9 as my first DEF CON. Uh, I went up through self-taught ranks when I was in my early teens, got a computer science degree from Stanford University focusing on computer security. Went on to join the com- the security consulting group, ISAC partners. I was acquired by NCC group and continued to do that to today. I got started just doing the regular pen tests, looking at, uh, applications, finding the vulnerabilities, moved my way up the ranks to become, um, uh, the leader of the San Francisco team, joined the management, did that for five years, ran a team of 30 people, spent most of my time running that team of 30 people, trying to find an excuse to do the projects my team was supposed to be doing. So I gave up the management stuff and I'm back doing the technical work and here presenting today. I, thank you. Uh, I'm probably best known though by my alias of Dana Volmer's husband and, um, and you can find out more about me and my time off to support her career online. So we're going to talk about what led me to looking at packages and installers, then open up the packages, look inside, uh, and then see what can go wrong in, uh, with these installations. So first, I've got trust issues. X-Wix got me into computer security at the start, digging into what was going on in my laptop. I wanted to better understand what was happening. You have these pop-ups sometimes when you're installing software that says, this package is going to run a program, do you want to continue? And then you don't get to know what that program is or what got ran, just, it's going to run something. Plus, I'm lucky enough that I get paid to do this, as I was saying, and sometimes the client pays you to look at their application and their application doesn't work. So really all you have to go on is the installer and the process and then you kind of have to give them their money's worth out of just that working environment. So let's look inside what these packages are. So their technical term, their full name is Mac OS X installer flat packages. They have a .pkg extension. There's not a whole lot of documentation provided by Apple on them, uh, but you can find some reverse engineered unofficial documentation, but it's kind of out of date and, um, and incomplete. Uh, the flat package aspect of this is that it's a single file. It's actually an extensible archiver's arm. And in pre-10.5 OS X, these used to be bundles, uh, bundle packages, and so those were more like directories like your .app package, uh, app bundles. There's some helpful tools. One even comes pre-installed on, uh, Mac OS called package util. This allows you to inspect, uh, the packages installed on your system, inspect a specific package and go through and open, open them up, which is what we're going to get into. There's a nifty, uh, third party, uh, package out there that specifically is designed to look at the security aspects of these packages. And that's called suspicious package. It will highlight the code signing signature. It'll, it'll let you look at the some of the files that gets run and will highlight some, um, nuances of the application that might raise a red flag if it might be a malware installation. So let's, let's look inside. What's inside these? The easiest way to do it is to use your pre-installed package util, give it the expand command and then give it the package and the output directory and it'll expand everything out there. But we don't want the easy way. We want to do it the hacker way. We got trust issues. We don't trust what package util is doing. We want to make our own directory. We understand that command. We go into that directory because the, uh, ways are to extract these files works. It just, um, outputs right into the current working directory. And so now we're going to go through and extract the package files. After you've extracted them, this is sort of the typical structure you find inside. You have a distribution XML file. You have a resources directory and then you have one or more package directories. These package directories contain a bill of materials, a package info, another plain text XML file, and then two compressed archives, uh, payload and scripts. So the distribution file, this is the customization of the installer window. It's a, it gives it the title, the welcome text, if there's a license, if there's, um, a read me, the background logo that, that is displayed and sort of, uh, determines whether you restart or shut down or don't need to do anything after the installation is complete. These can also include JavaScript, specifically a subset called installer.js. And this is supposed to be what triggers that pop up of some, uh, code is going to run to check to see if your system's compatible. It's in the compatibility check. You have the package info. This is more information about the individual packages that are just installed with that distribution. It has the specific requirements of that package. The install location where that payloads, uh, that package payload will be extracted to. And then it will also include any paths to the scripts that will be run. And then you have the bill of materials. This is, um, a special file that lists out all the files that will be installed, updated, or removed during the installation process. And it includes their file permissions, the owner and group that they will have, the size of the files and creation time and some other, uh, file metadata. Now we have these, um, compressed archives.  The payload includes all those files that are going to be installed that are listed in the, um, bill of materials. And the installation process here is actually just extracting this archive into the install location specified in the package info. You have the scripts, um, if there's any scripts to be run before afterwards. Same type of archive, CPIO archive. You have pre-installation and post-installation scripts. But really, this can contain any executable file that has an appropriate shebang at the first line. So it's typically bash Python Perl. Uh, this gets extracted, um, during the by the installer into a random directory and gets executed from that location. So to unpackage those packages, those archives within, within it, you, um, you can go, like I said, it's a GZIP CPIO file. And so you can cap this, the archive into the decompression, into the archive extraction. Or CPIO actually natively detects that Xbin GZIP compressed. And so you can just put it right into the CPIO and say it's input and, um, and away you go. It'll dump right into the current directory, all the contents of that. If you did it, the easy way to begin with the expand command actually goes ahead and extracts this, uh, archive already. And instead of having the scripts, um, object to be a, uh, archive, it is already a directory with the contents inside of it. You do the same thing as scripts for payload. You go through the CPIO command, um, sometimes in going through that payload and extracting the files, it has further packages in it. So you just recurse through if you want to find everything that's going to happen during the course of your install. Unlike with scripts though, the package util does not auto expand this. And you do have to go through the manual process of extracting the payload files if you want to see what's going to be installed on the system. So let's walk through what happens when you actually launch the installer with one of these packages. The, you start with the distribution file, um, they were working through sort of more the, the code execution flow. So it checks to see is there any installer check? If so, it looks for the JavaScript that's going to be there. That JavaScript is defined within the XML file between script tags and it goes through and executes that JavaScript. Then if the package info, um, said there was any pre-installation scripts, it goes and runs that pre-installation script. Then you install the files. You extract the payload into an install location. And then you do the post-installation scripts if there was any specified in the package info. So now we're going to get into sort of the security concerns that can happen during the installation that, um, that can occur. You have the scripts in the payload, which is where most of this is happening. In the scripts, you're going to look at the pre-installation, the post-installation. These can also include helper scripts and other files. So you'll want to look at what's going on there. They're plain text. Like I was saying, bash Python Perl, pretty easy to audit and understand what's going on and look for common mistakes. Within the payload, you also have, um, you can also have more scripts. You've, I've seen an uninstallation scripts that are easy to audit. Some helper scripts for debugging or logging or error reporting that gets installed. And then you also have your normal native apps that get installed, the b, actual application binary, the kernel modules, the libraries. And if you want to go into it, you can go and look at for native application flaws through reverse engineering, fire up hopper. So the types of issues I was seeing when looking at these packages largely amount to time of check, time of use, except they weren't doing any checks. They're, they're operating within the temp directory, which is world writable by anybody. And, uh, they're doing reads out of it that are untrusted. They're doing writes into it that are untrusted or they're executing files in it without confirming that file is what they believe it should be. I've also seen the, um, some of these installers go through and set 777 permissions on what gets installed or what's get written into different locations. And that just allows everybody to mess with whatever you wrote there and it's no longer a trusted install. So now we're going to dig into the actual vulnerabilities I got to see while looking at this for the past couple months. So I've found a number of privilege escalation issues, um, did some symbolic link abuse, uh, and got some arbitrary code execution, which was fun. So the first one, we have this installation. We're going to go through the payload installs, uh, um, installer util binary. That's just a helper program for the installation to go through. And then the post install script actually calls that with sudo with super user powers and, um, and executes it. This is written to the temp directory. Temp directory is world writable. This is actually, um, the payload is installing as the current user, um, the way this installation was working. And then the post install is calling that user owned, uh, file with super user powers. So in this instance, I'm possibly an unprivileged user asking my IT administrator to install video conferencing software so I can join a meeting later that afternoon. So I would have audited this program, looked at, at this, seen this vulnerability and then written up a little script to run in the background a while loop say, while this file doesn't exist, do nothing. And then when it, when it does exist, remove that file and put in my payload, um, in, in its place. And then the post install is going to come around and execute that with root privileges. And I've just escalated from my unprivileged user to my IT administrators, uh, root powers over my laptop. Another package I saw, um, during the pre-installation it tries to do some cleanup in case it had previously run the installer. It deletes this, um, install, installation file in the temp directory. And then later on it writes to that and wants to make sure further installations unassociated with this install can also write to it. So it sets 777 permissions using sudo and then also makes the owner of it, um, the current console user. So in this attack, any user on the system, any process that can write to temp, the temp directory, which should be all of them, can attack the system administrator or whoever's install, installing the software.  So then your Y loop can say while this file exists, wait and do nothing. And then once that file has been deleted during the pre-installation, go through and create a symbolic link to a directory that you want to gain right access to such as slash applications and link that to that file's name. Now when they're going through the post-installation, they'll try to write to this, it'll fail, things fail silently unless you're doing an explicit checking of failure states during these scripts. And then when you get to this sudo change permissions to 777, that's going to follow that symbolic link and make slash applications world writable. And then it'll also go through and have the, the happenstance of changing the ownership of applications to the current user. At this point we don't really care about that because it's world writable, we can drop whatever applications we want onto the system now. Another package was privilege escalation. This is not to current user to root. This is any user to the current installing user's privileges. So they go through, they, during the pre-installation in case it had run before, it deletes the 7-zip file, 7-zip archive binary in the temp directory. And then it goes through and tries to extract this 7-zip file that came with the payload and then execute that 7-zip file. This is all happening within slash temp. So pretty straightforward. Before this install was ever run, I just put my payload as that name. You notice none of this is sudo, this isn't running with root privileges. So they can't delete my file that's sitting there. So the RM fails, the overwrite from the unzip fails, but the execution happens. Because like I said, these fail silently inside the scripts. So I just went from just putting a file there on the system, the installer happily goes through and executes it as the current installing user and I've gained the privilege as them. Another example we have here is another symbolic link attack, helper script outside of the payload. So once you're running the application, this was for some debug reporting back to the developer. It tries to clean up some of the logging it was doing in the temp directory to capture that debug log. And so it does an RM-RF of this temp directory slash star and then it does remove the directory notably with a slash at the end of the path. So the attack here is before the scripts ever run, any user can go and write to that temp directory. I have a typo in my slides, I say slash var, I realize instead of slash temp. But in the payload it should be slash temp slash SDU. And the way the symbolic links work, that RM-RF with a slash star will follow the symbolic link and delete everything in the user's home directory in this example. And then the remove directory command with the slash at the end will follow that symbolic link and blow away their home directory also. So now you hear left with a symbolic link that points to nothing because everything's been deleted. Next we have a vulnerability that has in the package info it says we're going to extract the payload into slash temp, specifically this razor synapse place using root privileges we're running as the root user. So you don't even need sudo here, everything just runs as the super user. During the post installation we're going to change into that directory and then we're going to look for star dot PKGs and install them once again with root privileges. So this has been fixed by razor and so we're going to use this as our demo today going through everything I've talked about here. We're going to download the package, extract the files, audit the package, find this vulnerability, develop an exploit for it and then drop the payload and watch it take place. So here I go through and I download the package. Once it's on my system I'm going to go through the hacker way to create the directory, extract the contents of that package into the directory and then I'm going to go look at the file. So I'm looking at the distribution file first to see if there's any installer checks. They don't see any installer checks so I'm going to move on, I'm going to look at the package info to see what's going on. Here we have that it's extracting to the temp directory, it's installing as root and there's extra little tidbit there that it's going to ask to restart at the end. It also notes here that there is a post install script so let's go see what's happening in that post install script. We're going to create our, our, our collection directory so we don't clutter the current directory, extract the, the scripts into it and then we have all these extra files in here but we're interested in what it named, the post install script. So now this is the whole post install script, we're, we're reading it, we're really fast at finding vulnerabilities. Here's our vulnerability that, that we just looked at. So we're going to go through, we're going to, and now we're going to take advantage of this. Now that we know about this vulnerability we can become the malicious user. So Mallory is going to take over and she's going to go through and develop the, a malicious payload, a package that will be installed as part of this exploit. So we create our scripts directory, we create our pre-installation script, so we put in the shebang, we touch, we just touch a temp file and echo the current running user into it so we know what privilege this exploit runs at and then every good proof of concept pops calc and so we'll also pop calc as part of our proof of concept. Now we have to make that executable or else it doesn't run. Now we use package build to make up our package. We can give it identifier, this isn't really necessary, but it just shows another aspect that you can label and call what these are. Here I specify that there's no payload here, there's no files being extracted and so it doesn't try to look to create that payload archive. I script only package. I create the package, I create that directory because Razer hasn't been installed yet and I move the payload into that directory and now I'm done. Now I wait for Bob to come around and run the installer. Bob's going to do it right now. Bob's not actually an administrator on here so Alice is going to have to come and type in her admin password. It's going to continue through pop calc and then we go and look at the temp directory file to see that we just ran as the root user here. In my final minute I want to make some notes about what we just observed that there was some unexpected things happen when you do this no payload package that I just created there. When you install anything with a payload, the installer creates a receipt and you can look at your system of all the packages that have been installed by that identifier and then you can give the package util that identifier and look at all the files that were installed during that process. However, if no files are installed because there's no payload, there's no receipt that that package installer ever ran. So there's no appropriate system record that you could look up and audit to see that this ran. Also, if you get super fancy for minimal clicks and user interaction, you can actually have that installer check in the distribution XML file. That JavaScript can call system.run and execute any scripts that are inside that script file. So within the system check when it's like do you want to check if your system is compatible, it will actually execute script which can extract an zip file and copy those files around your system and that's a one-click install instead of all the multiple clicks you normally have to go through. And then for for extra fun you can then call killall installer and installer quits itself and the user is immediately back to its desktop. Some of these tips and tricks have been used by the people over at Paterian. They wrote an awesome blog post series, two parts, about bypassing application whitelisting specifically Google Santa to using the installer. The quick quick version of that is application whitelisting happens at the basically the process executing level and installer is whitelisted reasonably and all of this installer check JavaScript all the pre and post scripts run as part of that installer process and so they're all whitelisted also. I'll be stepping off to the stage as I think I ran a minute long and so I don't have time to take your questions right now but I'll be happy to talk to you here.


Hello and thank you for clicking. This is Professor Farhad. In my advanced accounting course, I cover consolidation from A to Z. Whether you are taking this college course or you are studying for your CPA exam, my advanced accounting course will help you learn the material from scratch. Go ahead and subscribe!


The hektite E3 ubiquitin ligase family plays a crucial role in regulating autophagy, a process by which cells break down and recycle proteins and organelles. This process is important for maintaining cellular homeostasis and preventing diseases such as cancer. Recent studies have shown that certain members of this family, including NEDD4-1, NEDD4-L, SMURFs, WWPS, and ITCH, are involved in defective autophagy in cancer cells. These E3 ligases can target specific substrates and interact with other proteins to regulate autophagy, providing a potential therapeutic target for treating cancer. This article was authored by Rui Zhong and Xiao Qingxia.


Hello everyone, welcome again to another Narc Survivor video. Before I begin please hit the thumbs up button down below to show your support. Hit subscribe and click all notifications to be notified when I upload a new video. And if you would like to book a one-on-one coaching session with me just go to my website it is narcsurvivor.co.uk. The one thing a narcissist will do in your absence. Narcissists like to keep secrets. They like to keep things unknown and unseen by other people. They like to have things that are not properly understood because they're very insecure and they feel powerless and helpless. So by acting strange, peculiar and mysterious it gives them power and control over their environment. It gives them narcissistic supply and that is always the reason for why they do anything. But when they're seeking supply they will also behave dishonestly and they will keep secrets because it gives them a false sense of power. So you may never catch them out, you may never see what they're doing but they've been doing this for a very long time so they are masters of manipulation. They know how to plan and coordinate the elements of a situation to produce their desired effect but whether you see them or not you can be certain that there is one thing that they will be doing in your absence and that is engaging in their many addictions or they will be in the process of seeking new supply. Narcissists maintain a sense of superiority through a constant need for validation, a lack of empathy, manipulation and other controlling behaviors because they're seeking emotional sustenance to maintain their self-worth and self-esteem and they will typically target vulnerable people who are more likely to provide the comfort or support that they are seeking. They may acquire their supply by using their charm and charisma to elicit admiration but with that to some work some narcissists may have to resort to aggressive behaviors but either way they will engage in excessive self-promotion and they will always steer conversations back to their achievements or they will create drama and a little people to elicit emotional reactions to reinforce their sense of importance and there are clear signs to know if you are a source of their narcissistic supply because they will seek constant praise and admiration from you, they will expect special treatment and they may even exploit you emotionally or financially. They will also dominate conversations, seek to be the center of attention at all times and react strongly to perceive slight criticism. When the narcissists first targeted you, they idealized you and saw you as perfect. They showered you with attention and praise but as time went by they started to feel insecure so they began to devalue you to where they became manipulative and emotionally abusive and from that point on they begin to spend less time with you because they're off seeking supply from other sources and they're engaging in their many addictions. One of their main addictions is that addiction to people, they attract people by projecting a false self to elicit a constant stream of attention and admiration but it's never enough and they're never satisfied so they often employ other addictions in an attempt to fill this bottomless pit and one of their other addictions may be alcohol which they will use to reinforce their false sense of grandiosity where they will become even more self-absorbed as they display an underlying craving for admiration or they may even use recreational drugs to achieve a state of superiority above other people and to lessen their feelings of inferiority because their self-esteem is constantly fluctuating as it's all a facade it's not real it's a deceptive outward appearance which is why they have a void that can never be filled and it's why they have to use other people to fill this void but even then it's still never enough so they have to use alcohol or recreational drugs in an attempt to stabilize their fluctuating self-esteem and they may also engage in a pulsive buying or gambling to self-enhance and elevate their false self but once they've run through all of their options for self-gratification through the use of positive sources of supply then they have no choice but to resort to negative supply and this is where they can become dangerous narcissists will typically begin to seek negative supply when you know your own mind when you're not prepared to lie down and be walked over in the way that they would like when that happens they will turn against you and they will seek to destroy you as a means of acquiring their negative supply they will punish you for not giving them the attention and admiration that they believe they are deserving of and entitled to and they may react to this in many ways by becoming rageful and escalating to violence or they may use passive aggression or withholding to punish and control you out of their annoyance and disappointment and as a revenge for their narcissistic injury this is often subconscious which means that they do not consciously know what they are doing they just feel like their false self has been threatened so now they are determined to keep you under their power and control but if you're no longer susceptible to their revelation they will seek to destroy you as a means of annihilating the threat because they have very low self-esteem so they are very easily threatened and it causes them a lot of anxiety so then they feel like they have to deploy certain tactics to regulate their self-esteem and to manage their narcissistic injury but they will see it as though they are defending themselves rather than attacking you even though they may damage property intimidate bully slander stoke mimic plot wrongdoings manipulate lie and pretend or even turn people against you and encourage people to support their side because their rights and your wrong and it's all because they crave acceptance and validation which is their positive and narcissistic supply and it's what they prefer to negative supply so they will do whatever it takes to get it even if it means throwing you under the bus they don't care because they want it and they need it and they can't without it images everything to a narcissist and this is why they can't have any empathy for you or anyone else because they're in this constant pursuit to elevate their false self to prove to themselves that they are wanted and desired but even then it has nothing to do with anyone but themselves we are nothing but pawns in their game of chess we are mirrors that reflect back to them how they want to be seen and when we look into a mirror we're not concerned about the actual mirror or where focused on is the reflection we're getting from that mirror so they don't see you or anyone else the people they're involved with or trying to get supply from do not even exist in their world the narcissist is a prisoner of their own mind they have an inability to interact with the external world they only know how to pretend and act like they see you when really they don't they don't even see themselves because they view themselves as an object as well they're either a good object or a bad object and they're not really that concerned about being a good object they're just doing anything they can to avoid being seen as a bad object because that would then reflect back to them that something is wrong with them which is a feeling they're doing everything they can to avoid reflecting on but this is what they're doing in your absence they're doing everything they can to avoid being seen as a bad object so that they can avoid viewing themselves as a bad object and feeling like they are bad or wrong because they can't deal with the shame so they created a false character and a false reality to protect themselves from their true feelings about themselves and because of this their self-esteem continues to fluctuate because it's like they built a house on shaky foundations so they never know where they stand they never grasp a good understanding of a situation or what someone thinks of them which is a miserable existence but it's how they have to live because they chose to live a lie and that lie continuously comes back to haunt them because they're like a house of cards they're dangerously unstable they're on the brink of collapse which is why they're constantly in need of supply they're addicted to people alcohol drugs shopping gambling gossiping punishing and revenge and it's all as a means of establishing their shaky foundation and this is why they're always on edge it's why any little thing could set them off and cause their reality to crumble because it's built on a lie they're not who they say they are they've done horrible things to people and they are aware of it which is why they deny project blame shift and gaslight because they're trying to pretend that it isn't there so that they can continue living a fake life but by doing that they're just running from themselves instead of accepting themselves for who they are and that is why they're so miserable it's why they're so heavily dependent on you or other sources of supply whether it's people or one of their many addictions when the regard to get is that they can't even experience those things they have to get people to filter everything through them so that they can live vicariously through other people because they can't find pleasure or fulfillment in anything directly it doesn't do anything for them because they abandon themselves to create a false reality which is why it's all about their image of reputation and it's why nothing they acquire or obtain is ever enough thank you for watching if you found this video helpful please give it a thumbs up share your thoughts in the comment section hit the subscribe button to receive the notifications if you would like to support the channel you can donate at paypal.me survivor you can book a one-on-one with me on my website it's narcsurvivor.co.uk thank you for watching and i'll talk to you soon


Okay, so I think we can, we can start. I just prepared a quick summary of what what we did yesterday so the problem that we are trying to solve is about the so called oblique you progress this problem so essentially we have a linear system of equations so x is our unknown a is the matrix of coefficients that we assume to be equal to of size M times and with in general M. Number of equations larger than the number of unknowns so the system is in general over complete with quadratic constraint on the on the norm of the of the solution. Sorry, this one is so by computing the introducing a Lagrangian that takes into account this constraint and computing the critical points. So let's go back to an equation for the solution in terms of the matrix W, which is the Wichert matrix corresponding to the matrix of coefficients, and we have an equation that fixes the Lagrange multiplier. The equation depends on random objects that are the eigenvalues the positive eigenvalues of the Wichert matrix W and the component essentially of the noise vector B. Okay, and in general we have a profile of this function on the left hand side that must match this constant and over sigma sigma square and depending on the level of the noise at which we we cut this equation. So we have a number of real solutions of this equation which gives the number of critical points, irrespective of their type irrespective of whether they are minimum maximum or subtle in this large dimensional, large dimensional space. So the noise here is essentially in the term be and in the matrix a so a would see. Sigma square. So we define essentially be as sigma psi where psi is is a Gaussian vector with mean zero and variance one. So, we wanted to compute the average number of critical points irrespective of whether they are minimum maximum or or saddles, and after averaging over B, and then averaging over the matrix, the matrix W, which we represented in this form. We ended up with a formula with the known constant that depends on and and and sigma, an integral over lambda, the one of the n plus one degrees of freedom. And are the number of components of X and then plus one which is the Lagrange multiplier, the an integral over Q which will produce a vessel K function that comes from from a change of variable. And then the remaining, the remaining important bit that we wish to compute is this five function, which is an integral over essentially we shared matrices of size and minus one, but with an extra absolute value of this determinant. And that comes from the cuts rise from the Jacobian in the cuts rise formula. Okay, so this is the main technical hurdle that that we would like to to overcome, and this can be done and this is the last thing that I wanted to show you, thanks to a trick that that is due to to young young fielder off. So the evaluation of this integral proceeds separately, depending on whether lambda is larger than zero or lambda is smaller than zero, but I will only do the case, lambda larger than zero for time, time reason. The idea to solve this integral is to first perform an orthogonal decomposition of the matrix. W, which is we shared in terms of eigenvalues s one s and minus one. And then, oh, minus one where all is an orthogonal matrix of size and minus one. If we do that, we notice that essentially this integrand is rotationally invariant, so it will only depend on the eigenvalues here. So the measure the W gets transformed into an integral over the orthogonal group, an integral over the eigenvalues. So this is the equilibrium of this transformation, which is given by the wonder month determinant in N minus one variables. So I put a pointer to this transformation law in the handout I think it's a question. So this delta object is just the product, j is smaller than K of s j minus s k. Okay. So it is an object that contains the differences of all the eigenvalues evaluated. Yeah, the N minus one eigenvalues of this matrix. So there is a pointer to a derivation of this of this time. Okay. Now, noticing the rotational invariance I mean we can we can proceed formally by changing variables and having an integral over the unitary group, an integral over the eigenvalues. So all these terms can be expressed in terms of the eigenvalues alone, right. So we get exponential of minus and over to summation k one to n minus one s k. And then we have a product from J or K from one to n minus one of s k raised to the power and minus and minus one over two. So this term here can also be written in terms of the eigenvalues only. This will be the product k one to n minus one of the absolute value of lambda minus s k. And then we have the absolute value of the wonder month determinant in variables of size and minus one. Okay, so this integral over the orthogonal group is just, it's the volume of the orthogonal group essentially so it is a known constant. We don't care, we will absorb all the constants in the main constant here. So we have this, this integral, this n fold integral and minus one for the integral over the eigenvalues. And what young fielder of noticed is that we can lump these two terms together, using the following identity. The absolute value of the wonder month in n minus one variables times the product k one to n minus one of the absolute value of lambda minus s k can be written in terms of the wonder month. So we have n variable. s one s n. So we are enlarging the space we go from n minus one to n variables, then we stick in here at Delta that lambda that s n is equal to lambda. And then we are integrating over. So this, this is an equality and identity that you can essentially prove prove directly, you just write the bottom of the terminal, which is this object here, and you recognize that the terms in this wonder month, the term in this extended determinant that pertain to the lamp to the s n eigenvalues are the product of s n minus s one s n minus s two s n minus, you know, s n minus one. And all these you can write into using this delta function all this s n becomes become equal to lambda, which reproduces exactly this term, this term here. So using this, this trick, which is a fundamental observation we can rewrite this integral in a much more convenient form. The absolute value is is in here as well. Yeah, sorry, of course. Thanks. Thanks. Yeah, that that if if these were so simple that we could get rid of the absolute value now. Thanks. I wish. Yes. Okay. Okay, so what we have thanks to this identity is that this integral here. We can extend it to include a further variable. So the s one d s n minus one and then we add an integration over the s n, and we write something like exponential of minus and over to summation k one to N. Okay, so we extend this sum up to N. Remember it was up to n minus one and of course we need to correct for the for the nth term in this, this exponential. So we write here in front exponential of n over two times s n, but as sent is equal to lambda. Okay, then we extend also the product, the product of eigenvalues. Okay, from one to N. So we need to divide this of SK to the power and minus and minus one over two. And of course we need to correct this. So we need to divide this by SN to some power, but SN is lambda to the M minus and minus one over two. So we do this corrections, and then we have a wonder moon in n variables of our vector of eigenvalues times a delta that fixes that lambda is equal to SN. And now we are essentially essentially done because we are recognizing in in this integral here is integral with this term, the joint probability density function of the research ensemble of the eigenvalues of the research that we recognize and which I give in a question to of the of the handout, and with this extra delta here. This becomes just the marginal of the joint PDF. So this is just a spectral density. Okay, so we have related the average of the absolute value of the determinant of a we shared to the spectral density of a larger we shared. So that's the essence of this of this trick. And if you're not totally mesmerized by this trick. Well, I don't know what what we will do it for you. Okay, so this is just a wonderful, wonderful trick, isn't it. So the object here, this entire integral is nothing but the spectral density. Let's call it raw and of lambda of a we shared matrix of size and by, and by N, which is known in closed form in terms of Lager. So I give, I give a reference to this in the in the handout as well. So everything now is written in terms of quantities that either are known or can be easily, easily computed. If the object is effectively is sold remember that had to start with this lambda larger than zero hypothesis why, because in order to recognize that this object is the spectral density of an enlarged we shared, we need to impose the constraint that we shared to the spectral density. Okay, because the, the we shared matrix as as positive eigenvalues. So for lambda negative we have an entire set of arguments but luckily, the case lambda smaller than zero is not as interesting. The number of critical points of all types is essentially the sum of two contribution and plus and and minus where plus and minus are the sign of of lambda. So you need to split these two contributions. Yeah. Sorry. Sure, but you cannot connect it. It is no longer true that you don't have to worry about the absolute value. Yeah, true. But you have to do the computation and you cannot relate it no longer to the spectral density of we should. So you saw one problem but not, not the full, the full story so the absolute value is a problem in general, not in that, in that case, but you cannot relate, you can no longer relate it to the spectral density of, of a larger Okay. So essentially, the, the problem is solved, all you have to do is to take this formula here and stick it into the, the, the format that I gave you before, and there are two remaining integrals that are left the integral over lambda and the integral over q, one gives a best of function and there is a surviving integral that is difficult to write in closed form. So in the end, you get a final formula that I can write for n plus, of course. So you have a certain constant that depends on m and sigma and this is fully explicit, and then you have an integral over lambda of exponential and lambda plus one over sigma square root of lambda. You have rho n of lambda, some combination of Laguerre polynomials times the integral over q of q to the m minus n minus two over two exponential of a certain combination here, another constant times q plus one over q. So the integral becomes essentially a best of function and this other integral must stay this way, because it is, I mean, you can with a lot of work reduce it to a finite, finite sum but it's not much more illuminating. You can solve because you can plot this, this function explicitly. Why did I say that and minus is not very, very interesting. Well, you, you understand it from the finite and picture that I drew before. Remember, you have something like this. The lambda negative. So the intersection of this horizontal line that gives an interest and a negative intersection. You can see from here that the intersection can either be one or zero, essentially. So if, if the, if the horizontal line is here, you have one negative intersection. If the horizontal line that is here, you have zero negative intersection. So for for large and this object is essentially either zero or one. And for, for, for even if you take the average, essentially you have a situation where n plus starts from to end and goes down to one. That's the result. If you plot this function here. You have n minus that starts from zero and quickly raised up to one here. So if you put together these two, two terms, then you, you get, let me change color. And the average number of critical points has precisely this smoothed version of the staircase where the number of critical points goes from to end. When we are up here, down to just two critical points, a minimum and a maximum where we are down, down here. So I just showed quite quickly, but with all all the steps that this problem can be solved completely for finite and if, of course, you are not interested on the type of critical points that that you have here. If you are if you want to distinguish whether you're talking about a minimum or maximum or a saddle, the problem is orders of magnitude more, more complicated and for this particular problem, we don't know the answer. The reason is that in the cuts rise formula, you need to put an extra constraint that you won't be Hessian to be, for example, positive or negative. And that constraint is something that we cannot easily handle with this with this formalism. Okay, so what I wanted to do now is I wanted to go back to a more perhaps stringent question which is the statistics of the smallest solution. Okay, can I can I raise everything and I'm happy to take questions if if there's any. I will keep the, I will keep this sketch here. So let's go back to the equation for the lagrang multiplier, which is let's call it g of lambda, which is the left hand side of this. It's divided by lambda minus Sigma I s I sorry, square psi t bi square, and this must be equal to one over Sigma Square. So every real solution of this equation provides an intersection here. And each of these intersections correspond to a critical point of of our loss function of our constrained loss function. Okay, so this is of course a random function of London. So what is what is interesting for us, the most interesting of these intersections is this guy here, because it is the smallest solution of this equation which according to Brown theorem corresponds to the smallest value of the loss function, and the smallest value of the loss function is what we are, we are interested in because that's, that's an indication of whether our system is compatible or non compatible in large dimensions. So we want the statistics of this guy, and to do so, we try to average this equation over the disorder with the condition that lambda must be smaller. So this is lambda lambda must be smaller than s one. So this is the smallest eigenvalue of our wishart. Okay, in this way we are singling we're singling out the, the smallest eigenvalue here. Okay, so we are singling out the smallest lagrange multiplier. Okay, so if we average this equation and we try to solve it with the constraint that lambda must be smaller than the smallest eigenvalue of the s one, then we have some chance to characterize the smallest value. Sorry. I mean, it's either this one or this one, you need to imagine that you have only one cut here. Okay. So you have only one cut. So whatever, whatever is the, the first intersection that is to the left of s one, this will be the smallest value of the Lagrange multiplier. Okay. So we want to average this, this guy here over the distribution of side is normal zero one and the distribution of the eigenvalues of a wishart wishart matrix that's the two sources of disorder. So we first average over psi. So we get one over N summation, s I lambda minus s I square. And then we have summation over lambda. Sorry, L and M. And since the components of the vector psi, which remember psi is just Sigma times B. Sorry, B is Sigma times side and the components are ID Gaussian. So this is just with variance one. So this is just a delta L M. So what we get here is just summation over L V IL square, and this is equal to one because we assume by normalization of the eigenvectors. So we perform the average over the side or the noise disorder, and we can rewrite this, this object that remains here in this way, one over N minus the derivative with respect to lambda of the summation over I of s I lambda minus s I. I'm pulling out a derivative so that I can, I can take out a power of two here.  So if we do that, then we get that this object becomes minus the derivative with respect to lambda of lambda, the guy that survives here times one over N summation over I one over lambda minus s I. This is an object that Mark has discussed at length in his lectures. This is just the resolvent of the we should the we should matrix. Okay. So we get to the to the final formula that if we average the left hand side of this equation over psi. We can average it over a or over the we should matrix w, which is a transpose a. What we get is that this object is equal to minus the derivative with respect to lambda of lambda g of lambda, where g of lambda is the average over the we should matrix of one over N trace of lambda I minus w to the minus one. So essentially we we have an explicit expression provided that we can compute the average resolvent of the we should we should matrix, which is something that we essentially with with Mark we have touched in sideways. Yes. Yes. Yes, so this, this is a notation that in the large and limited is a bit misleading what we are going to what we are going to determine is the fact that of course the eigenvalues when we average over the we should matrix will will form a continuum of eigenvalue which is the spectral density. So we are we are, we will need to require that lambda is smaller than the lower edge of the much and couple store essentially. So what what is going to happen is that in in the large and limit when we average. The eigenvalues will will form a continuum here, which is described by the Marchenko Pasteur law, and we are going to impose that lambda is smaller than the lower edge of the Marchenko Pasteur. Of course, of course, it's not. Yes, so we are just assuming that we are taking the solution that lies outside of the Marchenko Pasteur C. Good. So, excellent. So the to compute this object here we use what what I call in in the handout equation 16, the average trace identity, which is something that also Mark essentially covered. What we need to do is we need to compute the integral with some some constant C, the integral of the Marchenko Pasteur density with the lambda minus s that comes from from from here. Under the condition that lambda is smaller than the lower edge of the Marchenko Pasteur. Okay, and this integral can be computed exactly by making a change of variables. To do that, you, you can reconstruct an integral. So this goes between as minus and as plus you reconstruct an integral in the x, that is, of this form x, one minus x divided by one plus a x. One minus BX. That can be computed explicitly explicitly it is in various tables. I can give you the result here. Okay, so you, you make this change of variables the constants are are known, you use this integral and you plug it in in here. And this will become a function of this parameter lambda, which we assume is smaller than s s minus, and then all you have to do is is to take a derivative of this object. There's just a long but trivial, trivial algebra. Okay, so if you do that, you get an object. Let me write it like. So a and B are these these coefficients that are of course expressed in terms of s plus and s minus the two edges of the Marchenko Pasteur. So, so with this with this change of variables. So you don't find this integral on tables but you do find this integral tables, and then all you have to do is to match the coefficients a and B with some particular, you know, combinations of s plus and s minus. Okay, so you get this equation. So this is the left hand side of the average version of this of that equation, which must be equal to one over sigma square. And this is an equation that you need to solve for lambda. Let's call it lambda star in in the larger limit this lambda star is essentially the location of the smallest Lagrange multiplier. And after you have averaged the left hand side of the of the equation over all sources of of disorder. Okay. Now if you solve this, this equation for lambda star, you get a very interesting expression which is one of the main take home message messages, which is this. lambda star, while I put the star here is equal to square root of one plus sigma square, and then you have root alpha minus root one plus sigma square. And then root alpha one plus sigma square minus one where so alpha is m over n, the ratio of number of equations versus number of unknowns, which is larger than than one. So, a few consistency checks. So, first of all, we see that lambda star the minimum. The minimum Lagrange multiplier changes sign at some point, depending on whether alpha is larger or smaller than one plus sigma square, which is in agreement with with this. So this this value here. I mean, depending on whether alpha is larger or smaller than one plus sigma square, the smallest intersection here will will happen here or or here will be positive or or negative. Okay. And then we have this very important combination which will play an important role in the in the in the future. Having the result for the typical smallest multiplier, we can proceed by computing the typical value of the smallest loss. So what we want to compute is the, we take the age of X, which is written as one over to a X minus B square, but then we replace for X, the solution of the critical point equation. Okay. And then we know that X. The solution was w minus lambda identity to the minus one a transpose B minus B. Sorry. This, this was the solution and then there is an extra minus minus B. And then we compute this object. When we take the square norm. It's not equal to lambda star. So, it, it is, it is the average. But then we, we have assumed some sort of self averaging from from the, from the beginning. So it is the average and the typical value if if our old derivation, you know, goes through. Otherwise, we wouldn't have, we wouldn't have been able to start from averaging the entire equation. Right. So, if, if this disturbs you, this would be the average value of the smallest eigenvalue, but in the back of our mind we need to assume that this is also the typical value. So that we are not in a situation where the average and the typical value do not coincide. It is an assumption behind the fact that we, we are averaging from from the beginning the left hand side of the equation. Right. Otherwise instance by instance, that equation will have a fluctuating solution, a widely fluctuation fluctuation solution right, which is not necessarily represented by by it. The fact that typical and average do not match is not necessarily linked to a lack of concentration. It may be just two different quantities, even in problems where the typical quantity. Sorry. No, no, okay. Like, if you assume concentration, it's. Yeah, if you assume concentration, then, then it's again, I would say. Okay, good. So what you have to do is to compute now this, this object and then replace lambda with lambda star here. Okay, so you just need to multiply this. You just multiply one half of a X, which is this object here transpose, and then you multiply it by itself. Okay, so you can then you plan. You compute this at lambda, lambda star. Of course you need to average over B and w again. So I will not.  So these are algebraic step we're just multiplying matrices. Okay. In the end, you get the following. So this is essentially the minimal. So averaging over a and B, this will be the average value of the minimal loss. So what you get is one over two B transpose a. So after, after multiplying matrices, which you need to average over, let's say, a or w and and B. So you, you do that. So the average over B of B square is easy. So it is summation I want to M of bi square average and B. We know that the variance of B is Sigma Square. Okay. So we get that this is M of Sigma Square and this takes care of this of this average. And then we need to average over B this term here. So let's call this matrix. So you get that the average of B transpose R B is equal to Sigma Square, the trace of R is a simple one liner exercise for you. Okay. So the B, the B average is easy. And once we have done the B average, we get a term trace of our. So the trace of our is is a term of the surprise is the trace of W divided by lambda identity minus W, which we need to average over W. So this can be can be done using the marching poster law. So this is, this is easy. Okay, so everything that the minimal loss can be computed by averaging over the we should distribution and, and what we get in the end. Is this final result. Which is that in the limit and to infinity, the average minimal loss divided by N is given by this result one off square root of alpha one plus Sigma Square, minus one. And here is essentially what what you had here as well. So we have, we have a formula for the average minimal loss in the large and limit obtained by averaging over all sources of the of the disorder. And of course, we have computed this formula, assuming that alpha, which is the ratio M over over N was larger than one using a different technique so replica technique which I'm going to do next and for the remaining two hours. We extend this result down to a critical value here, which is smaller than one, and it is given by one over one plus Sigma Square. So what what is this result telling us, well it is telling us that for an over complete system. The minimal loss is positive. So we will not be able to satisfy the system, exactly, which is not. I mean it is quite obvious that if we have a number of equations that is much larger that is larger than the number of unknowns, we would not expect to find an exact solution. We will, we will show with another method that this carries over to another critical point which is smaller than one. So even under complete systems are in general, not compatible, due to the nonlinear constraint. Only only when the alpha the ratio is smaller than this number that is smaller than one, then typically we get that the average minimal loss is zero, which means that we can satisfy the system exactly. So the presence of the nonlinear constraint, the quadratic constraint makes under complete systems in general, non compatible. Okay, that's that's the take home message and and you see it for example in a simple example, like if m is equal to one and n is equal to two, you get a system of two linear system where you have one equation. With two unknowns, but a nonlinear constraint. So you, if you didn't have the nonlinear constraint, then you would have a very large number, very large space of solutions, but the presence of the nonlinear constraints tells you that you get a real solution. Only if be one is smaller or equal than a certain value. So if the noise is too big. Then we cannot satisfy this this equation, even though the number of unknowns is larger than the number of equations. Okay, so the presence of the nonlinear constraint is actually very important. So we can make a system that would otherwise be solvable, not solvable. And that's, that's the source of this. Yeah. Yeah, so the question is, is it known if below this, this transition point. The, the loss function is in India on the average is exactly zero, or if it is like a sub linear terms. And I would, I would guess that it is certainly sub linear in N. So what we have is that to leading order in N, the average is zero that's the only conclusion that we can, that we can get. And I'm sure there are, let's say, order little low of one corrections to that to this, to this result. And so, terms, terms that go to go to zero when and goes to infinity but it is not identically zero. So in conclusion, what we, what we are, what we are saying is that a very large system on average or typically is solvable. But the finite, a finite system will will have, you know, correct. So if you're talking about finite and then most of the systems will not be exactly solvable. That's for sure. This is a statement about typical behavior in very large systems. Let me, let me also mention that it is obvious that this, this threshold decreases so goes to the left when Sigma when the noise increases, right. The, the larger the noise, the more we expect the system to be incompatible in, in, in general so this this threshold is expected to move to the left, when the noise, the noise increases up to now we only have a result about this but we have to deal with the method that we are going to develop the replica method we can push this, this line down to this, and this is a very important message. So under complete systems in the presence of no linear constraints are generally non-compatible, maybe non-compatible. Sorry, I did hear. I, you're right to be honest I did this very quickly it might be that that there is, there is an absolute value I'm, I'm, I'm not sure I will need to redo this more, more carefully. I mean, this was just an illustration to say that there is an inequality constraint on the known term here that comes from the, from the quadratic constraint. Yeah. Yes, probably you are, you're, you're right. Yeah. Okay. Any other, other questions. Okay, well, luckily I can now relax. I'm sure it's not true. Okay, we have a break right.