YouTube team keep it clean. What's going on? It's in Graven here with another video and in this video We got our first injury of the season and it came to somebody. That's one of our new wide receivers And also we got a starter back And we also received a big-time special team of back to but before we get on into all of that Let me introduce myself me. I'm engraving vids. This of course is the YouTube channel engraving vids And I'm a Ravens fan, but on here we just talked football period So no matter what team you a fan of come through subscribe and join. I love y'all y'all know that I appreciate y'all y'all know that Thank you for joining me so early. Thank you And you can follow on Twitter shout out to my boy Meach because he's the one that sent a link about this Ravens player getting injured In the Ravens group chat if any y'all want to be part of the Ravens group chat Y'all just hit me up on Twitter man, and I'll throw you right in there My Twitter is engraving vids follow on Twitter's engraving vids snapchat all that good stuff Everything Instagram everything is engraving vids and make sure y'all leave a like on the video to click that thumbs up button man Click that thumbs up button again shout out to Meach for dropping that link in that Ravens group chat So anyway, I see a lot of people asking some people know some people don't know But the first injury that happened this season already already already It came to John Brown. They said he got a knee injury John Brown apparently has a knee injury So that's never good news. Oh, yeah, you see everybody come through when they get that notification If it's just a regular stream a regular video, I see some of y'all just be like all engraving she's streaming whatever okay I don't care so y'all exit out but come to somebody getting injured. Oh y'all come through man Y'all come through quick. But anyway 75 people in here 1030 in the morning Y'all make sure y'all leave a like on the video and subscribe if you haven't already But anyway, John Brown got a knee injury They said he injured it yesterday in practice But they said he didn't come off the field So it doesn't appear to be serious that have been injuries before where guys have stayed on the field Look at Joe Fleco. That was during the games and shout out to Joe Fleco in his heart man Because he stayed on the field during his injury and finished the game out. Y'all remember that? I think it was against the Rams With a game winning field goal, I believe but anyway, yeah, hopefully he'll be okay because In practice, I'm not taking I'm not getting all over hyped about it anything like that But in practice it seems that him and John Brown are developing in chemistry, but that's practice. That's against your own teammates I'm not buying into it yet But the bet the the the more practice they get together the better the more they they can get to know each other Know what they like what they don't like know their routes noted every just everything about each other the more the better So I'll take it and I'm grateful. Yes, we do still have Chris more. We still got Tim white We still got out of boy. Well out of boys. You'll still hurt right now And we got I mean we got it's a bunch of receivers there But they didn't sign all those receivers to a one-year five million dollar deals Not saying that those receivers can't step up and in if anything happens to John Brown Or if he if the injury turns out to be serious, but Yeah, that's that so Hopefully it really is nothing serious. Hopefully it is nothing. Hopefully. Hopefully that's what we're hopefully that's what we're hoping for so Yeah, I know a lot of people like to white a lot of people like Tim white Kyle Will say I don't think he's gonna make the team I don't think he's gonna make that the 53 man roster, but we'll see man We will see But anyway, and again, we I did put a bit put out a video earlier But I don't think YouTube sent out the notification the show didn't look like it. I thought yeah, they didn't I'm like a thousand percent sure that they didn't but I did do a video earlier on Us getting in a starter back and a very important a big starter that being Jimmy Smith We remember Jimmy Smith toward his Achilles Officially it just blew out on in December the beginning of December. I think the third so his his Achilles blew out then and it just It is like a bittersweet thing because It's he just so he just so happened to be He just so happened to get this is For those four games and we have four games left He said he said John Brown sacrifice himself for Jimmy And appreciate all y'all coming through man appreciate all y'all coming through so early Good morning to everybody that's up in here right now Make sure you leave a like on the video and subscribe if you haven't already But anyway Jimmy Smith It ended up working out for him like in a beam So he got to serve his suspension last year while he was hurt because the Ravens would have ended up putting him on injured reserve Oh, I gotta do this again. I gotta do the same thing I did yesterday. I gotta hit this turn man Okay, there we go. All right. I'm back But anyway, he ended up serving his four game suspension last season as opposed to having to do it this year I know somebody asked me about that on Twitter about like 15 minutes ago So yeah, Jimmy Smith for anybody that was confused about him being suspended for the four games And if he served it this or last year, he served it last year So Jimmy Smith, he is good to go now. He's he can come back and play He won't have to serve any more time unless he does the crime again, but anyway It just worked out because it it allowed him to start rehabbing quicker It allowed him to start recovering faster because last year he was never healthy. He was never healthy never healthy Apparently they said the injuries not that not too serious. So hopefully they're right about that Ravens have said injuries aren't serious before and we know how that turns out. So we'll see I just I won't believe it until I see it. That's what I always tell you all about Ravens injury We back at this. Hey, what's going on Charlie? We we back at this time of the year where I'll be telling y'all do not believe anything until you actually see it Meaning with injuries. So if they say somebody's injured and they say that it's not serious Do not believe them until you actually hear about that person practicing again. Don't believe it. Don't believe it I appreciate it Savage But yeah, he yeah, no Jimmy Smith. He didn't have that injury since week six He had it since week one Jimmy Smith was literally hurt all year last year all year long He was hurt all year long. He was never ever healthy when we get oh, that's a good question line Oh, he said when we get another madden stream, I don't know man. That's a real real good question But I'm not sure honestly. I'm not even gonna make no empty promises and anything like that I don't know. I don't even remember the last time I played Madden But I played 2k, but I don't stream it y'all know that but anyway Yeah, so if we can get Jimmy Smith healthy for this year I talked about make sure I check out the video that I put out before this about Jimmy Smith in the injury because I just I just hope everything goes well, man. I hope everything goes well. I hope they don't rush him I know they said earlier today. He was doing individual drill. So that's a start He's not thrown out there all the way in the fire yet, but this is a good start. This is a real good start He's out there early. It's only mini camp. We're not even in training camp yet We're not even at preseason and Jimmy Smith is out there. So I love this So I just I hope that he's all the way healthy And another thing we did get a big special team of back to That being Albert McClellan with all this Jimmy Smith news and then of course the John Brown injury Kind of overlooked that Albert McClellan came back to I hadn't even seen that at first So that's a good sign for him That's a good sign for the Ravens even though he's somebody that I don't think is gonna even make the roster Because like I said last last time I feel like with Albert McClellan nice player He can come in and start at linebacker whatnot. He can come in and do his thing He plays good on special teams, but he um They they saw what life without him was like last year and they were just fine, especially on special team So, I mean we'll see what happens Like I still don't think he's gonna make the team But this is good that he's back and he's healthy because one it gives him an opportunity to make the Ravens It gives him a better chance of making the Ravens and two worst-case scenario If he doesn't make the Ravens, then this gives him a shot at being healthy and being ready to make another team So this is a um, I can't say it's a win-win. I don't know where his heart is I don't know if he wants to play I'm sure he probably would want to play for Baltimore, but at the end of when it comes down to the end of it I mean the thicker things it's a business and he knows that more than anybody He's been cut and re-signed by the team before so if they were to cut him again I'm sure he would be like, okay time to move on. He already knows the risk of injuries He already knows NFL stands for not for long. That's no surprise or shocker to him He's uh, he's been in the NFL for a while now. So, you know how the game goes but anyway, um That's that man. That's that we um Appreciate y'all coming through this morning. Uh, a lot of stuff going on I was not a lot of stuff going on, but big stuff. That's some pretty big news, man That's big stuff. So again, just do a recap for anybody that just joined us shout out to my boy Jay money What's up? Perfect one appreciate you coming through man. Hope all is good up there in Baltimore. Um, it is Oh, he said T. Oh on speed out. It's John Brown. John Brown was the Ravens that got injured. All right, John Don't appreciate you coming through. Um, John Brown was the Ravens Receiver that got injured. What's up, Brandon?   I saw the snap I said, oh check them out, man. My guys out here traveling the world. I Almost thought I was like, hold up. Is he gonna go to a Broncos game? But then I realized it's not football season yet So but you did give me an even more excited for football season when I saw that. Oh, you're in Cali now That's what's up. You doing a world tour or something? Okay, I'm gonna I'm gonna check out those snaps when I get off for work, but yeah, man It's uh John Brown. So John they said it's minor. But again, like I say around this season I mean around yeah around this time of the season Do not believe anything that they say about injuries when they say that minor unless you see that player actually get back on the field Don't believe it because they've told us that before That an injury is minor and then that player end up being out for the whole season They that's just what they do. So I Just don't want none of y'all to get get like hopes up or anything when it comes to it And not just even this injury. I'm not trying to upplay this injury I'm not trying to downplay it but I'm trying to make sure that y'all keep a realistic view Of the injury and of injuries in Baltimore and of people of injury history in Baltimore What Raven say when somebody is hurt and you know, they always say the same thing, man They they they they kind of downplay the injury They kind of make it seem like it's nothing and then in all actuality ends up a major blow Not every time but enough times it has so they got a history of it. So Appreciate y'all Thank y'all for coming out man. I really appreciate y'all the fact that we had 75 people in here at 10 30 in the morning That's great, man. That's really that that's great. I really appreciate y'all coming through. I love y'all Thank you so much for everything you do for team keep it clean. Thank you so much everything you do for me every um Every opportunity that you presented me. Um, there's some stuff that it's just it's been a lot It's been a lot but a lot of good stuff, man So thank you for coming through appreciate y'all make sure you leave a like on the video Follow on twitter now. I ain't nothing man. Y'all are the best y'all are the best. It definitely ain't me by far So I appreciate all of y'all man. Thank you and I see y'all later on. Oh real quick notifications Uh, I did see somebody put on twitter for notifications to fix that Turn uh click on the bell and turn off the notifications then click on the bell again and turn all on So if you turn them off then turn them all on then it says that you're supposed to get all the notifications So hopefully that works. I meant I meant to mention that I meant to mention the video earlier But we'll see either way appreciate y'all man. I'm out. I love y'all. I'm gone Oh, and if you want to be part of that Ravens group chat, just send me a dm on twitter man And I'll throw you in there. My twitter is engraving viz. Y'all already know all one word. I'm out


We stand at a historical moment in our nation's history, a moment of huge potential and possibility, but also a moment of uncertainty and important choices. We can't predict what the future will hold, but we can't prepare for a range of possibilities. There are key strategic decisions Mongolia's leaders must take to ensure the country's prosperity. Possible responses to these challenges need to be explored so we can find original ways to face the opportunities and trade-offs together. How should the development of the mining industry be managed to maximise benefits to the country? What forms of economic diversification should be pursued? And what relationships for trade and investment need to be nurtured to achieve both? But Mongolia's future is also impacted by forces beyond its control. Will Mongolia's context allow it to produce and sell its main minerals with ease? Will external factors help or hinder the development of other economic opportunities? The possible outcomes of these uncertainties are explored in three scenarios, helping Mongolia to learn and prepare for whichever future arises. In the first scenario, Northeast Asia becomes more politically integrated with strong economic growth, giving Mongolia the opportunity to sell its main minerals and achieve economic diversification. In the second scenario, a revolution in environmental attitudes sees China lead the way toward sustainable green growth, reducing demand for Mongolia's main minerals. However, this opens up new opportunities to diversify into green products and services. In the third scenario, geopolitical tensions ravage the region, making trade difficult. In this world, Mongolia struggles to access finance and markets for its minerals and to achieve economic diversification, but an opportunity is presented to be a respected and neutral neighbor. Stakeholders and experts believe these scenarios suggest common policy responses to the strategic decisions such as developing a good investment and business climate with public buy-in, designing sovereign wealth fund and actively engaging with neighbors. They also suggest that individual scenarios offer interesting policy choices, such as facilitating cross-border infrastructure in regional renaissance, joining green regional supply chains in China greening and locking in long-term contracts and resource tensions. By thinking the unthinkable and imagining how our world can change, we can choose the transformation we want. By looking forward with our eyes open, we will be ready and aware to grasp our future with two hands.


We are the best please we are on that first pull. The second ball bit of break on the third round. A wing is tough. We worked well. Oh thank God let's go to the sprint check. What are you saying? Come on, that's it Tuesday. The other comes, good. What we're going to do, we're going to love to skip like we do on a game day. We're going to go for height please. Just go skip to skip, skip to skip. Go for three if you want all tonight, it's five. Watch it, watch it. Is that an awful step to the nail? Come on.  Yeah, we've just got bikes, right foot. The worst bit is that's absolutely staying in as well because of the way you built it up. You've just got to get a nice close and show it. Oh do you want me to get the other one? Yeah. The winner. No surprise there. His right foot was the worst actually. His was the worst. His was the worst. The second worst. Don't lie to the people. You didn't score more than me, him. I scored, I scored the most. Actually let's actually check that. You scored the most. No idea.


24. It's probably about the show 24. Keefer Sutherland, about time. That great Indian talent. I think he went to India and remade it. Everything he does is in Hindi. Welcome back to our 200 reaction video. It's I'm Corbin and this is Rick. I'm Dom. Yes. And if you're new to our channel, go to back, like, button, subscribe, and ring that little bell to be part of the Notification... Watch, watch. He's gonna ring it. And today, to, uh, something after I tell you to follow us... On Instagram! Fastball down at the knees. My mind's not working. Everything's all over the place. That's okay. Uh, we're reacting to 24. I believe this is a South Indian film. Cool. We see you when you're telling us to react to South Indian films. We really do. Um, sadly, usually you just say, react to South Indian films without telling you which one you want. But this one has been requested a lot and also South Indian films, I feel, are even more difficult to find English jobs for. They are. That's true. Um, but yeah, we are working on... Unfortunately, our guy on Patreon is working on a couple that you've had been requesting a lot. Uh, thank you to him as always. Yes. Um, he's on. Hopefully those will be out soon. Um, but this one's called 24. Um, we have no idea what we're going into right now. The only 24 we know is the show. The series. Which I'm assuming you guys know about, have seen. And I'm assuming this is nothing about it. Nothing to do that at all. But, we should, it's the hee. Okay, this one had a lot of stuff going on. You think? And that's why we were a little confused. Because, one, it was so fast, but it just... And it was hard to follow because it just kept changing. Like one day, happy, happy musical! And then it started off. It started like, straight. It started off. Yeah. I was like, okay, ooh, it's us. It's creepy. This is going to be a horror flick.  Yeah. And it felt like, like, Ellis. I felt like I just went on an acid trip. Yeah. Like, multiple things. Like, not a single congruent. So, maybe it was just a trailer that was weird. I mean, it's not that it was like the old trailers that are just not good. No, not at all. And it was really difficult to follow. And the one thing I did love about it is that it was really pretty. Yeah, I actually... I liked it. It was beautiful. It was just, I couldn't tell you what this is about. Not in the slightest. There's literally at least eight or nine different directions I felt it was going. Yeah. And then at the end it goes, for good measure, it goes, and by the way... It's musical. Yeah. What the heck? It had like a bang bang dance number in there. Yeah. It had everything. It had like some gangster stuff in there. It had some scary stuff in the beginning. And a drama and a drama comedy. What the heck was that? So, the trailer was just so difficult to follow. So... I know what this was. This was an acid trip dream that Keifer Sutherland went on in one of the episodes of 24. Yes. So, it starts with an episode and ends with him waking up. Wow. Crazy. Wow. The... From what I've noticed though, from what Yelf said about something in each film is that they're very original stories. So, that's what Yelf said. Obviously, we haven't... KGF. KGF was the South Indian film I think. Yes. Oh, big time. Like the biggest so far. Yeah. They're making the sequel. It's a long fucking... But that's what they said because like when we watched the eye trailer... Which was freaky. Crazy weird. Crazy weird. And like Yelf said, a lot of Yelf said that was like from one scene. Right. It was very strange. Yeah. But, Yelf said that like Bollywood, they kind of rehashed a couple things often. But the South Indian films kind of have a very original story. So that... It definitely looked original. Definitely looked original. It looked like five different original films into one trailer. And I don't want to categorize people in a particular way that locks them into a box. But I do want to point something out. We did the Carnatic music thing. A lot of messages about the difference between South Indian music style and other music style in the North. And I'm forgetting the name of that in Hindustan. And what we listen to in the Carnatic is actually not even written out a lot of the time. It's an improvisational form of artistry. So when you see one particular concert, that's an original thing that will never be done again. I have a sense that South Indian artistry as a whole has this, don't box me in. It's going to be fluid. It's going to go. I would love to be on a set with something like this and see if the screenwriters just they just make decisions and change it. I don't know what's going on. That was crazy. And I think I like it. That was crazy. Let us know how it is. Is it worth the trip? If it isn't worth the trip. Obviously I'm assuming the film makes more sense because... Right. What I don't want is three hours later to feel like I did after the trailer. Yes. That would be bad. That would be bad. Let us know what films we should react to next. If it's a South Indian film, please tell us specifically. And it would be very helpful if you send a link with English subtitles. A link with English subtitles is always awesome. That would be very helpful. Yep. But yes, Keith has changed a lot. He has. Yeah, him and his dad.


Alright, we are here at the top of the mountain to film motocross and it is going to be so much fun It's kind of a different environment a lot of times you see motocross chasing kind of in an open field with a lot of big Jumps, but today we're at an avocado grove. So basically There's like 50 acres here and there were all surrounded by avocado trees and everything all a bunch of really cool Vegetation and plants and all the nature stuff. I'm from Florida. It's flat there We don't have hills and mountains like this. It's crazy. Wait till you guys see it. I can't wait Chasing chasing anything really an environment like this But there's a lot of hills is your camera angle. So last time I chased here I used 25 degrees of camera angle and it was really difficult for me to chase them because when they're going downhill You know 25 degrees pointing up pointing down It's now like it's like 50 degrees and you're just going way past them So today I'm trying out 15 degrees of camera angle and it's been a little bit better Honestly, I just got my first packet and the footage looks great. I cannot wait to get ripping all my shots are awesome Yeah, but they're not like touching the tire with the lens of the camera like buddy So it's like I'm not like jumping up and oh, hey look at my clip What do you mean you say touching the tire? I mean like really close really close. Yeah, that was a joke Gotcha. I didn't mean that time you actually hit somebody. I didn't oh Hit the tire I felt like I was chucking the air for like a solid 10 seconds and then I hit and they found me a bike I asked for something like really my speed something like a lot of power The bike is so small for him too. It's so funny. Oh my gosh All right, so I'm about to fly my chendrones the car. Yo, this is a center lift quad so it's spinning Oh my god. It's so heavy x8 basically Gives us more power because with a drone like this We're gonna be carrying a cinema camera right now. I'm just carrying my vlog camera This is a cannon m50 with an x8 you still have four points of thrust just like a quadcopter But you double up the motors at each point you get an increase in power Without the increase in size that typically comes with other octacopter Configurations and you get more redundancy you could chop off a couple props and you'll still still able to fly I don't recommend it. Yeah, but when you're carrying a heavy and expensive payload It's really nice what you'll typically see on here is like a red Komodo seems to be the popular camera Like people are putting on this job, but you didn't have enough allowance money for a red Komodo So we can and I'm 50 is gonna have to do it Yeah, and I notice you you taped the lens right where you want it So is this you got your aperture and your focal length and all that just fixed Yeah, I have that fixed and there's electrical tape on there because Alex told me a good tip is sometimes in flight This all vibrations can change these right so electrical tape just keeps it there nice Are you worried at all about putting such a big expensive rig up behind dirt backers kicking up dirt? You know not really. I mean today's kind of like the perfect days like you know I mean I don't get to chase many cool stuff So this is a perfect opportunity to take it out and try to get some cool footage with it Can't wait to see what you do man show us what you've got. Yes, sir Oh my gosh, we're holding the drips hand. I saw you go down this way I couldn't see it could be over here could be over here I got unplugged in the air like it was just complete locked out freezing. I didn't even hear the the motor What no way you just found it.  Yeah, yeah You got a celebratory coke. It's a celebratory coke. Can I have a sip, buddy?


Mojte. Zvukaj pa sem bilo površen, da so promatovali. So, razvaja, posledaj. Prdne, bomo ga počutite počutiti o pletformu procesoru in o pletformu procesoru. Zato se lahko dobro vse izgledaj. Na pletformu postavimo izgleda in skupaj svoj skupaj na vsega svetu. Tako, X86 procesor je, da se možete vzve, je veliko je procesor od lat 70-jih, in nekaj zelo je, da je procesor veliko zelo vse procesor, ki je veliko začala, je veliko začal. from 1984 and also 1983. Those processors were the platform processors without a possibility to change the firmware, but they had important functions, which in that time was a keyboard and also the resetting, the whole platform and the famous A20 hardware. Ja so znamo bo, da sem da sem gatherila, kaj je veliko tukaj čega, z pošpos, v kaj se tažem so gordi, in za to, kaj je V820? Vse, staj z našem vzdušenjem. Tako je OK. Vsi so to, še se du posludi precezes. Po našeho, tudi dobrali se dobrali, nekaj nekaj neki prececes, da bi je všeho katilitva z izgleda laži. plug-in events in special keys in so on, and this controller has usually 8051 CPU or some super Hitachi CPUs and so on. So, this x86 platform currently is using such things, and if we look how it looks in today, that we will find that the border between the hardware and software somehow diminishes a little, and that there is a lot of firmware present if you look to the Linux kernel, which has this firmware directory or the package you will immediately spot that virtually any peripheral today has a kind of firmware, which needs to be uploaded and to operate. But in our lecture, I would like to concentrate on the platform processors, which are helping the main processor, and let's start with the Intel processor. As you might know, there is one, which is remarkable. It's an Intel management engine. Who knows this one? Yeah, great. So, let's go. Let's go to the AMD, because maybe it's not so many known. So, in AMD platform, which you can buy today, you will find several other processors. The first one, which I listed, is the system management unit, which will be more on that later today. Then there is even a small AT51, which is located in the south bridge, which is called integrated microcontroller. And of course, there is also some other controller in the USB, which you can figure out in your homework what kind of controller it is. And in the end, the very recent AMD processors comes with something, which is called platform security processor. And this processor is ARM Cortex A5, with a trust zone thing. And the reason why AMD introduced this processor is to redo the chain of the root of the trust. So, the idea perhaps behind this is to have something else, which gives the root of the trust, while booting the x86 processor. So, in fact, something which verifies the BIOS before even the BIOS is started. But in this lecture, as I said, we will concentrate on the system management unit. But x86 is not the only platform, which has such kind of special platform processors. If you look to ARM or PowerPC, you will notice that there are special channel or DMA processors, which are also running there, if you know. And here is just a funny table. I hope I have it correct. So, I'm not aware if there is any malware running on this kind of platform processors, but as for today, I can put the platform processor as some bugs. So, let's have a look. And to finish my introduction, I think it's a good way to increase kind of awareness of this. And because these platform frameworks are in every modern platform, and you cannot simply disable it, because it's a part, it's a generally part of the system. So, you have to live with it, and there could be possible security problems. And this is, I think, a very important point that the hardware engineers are involved, which means most of them are not the software engineers. So, if you ever have looked to some BIOS assembly codes, or some small embedded system platforms, you know how clumsy they are, and this doesn't help the security much. And there is kind of an event of some very special firmware, which can be loaded to the current platforms. Most likely you are aware of the bad USB stuff, which I think I have it. It's not in fact in the USB 3.0 controller, but in the client, in the USB device. But what you can also run is that you can run Linux in your hard drive, because somebody with the Sprite TM name found out that the hard drive PCB contains free ARM processors, and you can run MMU less Linux inside your hard drive, and also fix the ATC shadow, if necessary, for example. So, as you can see, now we live in the age where those processors are somehow bubbling out, and something needs to be done. Yes, and I was speaking about the open source firmware, and I believe there are also perhaps some close source firmware, and here you can choose your right permutation of the vendor. Okay, so this was just the first part of my story, and the second part is about how I went through the SMU stuff, and as usual it begins that people read books and some read also datasheets, and if you do that and have a look to this document, which is very nice, it describes most of the stuff, how the modern AMD processor is working, it's called AMD BIOS and Developers Guide, and if you have a look into this document for the very recent families, you will find there this quote, that there is something which is called the system management unit, and it takes responsibility for the power management and system related tasks, and the last sentence is quite nice. It says the SMU contains a microcontroller to assist, and this is the point where I started to think, let's have a look, what is it, and if I can get some fun of it. And because I like the stuff like ciphers and so thing, so it was very ideal topic for me. And this thing is also very special because it lives in North Bridge, and North Bridge is the part of the system of chip, and it means in the end that it lives in the CPU, and this was the reason why I put the name Matroshka processor. And while I was preparing my lecture, then I noticed that the Western people are not, they simply don't know what the Matroshka is, and so I brought one to show you. So this is the main CPU, and if you open it, there is a smaller one. And so this is not a part of the Czech culture, because we were the Soviet satellites some 20 years ago, and there were not other presents available, so we kind of have still some of them hidden in our homes, but please do not buy them in Prague as a tourist souvenir, because it's a tourist trap, and please don't do that in the end. Okay, so now back to our lecture. So what kind of microcontroller is there? Of course, nowadays the Google knows quite a lot of answers, and if you put this to the Google, you will get some more datasheets, which we will need later, but also you will get something from LinkedIn, and not just this one, but also a lot of other pages, which describes a lot about what the SMU is in fact doing. So here I won't read it at all, but in fact, as you can see it is LATIS LM32 processor, it's doing some dynamic power stuff, and this guy apparently implemented the adaptive algorithm to deal with the power management. But please don't blame this one, because there is many more on LinkedIn, especially for the AMD employees and other employees. Okay, so if you know that this is LATIS Micro LM32, then here is quite a short introduction. So it is, let's say, open core processor, you can get SDK for it, or you can download, or you can compile your own tool chain, and you can get also the reference manual. So this is in general a very good start to think about this. And the LM32 processor really likes the number 32, because it's a 32-bit processor with 32-bit instruction size, and you can guess how many registers inside processor it has. Yes, it's 32. And because in the next part of the lecture I will need this information so just quickly, we have the R0, which should hold the 0, and the rest is quite obvious. This architecture is not like x86, it uses link register to save the return address from the function. Yes, and so far we know what kind of architecture we have, but we don't know where to look for the firmware. So the hard way is, of course, to desolder the flash, or the flash chip, which is on the main board, read it out in some programmer, and look if there is not the firmware, but in fact there is an easy way, because on these platforms the BIOS image is a complete image of the flash. So you can have a look for the firmware in this image, so you don't need to do the soldering stuff and reading out. And I put some clue here that the firmware is part of something, which is called AGSA. This is AMD platform initialization blob, which initialize the every aspect of the AMD platform, and this is included from AMD into the vendor BIOS, and it is called, during the BIOS execution, to perform the initialization steps. And to get the firmware, you can download virtually any BIOS from the net, for example, for the FM2 motherboard, which I was using for my experiments. And now, because I already told you, it's in the BIOS image, so you can try the text search, and the search is for the SMU. And if you do that, you will find something like this. If you look to the slide, there is underscore SMU underscore SMU, and this thing is most likely just an encore to allow other, perhaps AMD people to find it more easily inside the blob. I have no other explanation of this. Then the bold text is actual firmware, which is for the SMU part. And you have many firmwares, many, like, three or four in the IJESA, because one IJESA supports different CPUs, like Trinity or Richland, and also others like Arizo, for example. So, the next thing is that we are on the Communication Congress, so we have to communicate also with this processor, and we would like to communicate from the X86 processor, so. And this is where the document I mentioned is, again, helping, because it is described and documented in the public documentation, that there are these two registers, which you can use as kind of gateway to this other space of this processor. And here let me take a little detour, that if it is not documented, it doesn't mean it doesn't exist, it's just a delay. And on the other hand, I do appreciate that AMD is putting a lot of efforts to have documented platforms way more than the Intel, so please try to support them at least like this. So, let's write some simple utility to dump the address space of the system management unit from running system. I use the Linux. So, if you do that, I know it's rather small, but, well, I will fix it later. If you do that, you will see that it's kind of strange data. It's repeating 55, 55 AA, and again, and this is for the first 64 kilobytes. So, then it's getting a little bit better, because you will immediately see that at the offset of 64 kilobytes, it starts to be the same as you have found already in the BIOS image you or I analyzed. But what is strange is that after the 500, sorry, 256 bytes, there is again this 55, 55 AA, which means that the runtime firmware is most likely hidden from you, so you cannot modify it, and then some random garbage flows. So, this is how it looks if you dump first to 64 kilobytes segments. I put it into the nice table, so it is more easily understandable. We will look now to the header, and then we go back to the firmware. Okay, and I need to drink some water, because... So, this is quite easy stuff in the firmware header. You will find what you think it should be there, and you will find out that there is a version number. There is a length of the header, there is a length of the firmware. There is also something which looks like entry point at the offset C, and then at the offset 10 in hexadecimal, there is something which looks like a checksum, it looks like very random data. And in the end of the header, there is a 55AA signature, and then it continues with some firmware, which we don't know yet. It could be the first instruction. So, let's have a look at the instruction stuff. So, as I said, it immediately follows the header, and if you disassemble this instruction, this 0000, like 3098 at the end, and the second one is the same, so you will get this instruction, which is quite unhappy, and it is garbage. But you have to try something else, and it's like big end-end, for example. And if you do that, you will get something which is very promising, because as I have shown you, it is expected that in register R0 is in fact a zero. So, it looks good. And is there someone which can do something with the radar software? Yes, please, I will need some kickstarts to this, because as you will see, I did it in very own way. So, I decided I will convert the firmware to the L file, and I did it with the object copy, like this. So, I created one section, which I marked that is executable, and then I used object dump to dump it back, and if I have done it, so I get these first steps. So, here, as you can see, it's just zeros. I don't know why twice time, but it is so the R0, then it disables interrupts and setups the exception handlers. And then it sets in other place in the routine, setups the stacks and zeros the BSS, and it's classic CRT zero startup. So, I decided I will put back some more symbols, so I can use nicer object dump, and exception handlers were described in the LM32 manual, so I could add more data to my linker script and identify the exception handlers of the firmware. And if you look to the functions, they look pretty standard, they have some prologs and epilogs, so I just skip this for now. And here I think it was a great idea. And I said that let this SDK, and I looked into the SDK and found out there is CRT zero RAMS and some C functions, which were handling the interrupts, and interrupts routines, allocation, and registration, and so on. And I also checked the binary image of the example, which let this included in the SDK, and I found out that AMD, in fact, uses this also. So, I was able to fill my linker script again with some more functions. It's not exactly the same because of the different GCC, most likely, but it's very similar. Okay, so let's see how to communicate with the firmware from the operating system or from the BIOS. You can read in the manual that it is possible to invoke something which is called SMU firmware request, and this is documented again. And you will just write some request number to a doorbell register, then you will just trigger the interrupt inside the doorbell register, and the SMU will get the interrupt and proceed with this kind of interrupt, and then also return if the interrupt or this routine was successful or not. So, in the detail, this is what I found out is that most of the stuff is power management related. It's something which is called budget aware of power management, and that the custom registers are usually located at the end of the second 64 kilobyte segment. And this is not only this. There were also some functions or some service functions which were quite easy to understand and there were some for the flashing of the data caches and instruction cache. There was also a very special request which I nicknamed pink request because it just incremented by one sum register and this was all what it was in fact doing. So, now we know quite a lot about this SMU and now we need to ask some questions. So, if it is possible to run some program, our own program on it and what are the problems? So, the obvious problems could be that there is this protection thing which doesn't, which means that the code is protected from the runtime modification plus there is something which looks like the checksum. Plus if we would modify the BIOS, it would mean that the BIOS on its own has some kind of checksums so, this is the problem that we need somehow to solve. So, this is again just from the firmware headers I was telling in the beginning. So, there is this 20 bytes of something which we will need to find out and this 20 bytes is in fact 160 bits. So, what this could be? Yes, that could be SHA1. So, I tried really hard with many permutations like computed from the firmware without the header, with the header a little bit in the end with zeros instead of the places where it is and I simply failed. I didn't find out how to do that. Yes, and this is what I said already. So, the second thing is runtime code injection. So, how to do that? We have this problem that the code and data segment is hidden and it looks like it's protected. So, but there are also ranges which are not protected and this was seen in the big dump I showed you in the beginning. And let's examine this further and see if we can write there something. So, in this slide you see that there is this 55 and so on again and at the offset DC50 it stops and there is some random stuff. And the header as I have told you already is also visible. So, these are these two regions and in the end of the 64 kilobyte segment there is this communication area with some random garbage. So, if you look to the offset data which are to be seen right after the protection ends, it looks something like this and there are some strange things happening here. So, the offset data matches some functions in the firmware which I need to tell you. What is it? So, I don't know. And what is more strange is that this part is still part of the BIOS image. So, somehow something went wrong with that. Even more than terribly. So, there is a first problem that there is some problem that the 256 bytes is missing in the protection and the header is also the same length. So, it looks like it's kind of a problem that this part is not covered because someone forgot it to edit over there. So, because of this we need to ask more, can we change this offset data during runtime? And answer is yes. And is there something which involves this function pointer from the offset data? And answer is also yes. In fact, there is IRC, there is this patcher which handles various interrupt requests from the SMU and one of the requests is also which is present there, this SMU request function handler which gets invoked. So, now we can think about how to run the program. So, I took the obvious approach to load it to unused part of the second 64 kilobyte segment. I put there the quotes because I don't know if it was a really unused place or I was just lucky. So, we can modify the pointer in the offset data and then when finished we return the control to the original function to handle the request and also the IRQ request so it's cleanly done. And while at it, I also included here this is actually the function which is invoked for the SMU request and now we can also go through this one. So, first it acknowledges this SMU request interrupt which came because of this doorbell register. It loads the request number which was stored in some other register then it masks it and shifts it and then it loads the base of the function pointer table which is different from previous. This is another function and load it to the register R2 and then call it. So, is here anyone who sees already the problem? No, okay. So, I give you more time. Okay, so there is no check for the bounds. So, in fact it means that you can run something which is not in the array for the pointers and this is bad. So, something went wrong again because we control this 15-bit value which we are passing to the request to this function then the offsets where the pointer table starts is also known. So, we can simply load to some address pointer to our function which we can load there and if we call the SMU request with the right number which matches then we can again execute our own code yes, including our injected functions. Yes. So, in this case it means that we can execute our own code inside the SMU but there are still some regions which are not available to us and I was interested what I can find there. So, in this case it is the region for the first 64 kilobytes. Yes. So, everything begins like writing a program so let's start and write some and this one will be quite easy we will use the methods I told you right now to actually program some kind of function which allows us to copy 4 bytes from any place inside the firmware and copy it to some place which is not protected which we can read and we can use this damper as many times as we like and it means we can dump the first 64 kilobytes to see what is there. Yes. So, let's have a look what is there. I do think it's most likely a ROM I like my processor and I have written data there only once very covertly and nothing happened so most likely this part is a ROM part. What is interesting is that it has the same structure as the runtime firmware but with more complex initialization and it implements only SMU request 0 which verifies the firmware which is loaded by the BIOS. So, while the computer is starting most likely this ROM gets executed first then it waits for this request and BIOS will load BIOS will load the firmware from the BIOS image to the second 64 bit 64 kilobytes then invokes this and the firmware in the ROM will authentificate this kind of firmware. So, and if we can analyze it we can also see what went wrong with this 256 byte offset and of course what kind of hash is used. So, this function if you look it is not one function in fact it's much more than one function and there are some strange constants like this anyone knows what these constants are? I didn't know either so I had to use a help and if you look there is another clue that it's SH1 or HMAC and I had now difficulties because I didn't have any proper disassembler so how to make sense of these big functions and I found out I can use something which is obviously known it's called QMU so QMU it has support for LM32 and I hack it a little bit to have support for this memory layout which was like there will change to one file so I load it in the QMU the ROM part firmware and RAM part firmware and I also load I started the QMU to executing the authentificate function and I was able to debug it with the GDB and to see what's really happening so now what I have found out is here so the authentificate function it loads data from the firmware header it flashes the data caches computes the hash function flashes data caches again and then it checks if the hash is matching in the firmware in the firmware header here it is using the constant time algorithm so it means if the hash is different you cannot use the timing attack as it was possible I believe in the nintendo vii or something like this so far so good it setups also the protection registers and here is the problem because the size of the firmware doesn't include the header so they thought it's included but it was not and this explains why there is this 256 bytes gap on the part which should be covered but it is not and it changes also the reset vector of the LM42 so next time the ROM is not executed anymore and the authentificate firmware is run and in the end it signals back the results to the bios so how it looks with the header checksum so it is not a checksum but a hash and debugging helped and this is what I was telling class time and it is also it also means it is a symmetric key and if it is a symmetric key if there is anyone with a key he can or she can sign on firmware I know that this question will arise so I will answer it wait a second I do have some keys yes okay so now you can close your eyes yes yes so who has the closed eyes it's written no close your eyes really I'm watching you and wait for the next slide so the slides now you can open them so you can actually read that it's called the secret so now I will press the space now you can see there was a little spoiler because the 42 is in fact the slide number so let's move on the slide number 43 there will be no 43 there will be some joke which or which will be fun at least for someone is there anyone from Czech Republic so great this is not a secret in Czech Republic and it is not a secret anymore here so I will also skip it and the secret of course remains a secret so but now it is time to write some email to AMD and we need to write them something so this is what I have done I wrote to whom it may concern I have discovered security vulnerability in the recent AMD processor which allows arbitrary code execution on the system management unit and I have trouble to find out whom to write so I decided to use link at in to find some contact to some sensible engineers which looked like they are responsible for this and how to support the claim I changed the pink function to add instead of one to add 42 in hexadecimal and I fixed the hash and then I send it to the AMD and so and now something about how it went so I analyzed the firmware during the Christmas 2013 while I was watching chaos communication congress in a little window but in the big window the firmware and sometimes later I found the bugs I presented to you and I've written to AMD on last days of the of the April and in like two weeks I received a response please can you give us more information and so I started to and create the communication between me and AMD I've written in the detail what is the problem and then in July they acknowledged the problem in the meanwhile there was some communication and in November at the end I received a list of version which will contain the fix so now it is fixed and the conclusion is that they responded like to the next day and because they are on another continent then meet so it was fun to and fast sorry fast to speak with them and that's it and yes the fix problems both issues are now fixed so the firmware is now padded so there is not a problem again with this with this problem inside the inside the routine in which is authenticating the firmware the problem with the SMU request function I check it is also fixed and some other unrelated fix to these vulnerabilities in some other processors that are also fixed so how it looks as you as I already told you the SMU firmware is part of the AMD AGSOM and now it is time to ask your vendor for updated AGSOM and I think it is a good idea to do that and to support this because it's the vendors which are delivering the BIOS updates to you not the AMD and this is perhaps the only way how to force them to update also the older platforms is to simply bug them and ask them for the fixed AGSOM which is here so in this table you can see the processor names which are affected by these problems also the AGSOM version number which you can get if you search in the BIOS image for AGSOM string then there is this string likes begins with 1.1 and the SMU versions which are listed over here in my presentation in the slides if you go back then later I use the version AA which means 10.10 so you see now it's version 10.14 which already includes the fix and I use this let's say some nicknames of the processors but it is easy to find them using Wikipedia so you will find it or just ask me or drop me your email if you have some problems with that so thank you for your attention you would also agree to a Q&A session so please line up on the microphones microphones free yeah sorry I need another microphone and I have my own yes I know cool so two simple questions first of what can you actually do from the SMU can you read anything from memory can you actually do anything else than just respond to interrupt well it was not a purpose to analyze this for me I simply took my journey and I didn't want to damage my processor I'm not sure if it is even possible to physically damage it I don't know if there is any DMA available inside this processor I would bet it's in the USB3 controller which needs to use DMA I don't know if this processor uses the DMA but I forgot to tell you that I have here a guest from AMD which can most likely help me to answer please welcome David hi David hi everyone yeah with regard to that specific question the SMU appears to software as a PCI device and it has the same capabilities that you would generally expect of a PCI device which includes DMA it has of course some additional capabilities with regard to its specific function within the SSC regarding power management and things like that but yes it is able to read and write memory okay awesome so the other thing is help assistant is firmware once a geesa actually puts anything in it's basically volatile right so if I overwrite the like if I'm malicious and I patch the host's firmware the bias blob to have a malicious piece of LM32 code in in that blob that I recalculate the checksum for that I now can since I do know that older CPUs allow me to read it out and the ROM doesn't change since the last time I can basically just infiltrate any random CPU can't I? alright I guess I'll so your question is about the the window of vulnerability right between power on and when the firmware is loaded yep yeah that exists and that's unfortunately not something that we can really patch in the field I guess our response to that would be that if if you are able to have more trust in your early BIOS code to correctly load that firmware then that will help address that and so some of the technologies that we are working on with our newer products include things like Harbor Validated Boot where we have the reference platform security processor verify the integrity of that first BIOS block that executes so that you can have that chain of trust going forward but yes I agree there is a window hey that makes sense thanks the IRC has a question yes thank you the question is what is exactly in the SMU and is there power management unit also in it could it be used to overclock or activate more cores well I think it is used for the power management stuff like the the dynamic or adaptive power management I don't know if it if you can overclock way more or if you can unlock some other cores that's I don't think the David will tell this to us so I don't know yeah I would say go and have fun let me know what you find okay microphone 4 thanks for your talk just a quick question so currently the BIOS the actual BIOS image calls that SMU DERA request to verify the BIOS image right yes so you could in fact just remove that from the BIOS assuming you could re-compute the BIOS checksum and bypass the whole I'm not even sure if the computer can run without that so I think you have to you have to load it so well no no no I mean bypassing the SMU checksum not the SMU loading was it because if if the BIOS has started if the main CPU has started first I'm sorry I can't hear you very well sorry if the main CPU started first and then it loads the SMU image and then it calls something to verify the BIOS image was loaded correctly the BIOS image must have been already loaded right or am I getting a problem? the sequence is that the main CPU x86 starts to run with the and the SMU in maybe same moment is running also but it is running the ROM firmware and when the BIOS is doing its stuff it will load the image to the the RAM of the of the SMU unit the second 64 kilobytes and then it will invoke the authentication function and unfortunately I don't know any details what could happen if this is wrong or if you don't do that so again maybe David will yeah I think I may have created the confusion so let me try to address that the statement about verifying the BIOS code which loads the firmware is a statement with regard to newer products starting with the Mullins product that include a platform security processor where the platform security processor is the first microcontroller that comes up out of reset for the older parts that do not have that what Rudolph just said was correct okay thanks microphone 2 okay you notice that now we should rely on the mainboard vendors to supply BIOS updates containing the patched firmware blobs for my experience with inter mainboards I have very little trust in the mainboard vendors to do proper h-macking in their BIOS updates so do you see any chance in just swapping those blobs in existing BIOS updates I mean I know for Intel that it's definitely possible to patch BIOS updates which are not properly secured I think you will face the problems with some other BIOS checksums in the end and I would recommend you to use the core boot and because core boot has the fix for this problem also yeah that might work as well good point thank you microphone 1 hi I was just wondering I've heard from companies like Facebook, Microsoft and others that they put out pretty huge bounties for security vulnerability found so did AMD reward you for basically doing their job? no I'm buying them dinner what are you talking about? well well I didn't want to sell this because I thought if maybe some other people know about this so let's make it public to balance out the world, our world and yes it cost me some money to get in fact here and speak about you about this so I'm a little bit at the minus but I'm enjoying the congress very much so it's okay for me good for you number two yes thank you for your talk did AMD actually change the salt they use for the sharmacking? I think no it's still the same key so basically if you take the same steps that you did you can just find the salt and write around firmware for the... yes it's in general it is possible but there might be a ways how to put there the new keys or the new salts I don't know if they would then these would be supplied in bios updates and you can just extract the new seeds or the new seeds yes it's a fairly good game maybe David can tell something right so obviously the fix that was released is new firmware and so if you take that out and you write your own thing that gets loaded before that or something like that then you're running essentially with the same device that Rudolph did the the key or salt in question is hardcoded into the silicon itself so it's not something that unfortunately can be changed okay thanks number two the first part of my question you already answered because it was just that question so after applying the new firmware new vulnerabilities not with standing like the SMU is then safe like yes so so with this fix it's okay now because yes the window is closed you cannot access the memory anymore and you cannot load your own code into it anymore and as long as you have the bias blob in the chip it's okay as far as we know unless you guys find something else yeah thanks and if you do I'll just say since Rudolph's encounter where he had trouble finding someone to talk to you at our company we have set up in a new email alias that's listed on there so if if you do have time to experiment and you find anything we'd love to hear about it so please email us so thanks to Rudolph thank you very much for finding this bug and make us all safer thank you and for the talk


Welcome to DIY Bypass Tools. My name is Robert Graydon and I'm one of the organizers here at the LBV and today we're going to be showing you how to make bypass tools at home. So a lot of you may be wondering, aside from being mid-pandemic and having to do all of this from home, what other reasons would there be for us to be making our tools DIY? The most obvious, of course, is that these are specialized tools and most of them aren't even in production. So if you want to get it at all, you need to be the one making it. Aside from that, when pen testing, it wouldn't be a fantastic look at a lot of sites to be of the guy walking in with a duffel bag stuffed full of various tools and wire and rope and all of that. So it's handy to be able to know how to look around in your situation and find materials to make the tool that you need when on site. Today we'll be showing you how to make five different types of tools. The latch poker or puller, the under the door tool, the beside the door tool, padlock shims, and the latch knife. First off, we'll be teaching you how to make the latch poker or puller. The materials required for this is a single coat hanger or a piece of wire. You will also need a pair of pliers. Welcome to the Lock Bypass Village's tools making presentation. So in this presentation, we're going to be going through a few different tools that you may have seen already in Bypass 101, which is another talk that we'll be running multiple times throughout the duration of DEF CON. And if you haven't already been to that, I highly recommend checking it out. It's somewhat of a prerequisite to this presentation just because we won't be teaching you how to use these tools so much in this video, but just how to make them. So to begin, we're going with a pretty simple one. Some call it a latch poker, but its essential purpose is when the latch of a door is visible to you from the locked side, it's basically a tool to just go in and push that out of the way. So this one's incredibly simple. All we need is just a piece of wire really. It should be somewhat thick because it does need to be fairly rigid, but coat hanger wire works perfectly for this purpose and we'll need a pair of pliers. So to begin with, we're going to take our pliers and we're going to bend the tip and we're going to take about a centimeter and a half at the front of this and bend that over at 90 degrees. And so then we have our sort of hook there. And then we're going to go about four inches back from that and cut off the rest of our wire. And at that point, what I like to do is put a little bit of an eyelet onto your poker here. And once we have that there and we have a bit of a hole at the end of it, you can just thread this onto a key ring and that works as the handle and how this functions is it just reaches in and you can use it to push a latch out of the way. And so that is how to make a latch poker. Next we'll be making the under the door tool.  You will also need a pair of pliers. So in this video, we're going to be making the under the door tool. It's very similar in purpose to the beside the door tool which we'll be making later in this presentation with the key difference being that although both of them are trying to pull down on the handle on the other side of a door, the beside the door tool requires a certain amount of clearance. So if we have the door frame and we have the door, the gap between those two has to be great enough that the tool is actually able to pass through and slide up that gap otherwise it won't work. And if that isn't possible, if we only have enough of a gap just underneath the door, not beside it for our tool to go in, then we'll be having to use the under the door tool. So that's why we have these two different versions that accomplish the same thing. So to begin with, the materials that we have will be needing a coat hanger. We'll need string. And if it's possible, try to get some sort of string that is somewhat abrasion resistant just because we're going to be pulling it underneath that bottom edge of the door when we're using this tool. And so if it's something that's too thin or easy to cut, then it might just get actually snapped when we're using it to pull. And then for tools, all we need is just a pair of pliers. So to begin with, we're going to be taking our coat hanger and turning it into a long piece of wire essentially to build our tool out of. So how we open it up is with this twisted area on the neck here, we just take our pliers and we're just going to firmly grasp the top there. And then we can just twist this by hand and that will unwrap that top portion. So now we're going to be straightening this out by hand just to get a straight piece to begin with. And so this only takes just a few seconds here. And some might find it helpful to use pliers for this step just because it's kind of hard to grip the thin wire and bend it sometimes. So once we have our straight piece of wire here, so this has all been straightened out, what we want to do first is we're going to create a kind of loop at the end for our rope to attach to or our string. So we're going to take our pliers and we're just twisting that over. And so now we have this little eyelet here. And next what we are going to be doing is we're going to create a bend in it and we want to create a kind of hook here that will go over the door handle. So this is the shape that we're looking for on this side of it. And at this point we can take our string here, we will just tie that on. And so now what we want to do is now this varies depending on the height that the handle is on the door that you're actually facing. So in some cases you may need to either find a longer piece of wire or you can also, if you get two coat hangers, twist them together to get enough length. In this case we're just going to be making a small scale one that would work on the demonstration doors that we've been using throughout. So we're just going to go down and imagine if our handle is here and say this is where the bottom of our door is. Then we're going to make a bend there at 90 degrees. And we can just kind of make a little bit of a bend and then we have our hook here as a bit of a handle. And so at that point our under the door tool is complete. We'll now be making the beside the door tool. The materials required is a coat hanger and we will need a pair of pliers. So we're going to be making the beside the door tool in this video. So all that we need in terms of materials is just a regular wire coat hanger. Some coat hangers that are made out of wire you'll find that they have a sort of plastic or rubbery outer sheathing on them. And while those will work sometimes they're not ideal because they're thicker so they get stuck in the plastic actually inhibits almost how strong they can be just because it means that the wire inside is going to be a lot thinner. So you want to try to find one that's just wire itself not with any coating. And so to begin with we're going to just unravel the twisted top here and that's going to let us open up the coat hanger. The easiest way to do this is just with your pliers you just grab at the top and then rotate the whole coat hanger. And so now we have our opened up coat hanger here. So just by hand we are going to straighten out the wire here and this just gives us a nice starting place in terms of actually creating our tool. And so we have a fairly straight wire here now. So the part that's actually going to be reaching out to the handle on the other side of the door is what we're going to be creating first. So we're going to take our wire and we're going to bend it with about an inch and a half or two inches like so. We're going to be adding another bend like that. And so that creates our hook that will actually be going onto the handle on the other side of the door. So now while keeping this flat we're going to be coming down about a foot and a half and we're going to be bending a 90 degree angle in there. So it's looking like this.  And so after that thickness you want to put another 90 that brings the wire coming up like this. And so now we have this basic shape and so this can go around the side of the door. And then we're going to come up to here and we're going to look where is our hook. So we have the hook that's on the handle here. So what we're going to do is mirror that on the other side just by bending this over. And the purpose of that is that just gives you an indicator. So when you are using this tool you can look at where this is on your side of the door. And you can because they're bent symmetrically you can see that the hook is in that same place on the other side of the door. So you know where it is relative to the handle. Okay so just to quickly demonstrate the sort of symmetrical idea of this tool. So here we have a small example door and you can see that it's a lot shorter than a real one. So the tool that we've made here it's kind of built for a full-size one. So it isn't going to quite actually be usable on this tiny example here. But the basic idea with this is that you would put it underneath the door and then sort of jimmy it up until you have this piece here between the actual door and the frame. And so at this point just from looking on this side we can see where our little bend is here. And we can see okay well that's right next to the handle here. And what that means is that because it was bent symmetrically we know that that's actually where it is on the other side as well. And so that's how we make this tool and also how we use that symmetrical trick on it. Next we will be making padlock shims. The materials required is a soda can and you will also need a pair of scissors. So now I'll be showing you how to make padlock shims. These are a very simple thing to do at home. You just need a soda can that's empty and you probably want to wash it out beforehand just so you don't make a mess as well as a pair of scissors and that's it. So to begin with what we want to do is basically get this flat wall of it out into a rectangular sheet so that we can more easily work with it. To do that we're just going to cut the bottom off of it, cut the top off of it. And these edges are very sharp so be careful that you don't cut yourself. And then we'll cut right down the middle and we can open it up and we get this flat sheet of very thin aluminum. So you can kind of flatten it a little bit that just makes it easier to work with. And so next what we want to do is actually cut out our shim. So the basic shape that it's going to be is it kind of has a curve downwards. And that's the actual shim part and we're going to leave about a centimeter strip on top of it so that we can fold that over to create a handle that we won't cut ourselves on. So we'll be starting this off by just cutting that curved piece down there. And that's the part that's actually going to go down into the padlock and push the lash out of the way there. And then again you're cutting about a centimeter wide strip. And so that leaves us with this basic shape for our shim. And all that's left to do now is we take this strip that we made here and we want to fold that in half. And what that does is first of all it gives us a rounded edge so we aren't going to actually cut ourselves on that because the edges of these pieces are extremely sharp. And also it just adds a bit of structural rigidity to this so that it will hold up better while shimming. And so then the final step is we're just going to take this and kind of bend it a little bit into a bit of a round shape just so that that'll more easily conform to the actual shackle of the padlock when we're trying to put it in. And so that's how you make a padlock shim at home. Finally we'll be making the latch knife. The materials required for this is pallet strapping. This is commonly seen in warehouses where it's used to secure large loads onto pallets and is something that's recycled after use so very easy to find. You will also need a pair of tin snips and a pair of pliers. Okay so we're going to be making a latch knife in this video. So what we need for this in terms of materials is a piece of pallet strapping. So this is a very common thing to see in warehouses. It's essentially a very thin piece of steel and it's used to hold down materials on pallets. But because of how common it is it's also very helpful for us if we're trying to DIY this. In terms of tools scissors aren't quite going to cut it for this material so we will be needing a pair of tin snips and we'll be needing some pliers. So the actual creation of this tool is fairly simple. First of all we're going to want to cut a kind of knife point onto this and what that lets us do is push this in and actually get it behind that latch to begin pushing it out of the way. So now we're just going to cut that knife point onto our piece of material here. And so now we have that there and if you wanted to you would maybe straighten it out a little bit if it got bent while cutting. And then so what's left to do is we're actually going to have to put a handle on this. So you want to look at your point here and if we know that the latch is going to be on this side we want to go in behind it. We want our handle to be facing outwards from the door because how this tool works is it goes in between the door and the frame. So we're going to take our tool here and we're going to just start the bend by hand. And so you can see that we have the start of a handle formed here and now is when we need those pliers because this is a fairly strong material. So the pliers are just going to let us take this and squish it down so that it's thin enough to actually go in there. And the hammer also would help out with this if you do have that but we can get it done with the pliers. And so that's how we make the latch knife. Thanks for coming out. You can ask us questions on Discord or if you want you can message them to us. If you haven't already I'd highly recommend checking out Bypass 101 as well as some of the other talks that we'll be running. Enjoy the rest of DEF CON!


From Africa to Israel, these incredible people have come a long way. My name is India and today we are going to meet the Ethiopian Jews of Israel. You may have heard of the Ashkenazi Jews from Central and Eastern Europe or the Mizahid Jews from the Middle East. But have you heard of the Ethiopian Jews? The Jews of Ethiopia are known as Beta Israel. Most Ethiopian Jews first came to Israel under two major military rescue operations in the 1980s and 90s. They were called Operation Moses and Operation Solomon. In fact, Netflix even released a film called the Red Sea Diving Resort based specifically on Operation Moses. Under Israeli law of return, every Jew has the right to come to Israel as an immigrant. This is called Making Aliyah. So the mission of these military operations was to airlift as many Ethiopian Jews to Israel as possible to help them make Aliyah. With Jews facing major persecution in Ethiopia and in the war torn Sudan at the time, it was no easy task. But thankfully, many of them made it to Israel. And today, there are around 160,000 Ethiopian Jews in the country. They make up 1.7% of Israel's population. It may be a small portion, but their impact on Israeli society is quite large. They are involved in politics, they serve in the army, and they have a big influence on Israeli pop culture. In 2013, Titi Ayanao, an Ethiopian Jew, won Miss Israel, making her the first Black Miss Israel ever. And in 2020, Ethiopian singer Edyn Alena was chosen to represent Israel in the Eurovision Song Contest. However, the Ethiopians of Israel have also had many struggles with discrimination, with poverty, and with the police. In July of 2019, a young Ethiopian Jew was shot and killed by a police officer. This incited many protests in Israel, similar to the Black Lives Matter protests in the U.S. But despite the many challenges they face as a community, the Ethiopian Jews hope to preserve their heritage and share their culture with the world. That's why in Kiryat's gut in southern Israel, there is this Beta-Israel village. Here, they have mud buildings called Godjos, and plots of land for farming like they had in Ethiopia. Hello, my name is Giaulah Adarai, and I am an Ethiopian Jew. Today we are talking about Pekes Buna. Buna is an Ethiopian cafe. It's not just a restaurant, it's also a home for the family. The Ethiopians also have a passion for music and dance. It is still a huge part of their culture here in Israel. The Ethiopian Jews are brave people. Many of them escaped brutal persecution before coming to Israel, experiencing grief and the loss of family on their journey. Yet they remain resilient even today in their own struggles. The Ethiopian Jews carry a special joy in their heart, maybe because they are glad to be home. Their story should inspire us all. Thanks for watching, and I'll see you next time.


That's just on side of my face. Okay Me and my boy started a label together along with his dude named since sir and Asha was he I shone the Hoover. Yeah. Yeah, they not do so. Yeah, I'm full trade gangster crypto. Okay. So like, you know that the NLA The politicians doing but at this time I was up like a couple million dollars. Okay I stayed next door to Jay Leno at this exact moment one hour stuff here like when he was I had so many calls on my house Jay Leno was coming next door asking what kind of cause to me and my partners had like Brabis Benz is it like exclusive? That's real I just like I said when I when I Think about the things that you you know people that came into my my show flew in from New York And I didn't never know that your name were gonna pop up, but a dude came in here Man this dude came into my show. I didn't know how to take him He was he used to be with Takashi 69 And I really were looking like what he wanted to come on my show for yeah And he flew all the way down here. He had been trying to get on this show for months I didn't know what he wanted But the dude came in here and he was a solid dude. Yeah from what I what I know what I felt He seemed solid and he seemed like a genuine person But the story that he told about you was he said you got shot I think it was four times and after he got shot when he was rehabilitating himself up through the hospital and through different trials and tribulations He says he didn't have nothing and he run into solo luchin solo lucha gave him a couple thousand dollars to put him back on his feet. I Was in my hood solo luchin was living in LA during the time this one He was a loving hip-hop in our country right now, so he was living in LA So, you know solo luchin from Fort Worth. He gave me some money. I said I said bro I just got out the hospital. I just started back walking. I met up with so I met solo luchin and I told him I'm from Hoover. He's not from Fort Worth. We was in LA, right? So for luchin is like do yeah crypto exactly. So I said this he was in my hood with me I brought him to Hoover Street with me. This is when I just recovered and everything So I said yo, bro.  I said bro.  I felt like that when I got shot I was like bro. I'm about to do this rap shit because I felt like my story was so real and everything like I was in his trenches Like I saw I gotta do it, you know Yeah So what happened was luchin gave me about a couple thousand dollars off the street like here, bro Shot me a couple thousand with that couple thousand dollars. I threw World Store hip-hop like a thousand to throw my video on World Store. I shot the video for maybe like nine hundred dollars like only had a lot. He gave me a couple racks, right?  It just looked it like you so when he hit when I we was on this one Instagram was just barely Just barely taking on me.   I in California with a what do you call it?  That's just on side of my face. Okay. Me and my boy started a label together alone just do name since sir and Our son was a son of Hoover. Yeah.  So our son was um One of the one of my affiliates right like hood home boy Like we was all we all kind of carried ourself up an echelon, but we was hood two of us was hood And one was not okay, but so we tried to stay in contact without you know We want to show our people to shit, too they was like We made them feel like security, but there really wasn't no security But just to help a hood in there and get your people some paper put some paper in a pocket Right, so it was my boy big Nate shout out big Nate and then our son, but our son wrapped They wanted to be a rapper he was coming around and one of my partners That's not really a hood he kind of wasn't too comfortable with our son being around because our son. Let me get it straight He bought six seven now Six nine six nine two hundred seven pound when I met this nigga He a who they called him mr. Thousand phase because he called over a thousand fights in Cali Hmm with different sets different games.     I can't afford to get my videos. I boom boom boom I'll just skin them down bro to say this bro. It wasn't I'm gonna give it to a strip or something anyway Right, you know what I'm saying?  I'm like well at least I know Cug Cug ain't gonna never forget Man, he never did because he mentioned it on the cell and it might be reason why he wanted to get on the show So I'm telling you when you said That's why it's good things going on with luce solo man No, it's just like it's wonderful to know that that you is out here doing stuff from the heart Even when you get your breath a lot of folks change on people and don't even stay 100 like that So that's the thing that's why god continues to bless you bro. He's gonna continue to bless you too Because you're always trying to do right by him. That's what really matter, bro You know, we had these long conversations.  No, we went over 100 Don't have nothing to do with nothing just come out with it We got the plaque. So, you know, it's official, you know, so, you know, you got any time you come through You got to come through and see as you can be our running around here, uh, you know, for getting about us for a year, right? I can't know. You know, did a whole whole tv series all in atlanta I think I seen it in california I had to be out to sit there and question about it We're still we're gonna you got a co-host you could do anything over in here, man Okay, okay. You know what I'm saying? We could have did this without shunning. He could have told you about Man, you remember when I got shot you helped me. I'm like, yeah, this is good That's what we're gonna be back. Talk about how you seen princess dolly bae in the back Come on. Come here. Yeah, you for the pudding. Why am I a little bit? Come on. Come on So, yeah, okay Okay, yeah Put the song on cause any woman to get on here gotta drop 16 bars. No, I'm just kidding. I'm gonna do it Oh, she ready No, no, we ain't got the time right now. You're gonna do you like that? I know you'll be done just so so you uh, you you how did you end up meeting uh, mr. Solo luchi through instagram through instagram That's supreme Bob supreme he pointed me in her direction. Wow. Do I have the power to do to help? Yeah, so so so how long you've been doing music? Um, two years consistently. That's hard and and and did you ever think you'd be dealing with uh Did you ever think you'd be dealing with uh, uh, solo luchi, you know, had you had you seen him on a loving hip hop and all that stuff That's crazy, right? Yeah, man for you guys to be the linked up man. So I think that's that's hard, man I think that's one of the most courageous things man for god to bless you and you be able to link with a dude who really been in, you know Uh, been been in been in been in the limelight. You know what I'm saying? So I just definitely want to say man. Thank you for even coming over here, right?  Okay. You know what I'm saying? So, um, just um, solo You gotta come back up here cuz I gotta end this man.   God got to call me done. Let's do it. And we can we can hang out man. We you got I gotta see how that I don't want you outside. Don't give me I know you're making making there it is But but I can tell you right now, man. Uh, I like what you're doing man What's the name of your label? Have you even for money for money to win a collection for money? Okay? Yes, sir. We're different. Wow, man Yeah, we on boss talk one on one one on one. Yeah, we gonna talk