Welcome to Access a Trader, the number one community for those who are committed to taking control of their trading in order to achieve success, profitability, and longevity. Thank you for joining us. Here's Dan Shapiro to help you find your edge, master your process, and own your future. And just like that, with a snap of the fingers, bullish sentiment is done. Guys, good evening, everybody. Welcome to another edition of TheAx is a Trader.com. Nightly wrap up show. Hope everybody is doing okay. So let's talk about it, right? Let's talk about it. Again, I think one of the biggest problems that, and we spoke about this numerous times in the past, I think one of the biggest issues that new traders have, they are hell bent about being right. Okay, nothing about trading is about being right. Again, nobody cares about what you talked about. Nobody cares about the call you made or the stock that you touted that worked out. Nobody cares, okay? Technical analysis and doing your research, it's all about being prepared the night before, okay? It's all about safety, putting yourself and putting your money at the most comfortable situation that you can't handle mentally, okay? That's all it is. So the ego game should be brushed out the door. The bravado game and I was right and you're wrong and all that stuff. It means absolutely nothing. It's how you can sleep a night, okay? How you can take your capital however way you've got it and protect it until the day you die. And again, if you are careless in this tape and you continue to trade with blinders on, you're going to be gone.  And I know I see a lot of people talking about this market reversal that we saw today in the middle of the day and they were shocked. How could somebody predict this? This market sell-off came over everything. Again, it's not about being right. It's about being prepared the night before. And today played out pretty much how we talked about last night in the video. We talked about this 228 level on the Q's. I thought this area was an incredibly important area that the bearers, if they needed to defend any type of, you know, any type of conversation that this was nothing more than a bear market bounce versus a V-shaped recovery. They needed to make their stance. So the idea that somebody didn't see this coming is it's all about trading, I guess, like this.  But again, professional traders, when they're doing their chart work, when they're researching the night before, we're not looking for the alpha. We're looking for the dangers that could be right in front of us. It's like going into a dark alley. Would you go into a dark alley with no lights on with everything hoping to God you get out of there alive? No, you just don't go into a dark alley. And technical analysis is there to protect you. It shows you what your worst case scenario is. Of course, look, we're looking for measure potential. We're looking to see which way the wind is going to blow. But ultimately, we're trying to put ourselves in a position that our money is safe. We'll continue to be safe, that we can continue to stay in business. And one of the things that we talk about all the time is emotional buyers meeting technical sellers and emotional sellers meeting technical buyers. And again, that is the 101 most purest form of technical analysis. And I think if you really ignored the signs, again, you don't need to listen to anything I say or watch any of the videos, like nightly videos. But again, if you went into today's session and you didn't put in that macro chart work from the night before, you are the emotional buyer. You believe that, again, nothing could harm you. You believe that this is a Teflon market. And for the last 45 days, it has been. But it has been on technical levels that kept on getting rejected, that kept on getting reclaimed and remounted and going higher. And now we're kind of in this weird area. And you're starting to see a lot of the really aggressive perma bears. Even, for example, Stanley Drunkenmiller came out, you know, really, really legendary investor, came out after the close and said, this is the most aggressive area that you can possibly put your money. Literally, now, not yesterday, not the day before, not a week ago, not two weeks ago, not three weeks ago, now that we got this rally and we have this massive reversal intraday. Now he comes out and said, wait, wait, wait, let me add the feud to the fire. This is the most aggressive area that you can possibly put your money. Now, look, maybe he's right. Maybe he's not. We don't know. Anything that we were talking about last night on the video of a potential rejection of the 228 level, we weren't talking about. I wasn't talking about the idea. I said, well, that's it. Market's over. Market's over. We're going to retest the lows.  California, I think just talked about after the close that the governor, I believe so if I'm wrong, I'm wrong. I believe the governor extended an extra three months of the stay at home policy. Things are not looking great, right? So again, this is enough ammunition that the bear has to kind of make their claim. Now, again, it sounds easier than it does, right? It's never the case. Now the bears need to confirm today's price action. They need to make sure there's enough people that got caught, right? Got caught with their hand in the cookie jar, with their hand in the mouse trap, on this 228 level on the cues that they say no mouse tomorrow and starts kind of a waterfall effect back into the next support zone. And the most important part of what we saw in this sell-off today was two things. Number one, we saw that last gas. We talked about it at morning strategy. I believe we're going to get that last push. We'll talk about the individual pivots in a second. But then I believe that the bulls did not reclaim that level, which they didn't, got rejected once again, back to back days. We were going to get a move back to the five-day moving average. Not only did we get a move back to the five-day moving average, we closed below. And again, this is the first time you're watching any of my videos. The five-day moving average for me is the absolute most important short-term indicator for short-term sentiment. If the bulls reclaim back the five-day moving average tomorrow on a close, obviously, you know, the train is still on the tracks. If the bears confirm today's price action, then we're going to go down to the 10. And any close wall, the 10-day moving average, we're going to go all the way down to here. Now again, this still represents a very, very strong aggressive upside buys channel. But again, we're not looking to make macro calls. We don't care for a ride. We're looking to trade day-by-day, channel-by-channel, trade-by-trade. All we're looking to do for the next day, which is tomorrow, is get enough indication that tell us that we are on the right track to which way the wind is going to blow.  I went through all the NASDAQ 100 members. I went through the Dow 30 members. And I'll be honest with you, if you look, if you do your homework for tonight, you will see that any stock close below the five-day moving average, those are the stocks you want to pay attention to tomorrow. Because if they confirm the shortest short-term sentiment, we are going to get a second-day follow-through of sell-offs. And again, just to give you an idea of what I'm talking about, if you look at the cues, right? If you look at the cues, they close right below the five-day moving average. Look what happened to Boeing, right? We talked about Boeing, and we'll talk about the individual pivot in a second. But look what happened when Boeing confirmed the five-day, right? You see this? I just want to show you exactly what we could be in store for tomorrow. So yesterday, Boeing hit the five-day moving average, which is 128. Everybody see that, right? Yesterday they hit the five-day moving average, and then it bounced. Today, we confirmed the five-day moving average and the stock dropped. So if you look at the cues, just for all you people who are kind of new to trading to get an idea, a visual idea, sometimes, again, you want to see it visually, right? So here are the cues. Today, we tested the five-day moving average close below. If we confirmed the five-day moving average, right? We start confirming today's price target, price action, then we go all the way down to the 10-day moving average. Again, hence the whole point of the PS60 theory, stocks trade from supply to supply, and demand to demand. And if you go through the members, again, it shouldn't take you a long time to look at your charts tonight. It'll take you 10 minutes to go, 5, 10 minutes to go through the NASDAQ 100, and it'll take you a minute to go through the Dow Jones Industrial Members. All you need, again, simplify the day for tomorrow. Stocks that test the support today, if they confirm tomorrow, they should go lower. If the market gaps up tomorrow, and that's in my opinion, the worst thing that the bulls want to see tomorrow is a gap up. Because if these stocks gap up based on how we close into the five-day moving average and go green to red and confirm today's price action, it will be a nasty, nasty sell-off. And again, a sell-off is in the eyes of the beholder. I'm looking for at least, again, I'm looking, if you believe in the theory supply to supply, demand to demand, I'm looking for at least a $3.5 move on the cues initially. Again, nobody's talking about the lows yet. Carp before the horse, right? Steps by steps, baby steps. And until that happens, again, this is just an opinion, okay? Until we confirm today's price action tomorrow, again, this is nothing more than just a setup that needs to be validated. So, again, today played out pretty much like we thought, right? Pretty much how we thought yesterday we were going to get stuck at supply and then things are going to start rolling over. So, you know, let's talk about it, right? You didn't have a lot of pivots. It wasn't one of those days that you were going to have 10, 15 pivots pivot because, again, it wasn't a one big macro surge. There was a lot of names coming off of kind of a rounding top when you get rejected. You're still going to get that late-stage dip buyers that believe that the market will never go down, whether it's macro or just even gravity. So, they were still buying a lot of names into rising support, but we lost that rising support. And that sell-off came, you know, after 3 o'clock. So, it's very, very important to understand that every single day you don't need to really step on the gas with all your might. Sometimes you just need to kind of roll, right? Kind of roll, kind of go 30, 40, 50 miles an hour until you get that opening lane, and that's when you start putting the pedal to metal. So, let's talk about today. Amazon, I liked it for today. I thought, you know, this could get one more push and it didn't, right? Great pivot yesterday, needs to reclaim 24, 21. Obviously, I never did that. So, here's the Amazon chart, right? Here's the Amazon chart. Here's the 60-minute channel I was looking at and never came close, okay? So, again, we had to wait. Tulu, Tulu, Roku. Roku is a quick move here. Never confirmed the next channel, which was kind of weird because it did confirm the daily and the 60-minute in the morning. And this is kind of your first clue that stocks started to slow down a little bit. So, 134 needs to build, and here was Roku, right? So, 134 built. It took out this whole range here, and it went up a dollar, right? Went up a dollar and now we're sitting there and we're like, oh, okay. So, where's the next channel? So, where's the next channel? So, where's the next channel? So, where's the next channel? So, where's the next channel? So, where's the next channel? Again, buyer strike. That's exactly what we were talking about the other day. When stocks get tired, again, they don't need a reason to go down. They just get tired. Netflix, again, we're still waiting for that 445 area. Obviously, never got there. Again, here's a perfect example of a quick scalp. That's all we were looking for today just because we were looking for a directional, biased confirmation, whether it's rejected off that 228 level or reclaiming go higher. So, here are the early morning notes. 134, 75, 135 needs to build. I said scalp only. Again, we saw what would be on that. We saw what would be on that absolutely exploded today. But I believe this was the only trade today into the 136 area. And again, obviously, it got to the 136 area because the stock really, really exploded. But here's kind of what I thought, right? So, here's the 130, what was right here? So, here is the 134, 75, 135 area. Honestly, I thought it was going to just get here, right? I thought it was going to get here into the 136 and change, which it did. It came back in and later in the day it absolutely exploded. But again, we weren't going... We weren't in the mindset that we're going to have a really aggressive continuation today just because all the points we covered. But again, nothing wrong with that. Baba, again, this is a perfect example, another example of stocks that got tired. So, Baba, 207, 207.25 needs to build, right? And again, here's a perfect example. Here's the 207, 207.25 and it got rejected again at 208. So, again, never gave you a second entry on this thing. Again, another perfect example, stocks were getting tired. Boeing, again, this is the first one that really cracked. Boeing 128 daily support held yesterday. If the builds below can flush. Again, I know a lot of you guys are still holding puts overnight. Again, here's the 128 that we discussed, right? Here's the 128, which was yesterday's low. It took that out, started building, closed at 125. Again, this thing confirms, again, remember this whole channel is still measured potential to the 119, 120 levels. So, this is still very much on the table. Again, quick hits on Apple, right? 218 rejection needs to build. Again, we were just in scalp mode today, right? So, here was Apple, here was the 218, right? Here was the 218 level right over here, right? 218 level and the stock, you know, put up a move. You know, the 293.19 had changed. Again, if you can see here, there's a lot of similarities. We're Roku, Alibaba and Apple. They gave that last gas, right? They gave you the cash flow, gave that last gas. It gassed out, started rolling over. Again, picking up clues as we go along that's correlated with the 128 rejection. ZM needs to build, never got there. Tesla put up a move. Again, obviously it wasn't 334. Again, excuse the dyslexia. It was obviously 834 needs to build.  It was kind of all over the place today. Again, it did give cash flow, gave a pretty good move. But again, very, very choppy. I didn't even trade Tesla today. This was actually a really good move. Congratulations to all you guys who took that. 186.60, 186, if it builds below, can reverse down, experience traders only. And it was a nice move. Tulo was a really nice move here. You can see here this morning, right? So you can see here this morning, this whole 86 area right here went down right to this 81 area. I said as I get down to 181 and change, that was the rising 60 minute support. That's exactly what it got to. So Tulo, take on the way down. And I said here, here's the first support, right? It got down to 81.60s on Tulo. Beyond, again, perfect. Got into the 136s. So Baba now needs to reclaim 208. They never got to. Roku needs to reclaim 135, which never got to. Netflix again, got to the 44 area and then just died again. Stocks getting very, very tired. And then I basically said for the rest of the morning, look, these ranges is super tired. These strong stocks that are rallying nonstop over and over again, they're gassed out. Our window in the morning, it's closing. You can tell that the ranges are contracting just sit tight, just sit very, very tight. And the next thing you know, towards the afternoon, again, any close under 128 is bearish. Boeing really set the tone and then everything else got really, really plugged. And again, tomorrow is setting up for a line in the sand day for the bulls. So if the bulls believe that this was truly a V shape recovery, again, they got to step up because of this five day moving average does confirm tomorrow. And a lot of these names confirm with it. We are going to have a second day of selling. Easiest thing to do with kind of get yourself in the mindset of what you should be looking at. Again, guys, just go through these charts very, very quickly. The Nasdaq 100, the diamonds, look for the members, anything that closed on the five day or below it. That's your targeting audience for tomorrow because that is confirmation of short term sentiment. Guys, God bless. Have a great night. Congratulations for putting in the time to take control of your trading. You're one step closer to owning your future and achieving the success you desire. Want daily trade ideas directly from Dan? Straight off his personal watch list? Unlock our free PS60 vault where you'll get nightly updates on pivot opportunities we're watching for the next day's session. Click the link in the description to get started today.


Abstract ferroptosis is an eye-independent regulated cell death that suppresses tumor growth. It is activated by extensive peroxidation of membrane phospholipids caused by oxidative stress. GPX4, an antioxidant enzyme, reduces these peroxidized membrane phospholipids thereby inhibiting ferroptosis. This enzyme has two distinct subcellular localizations, the cytosol and mitochondria. Dihydrooritate dehydrogenase, DODE, complements mitochondrial GPX4 in reducing peroxidized membrane phospholipids. It is the rate-limiting enzyme in de novo pyrimidine nucleotide biosynthesis. Its role in ferroptosis inhibition suggests that DODE inhibitors could have two complementary mechanisms of action against tumors, inhibiting de novo pyrimidine nucleotide biosynthesis and enhancing ferroptosis. However, the link between mitochondrial function and ferroptosis and the involvement of DODE in the electron. This article was authored by Alvin Amos, Alex Amos, Lerong Wu, and others. We are article.tv, links in the description below.


Hello everybody, this is Mr. Mirajdar Bala Sahib, Assistant Professor, Department of Humanities and Sciences, Walchand Institute of Technology, Soulapur. In this video lecture, we will discuss applications to electrical circuit part 2. Learning outcome, at the end of this session, students will be able to solve problems of RL and RC series electrical circuits with initial condition. In previous video lecture, we discussed how to form a differential equation of RL and RC circuit along with the some examples. Now, in this video session, we will illustrate more examples on RL and RC circuits. Let us pause the video for a while and write the answer to the question. Question is write the differential equation of RC series circuit. Come back. I hope you have written answer to this question. Here I will going to explain the solution. Question is write the differential equation of RC circuit. RC circuit means a circuit containing resistance and capacitance in series with electromotive force E of t. As we know that voltage drop across resistance is R into dq by dt and voltage drop across capacitance is q by c and by using Kirchhoff's voltage law, sum of voltage drop across R and c is equal to electromotive force applied to the circuit. R into dq by dt plus q by c is equal to E of t, where E of t is a voltage source called as electromotive force. So, this is the required differential equation of RC circuit. Now, let us consider the example. Example 1, an electromotive force of 200 into e raised to minus 5 t volt is connected in series with 20 ohm resistance, 0.01 parade capacitance. Find the charge and current at a time t, if there is no charge initially solution. By reading this problem, we come to know that given resistance R equal to 20 ohm, capacitance c equal to 0.01 parade and electromotive force EMF, which is denoted by E of t equal to 200 into e raised to minus 5 t volt and initially there is no charge, means q equal to 0 at t equal to 0. By knowing this problem, we come to know that it is a RC circuit, so that the differential equation of RC circuit is R into dq by dt plus q by c equal to e of t. Now, in this substitute the value of R, c and e of t. Therefore, R is 20 ohm, therefore 20 into dq by dt plus q upon c is 0.01 parade, so q upon 0.01 is equal to value of e of t is 200 into e raised to minus 5 t. Now, dividing 20 on both the side, we get dq by dt plus q upon 20 into 0.01 is equal to 200 into e raised to minus 5 t upon 20. Now, after simplification, we get dq by dt plus 5q is equal to 10 into e raised to minus 5 t, denote this equation by 1. It is the differential equation of u 1 circuit. This differential equation belongs to first order first degree linear differential equation with q as a dependent variable and t independent variable. When we compare this differential equation with general linear differential equation dy by dx plus py equal to q, we get value of capital P is equal to 5 and value of capital Q is 10 into e raised to minus 5 t and these are the either function of t or constant. Now, the solution of differential equation 1, we have to find out. First of all, we find its integrating factor i f equal to e to power integration of P dt which is equal to e to power integration of P is 5 into dt is equal to e to power 5 as it is an integration of dt is t. Therefore, integrating factor of differential equation 1 is e raised to 5 t. Now, general solution of differential equation 1 is given by q into i f is equal to integration of i f into q into dt plus k. Now, substitute to the value of integrating factor and value of capital Q, we get q into e raised to 5 t is equal to integration of e raised to 5 t into value of q is 10 into e raised to minus 5 t dt plus k. Therefore, q into e raised to 5 t is equal to now, 10 constant we can take outside into integration of e raised to 5 t into e raised to minus 5 t becomes e raised to 0 dt plus constant k. Therefore, q into e raised to 5 t is equal to 10 into integration of dt is t and plus constant k. Now, dividing e raised to 5 t on both this side, we get charge q equal to 10 t plus k upon e raised to 5 t that is q equal to 10 t into e raised to minus 5 t plus k into e raised to minus 5 t denote this equation by 2. Now, we have to find value of constant k using initial condition we are given q is equal to 0 at t equal to 0 put it in equation second. Therefore, 0 is equal to 0 plus k into e raised to 0, but e raised to 0 is 1. So, that k equal to 0 now substitute this value of k in equation 2 we get charge q equal to 10 into t into e raised to minus 5 t coulomb this is the charge at any time t. Now, to find the current i we have to differentiate this charge q with respect to 2 t we get d q by dt equal to now in the right hand side 10 as it is and the differentiation of t into e raised to minus 5 t by product rule keeping t as it is and derivative of e raised to minus 5 t is minus 5 into e raised to minus 5 t plus keeping e raised to minus 5 t as it is and derivative of t is 1 bracket close which is equal to 10 as it is. Now, taking e raised to minus 5 t is common outside in bracket we get minus 5 t plus 1 bracket close into e raised to minus 5 t, but i is equal to d q by dt. Therefore, i is equal to 10 in bracket minus 5 t plus 1 bracket close into e to power minus 5 t ampere. This is the required current at any time t flowing in the circuit. Now, consider example 2 a condenser of capacity c is charged through resistance r by steady voltage v prove that if q equal to 0 at t equal to 0 the charge is q equal to c into v in bracket 1 minus 5 t ampere. This is the minus e to power minus t upon r c bracket close solution the given circuit is r c circuit. So that it is differential equation is r into d q by dt plus q by c equal to e of t, but we are given steady voltage v as a electromotive force e of t.  So, this is the differential equation of given circuit and it is the differential equation of first order and first degree belongs to linear differential equation type dy by dx plus py is equal to q. Here p means 1 upon r into c and capital q means v upon r. Now, we can find the solution of this differential equation for that first of all we find its integrating factor by formula i f equal to e to power integration of p with respect to t which is equal to e to power integration of value of p is 1 upon r into c which is equal to e to power 1 upon r into c constant as it is and integration of dt is t. Therefore, integrating factor is equal to e to power t upon r into c. Now, general solution of this differential equation is q into integrating factor is equal to integration of integrating factor into q into dt plus constant of integration k. Now, substitute the value of integrating factor and value of capital q we get q into e to power t upon r into c is equal to integration of e to power t upon r into c into value of capital q is v by r dt plus k. Therefore, q into e raise to t upon r into c is equal to now in right side v upon r is constant taken outside the integration and integration of e raise to t upon r into c is e to power t upon r into c whole divided by 1 upon r into c plus constant k. Therefore, q into e raise to t upon r into c is equal to in right side in denominator r r gets cancel and c goes to numerator. So, that v into c into e to power t upon r into c plus constant k. Now, dividing e raise to t upon r into c on both this side we get q equal to v into c into e to power t upon r into c plus k whole divided by e to power t upon r into c. Therefore, q equal to v into c plus k into e raise to minus t upon r into c denote this equation by 2. Now, we have to find value of constant k using u 1 initial condition that is q equal to 0 at t equal to 0 this q 1 put these 2 value in equation 2 we get 0 equal to v into c plus k into e raise to 0, but e raise to 0 is 1. So, that k equal to minus v into c substitute this value of k in equation 2. Therefore, charge q equal to v into c as it is plus value of k is minus v into c into e raise to minus t by r into c. Therefore, q is equal to now taking v into c common in the right hand side we get v into c in bracket 1 minus e raise to minus t upon r into c. So, this is the required charge at any time t we have to prove hence the proof to prepare this video lecture I refer this book as a references. Thank you.


All right, thanks for coming. I know it's lunchtime and no one likes to miss lunchtime. So my name is Josh Pitts. I got all the Marines right before 9-11. I wrote Backdoor Factory and Backdoor Factory Proxy and this is a file infection framework that will inject code into PELF and MAKO binaries on the x86 and 64-bit side and also do RMB7 for ELF. Because of that, I found Uniduke, which was a Russian malware infecting downloads over tour. Why would you do that over tour? I have no idea. But I co-authored an environmental keen framework that made environmental keen malware called Ebola and it has to spell correctly. I work at Okta where I do red teaming, I do design reviews, everything you think of, pen testing, reverse engineering of anything we put on our network and there's my Twitter handle and there's my GitHub where a lot of this code is. So why this talk? Well, you know, I think writing shell code is fun, believe it or not. My wife thinks I need new hobbies and that's fair. So, and I want to talk about the current state of public windows shell code, how it works and talk about updating it. So we got three parts. There's history, there's further development and there's mitigations and bypasses. So the first part. So Metasploit shell code right now uses Steven Führer's hash API or Metasploit payload hash. The basic concept of it is it uses a 4-byte hash with a 13-bit war instruction to find windows APIs and to use the export table or to find windows APIs in the export table of a DLL, any system DLL. And it was introduced in August 2009. And some of this has roots back to Matt Miller or Scape's Win32 shell code paper and these slides are online and I have a link to the paper. And Scape now works for Microsoft in the mitigation department. So just keep that in mind. So this is how it works. You do a call over the payload. You push everything onto the stack and then the shell code or the hash API will parse the export address table and then jump into a windows API and then return back to payload logic and it will continue until there's no more payload logic and your payload has been executed. Now this allows, what was kind of cool about this is this allowed payloads to be portable across all windows platforms. And of course some mitigations decided to be or to come out. You have Emmet or E-Met. This was obviously by Microsoft. And then you have Peter Benia. He has a frack article on beating some of these payloads. And then there's also the Havoc mitigation which was released, the concept was released in POC, GTFO, 12.7, amen. And in Havoc stands for halting attacks via obstructing configurations. And this was funded by DARPA, FastTrack, and it's by digital operatives. And what it did, it threw a DLL up into the loaded module list of the DLLs. And what it did, it basically pre-computed collisions for this 4-byte hash roar assembly. Anyway. So what it did, it made these collisions and it actually worked pretty well. So there's also the Emmet caller and EAF protections. Remember the shell code was introduced in August 2009. And the Emmet EAF protection was introduced in 2010. And what this does, it protects kernel 32, NCDLL, and kernel base from, you know, to read that. And then also you have the caller protection which is really more restricted to ROP like calls, but Steven Fierce hash API actually would trigger on this also. Basically you cannot go into Windows API via a rat or a jump. It had to be basically a indirect call. And as you may have heard, Emmet is end of life. It's supported through July 31st next year. It still works. But it's being reintroduced into Windows 10 this fall. And we're going to talk about that. And it does still work. I mean, so this is the protection, this is the Tor exploit that was targeting some people that were doing illegal things on Tor. Nobody does that. And basically it flagged on a stack pivot mitigation. So Emmet still has some relevance in the field, right? So bypassing Emmet. There have been a couple public bypasses. And Skyfer had a, or Skyline, used a method to make Emmet think that the code is valid reading the export table, going into the export table. And then you have Peter Bonilla. When Emmet used hardware break points, he would erase them essentially. In offensive security, they had a bypass by reusing code within Emmet itself. Now the caller bypass, like I said earlier, if you had the handle to a Windows API, all you do is move it into a, there's a couple ways to do it. All you do is you move it into a register, dereference the register, and then you can call it directly. Or you can do an indirect call. I think it's shorter to do an indirect call directly. I think it's only two bytes. So knowing this, back in May 2014, I put import address base payloads into BDF. And they worked just like compile code. Because I realized the closer you are to working like compile code, the harder it is to stop you with any mitigations. And it also makes you harder to see for antiviruses. So I added these in May. And then December, I wanted to see if I could use a concept in exploitation. And I wanted to use the import address table. So I looked for some prior work. Scapes, paper. Again, I used that. I looked at that. It was an import address table payload that he had. But there were some issues with it because he used the export table to get to API, load library A. And he would use that to get to a DLL and then use the import table off of that. And it was, I think it was hard coded to a certain version of a system DLL. And then Peter, he had a import address table parser. I decided to use that. But just for reference, the first known, I guess, use of the import address table for something malicious was a virus from 1997. It was not really an exploit to just use the import table directly. So it was a file infected and we just used the import table. So this is Peter Benia's point of concept. I cannot get this to work on a modern Windows OS. I think I was testing this on a Windows XP service pack 3 and also Windows 7. And so I decided to update it for some tolerances. And I was playing that. So the way it would work is you would find image base in the PEB, you would get the PE header and then you would get the import table relative virtual address. And then you would loop through and find kernel 32 via an ASCII match. And so next I would find low library A and get procedure address. But I added a check to set bounds of readable memory to make sure that it was readable memory because if you couldn't read the memory, you would have a crash. And then after this stuff is done, low library A would be an EBX and get procedure address, get PROC address would be an ECX. And I bolted on a reverse TCP shell and it's this bypass caller and the EF checks really easy. And then I emailed the EMAT team. And this was the response, essentially. So they knew about it. Obviously Matt Miller, I don't know if he was consulted, but they knew about it.  So MI POC just used the low library A and get PROC address from the import table. It was pretty limited. So if the binary did not have it in the import table, then it was useless at the time. So this code sat from December 2014 until February 2016 when sub T, if you don't know sub T, you should get to know him. He's the person that executes code and things, executes code and things that shouldn't be executing code, not through exploitation, but through hidden features and other things that just, you know, these are signed by Microsoft and you can run code and it's great. Like, you know, like it's pretty awesome. So he tweeted that he was having problems at EMAT because of EAF and I knew exactly what his problem was. So we started to collaborate and I sent him the only stuff I had at the time and he went crazy with it. He was using it pretty much everywhere. The only problem was in PowerShell, PowerShell did not have low library A in the import table. So we talked about moving, looking elsewhere for low library A and get PROC address from a loaded module and so he wrote an addition to do this and he borrowed code from Stephen Fuhr's hash API stub and changed it around a little bit. He decided to use a four byte hash, the Roar algorithm to find just the DLL name versus DLL and API and so that means it would use that hash to find anything in the loaded module that will match that. And so if you're going to do something like Havoc where you're going to cause a collision, you would need to know all the possible combinations of anything that might be deployed with any applications as far as DLLs. And so yeah, he wrote that stub and we were excited about it. So now we have two stops. Okay, that's cool. Right. So then we knew that you could use get PROC address anywhere in memory space and if you do that, you can get low library A as long as you can rate the location of kernel 32. So we used a four byte hash algorithm like I mentioned and then we would get, this is how we would get low library A, pretty simple right? And then we would push the handle onto the stack and move ESP to, we'd push the handle of low library A onto the stack and move ESP to EBX and then we'd do an indirect call to EBX. So now we have four stops that we could use. But we didn't know where we could use them. So what we did is I went through an enumerated system binaries across all five operating systems for low library A, get procedure address or just get procedure address in the import table. And this is the output of that. I saved the output in a JSON format so when you were looking for an import to use, it would walk everything that is loaded recursively in a dependency walker style fashion to find anything statically that might be in memory. So we had a lot of opportunity to use this. And if you look, you see they made an effort to decrease the use of low library A and get PROC address. And you see Windows 10 has less than XP, obviously. But then you see there's more get PROC address. So either way it was a pretty good find. So we're going to submit to a CFP or we're going to submit to a conference. This is about June. And then this came out. A flash exploit that used get PROC address from user 32 import address table to load a payload was discovered by FireEye. And this was pretty depressing. Because then what we had, it wasn't good anymore. Not good but it just wasn't as exciting. So we wrote a blog post about it and we released a POC that would pick for you which stub you would use. And we released a reverse TCP shell with this with no exit function so it would automatically crash all the time. That was kind of trolling a little bit. But we wanted to do more stuff. So we wanted more payloads. We wanted to get this into Metasploits somehow. And we knew it would be a lot of work. And we had a couple ideas. So that brings us to part two. So two ideas. Remove CMFuse hash API and replace it with something else completely. Or build something to rewrite payloads logic for use with an import address table parsing stuff. So I decided to rewrite all the things. And do it automatically and magically. And this is how Metasploit payloads work. You push everything on the stack, for x86.  So I had a workflow. I used capstone for disassembly, keystone for reassembly. The only thing I had issues with was protecting the saved load library and get PROC address from being clobbered because of conditional instructions that would pick a path and then I'll lose context. And I worked on this for five days straight for about 12 to 15 hour days over Christmas. Not on Christmas but over Christmas holidays. And when I solved one problem, more peered. And there was a point that I crossed it and where I could probably just rewritten everything. Or at least have a good POC of things to show for my work. But really I had nothing. So I decided to burn it down. So the next idea was to take the hash API and the actual payload logic, remove the old hash API, use one of my import address table stubs, then offset table. So I had some requirements. I needed to support read execute memory just in case I wanted to use this at other places that weren't read write execute memory. I wanted to keep it small as possible. I wanted to support any metasploit payload that uses Steven Führer's hash API. So I had the same four steps. I would take inputs in, disassemble it, capture the instructions or capture the blocks of instructions, capture all the APIs, build lookup, offset table. And then I would find the appropriate import address tables for the executable and then there would be an output to different types. So even if the user does not provide the DLL they're looking for, this would do it automatically because of all the JSON output that I've saved. So this is what I came up with. So you would take the four block, four byte block hash used in the API to parse the export table. But now it's going to point to the APIs and the DLLs that we're going to be called. And those are going to be in a string and they're going to be null terminated. So for example, you have the first hash, right? It's four bytes. And then the DLL offset, if it matches, is going to point to kernel 32. And then the next API is going to, the API is going to point to WinExec. So you have the next hash, points to kernel 32 again, and then it points to the next API, exit thread, so on, so forth. So you do, because I unique the string, you do have some overlap and you can save some space. So this is the logic for the parsing, for parsing the lookup table. Basically I jump over the table, I move the first hash into the lookup table and I continue until I find a match. If found, I move the DLL offset into AL, I normalize for memory, and I use load library A to load the DLL. And then I save the DLL handle. I put the API offset in AL, normalize, and use get proc address to get the Win API handle. I prepare the call to the Windows API by clearing the stack. I save EAX down the stack for recovery on pop AD. Then I save the return address to EVP that I call the Windows API. On the API return, I fix up EVP to point back to the beginning of the import address table stub, and then I return back into the payload logic. So this is how it works. I jump over everything into the payload logic that comes with Metasploit. And then I return, or I do a call into the import address table stub, and then lookup table goes into a Windows API, returns back in the lookup table, and then I go back into the payload logic. I just continue until done. So the initial POC to write the lookup table took about 12 hours. And then adding all the workflow, and the stubs took about another 12 hours. And it took a while to get the tool where it's at, but I'm really happy about it. So now that these API hashes are, they no longer hold reference, they're now meaningless, okay? After it goes through, and we figure out what they are, they're meaningless. And I found that AVs depend on them for signatures. So what happens if we just randomize them? It's pretty fun actually. So I got to demo that. Let me do this properly. Everybody see that? Okay, so all I'm doing here is just doing a, I'm just outputting to file a reverse TCP shell from MSF Venom. And then I'm going to cat that out into FIDO. That's what the name of this tool is, FIDO. And I'm going to do a load library A, get proc address. I'm going to use those out of the import table of the main module. And I'm outputting that file. And the output's fairly, fairly useful. I'll tell you what's going on pretty straightforward. And now I'm going to use backdoor factory and infect TCP view. And I'm going to put that on Windows 10. And there's Windows Defender. Of course it was detected. Now I'm going to do the same thing, but I'm going to use M for Mangle. Going to use backdoor factory again to infect TCP view. And I drop that onto disk. And then I set up a net cat handler. And then no detection. All right, so here's an example of using FIDO. Just as you saw in the video. So I was having some issues with a couple of DLLs. And when I say couple, all the system ones. I was running to a problem where I had to build a blacklist to avoid using those as saying that they had the get proc address or the library A in their import table. And I decided to look at this because it was going to a point where I was just blacklisting everything. And I figured out that it was just Windows 7 through 10. So I decided to look into it even more. And this is when I discovered the effect of MinWin. Typically these are used in system DLLs. It's for portability and they have been used in Windows 7 since they've been in use since Windows 7. And if the DLL, if it is in the DLL's import table in your process space, you can use exposed APIs such as get proc address. And in get proc address case, it's everywhere. It's in every single process because it's in kernel 32. So this is a view of kernel 32's import table. So kernel 32 is importing get proc address via its import table through one of these MinWin DLLs. And then it exports it back out so it can be used through the normal API. But if you're parsing the import table, you can use it. So let me explain what this means. We just need get proc address in any DLL, any import table in any DLL to access the entire Windows API. We just need get proc address period. So since Windows 7 get proc address has been in kernel 32 import table. So that means we've had a stable MDEF and color bypass since Windows 7. And it still works on Windows 10. So I'm going to demonstrate that with the Tor exploit I talked about earlier. All right. So what I'm showing here is I turned off the stack pivot mitigation just to show that AAF will flag as far as the mitigation. So now I'm going to drop the exploit and payload into Tor browser.  It's very nice. So now I'm going to just run FIDO with using Firefox as the target binary. And what you're seeing here where it says number of lookups to do, it tells you everything. That's recursively parsing through and trying to figure out what DLLs are loaded through the system. And then it will continue through and tell you where you can use what import table. And so it will automatically use get proc address. You can see it at the bottom where it says GPA. But I'm going to use the MinWin DLL. Because you can see it's in kernel 32 and it's the API MS WinCore library loader DLL. And what I did here is I had an encoder to put the output stand out so I can reformat it into a proper JavaScript format. Just showing that. I already have it in the exploit example. I just need to uncomment it. This is a calc payload. Restarting the tor browser. And so these payloads were introduced at recon Brussels back in January 2017. For DEF CON 25 I'm releasing 64 bit payloads. And that brings us to mitigations and bypasses. So I opened up a GitHub issue to incorporate these import address table payloads into Metasploit. Part of what I was offering to do was to release these 64 bit stubs to help with that process. And if my talk would have ended here, right here. However, three months later, after my GitHub issue submission and five weeks before this talk, the email protections are being added back into Windows 10 implemented via the kernel. Additionally, Matt Graber pointed out to me that there's now an import address table mitigation. Which is, this is my reaction. Just flipping tables for days. Yeah. So how does the import address table filter work? Well, so you had to download, I had to download the preview edition. This is coming out in the fall by the way, officially. But you can get in the preview edition. So first off, they're not enabled by the fault. You have to go through and click through, enable everything. But what it does is they take, there's a pointer to the import name and they zero that pointer. So at this point, the thunks are still there so that compile code can work. But at this point, you're driving blind. And if you're driving blind, you're probably going to crash at some point. And yeah, it's pretty awesome. So, but you know, the funny thing is I knew that something like this might happen. So I had an ace in my pocket. So this is kernel 32 entry for get proc address. And on the next line is get proc address for caller. This was introduced in Windows 8. It's exported by kernel base and then imported by kernel 32. That means it's in every process. It works very similar to get proc address. It's not filtered by the import address table filter yet. And this is how it works. You just add a zero on the end and that's it. Yeah. Way to go, guys. So yeah, so I've added, I've added this end to Fido and you use it basically, use it through extern GPAFC. So I got a demo for that real quick. Sorry. All right, so what I did, let me just, I don't remember. All right, so what we're doing here is, so I'm just taking a 64 bit reverse shell from Metasploit and I'm using just get proc address. And then I'm passing into backdoor factory, patching who is 64. And then I'm going to throw that onto the operating system. Now I do not have the protection enabled yet. Just to show you that the protection does work. There you go. Now I'm going to enable the protection. And then it's going to take a second to crash, it will crash. And then I'll run it again. It should be faster than the next time. All right, now I'm going to use a get proc address for color. Put that on disk. And there you go. So I did let Microsoft know about this. So they're gonna, they're gonna, they're gonna have a patch for it whenever it comes out officially. Because since they were making an effort to make it an honest try to fix it and I decided to let them know. So now what? Now we can't parse the export table or the import table. Is it possible that you could find more APIs that are not filtered and that could give you some useful information to get to get proc address? Yeah. Probably. Or what if we didn't use import table or the export table? So let's, let's think about this real quick. In modern user space Windows exportation you have to bypass ASLR depth and other protections. And on top of that your exploit is most likely to be tailored to a specific version or versions of software and operating systems. So why shouldn't your payload be targeted also? Why does a payload have to work on every operating system from XP to Windows 10? Right? Why not make it targeted to that specific version of application? So the way you would do that is you would go to get proc address directly. And the way it would work is you take PEV image base and that's easy to find and then get proc at the offset for get proc address. And that's going to be version dependent and the offset can be found during exploit or during exploit or payload development. And this can be in the main module of the main program or it can be in any application specific DLL. So I would not target system DLLs because those change very often. So if there's a DLL that has the same offset for a number of versions, let's say they depend on open SSL for something and they just, they don't update the open SSL binary even though you're not exploiting open SSL you can use the get proc address offset in that DLL across multiple versions. So and it does save code. So this is, this is the import parsing table code to find get proc address. Just to get get proc address. It's a fair bit of code. But if you know it, if you know it get proc address offset is going in that's how much code it takes. Obviously. Right? So and so what if, what if you had more, what if you had, you couldn't find a single get proc address in one DLL. Well what you would do is you would find a DLL that was consistent across all versions that had get proc address and then you would engineer, you would diff the binaries across the different versions, diff the DLLs across different versions and then you would make a similar lookup table so that you could use the diff sections to figure out what version you're in and that would be associated with the appropriate offset table. So I have an example of, not of the actual diffing process, but I have the example of using an offset for get proc address either within the main module program or the external offset of a DLL. Right? So if anyone wants to help me develop that or engineer that system, please find me. I'm easy to contact. I'm on Twitter and I haven't emailed address. That sums up my talk. Any questions?