This is where we stopped in the last module. We have worked out an expression for uncertainty in position and that turns out to be L square by 3 minus L square by 2N square pi square. Well to be very honest we have not worked out the uncertainty in position yet. What we have worked out is the average value of X square which is the first in the linear combination under square root sign in the expression for uncertainty in position. The saving grace is that we already know the average value of X from a previous module that is L by 2. Now let us work out the expression under the square root sign average value of X square minus square of the average value of X. This is what we need. We work it out and then put it under square root sign. The final answer that we get is L multiplied by square root of 1 by 12 minus 1 by 2N square pi square. I strongly recommend that all those who are taking this course should work this out by themselves because it is impossible to understand it completely or be convinced just by listening to me and seeing me work this out especially as we are not writing on a board. We are using electronic media. Please work out this expression by yourself. Then only I think you are going to be convinced. So crux of the matter is we have this expression for uncertainty in position that we had looked for. Now let us seek the expression for uncertainty in linear momentum and that is going to be much easier than uncertainty in position. This is the expression that we have got and now uncertainty in momentum what is it? Let us see. Well we already know that out of these two terms under square root that we need to find for uncertainty in momentum we already know that average value of Px is actually equal to 0. So then this expression becomes a little simple. It turns out to be square root of average value of Px square. Please do not think that the square root of average value of Px square the square root and square will take care of each other and it will turn out to average value of Px it will not. Remember the task I gave you in the last module take a set of numbers work out the average of squares and then work out the average of the numbers themselves take square you will see they are not the same. So it has to be written as square root of average value of Px square it is a root mean square quantity analogous to what we have studied when we talked about say speeds of gas molecules in kinetic theory there we talked about root mean square velocity is not it? So this also is a root mean square expression do not think that the square and the square root will take care of each other they will not. But the good thing is all we need to do is we need to find this average value of Px square how do we do it like this we know already how to find the expectation value. So we write the wave function and in this case we are working with a real wave function so it is so psi star equal to psi the wave function multiplied by Px square operating on root over 2 by L sin n pi x by L take this integrate between 0 to L and your home well almost because you still have to take a square root. So what is Px that we know h cross by i d dx what is the operator for Px square that would be making the same operator operate twice that is the meaning of operator Px square. So make it operate twice what do you get h cross by i multiplied by h cross by i that gives us minus h cross square and then d dx operated twice gives us d 2 dx 2. So this might ring a bell actually because when we talked about Schrodinger equation we got something very similar to this remember the Hamiltonian operator the first term the kinetic energy operator was minus h cross square by 2m why because kinetic energy is Px square by 2m okay so all our discussion is in sync. So Px square operator is minus h cross square d 2 dx 2 now so now what we have to do is we have to take this expression for the operator plug it in the expression for the plug into the integral let us do that this is what we have minus h cross square comes out of the integral sign d 2 dx 2 of root over 2 by L sin n pi x by L I am intentionally not taking this root 2 by L and root 2 by L out because if I can keep the wave functions then there I know what the integral is when the limits are 0 to L the integral for psi x square is equal to 1 now and also the good thing is here we have a sin function. So what happens when I take second derivative of sin I get back the same sin function the only thing here is that you have to take care of n pi by L for every differentiation this n pi by L will come and we can take it outside the bracket. So this is what we get n square pi square h cross square divided by L square integral 0 to L root over 2 by L sin n pi x by L multiplied by root over 2 by L sin n pi x by L dx what just happened where did I get n square and pi square and L square well because remember we differentiate it twice. So first derivative of sin kx is equal to k multiplied by minus k multiplied by cos kx that is why minus sign also came out in the first differentiation and that took care of the minus sign that was already there and then when you differentiate the cos kx function again 1 k comes out that is why you get k square outside and you get back your sin kx so far so good. What about this integral as we said a few seconds earlier this integral is equal to 1 because we are working with a normalized particle in a box wave function this is equal to 1. So the expression for the mean of square of linear momentum turns out to be n square pi square h cross square divided by L square. What is sigma px? Sigma px is just the square root of this let us find it out it comes out to we have very simple expression n pi h cross by L. So earlier we have determined the uncertainty in position now we have determined uncertainty in momentum the next task is to multiply them together multiply them with each other and see whether uncertainty principle is satisfied by this system of particle in a box that we are talking about sigma x remember is L by 2n pi square root of n square pi square by 3 minus 2 sigma px is equal to n pi h cross by L let us multiply them this is what we get what happens here L and L cancel each other n pi and n pi cancel each other so you are left with h cross by 2 outside the square root sign inside the square root sign you have n square pi square by 3 minus 2 this is what you get. Let us try to see whether we can get a simpler expression here what is the value of this n square pi square by 3 for the smallest value of n what is the smallest value of n smallest value of n is 1 we are talking about particle in a box. So if the smallest value of n is 1 then what is the value that we expect here pi square pi is 3.142 in fact so square root of that is going to be well square of that is going to be more than 9 you do not need to remember the exact value so more than 9 divided by 3 what is that that is more than 3 so more than 3 minus 2 is more than 1. So what you have under the square root is a real number which is more than 1 does not that prove that for any value of n this product is always going to be greater than h cross by 2 you see in this expression h cross by 2 is multiplied by this quantity under square root which we have shown is always more than 1 that is why the product of uncertainties of position and momentum for particle in a box turns out to be always greater than h cross by 2 which is nicely in agreement with uncertainty principle. So we have demonstrated that uncertainty principle is obeyed for a particle in a box remember non-conformity with uncertainty principle sounded the death knell of Bohr theory. So it is comforting to know that the first system that we have studied using the wave mechanical treatment of Schrodinger conforms with uncertainty principle. So a very major problem that was there in Bohr theory is not there at least so far. So next question we want to ask is that is this a specific case that only for particle in a box uncertainty principle is valid or do we expect for this wave mechanical treatment that it is not going to be it is going to be valid for everything is there a general way in which we can look at uncertainty principle itself. So this discussion might sound to be a little bit of digression because after all the topic under which we are performing the discussion is particle in a box but this digression if I can call it digression is definitely worth it so bear with me. So let us see let us understand uncertainty principle a little bit better to do that let us revise what kind of wave functions we have for your Px. So Px again we know is h cross i by i d dx and a good wave function for this is psi equal to e to the power plus minus ikx the wave function is an imaginary wave function but it is important to note that the eigenvalue is not imaginary eigenvalue is definitely real because when you differentiate e to the power plus minus ikx with respect to x you are going to get plus minus ik multiplied by the same function so that i and this i are going to cancel each other. So Px operating on psi gives you plus minus k h cross e to the power plus minus ikx we have touched upon this in one of the previous modules but let us make sure that once again everybody is on the same page with this. So this as you see is an eigenvalue equation with e to the power plus minus ikx as the eigenfunction is it normalized we are not trying to normalize yet maybe normalized may not be normalized let us not worry at the moment what is more important is is that it is an eigenfunction of the linear momentum operator and the eigenvalue is a real eigenvalue k h cross well the way we have written it plus minus k h cross what does it mean it means that the linear momentum associated with the system associated with this wave function is plus minus k h cross that plus minus k h cross is the value of the linear momentum no surprise root over 2 Me divided by h cross right that would better be the linear momentum now see what does this plus or minus sign signify k h cross is a magnitude we understand fine plus means that direction of motion is along positive x and minus means the direction of motion is along negative x so sign of the wave function specifies the direction of the motion of the particle remember we are right now talking about one dimensional space right so if it is just plus minus ikx then direction of motion if it is plus ikx then your momentum is defined very very well if it is minus ikx then you know you have zero uncertainty in momentum okay let us say I am not saying plus minus let me say it is plus ikx then what is the value of linear momentum plus k h cross one value no deviation this is not average value every time you do the experiment you are going to get this eigenvalue k h cross right so for this wave function e to the power ikx no matter whether the sign is plus or minus momentum is defined very nicely is defined precisely what about position position x can take up any value right because you work out the expectation value of position also here what will it be position is x multiplied by the wave function x hat operator is just x multiplied by wave function what do you get you get x x is a variable so the uncertainty in position is infinite it is defined by the boundaries so what we see here is that the moment the momentum is specified precisely in the wave function position becomes infinitely uncertain this is the philosophy of uncertainty principle but let us go ahead and before we make that statement let us see what happens if you can get a situation where position is better defined what happens to your momentum then to do that let us take this wave function we are very familiar with this wave function cos kx sin kx sort of particle in a box like wave function that as we know can be written as a linear combination of exponential imaginary terms okay let us say we have chosen a and b in such a way that we get either k cos kx or sin kx actually in the diagrams that we are going to show you we are going to use cos kx it is a little more convenient but let us not forget cos kx and sin kx are basically same the only difference is the phase shift right where cos kx is equal to 0 sin kx equal to 1 but the shape is the same so you just have to give an offset to x then sin can become cos okay so let us say we work with this wave function if this is a wave function then what does it mean it means that your linear momentum can be either ik or minus ik so there is a little bit of uncertainty in linear momentum two values are there px can be plus k h cross or minus k sorry i said ik that was a mistake plus k h cross or minus k h cross what about position position we can understand position by looking at the probability probability is mod of psi x square so if you plot this function mod of psi x square here it is just psi x square what do we get we get some regions of more a greater probability density some regions of zero probability density some points at zero probability density so if you just take a small slice dx then in this position and this position and this this this and wherever there is a maximum in this plot of psi square you get maximum probability of occurrence so that is the position so what we see is that position gets a little better defined at least we can say that the particle is more probable to be here here here and here and less probable to be here earlier position could have been anything all values of x had the same probability when you took one of the exponential terms so we have demonstrated that if we introduce a little bit of uncertainty in momentum position becomes more precisely defined let us now go way further let us take a large number of e to the power i k x and e to the power minus i k x for different values of k and let us add them up like this let us now work with sum over j a j e to the power i k j x plus b j e to the power minus i k j x coefficients a j and b j are chosen in such a way that you get say c j cos k j x that kind of a wave function so right now we are just making a wave function so everything is in our hands what happens then what happens to momentum now there are many values of j right I have not said how many values of j are there maybe there are 1 lakh values of j in the expression that I am going to show you I have taken a combination of about 10 values of j so momentum has become more uncertain depending on how many values of j we are working with you can have k 1 k 2 so what is momentum k h cross so you can have plus minus k 1 h cross k 2 plus minus k 2 h cross 1 and so forth depending on how many terms we have taken so in when we take this linear combination we get this kind of a wave function where your position your momentum has become significantly more uncertain what about position to get position once again we are going to take a square of this sum it is easier if you take a square of this sum over j c j cos k j square when we do that we get a plot like this now see what has happened now the other positions here there is a local mean maximum of probability density but it is so small same here the clear global maximum of mod psi square appears at this position of x where all the cosine functions are instead for x equal to 0 for all cosine functions the value is 1 the maximum value that is why here all these cosine waves are in step as you go further what happens is there is a phase difference between all right so the waves start getting out of phase this is a phenomenon that is made use of in things like Fourier transform time domain spectroscopy as well you have waves of different frequency at one point they are all in step then they start getting out of step you get destructive interference so what you get finally is that your linear momentum in this case is highly uncertain as we have said position gets reasonably well defined and for the records this kind of a situation where we have taken a large number of waves that are in step at a particular point this is called a wave packet and one can even experimentally generate wave packets and wave packet dynamics is something that has been of interest to physical chemists, spectroscopists, quantum chemists for several decades now and then they provide a very important information about how things proceed in ultra short time scale in systems we have discussed this in more detail in the NPTEL course on ultrafast spectroscopy in chemistry that was offered last semester whoever is more interested can have a look at those lectures but for now what we have got is that the moment we made linear momentum uncertain we generated a wave packet which had significantly better significantly more precise information about location of the particle so what we have shown here is that in uncertainty principle if linear momentum is well defined position becomes ill defined automatically in situations where position is better defined linear momentum becomes ill defined automatically. So the wave mechanical treatment here of Schrodinger is absolutely in line with uncertainty principle and using it we also get to realize that uncertainty principle is really the threshold of nature beyond which we cannot go here let me acknowledge my teacher Professor Rupindranath Banerjee of Jadapuri University who actually taught me this expression threshold of nature when I was in class 11 it is because of great teachers like them that students like me learn certain things that we perhaps would have not understood so well otherwise. So it is not possible to make a better instrument if you think that we will make a better instrument and we will determine linear momentum and position correctly it is just not going to happen it is not about instruments it is an inbuilt law of nature that in microscopic world if position is well defined momentum cannot be and vice versa and it is not restricted to just position and momentum also it is a feature that you see for all conjugate properties energy and time for example. Now since we are talking about uncertainty let us talk a little more about the workings of quantum mechanics and let us make this statement when operators do not commute properties cannot be determined simultaneously what is that supposed to mean? Commutation means you have two operators let us say x and px you make px operate first on a wave function you get whatever you get another function make x operate on it you get some value then invert the sequence of operation if you get the same quantity then x hat dot px hat minus px hat dot x hat would be equal to 0 which means the commutator is equal to 0 we will see it right now. So these are the wave functions we are working with let us do x hat px hat psi which means when you write like this px hat operates on psi first then x hat operates on it so x hat px hat on psi what is it? It is x multiplied by h cross by i d psi dx now we are not using particle in a box wave function it is a general statement x multiplied by h cross by i d psi dx let us do the commutation let us invert the sequence of operation px hat x hat psi what would that be x hat operating on psi is just x multiplied by psi so now you have to make this h cross by i h cross by i d dx operate on the product of x and psi we all know what d dx of u v is it is this px hat x hat psi gives us h cross by i x d psi dx plus psi very simple I am not going through this step. So now what is px hat x hat psi minus x hat px hat psi it is not 0 it is h cross by i psi and we can write it as an eigenvalue equation we can write it like px hat x hat minus x hat px hat psi is equal to h cross by i psi and in fact this operator is often written like this that x hat comma px hat in third bracket that means the commutation commutator of x hat and px hat that is equal to i h cross so what we see is that it is not equal to 0 and then postulate of quantum mechanics is that when operators do not commute properties cannot be determined simultaneously we will have some examples of operators that do commute in the assignment right. So this is what we have discussed so far we have considered a very simple model of particle in a box we started with particle in a one-dimensional box and then we extended it to two dimensions and three dimensions and then from this very simple model we have learned so many things over the last four modules I think we have even learned how we can see that wave mechanical treatment in general is in keeping with uncertainty principle. So sometimes students complain that whenever we try to study quantum mechanics or quantum chemistry this particle in a box model keeps coming back and is taught many times there is good reason for it in fact even in this course we are going to refer to the particle in a box model once again when we talk about say variation principle. This provides a good testing ground for sophisticated treatments as we had said but for now we are done with that discussion of particle in a box where the particle is confined within a box where the walls are infinitely high potential energy outside is v equal to infinity. Let us now move on to a variant and let us now finally tackle the question what happens if the potential barrier is not in finite what happens if the potential barrier is finite. When I put it like this perhaps it sounds like and a question that has arisen out of just curiosity from doing so much of theory that is not completely true. In fact, this question arose out of an experiment in the very early days of quantum mechanics early 20th century it was found that when people worked out the and not taking the name of the people you work out itself it involves people like Gamow and Rutherford and other stalwarts the kinetic energy of alpha particle emanated from a radioactive nucleus was worked out and the potential barrier immediately outside the nucleus was also worked out. And it turned out that well first of all this potential is finite and it turned out that the energy kinetic energy of the alpha particle is actually lower than this potential barrier. So, now the question came how does this come out? It appears that when the potential barrier is finite the particle can somehow come out of that overcome the barrier even though its energy is less than the energy associated with the barrier. How does that happen? The question of finite potential energy barrier arose from here and that is what we will discuss in the next module.


Good morning. Welcome to DEF CON. Today I will talk about a topic, kernel, Mac OS and iOS kernel debugging and heap function. So here is the outline. First I will introduce myself and what is the kernel. Then I will introduce how to do kernel debugging on Mac OS and then iOS. Then I will use these debugging techniques to debug a real kernel heap overflow. Last but not least, I will introduce two methods to do heap function. Okay, let's start. So who am I? My name is Min Zheng. You can call me Spark. I'm a security expert at Alibaba and I'm a PhD in COHK and I'm a member of Blue Lotus and Insight Labs. I worked in FIIR by doing maintenance before. Our team have achieved a private drill break in iOS 9 and we will show more details in the future. Here is my Weibo and Twitter. You can follow me and ask me questions on that. This work has a co-author called Liu Xiangyu. He is my colleague and he's a security engineer at Alibaba. I also want special thanks to my friends which helped me in this work. So the topic is kernel debugging. What is the kernel? The kernel is actually the XNU. XNU is the computer system operating system kernel developed by Apple. It is open source software as part of the Dow operating system. It has a abbreviation called X is not unique. We know that XNU for Mac OS is open source. It can be compiled and debugged. However, XNU for iOS is not open source. You cannot compile it or debug it officially. But most implementations is the same as Mac OS. However, we can use some tricks to do kernel debugging for iOS too and I will introduce it later. Let's talk about Mac OS debugging first. A wise man once said to do a good job when my master sharpener was tool. So we need to buy some equipment. First we need two Mac books or one Mac book with virtual machine. The system version can be different which means you can debug iOS 10.10 on iOS 10.11. Also you need to buy some converters or cables like Thunderbolt to firewall or firewall cable. After we have the equipment, we need to install KDK on the two Mac books. For the host Mac book, we need to execute a commander called FWKDP. For the debug Mac book, we need to copy the kernel development of KDK to the system library kernel folder in the debug Mac book and execute the following command. This command will set the environment and reboot the debug Mac book. After rebooting, the host Mac book can start debugging with commander LLDB, KDP remote local host. Note that we can get kernel slides immediately. It is very useful for us to debug the kernel. Also we can use some command like image list to get the kernel address of partial kernel extensions. Note we can only get partial kernel extensions if we want to get all the kernel extensions we need some other ways. Just like JDB, we can use X slash and X to read the data in the kernel. Also we have three ways to set the break points in the kernel. By using, by, we can use B asterisk address to set a break point in the LLDB. We need to use the offset of the kernel slides to calculate the address. Another way to pause the debugging machine is to use a shortcut key. You can use command plus L plus control plus shift plus ESC all at once. And it will pause the debug machine immediately. We can also set break points in the X and U source code through int $3 and print kernel information through print. Note that if you use this way to debug the kernel, you need to recompile the kernel and then put it in the debug machine. Also we can use commander script import, this commander to load the pattern script in the kernel, in the LLDB. It is very useful because this script can help me get a lot of information about the kernel. For example, you can use the print to print the zone, the zone information. And you can use show the free list to show the element information in the free list. There is another commander called show all kernel extensions. This commander can get all the kernel addresses of the kernel extension. In addition, you can implement your own pattern script. You can find some examples in the KDK's pattern folder. So let's talk about iOS kernel debugging. We know that there is no official tools for iOS kernel debugging, but we can use some tricks to do that. Before we debug the iOS kernel, we need to get the kernel cache. Unlike macOS, we need to decrypt the kernel cache. Before iOS turns, the kernel cache was encrypted. You can find keys in the iPhone Wiki website and then decrypt the kernel cache. After iOS turns, there is no encryption, but there are some encodes. So we need to unzip the kernel and decode the kernel using a major tool. After that, you can extract the kernel information through joker and adder. Know that there is no breakpoint in iOS, so the most common way to get the register value is to use the panic log. Something should pay attention is if there are too many panic logs in your phone, the system will stop generating the panic log. So if you want to debug your iOS system, you need to delete the panic logs if there are too many. So you can use these two methods to do that. One is for jailbreak the iOS. Another is for on jailbreak the iOS. Although there is no KDK in iOS, we can still use kernel task port to do arbitrary kernel memory read and write. So two user land API, one is called mark VM read, another is mark VM write. But what if we don't have the task for PID patch or no jailbreak? What should we do? Well, you first need a kernel vulnerability. Then you can use this vulnerability to get the kernel task port. Then you can restore the kernel task port into the host special port. Then you can use a user land API called host get special port to get the kernel task port in the user land. And then you can use mark VM read and mark VM write to do the kernel read and write in the user land. After getting the kernel task, the next step is to figure out the kernel text base and the slide. In ARM32 it's easy because there are only 256 potential locations for the kernel slide. But in ARM64 it's not easy. We need to do something like first create an OS object in kernel. Then we need to find this Vtable pointer which point to the kernel base region. Then we search backwards from the Vtable address until we find the kernel header. The source code can be referred to the iOS kernel utilities project. After getting the kernel slide we can get the root privilege for our applications through the kernel read and write. And then we can use offset plus kernel slide to find the kernel object address of related ports in memory. It is very useful to debug the mark port in the XNU system. So now I will show how to use the debug techniques to debug a real kernel heap overflow. This vulnerability exists in the mark virtual extract attribute recipe trap. This is a new function added in iOS 10 and Mac OS 10.12. So that's why there's no jailbreak for iOS 9.3.5 because this function does not exist in that version. It's a new function in iOS 10. This mark trap can be called inside the sandbox so we can attack the kernel inside the sandbox. This function will first use copy in to get the recipe size from the user land and save this size to the sz. Then it will use key lock to allocate sz size, a block of memory with this size. And then it will use copy in to copy the data from the user land to the kernel. However, the developer forgot that the recipe size was a user land user mode pointer and then it used as size value in the copy in. We know that a user mode pointer may be very large than the size value so it may cause the heap overflow. If we want to debug this vulnerability, we can set the break points before and after copy IO. They address are calculated through the offset in the kernel catch plus the kernel slide. So as you can see before heap overflow, we can find the flag of dead beef. The dead beef means this block of memory are unused but the next block of memory is used with FFF. After we trigger the heap overflow, we can find the first block is full of our data with A. And then the next block of memory is overflowed by the first block of memory. It overflowed 32 bytes with character B. So now we have the ability to overflow arbitrary content of data but we need to find a way to do the kernel read and write. So we need to do some function. There are two ways to do heap function in iOS 10 and macOS 10.12. I will introduce the first one. We know that in iOS 10 and macOS 10.12, we cannot use the classic VM map copy techniques to do the heap function by changing the VM map size because Apple added a new mitigation that they will check the free into the wrong zone attack which means if you change the size of the VM copy, the kernel will panic. So we need to find a way to avoid that. Luckily Bear in Google project zero proposed a new way to do heap function through the pre-alloc mark port. The basic idea is to use mac port alloc full to alloc IPC key message objects in the kernel memory. The object contains a size field. We can craft it and it doesn't have any pointer so we will not craft any pointer in the kernel memory so it will not be panic. By using the exception port, we can send and receive the data in the kernel memory and this data will not be freed. It's very important. And the data we use to send is the crash. It's the register value of the crash thread. So if we want to send the information to the kernel, we need to create a thread and set the register value we want to send and then crush the thread. The data will be sent to the address of IPC key message objects plus ICM size minus 104. So why the number is 104? We can use kernel debugging to figure out it. First we use kernel debugging to figure out the address of pre-alloc port buffer in the memory. Then we can trigger the exception and send the data to the kernel. After that we can use kernel debugging machine like kernel read to get the data to inspect the data of the buffer. As you can see we can find the location of the data in the buffer is D3C because we set the value of the ICM size to E4O. Therefore we can get 104 at last. So that's why the number is 104. So now we we get the object to do the heap function. The next step is to rearrange the kernel memory. First we allocate 2000 pre-alloc ports to ensure the following ports are continuously. And then the attacker can allocate three ports. One is the holder. The second is first port. The third is second port. Both of them are in the zone 4,096. Then the attacker can free the holder and use the overflow or vulnerability to overflow the first port. The overflow data contains the ICM size and other fields of the ICM object. The key point is to set the ICM size to 1104. So why is 1104? We can do a simple calculation that the first the address of the first port plus 1104 minus 104. It will be the address of the second port which means we can control the second port through the first port. So if we can control the data of the second port, the next step is to get the address of the second port. Which means we need a heap information link. So how to do that? The first thing is the attacker give you the first port to give the second port a valid header. If the second port has a valid header, you'll send the data to the second port. The second port's ICM next and ICM previous will be set to point to itself. Which means if you receive the data from the kernel to get the data of the second port, you can figure out the location of the second port in the kernel memory. After getting the heap address, the next step is to get the kernel slide. But before we do that, we need to safely free the second port. The reason is if you don't do that, the system will be panicked because the kernel detects the memory corruption. After freeing the second port, the attacker can allocate a user client to hold the spot of the second port. Then the attacker can get the user client object through the first port. Note that the first eight bytes of the user client object is the VTB address. So which means you can use the VTB address in the kernel cache compared with this dynamic VTB address. Then we can calculate the kernel slide. In this case, the kernel slide is 1BC000000. After that, the attacker can generate, create a rope chain which can be used to do the kernel, arbitrary kernel memory read. He can use all essentialize with UUID copy. In this way, the attacker can copy the data from any address to the kernel buffer base plus for it. And then use the first port to get this data back to the user mode. If we reverse the X1 and X0, he can get kernel memory write because one is to do the read, another is to do the write. So we get the rope chain. The next step is to trigger this rope chain. We can trigger this rope chain through the IO Connect get service. This method will invoke get mental class return and release method. So we can create a fake VTB and send it to the second port. Then we can use IO Connect get service to trigger the rope chain. We mentioned before to do the kernel read and write. When we get the ability of kernel read and write, we can do the kernel patch. The latest and public kernel patch technique could be transferred to Yalu. Note that this traditional function is not stable because it needs to do multi times and use a lot of rope chain. It only have 50% success for it. So if we want to get, if we want to have a high success for it, we need to use port function. So what is port? We know that mark port is the most frequently used IPC mechanism in X and U. And we can use complicated message to send out of LAN ports to the kernel. Which means we can send the ports object to the kernel. And in this case, we will send 32 mark ports to the kernel. And each port use the 8 bytes and 8 bytes multiply 32 is 256. So the data will be sent to the zone 256. Note that the out of LAN ports saved in mark message are the IPC object pointer. And the pointer can be pointed to the user mode address. Therefore, the attacker can overflow those pointers and modify the pointer to point to a user mode. And then we can control this port in user mode and also create the big task for this big port as well. So how to overflow the right port? The right port is the key. So we need to do some function to rearrange the kernel memory. The first thing we should do is to send lots of OOL port to the kernel to ensure the new allocated blocks are continuous. And then the attacker receives some message in the middle to dig some slot. Then the attacker sends some message again to make the overflow point at the middle of the slot. After that, the attacker can trigger the overflow vulnerability at the overflow point. Then we receive all the port from the kernel and check the value of the port. As we mentioned, we send the dead port to the kernel with FFFF. If the value changes to some other value, which means this port is overflowed by us, and we can control this port in user land. So if we can control a port in the kernel, what we can use this port to do arbitrary kernel memory read, how to do that, we need to set the IO bytes of the fake IPC object to IKOT task and craft a fake task for the fake port by setting the value at the fake task plus the process of the attacker can do arbitrary memory read. It is amazing because the function doesn't check the validation of the task and adjust the return, the value on that address. As you can see in this function, it will use port name to task to get the fake task. And the fake task is controlled by us. Then it will use get BSD task info to get the information. So the function will use A1 plus 38O to get the data on that address. And this address is controlled by us. Also it will use the process PID to get the information on the A1 plus 1O. And this address is also controlled by us. So we can get any address in the data in any address. And we get the kernel arbitrary read ability. Then we can dump the kernel IPC object and kernel task to our fake IPC object and copy it to our fake IPC object and the fake task. Then we can use a user line API called task get special port to get the kernel task port. Then we can use this kernel task port to do, to call the two API. One is mark Vm read and one is mark Vm write to do arbitrary kernel read and write. So here is the conclusion. We talked about kernel debugging. It is very useful for us to do kernel exploit development. And we introduced the two HEP function techniques. One is traditional HEP function because it needs rope chains to do kernel memory read and write. And it needs to do multi times. So it's not stable. For port function it doesn't need any gadgets and only use this structure. It's stable with a high successful read. But it's very easy for Apple to fix it. So that's all for my talk. Thank you for listening. Do you have any questions? Sorry, I take a long time.


So this is one of these, um, chisels. It's called a flanger, um, dongle. Do I have any broccoli in my teeth? No. You can't beat a flanger, donger. You're too friendly to her. Pretty large. Oh, David, this is a fine vintage. Then come on over and have a coffee. That's so irritatingly cute, or what are you, charismaticly, challenging?  So one of Art Reson's favorite, um, places to go is Exotic Woods, and last time we went there we saw this beautiful piece of wood, and Dave immediately thought this would be amazing for a clock. I'm not going to teach my kids how to use this type of clock. You're not lying. Why would you? That's like not teaching them cursive handwriting. I don't know. I don't know how I feel about that. Hey, times change. What used to be before a cursive? Well, what used to be, like, writing's just evolved. But it's not even writing. Times change. Yeah. Oh, pun. Speaking, it's time to start. Oh. Get it? I do. Okay, so we're so excited to get going on this now. Why don't we go through that process first, and then we can, you can, as we go. You can chime in on the tool. Hey, that's two in, like, 30 seconds. Oh, can I show, let me grab one thing, actually. I'll show you where this whole idea came from. It's a cool story. Time's money, Dave. Huh? So my uncle, my mom's youngest brother made this, and I remember the kid looking at it, and I always wondered how he did that. Yeah. Isn't that cool? And I loved this. And then he passed away, and so I ended up getting this because I loved it so much. And then so I saw this, and I remembered this clock. So we're going to make this a clock, too. He made it in jail, actually, in Saskatchewan. Wow.  No, he was selling drugs. Oh. He was the best guy. Let's get going. What's the first step then? Okay. So the first step is we are going to drill a hole in the center. We've marked out our face. I really like this placement.  The point of that is to find the center on the back so we can sink in our, what is this? This is the mechanism for the clock, right? Yeah, yeah. So in order to do this, we're going to drill in four holes. Yep, we're going to use our trusted drill press here. And this thing's good because we can actually, while we're drilling into the back to make the cavity where this will sit, with the drill press, you can actually make your drill stop at a certain point. So look, every time it won't go any lower than that. So why that is good, if we're going to drill through this wood, we don't want the hole in the back, the cavity in the back to go all the way through because then that would ruin the whole thing. So just make sure that we drill just to the depth that we need. Okay, so once we have our piece centered and synced in, then we're going to have this little bit sticking out the top. And then we take our hands. Our hands, yeah. And then they're too long, as you can see. So we're going to cut them down. And we're also just going to sand them so they're kind of a, you know, a little more industrial looking, I guess. Yeah, like a raw material or something. Yeah, rather than what? These are just tin snips. Just we'll snip those really quick. A quick snip snip, right? Change your life forever. All right, once we have our hands to the right length, then we will find the exact points. We're just going to put four nice little markers. We have this square chisel that's used for woodworking. See the tip of that? So instead of, you know, putting numbers on to mark all the points here, keep it really clean and simple and kind of go with that industrial look, we're going to have four squares here. And we're going to carve those squares out with the square chisel. And then we're going to fill it with silver, right? We're talking about silver, resin tint. Resin tint, yeah. So that is going to look awesome. And then I guess it's sand the heck out of it. And then resin the heck out of it. Resin the heck out of it and assemble it and then put it on a mantle. And admire it. Yeah, so if your hands are ready, let's hour on over to... Wow. Clock. Watch out. Dave's on fire. Oh, watch out. Was that a pun on purpose? That was a pun on purpose. Oh my goodness. Uh-oh. We have a serious problem. This is rather alarming. Oh, no. Oh, this is just, there's not enough, you know. Clearance. Clearance. Do we just put the hole somewhere else or do we? Okay. Anyways, this is what all of our videos are. Yep. It's problem solving. Trouble shooting, yeah. Yeah, that's the creative process. If it was easy then, you know, you'd buy a main. You'll go buy a pre-made kit where it tells you all the steps.  Okay, three, two, one and we're drilling. So all I'm doing here is making a guide hole. This is a guide hole. Put this over top and that will start the hole so that we're not on the angle, right? We're not doing like that. We're not doing like that. Is it some stability too? You're so smart. Yeah, so and that's very important because of this, right? That's got to stick out perfectly straight. Otherwise, you know what they say, you're behind the times. Love this. Thanks for laughing. All right, there's no time like the present. And it begins. You got to think of some more puns. Okay. All right, tick-tock. Let's go. Is that good? Fun? Hey, guys, welcome back to our clock project here. So last time, Dave and I decided where we're going to put the face of our clock and we got started drilling the hole all the way through to the back. And that's where the body of our clock mechanism is going to go. So, to continue. To continue, I think it's time to tick on the next part. So, the next thing we have to do is we want to have this clock mechanism stick up only that tiny bit over the top. So, I'm just eyeballing it from the side. Joanne, if you could just draw a line along the base of that, please. Why did we draw that line? So, we know exactly how far down to drill so that we can sink this to the right height. So, we need to cut out a big piece in the back that is this shape, right? So, I'm just going to roughly draw this shape. We'll make it bigger so that we can get our fingers in there. And then, this is a Faustner bit. So, it's for making nice circle holes. I'm just trying to understand. There it is. So, it's very time consuming, Dave. You know, it's right. There we go. Oh, that was a joke! So, we know exactly where or how far down we need to drill. And the reason for that is because when this clock mechanism sits in there, the tip is going to protrude at the front. And this little tip here is where our minute and our hour hands here are going to sit. So, we'll be able to tell the time. And the good thing about a drill press is you can drill down to a certain point and then it stops, right? So, when it stops, that means we know that we're not going to drill too far and come out the other side. Okay, so now we can drill knowing that we won't go all the way through our beautiful piece of willow. Let's do that outside. Where's some other funny puns? Well, how about I hold it in place and you do the spinning? Okay. Let's make that our first hole. Okay. So, I'll hold it. I'll jam it against this. How do we turn this baby on? Oh, like that? Okay. Give her. And it's only going to go... Oh. It's going to take forever. I have to tighten this thing. Ready? Give her. Here we go. One more time. Please just work. So, I'm just going to keep going as far as I can crank it? Yes, until you can't move it anymore. All right. Still got a ways to go. Oh. Okay, ready? I'm no time like now. Yeah, that's a good one. Almost there. Almost there. Touch more. All right, that's it. You made it. Oh, yeah. Well, it took us a few minutes, but we drilled our hole out in the back here, our four circles, and let's go inside and see if our clock mechanism fits inside. Come on, guys. I got a hand that you joined. You really impressed me. I was trying to face my fears of the drill. Oh, good. Let's see if this works, everyone. The moment of truth. Perfect. And the front. Yeah, and the front. Yeah, we need the white part to be sticking up. So, this is actually the hour hand, and look, that's too long. And this is actually the minute hand. And that's the second hand. Oh, but that's good, though. We'll have perfect. Where do we want to cut these? Yeah? Yeah. Are we happy with this? So, what we're going to do is to make these a little more industrial looking, we're going to sand off the white. Yeah, and just snip them with the... And snip them. Snips. I'm actually going to get snipped. Awkward silence. Moving on. Why don't you take these 10 snips and just cut along the line. Okay. And I'm going to go get some fan paper. How do you make metal look aged? I don't know how you make it look aged. I guess you can put stuff on it. Or do you like let it soak in water? Yeah. Should I leave a bit of white? Or just let it look like that? So, it's kind of distressed? Yeah. You can do that. Okay. So, what we're doing is just marking off where our quarter hour increments are going to be here. Yep. Minute hand. We'll center this, and center this. And then at the tip, we'll draw a line that way, and that's the exact center point of something. So, we have marked these four spots. And we're going to drill a hole with this bit in each one of them, just down within an inch or something. And then we have a wooden chisel. We're going to chisel and turn these circles into squares. So, that four squares that we'll do something exciting with. This is our chisel. It's kind of a 90 degree angle. So, we're going to tap it twice into the circle to make a square hole. Just like the pioneers used to do. That's right. Since they plugged in there. Drill press. Okay. Drill a hole. All right. But not very deep though, right? Oh, yeah. Give her. Just give her. Oh, just give her. More. More? Why not?  Okay, that's good. So, this is one of these chisels. It's called a flanger dongle. And I'm just going like that and making corners. Look at that. What do you always say, Joanne? You can't beat a flanger dongle. Oh, look at that one, Ed. Oh. Now it's a two banger. Flanger dongle. Well, Dave, I think it's break time. So, look at what we've done today. Awesome.  And then we drilled our 15 minute increments here. And the next step is going to be a pre-seal. Giving a real thin coat of art resin just to prevent any bubbles. Well, we'll sand it first to take this off. Oh, yeah. I was, yeah. Yeah. Sand first and I see. Oh, and we also cut the letter, the arms and sanded them too. Yes, that's right. We did a lot today. We did a lot today. Break time for sure. Tune in next time. See that? Yes, I did. See you later. I have to come up with something more good ones. I can only think of like five blocks. Just you wait. Oh, just wait. Ever? I wasn't even trying. I got a hand it to you. Okay. So tick tock, Joanne. Tick tock. Here we are back with our clock and we're going to do a couple of things today. First, we're going to sand it. We're going to get off this writing here. We're going to get off our face template. So we're going to give it a nice quick sand the belt sander. Belt sander. Belt sander it is. Okay. So we're going to do that and then we're going to do a pre-seal with our art resin. We have it here all ready to go. And what's the pre-seal for Dave? Well, good question. That's because some wood still has some moisture and some stuff going in there. Still breathing a bit. And if we were to do a full coat, there's a chance that the wood could still be releasing some sort of air or something and could create bubbles in it. So a nice really thin pre-seal. We'll just stop that first to stop any bubbles from coming up and then we'll do the final coat and then we'll be able to tell the time. They're used to. That's right. Okay. Here we go, Joanne. Alrighty. Hold your breath.  It's going to get dusty. Okay. I'm ready. Look at that. All right. That's got to be enough. Okay. Okay. Time present.  It was. So Joanne's heading downstairs to get some compressed air so we can just to get all the dust out of all the little grooves and stuff. And in the meantime, I'm going to tell you some clock stories. All right. So when they were building Big Ben, you know the huge tower in London? Big Ben, the clock? They called us. This was way back in the 40s, I think. And they said, we're looking for a resin that's super clear and non-toxic because they were concerned about their workers, these unions were coming and everything. And I said, if you're building a clock and you use resin, you should use art resin because it's No VOCs, non-toxic, don't have to wear a respirator and it has the best non-yellowing performance. And I was like, why call it Big Ben? And it's actually Ben is the guy that used to own the little plot of land that they built Big Ben on. And he was actually really small, but they called it Big Ben because he said, if you're going to build a clock here, you have to call it name it after me. But I want to be remembered as someone important. Any questions? What's the plan here? Just pour it and rub? Pour. Do you want to just stand it and just use the gloves? Let's just do that. So here we go. Gloved hands. You do the honors, please. Okay. So look at that. It's the best part. Isn't this fun? Look at that. How does it make the wood look? Look at that. I know. Beautiful. It's so pretty. So you just see all the different grains. Yeah. You see all the texture. And it stays like that. So you could actually keep this clock outside. You could. No one tells time like this anymore. I know. It's true. It's time to bring back the old times. Wow. That was a double time. Did we catch that? That was a really good turn, man. And I can see there's already some bubbles popping up here, I guess. Oh yeah. You know what that means. It's off-gassing. Yes. But we're not going to worry about torching it right now, right? For these bubbles because... Yeah, we'll just sand and then do our final coat. That's okay. So it's a good thing that we did this first pre-coat. So we might have to like just re-drill through there. Yeah. Okay, high-five. High-five. Until next time, guys. Yeah. We'll see you next time. Okay. Great to be back. It's about time. Right off the bat. You know, time flies when you're having fun. Where are we? We're back here again. And we did our first coat and just kind of seal it so that we stop any off-gassing from happening because it would. So it's basically alive. So that'll stop bubbles and kind of seal it. So seal it so we don't lose a lot of resin just soaking right in. That's right. So now what are we doing? Today what we're going to do, we're going to do two things today. We're going to fill in our holes here with some silver resin tint. And then there are some spots here that didn't take the resin. Now don't get ticked off if you see this. Whoa, that's a new one. We're going to fill these in with clear resin. Just in these little craters and holes here in the wood. The natural formations in the wood that didn't take the resin. Okay, great. So let's get mixing. We already poured our resin and our hardener here. We did. Wait a minute. What? Did you catch that? I did it again. Clear resin first, right? We're going to fill in our holes first. Yes. With clear resin. And then once we've done that, we're going to add the silver resin tint. Exactly. To the remaining amount. Yeah. Okay. What do you think? Can't wait to watch. Oh, watch. That was a good one. Do you think people will get annoyed with Oliver Pines? Yes. Thoroughly, next for three minutes. What do you want to talk about for three minutes? Um, I don't know. Can you tell jokes? I can't. Do you have one? I do have one. Okay, cool. What does a clock do when it's hungry? I don't know. What is it, too? It goes back for seconds. Oh. That was good. Anything else? Oh, you do have more. I do. Wow, you came prepared. What did one clock say to the other clock? I don't know.  Oh, I should have known that. Daylight savings time? Oh, yeah. It's interesting. It is. Why don't you go ahead and do those voids there? Okay, and it doesn't matter if it runs over, right? Because we're going to sand it down anyway. We're going to belt sand this. We're going to sand this. So while Joanne finishes up, I'll talk to you about resin tins. So take a look at that. See, this is silver. So there's sediment at the bottom. And then the oil. It's an oil-based product. So if you want to mix it in, there's a little ball bearing in here. The tip is you loosen the cap at the time you bit until it's an air in, and then you shake it. And that makes a world of difference. It's smart. You hear that ball bearing? It's now perfect. Beautiful. I'm going to put a bunch of silver in here. I'm going to put a lot. So I'm just mixing that in there. And that's good enough, I guess. So now we're just going to fill up these holes. Ah, that's so cool. Let's start with 12 o'clock and move around the clock. Oh, what's that one song? About clocks? Dancing around the clock tonight? Rock Around the Clock? Rock Around the Clock. Ooh, let's think of clock songs or time songs. Oh, Coldplay has that song called Clock. Are you right? Yep. Hmm, what else? It doesn't share how it sounds. If I could turn back time. So that's way too much, but we're going to belt sand all that off and... That's pretty cool, huh? Yeah, super cool. That was my next one. Time after time. Who's saying it? Cindy Lauper. Are you ready? I'm ready. Oh yeah, that's amazing. Oh, it never gets old. Oh, wow. Okay, I think we're done here. Let's hand it over to our sponsor. Until next time. Until next time. Stay on top of the time.  Punts are hard. I know. All right, we're back for clock, for the clock part. Where are we on? Three, three, four. What are we going to do today? That's what I want to know. Yeah, good question. Well, today's going to be an easy day because we are just going to sand the heck out of this. Yep. And then resin, hopefully that's the final resin coat. Yep. And that's in preparation for putting in the clock mechanism in the back that we're going to do next time after it cures. Yeah, I'm really excited to see how these turn out. Our 12 o'clock, three o'clock, six o'clock, and nine o'clock squares. Yeah. Okay. So we got our belt sander or plugged in. Where's the button? Trigger. Yeah, okay. Beautiful. What do you think, Dave? Looks good, eh? I think it's great. All right. So what have you done here, Joanne? We've taped off the bottom because we don't want any pesky drips. So that's going to help with that. Yeah, it'll make our life so much easier. Yes. And we belt sanded down the face. We also pre-leveled everything. That'll do it. We did the math, too. Dave did the math. Yes. Face it, Dave. I can't do math. Face it, face it. We, one square foot is four ounces of art resin. So that's two of resin and two of hardener. This is more than one square foot, but we're just going to do a square foot because... We can. We can. Give her. We're going to stir for three minutes. Oh, that's so nice and liquidy. I know. Be sure to scrape the sides and bottoms as you go. I'm going to stop doing clock funds because I feel like people are getting annoyed. Really? Yeah, look at them. For you? I'm sorry. All right, I think that's good. Okay. If you say so. Yeah. So we're going to attempt to just push the resin right to the edge instead of just letting it run over the side. It might run over the side, but we'll just do our best. All righty. No time like now. That was not... I didn't mean to do that. I was just saying. Okay, so we're ready to torch now, but I just wanted to point out we are getting a few drips. We are totally not even worried about this edge here because Dave's going to saw it off, right? You're going to... Yep. Just run it through the table saw. Yep. When everything's done. And then there are... And then we're just kind of rubbing drips in here. If there are any, all the curves and everything in the wood will hide any imperfections in our resin job on the sides. We're not worried about that. Yeah. And they're probably just going to run right down anyway, right? We're going to level out. We're not going to have big pools or anything. So... That's right. Okay, girl. Okay, here we go. This is always the best part. Look at that grain. Oh, my Lord. Awesome, girl. Is that enough? Yeah, let's cover it and get out of here. Okay. Okay. Here we go. There we go. Okay. See you next time, little clock. So what do we have left? All we have to do is... We're so close now. Can you believe it? Cut the bottom, drill out the middle part and put in the hardware, and then just enjoy it. And then tell the time. Thanks for joining us on this adventure. Give me a terminator line. It's time. Like that? No, that was... Oh, God. Let's just go. We're back here with our final finish clock. And look how beautiful it is. I love art resin on wood. It just makes it look so, so, so beautiful. Yeah. But the problem is I don't really... It takes so long to read what time it is. Because it's like, look it. You have to say the other thing I've never said. No. How do you do this? I don't know what time this is. I think it's like 25 to 5. I don't know. Like that's 3, 4, like 5. Anyways, it looks great. It's for smart people. Yeah, you don't actually... It's very... Yeah. And you don't actually need to use it as a clock. It just looks like you're really smart. Exactly. Yeah, and then you say I made it myself and it was easy, right? So you're crafty and smart. Creative and smart. Yeah. So the last steps were really easy. Just picking all the tape off of the back. Just use an exacto knife to get under there. Did you get that? I did. And then re-drilled the center hole just to get rid of all the epoxy that had hardened in there. And made it nice and clean. And then just ran it through the table saw to make the perfectly flat bottom. I love that smell. Delicious, eh? And you can actually see how thick the resin is now right on the side, which is kind of neat. Then we took our clock mechanism here and you can see we just placed it in the back in that hole that we've made. And we lined up our second in minute and hour hands here. And then just fit the whole thing in. Looks beautiful. It was hard. Those pants, did you ruin them from working so hard? I know, from hard labor. Did you or you bought them? I bought them. Yeah.  It looks awesome. Slow clap. Yeah. I guess my final words are I never really thought about time and like what is time? Oh wow, that's getting pretty deep now. It's kind of existential. I don't know. What is time? Anyways, if you know, comment below and thanks for watching. And Drann, that was great. It's second to none. It's second to none. I'm done, I'm dead. Next time on Dave and Joanne Make Something, we are going to make a... You have to watch and see.


Then we added a piece this year. Each year I try and just go a little bit further with what I've learned since 2001 and say, okay, how can I make this be a little bit better? And that's just the strategy that all teachers do is try and once you've tried something, how could this be better the next year? So I went to a conference in Houston at the beginning of the school year, and a lady from the Library of Congress shared with me a thing called Books as Hooks. And so what she did was she took primary sources and showed the kids the primary sources before she read a book to them to get them interested and hooked on it. So that was an interesting concept. So when I came back to my classroom, I decided I was going to try it, but we were working on reading comprehension strategy of inferring at that time. And so I decided to add that piece to it too. So I pulled different primary sources, both documents, photos, and a few artifacts too, and pulled those together and the kids analyzed those and they have different pieces of paper that they do that on. It's mainly looking at who, what, when, where, why something's happening in a photo or in a document or in an artifact. So just thinking of those questioning strategies there, then I pulled that into a document analysis, a photo analysis, an artifact analysis, so that each kid gets to see each of the documents, each of the artifacts. And then from there then they predicted as a small group what they thought that photo was going to have to do with because I didn't tell them what book we were going to be reading or anything about it. I wanted to see what their background knowledge was on it first. So they made some predictions, and after then we predicted then, when I'm reading the story then, I stop at different places and I let the kids make connections or infer with those artifacts have to do with the story or the time period that we're talking about. I think it's the best way that I've ever taught inferring because they completely understand and it's a very easy assessment for me to see who can make the connections and what their inferences are just by what they're saying. I've also found that kids that maybe had a difficult time doing it, once they've heard another student made a connection, they're like, oh, I've got something else I could add to that or I could add on to that. And so just being able to talk those things out, it's made other kids who are more quiet and reserved be able to then share during that time too. So it's been a very successful project.


Game over Alex got his first one Hammered you good job Dude that's freaking sweet Oh my what's happening YouTube welcome to another video You like that? I think that's a new intro man. It's an intro. What's happening YouTube? I don't know if you guys like that I mean comment below. I mean YouTube's kind of current you anyway So we're gonna make it have anyways guys We have a cheap versus expensive fishing challenge today as you can tell we're outside of Walmart as you can tell come up Boy Alan right here the peacock bass fisherman. We're probably gonna go to the Amazon this summer or maybe even I don't know We're gonna figure something out. We're gonna be filming some peacock bass fishing, but that's gonna be awesome So stay tuned for that one and this cheap versus expensive fishing challenge today We're gonna be doing it over spinnerbait So there's one I have not done that's one that you guys suggested and I'm super excited about it today The only problem people is it's super windy outside because a hurricane is actually blowing in when I mean a hurricane is blowing in It is blowing in in a few hours. It's kind of like one of those things I mean it's like about to happen So we're about to get out there. We're gonna be doing some fishing by the way stay till the end of the video because I am Going to be giving the fishing tackle that I buy in Walmart I'm gonna be giving it away at the end of the video, but don't go ahead and skip Don't do that whole deal. Just wait till the end and we'll make it happen because we got some juicy content So let's get inside Just made it here inside of Walmart There's a lot of people in here buying groceries because the hurricane is about to hit and I have zero food in my house That's something I'm gonna have to do after this video But anyways, we have the fishing section right here. We're gonna take a peep at what spinnerbaits they have I know they have a $1 one So that's gonna be the cheap one, but I'll show you guys that here in a minute I see a lot of different ones right here, but let's let's see what we can get here is all the Juicy looking spinnerbaits right here One dollar ones down there. It looks like we got some boo-yahs some strikeings And some more boo-yahs and some more strikeings looks like that's like the only two brands they have Alan Bob What do you what do you think hashtag Alan Bob below? That's his new nickname for the for the channel What do you think for the like all right? We're gonna do we're gonna both decide But what do you think on the spinnerbaits like the expensive one? Speak up a little bit Alan Don't be shy This this is what we gotta do first Alan so as you can tell by these obviously those are babies We those are out. All right, then they have these these are four dollars because this is the cheapest expensive So that's the main thing we got to pay attention to and these are five dollars And then some buzzbaits and then these are six dollars That looks like the most expensive spinnerbait that they have Let me see that one looks juicy man that one Now that one's right there. Yeah, it's what's it all right, so let's see I do that one or this one. I really like that one honestly, dude. I don't know man That one is three eighths. These are half. I'm thinking we get one of each anything. That's fine I just one of each so one of these so this is about seven dollars of tax KVD spinnerbait right here. This one's like a sexy Shad the chartreuse on the belly And that was just more of a natural, you know color It's got a little bit of white and then blue swirl down here We got the $1 spinnerbaits the Walmart special. I've actually made a video on it months ago I actually caught a few good fish on it So it's not half bad of a spinnerbait, but you guys know at the end of these cheap versus expensive ones I do do I do do I do do I do reviews over the bait, so let's see what we got Mainly they don't really have like a chartreuse like that's a buzzbait, but I mean the skirts are the same here Like that's not really like a chartreuse spinnerbait. It's more of a means the colors are so off But I mean, what do you really expect of the dollar spinnerbait? We could get one like this I'd say I really like this one the best The white all right Like a chartreuse one and Like a natural yeah, I was thinking like I'll buy two it where's another is there another white one right there So I'll get two white and like one of those get three total. I think that's fine. All right. That's good. Is that good Alan? Let me see what you get Juiciness right there right juice so two of those and three of these $1 spinnerbaits All right, Alan meet you at the palm bro The first process of this whole challenge is obviously to rig up. It is extra windy guys extra windy today But honestly, I don't know if you guys can tell there's a bunch of clouds out. We got some wind So you know what that means spinnerbait Spinnerbait mmm Juicy today. I promise you I'm just worried about the recording. I'm worried about the film That's my only concern, but we're gonna top right now Alan actually I have one question, bro So there's a cheap and there's an expensive one. Which one would you like to throw? That is very Kind of me, bro. I'm letting you It don't matter. What are you thinking, dude? I Don't know the expensive one looks juice.  All right Alan or throw the expensive one and after the cheap one. All right, here you go Alan Bob Which one would you like though?  Yeah, that's juicy for me. I'm gonna be going with not this one Since he's throwing like a another one. I'll just throw this white one right here Gosh, Alan, you're really putting me on the spot the $1 spinnerbait. I've caught big fish on this matter of fact So it's going You can't let me beat you with the $1 spinnerbait now. This is gonna be the one challenge where the $1 one just Kicks the other one's butt. I got to kick your butt Alan Leave your suggestions below on what you think's gonna win about to go down. Make sure you check your Jag now. Oh my god Dude, did you see that first cast duty hammer me? That's where I saw that fish kind of duty like whack my blade first cast. I'm actually glad I didn't catch him That's like bad luck. I don't know There he is. Yeah, I got him. He's not that big. It's like a pound That is first fish of the challenge baby $1 spinnerbaits. You choke that thing Look at that, baby first fish of the day that happened pretty quick. That's a good sign Look at him choke that $1 spinnerbait, dude. I'm impressed. I mean, it's not a big fish But guess what Alan fish is a fish bro On the $1 you cannot let the $1 beat you pretty little pass. I think it's so skinny Look at that thing. That is like the skinniest bass ever first fish the challenge, baby Alan's got his first one. He's a decent one, dude, ain't he? Good job Alan. There you go, bro. There's one on each. That's not a bet dude. That's a healthy fish Hammered you good job. There you go, bro. I know we're enemies right now, but good job On the expensive spinnerbait says one one on one right now pretty fish bro. Good job. All right, man I give you that one. Good job guys The wind is freaking real. Look at this. It's crazy Alan Bob. What do you think about this man? It's pretty wild ain't it? We're going to the next location on number two We're gonna see what's happening. We each got one fish so one on the expensive one one on the cheap one Honestly, I'm kind of satisfied with the first place. It's kind of like a hit-or-miss.  Oh my gosh. How about fell right there? God Yeah He ate it right away around that grass line It's number two on the cheaper cheap old spinner but hooked them all weird man What's a good sign though this first fish look how fat these guys are look at that Yeah, definitely healthier than the other pond second fish on the cheap one third fish overall.  Oh I got your line, bro. I got it. Wait. Wait. Gosh Alan such a mess man I don't even know why you're still on the show Alan. Gosh God dude, did you see my line dude? He look he ripped my skirt off throw in there He like took off to the right with it. Oh My dude what? I'm so confused.  That was What in the world Alan? That was some crazy stuff throw in there. There's it has to be more dude What in the world? I don't know if you guys caught that on camera, but this fish literally ate it like a 10 pounder I don't even know if I had a bass there for a minute. See ya, buddy Whoa Alan, I don't know what's happening man The one dollar is killing it. I'm kind of impressed with it I'm kind of surprised man and be honest with you because you just threw two casts there and you didn't get a bite I don't know. Well chunky dude. Oh It might be that smaller profile and it could be the white maybe they want that white I don't know. I if I had to guess it could be that smaller profile Alan dude, I don't know bro. It's one dollar one is whipping it There should be some right here fight so hard. I gotta turn my back to the wind. I Apologize guys for this win. This is really and there's nothing I can do is either we film this video or we film none at all So I'm trying my best to get the wind noise off the camera. All right, Alan. I'm letting you get first cast Never been to this pond could be some giants Alan Bob gets first cast go for it, bro. Whoa Never catch a fish on your first cast Show me one more. Oh, dude, this looks juicy. One more dude Donzo go for it. God, dude. You got a fish Dude, that's a solid fish right there. It's a cool one. I'll take that one any day I thought it was like three pounds for a minute there. Alan Bob hooked him one while getting the camera Dude, that's freaking sweet double up right here. That's a beautiful bass right here. Gosh, that's crazy. What happened I don't know. I literally said the rod down and I felt it move out Dude double up that's freaking sweet Definitely the best one by far. That's a solid two and a quarter They can help you right there. Oh, dude. That's freaking sweet That's a good one, dude, that's seriously quality one. That's definitely the second best these little fish Solid pound and a half just like that. There you go. Good job Dude, that's a good one. Oh my god.     Oh, oh You didn't see that The fish just slapped me in the **** See a guy Dude, that was like insane. It was a two-pounder. Yeah, I was just trying to be all fancy Dude, I cast it like that with one arm. I'll lift it up and he already had it Game over Dude, that's a good one. Get that net. I mean, not net. Get the camera. This is the best one yet Oh, that's a good one, bro Get the net Get that net Bro, what in the world did he just spit up? Dude, is that a salamander? What is that? It is What is that?  Oh my god Dude Look at that guys, definitely not the best one, but I'd say definitely second best or maybe third best I don't know if you beat the one that you caught. That's a pretty fish first time I've seen a fish spit up like a little lizard. That's pretty crazy. It's massive thing. It's like game over It's game over, baby There he goes. Is he big? Really? Watch my line Oh, you have him like, yeah, that's why I thought you had a giant That'll make any fish feel big What in the world?  You got him good, too It's not a bad fish though.  I thought you had a giant.  I'm not gonna say it's better than the expensive one, but Catch it bass, baby Nothing big, but these things fight so hard. I cannot explain it So I will show you guys how I'm catching them today, you know on the spinner bait Throwing around all these cypress trees It's grass and this big old pond Catching bigens Let me show you how I'm kind of working this bait here. I'm very windy All these cypress trees in the middle All that pine straw pine straw is really good for bass if you guys didn't know Well, everyone we're about to end this bad boy off But first I want to give away these spinner baits the one lucky winner So this is what you got to do. You got to follow these instructions So make sure you're subscribed to my youtube channel. There's a little notification bell Make sure you click that bad boy like the video and comment below something about my channel That you enjoy what types of videos whatever it is if you're new to the channel What comment what type of videos you want to see and leave your instagram handle or facebook handle any other platform And that's what i'm pretty much going to message you guys on it just makes it a lot easier So I have to make like a designated video over giving this away because I want to do this in the You know other challenges as well I want to be giving away the product because honestly like once i buy it using these challenges It kind of just sits on the side I'd rather give it to you guys because you guys would put it to good use And that's what i'm really wanting to do overall. It was a really good challenge man. I had fun But I hate to say it alan I smacked your butt man The uh smaller profile bro. Yeah, it was a smaller profile I promise you guys that one dollar spinner bait like I guess it can be worth it It's not going to catch as many fish like I literally tore it up today Like I can't go out there another day with it I'm obviously not going to give you guys the one that tore out, but I'll give you the new ones But yeah, I absolutely tore that thing up caught a lot of fish on it It was definitely the smaller profile that allowed us to get more bites on that Um that spinner bait that alan has I mean nothing catches fish. I mean I've caught a lot of fish on that Spinner bait in particular, but I just think it really was a smaller profile possibly the white as well Um, I mean yours was like a sexy shag color, but then again it had the chartreuse I don't know if that would really matter too much especially in a pond You know in a pond like this most of those fish eat whatever it is But I just really believe it is a small profile that those smaller fish were really keying in on Especially debating this and these little ponds that I mean they're small. It's not nothing crazy Overall everybody if you guys want to see another cheap versus expensive fishing challenge Be sure to pepper that like button up. Let me know in the comment section below Which one you would like to see next and enter the dang giveaway people Just do it. I wouldn't Go follow my man alan on instagram some more videos coming soon Thank you guys so much for the support. I love you guys so much and I catch you guys in the next All right, man, that was good. That was a juicy one people


When we came here it was family and then I guess is the key word to the Rio Grande Conference. We were family. We were family in the local church. I always felt I had 20 moms and 20 dads and all our friends and of course in the fifties early sixties that was the only social life my parents had was to visit each other and all our fellowship was with the church so we were very sheltered and which was a good thing because that was you know still a time of unacceptance of people that were different in Dallas. The Methodist men had their organization and they were very strong. The Methodist women but I was involved in the youth and that was going to camp every year to Kerville and you know establishing all those connections that the Rio Grande Conference offered to Texas and New Mexico. So I think that's why people still today everybody knows when when Roberto Gomez passed away when Danny passed away Danny Solis the whole conference grieves because they're we're part of a big family so I think that's the key words family


Any issues with holding crypto and a hardware wallet stored in a bank vault owned and in the name of a trust, which is an asset of a self-directed Roth IRA. There isn't an issue where you custody your assets within that self-directed Roth IRA. The key on the transactions of that IRA account is just making sure that everything is up to code, right? So you have transactions within that self-directed IRA. You don't have any distributions to this trust. You don't have any distributions to yourself personally. You just continue to transact in there. But if you're holding that crypto in a hardware wallet and that's stored away, you're likely not able to do anything with inside of that IRA account. So that would kind of be moving funds from maybe that that IRA account. You might have like an LLC and then maybe you move some of those funds from that crypto exchange. Maybe you got a cracking custodial, you know, corporate account. And then you move that to like a personal account. That looks like a distribution.