Hi everyone, my name is Chris and I got my friend Philip with me. Hey, hi and Yeah, today we like to talk about demystify into security technologies in fiambo. Yeah Unfortunately, we are not able to Preval to the US so We have to actually do our Recording here and be there remotely All right Yeah demystifying into security technologies first of all, I'd like to give us like a short intro on who we are and what we're doing So we are both working at nine elements, right nine elements is the largest open source Independent bios vendors so IBV worldwide We are more than 12 30 15 people now And only work with open source firmware We're actually driving the open source firmware community So we founded our own Conferences we are in the leadership meetings of Corbwood Linux boot yana core and all the other Firmware projects which are out there. We will not go into these projects today Or not that much actually, but just so you know, what our background is here Yeah, what do we want to talk about today? So today it's a little bit. Yeah, it's a firmware talk obviously, right? And here where as you might know and probably you know best That fear was quite blocked today, right? So there's like a lot of blocks and binaries all over the place and It's also NDA like a lot, right? So for everything that you that happens in firmware like every security technology and also everything else basically You need an NDA with one of the big stock vendors to actually get documentation if there's any or to get to link if there's any and yeah As I said firmware bios in UFI is it's it's pretty blocked. There are a lot of binaries to give you an example Like the normal x86 x86 firmware that you have have nowadays. I mean what what blocks do you have there? There's like a handful of CPU vendor blocks like all these famous support packages that you actually need to do all the memory in it The silicon stuff and so on There are also additional OEM and ODM blocks like for custom custom stuff that they actually put in there for for a graphics card and all these kind of things right and All together that's like if you have you know, like a 16 MB firmware image It's at least half of the images. Yeah, at least 10 megabytes. I would say so on a modern Platform at some moment. Yeah, so that's that's even more than half right? Yeah, I mean, I already got my new Lenovo X1 Carbon Gen 9 and it already has inside the Linux six firmware blocks for initializing audio and Video and whatever so it's like it's really it's really not really nice and so we're seeing more blobs in the ecosystem now and Actually, I mean you have 10 MB of blocks, right and the other six MB is close source firmware Everything is actually close However, the blobs are even even even more special, right? Yeah That's true. Yeah And also, I mean the other the one thing is we have firmware and all the blobs inside and the other thing is There's no real tooling right for these kind of things. I mean, there is some tooling And also some open source tooling some close source tooling most of the close source to makes actually only run on windows and these kind of things, right? So there's no really open source tooling for for these kind of things out there And I think that is that is was one of our main Main motivations here actually to do what we did in the last few years and also for Transparent security out it. It's really important to have let's say open tooling or at least open documentation about those technologies, right? How do you an open and transparent security out it if you don't know what's in there? So it's nearly impossible. Yeah, that's a huge problem actually hmm, I mean nowadays if we look I mean we in the stock actually now We're concentrated on Intel but not that AMD is much better on that part But we're concentrating on Intel and there are so many security technologies in it, right?  It's like pvr SGX TDX There's bootguards. There's txt. There's some CVT What what did I miss? There's probably STM right secure transfer. Oh, yeah, yeah, right It's it's and there are also some hidden ones which are not public yet So we can just close them but there are tons of more inter security technologies out there Probably you had some and you had some of them we currently have in the slides But in general, this is it's a really it's a jungle of IT security technologies Yeah, and what all of them have like fancy names, right? And you don't really know what they're doing And the thing is most of it, right? Most of them are actually implemented in firmware or if not any of these right so at least any of the ones that we named by now You have either any binaries or structures or functionalities and even SGX right so secure software guard extension abase it basically They have also firm as the most people don't know but it's located inside the microcode So even if you have like confidential computing technologies, they also need them Probably the firmware code is really small and it doesn't compare with which with other parts parts of the system But yeah, that's it's really yeah. Yeah, and I think that's that's unknown to most of the people, right? So that that you have so that these security technology actually like so much on firmware And even if you're an IBV as as we are even then these parts are in the eight right so we have to have special MBAs with the sock vendors and so on to actually get proper documentation on these kind of things and Like to be honest even with proper documentation most of the time. I know it's trying error, right? So that's that's the thing Yeah, so What what does that mean, right? So everything is implemented in firmware You're actually relying on on the OEM or OEM to that they know what they're doing, right? And that they provision your platform correctly that they configure your platform correctly and these kind of things and and that is Yeah, that's like a big risk here, right? Yeah, and also it's impossible to to get into that topic quite easily If you're part of the linux community, right? So as there might be some public documentation now But it's just high level. It's no details in it and all the edge cases and problems in these technologies are not documented and So this is a really a problem. No, there it is Yeah, so and that's that's where it all starts basically, right? So we will give now an intro to the Intel convert security strategy, let's say so convert security is basically the idea of Putting everything together, which basically means if you have security technology It always has a core root of trust and this core root of trust somehow Can be shared between different security technologies, right? So and even if you're a hardware vendor It's really expensive to develop everything every new technology and a new stack So it's probably a better idea to base it on one stack you have in control And so we will talk about it's not it makes sense, right? At least make sense. I just okay Let's share some of these features across the different technologies that way is that's It's also better for security, right? Because you only need to verify one one Caustic let's say in terms of security properties. No, yeah But let's say Intel started that and they call it convert security strategy and at the moment It includes boot guard technology will become later to that extended to the use the same for trust execution technology And into PFR All those technologies are currently in there I heard there will be more coming which merge in so they try to add more and more security technology or put it on top of their core technology stack and So we will see what happens in the future in the next generations. No, but this will definitely happen Yeah, I mean book guard and txt. I think they called Converged guard and txt, right? Yeah, yeah, but people come later to that We first we will explain basically the core technology concept So we had come as this off. So basically in the technology concept. We have four four things So we have the Intel authenticated cold modules. You may have May have heard about this is some kind of block, which is doing all those security stuff There's a CPU which is really important in this case A result would be bad the internet management engine so internet management in the for everyone doesn't know what it is It's basically the Southbridge. Yeah, it's Southbridge. We have this benefits. I call it's like that's solid benefits And we have PMV security headers, so we have some kind of headers around the bios or your five PMV So first we will look into the ACM So ACM are basically closed source binaries or firmware Distributed by Intel They're basically written in assembly. I don't think they use C rates So most of our biggest part of it is probably written assembly may might be some C Maybe they use some C for it as well But they are really low level because they run before the memories initialized inside the CPU cache Yeah, and actually you don't have much there right before you got DRAM Like you got the CPU cache basically right like there's a couple of things going on But there's not much that you can actually do there. Yeah, and the the the the nice things actually so Before you so when you turn on your computer basically and before the x86 system x86 firmware actually starts The CPU loads these ACMs, right these authentic code code modules into its own Let's call it RAM. I think they call it AC RAM, right? So they have like a special proposed RAM or I think they're using the cache basically for that Where they load the ACM into to execute that, right? Yeah But it gets verified if I so if I remember correctly all ACMs have like signature And the the key to verify these ACMs, which is which is quite fancy. It's actually in the CPU, right? So there are ACMs for dedicated CPUs or they are Yeah, every CPU basically has dedicated ACMs that you can run Yeah, and every CPU also just for info has firmware itself. So CPU is not firmware less It's not a piece of hardware. It has also multiple firmware components in there. They're quite small But they are there. No, so it's really important and another interesting thing is some of the Intel ACMs are encrypted so I guess for bios card They use an encrypted ACM to protect against reverse engineering. I guess so it's some additional protection mechanism I don't know where the key comes from to decrypt it But I think it comes also from the CPU not sure what they use there, but you know what encryption they use No, okay, that would be interesting. Yeah, we can probably look into that I mean, we have at least NDA level access, but it's it's it's kind of let's say It's also hard to dig through those documents. And one thing to note also is you have different versions of ACMs, right? You can have like a debug ACM Yeah, which can only run on On pre-production hardware, right? Yes at the OEM basically when they when they spin the first boards You've got non-production worthy ACMs, which is kind of something in between I don't know. Yeah, and you got the production worthy ACMs and all of the ACMs you only get under NDA, right? Yeah, that's correct. No So what have we next we have the firmware security header So as there's one header called fit firmware interface table, which is basically a CPU Carseable data structure. So you need to know The ACMs we talked about are located inside the firmware image and you somehow need to load it, right? And the CPU doesn't know where where it is So it maps in the beginning of the of the platform bring up the CPU memory maps the entire let's say up to 60 megabytes of SPI flash or the bios flash into at the reset factor of the CPU and So CPU and somehow needs to pass this fit to figure out where the ACM is and so This is what fit does It's I guess it's all they are already some documentation about it or especially in the cobalt project You probably can check it out. There's some nice graphically included in the slides. You can see it's more like cobalt base but you can see what kind of Let's say offsets the fit is referring to and it's a binary data format So that's no common data format just binary data format And it's easy to to pass for the CPU because the CPU doesn't have so much Firmware, right? So it has not enough space probably to include an JSON password. Yeah, right But yeah in in the fit as you can find location of microcode updates, you can find ACMs and also the other PMware headers that you need as we already mentioned like KM and BPM and these kind of things, right? Which we'll explain probably in the next slides But all these kind of information where to find those stuff is actually located in that fit table. Yeah Yeah, another Firmware security header is the key manifest So as the name already tells you it's it's for key management. So it's the high-level key hierarchy Manifest it's also passed by the ACM. So not by the CPU itself. If the ACM is loaded It it will pass a key manifest It contains a lot of hashes from public keys So there are different kinds of security technologies as we already mentioned for the conversion security strategy which can be validated through the key manifest and Yeah, the signature of the key manifest itself is verified through the Hash of the public key which is attached to the to the key manifest itself So not not the hash but the public key is attached the hash is burned into a few this into the south bridge So into into let me if you're mad. So basically what they're doing is They move with that with the technology basically what they do is they move the rule of trust into the south bridge, right? Yes, because they're fusing The the hash of the public key in the me, right? And that is like a one-time thing that you can actually do right? So it's one it's one way direction I can fuse and cannot unfuse it again if it's in production and then the ACM which is Signed by Intel and verified to CPU actually checks if that KM is the valid KM If it has been like signed by a valid by a valid key, right? Yeah, and that's that's how they build up that route of trust, right? And before they use like different route of trust technologies like for I don't know legacy TXC That's called where they have to add like TPM and these kind of things But now what that is moved into the south bridge and combined with the CPU, right? So their own city can basically and started from there. Yeah, so it's also probably the most secure idea. It's probably not that Let's say independent from it anymore. It's less open. I would say yeah, let's open But it has a probably the benefits that the Intel me has some kind of hardware protection mechanisms Which are probably better than the TPM. I am it's probably TEPA Evident instead of resistant, but I don't know I mean either I mean TPMs already like a hard catch, right? Yeah, if that's better, I don't know, but I do get the idea, right? So I moved everything into Intel IP basically and have everything under their control Which probably makes it so they also use binary data from the binary data format So it's again, not Jason now XML or something like that Yeah, I mean XML can be also quite confusing anyway So, yeah, and then we need to see you so the CPU has some cash already before the memories available right and the AC RAM Chris spoke about is basically on placed inside this CPU cash and Yeah, during early launch the CPU passes the fit table figures out where the AC MS loads it into the cache Into the AC RAM location, which is shielded or protected And then it does the verification over it and after signature verification Is done then it gets executed and this is how basically How that works and also CPU is quite important because a lot of registers in it like MSR registers Which are programmed by through the ACM. So the ACM is basically the core root of trust code Which is then doing all other or further steps now. Yeah, I think you can kind of Interpret the ACMS like you're probably your trusted computing base right because that's like the first real code Let's say that runs there. Of course, everything is closed source NDA. I don't know if you want to have that as a piece But still it's like the first real real code that that runs and does the verification, right? Yeah That's true. Yeah, I sense Yeah, it's Intel management engine. We already talked about so it's basically the Southbridge firmware Nowadays, I guess it has eight megabytes probably more It depends right so there are different types of so yeah, I mean Management engine is not management, right? Yeah, there are multiple let's say version for server client platforms IOT But let's say in general they all have benefits which basically meets additional features that like for server space They have monitoring features for for the customer for the client Which means desktop and mobile platforms They have some kind of remote management and whatever and it also is able to run Java little so Java little machine So you can load your own Java applets into the Intel management engine. It'll make the probably Is this innovation engine that they talk about? No, no, no, this is a digital so you have also Intel innovation engine But it's a separate part of it. So it's it's a different story But let's just concentrate on the Intel management It's an engine in the engine, right? Yeah, which is okay. Yeah, okay Okay, so Yeah, it's and the inter management engine is highly involved in all those platform security technologies from Intel I must be said it's it's really part of the the firmware Image from the ME is a separate from from the BIOS and it has its own data petition inside It's not only code. It's also integrated data petition You can figure out there. There's a lot of research and reverse engineering arm regarding Intel ME You can probably get some more information about it and it also the most important thing it has some kind of confuration inside Inside the data. So let's say data petition and it has the fuses which are important for security Yeah, yeah, that makes sense. So for those who are wondering I mean, I think there are a lot of talks about Intel ME, right? What the management engine does and what not in these kind of things Out of an IVV perspective perspective basically What you what you put in there is like all your hardware configuration They are not what PCIe slots you have what status lots and these kind of things what should be done if I don't know if the machine boots up and you have food got enabled and then the keys are not correct in these kind of things, right? So that's actually a lot to configure there and also that tooling is NDA and closed source and I would probably say there Over 200 options or so for a normal platform that you have to configure in order to get it right. So The the the space for errors is quite big there I would say right so even we are dealing with that on the baby days is and It's still very complicated. Yeah, that's completely true. Yeah Yeah, so platform loop flow, so we will give you a rough overview of how it works We can go into deep in detail in 40 minutes. That's that's probably impossible So even with I guess six hours it you have edge cases and things you can't Cover so it's a topic for multiple days if you want to get more detailed information Please check out Ronald Hudson's blog about but that's a good one. Yeah, then you get definitely more details from it In general as we explained it before The pch maps firmware at reset vector, which is basically on the bios firmware CPU parses them to fit Table then it loads the ACM into a serum It verifies and executes it and the ACM does some platform checks, right? so it's basically security check checks if it's production worthy or whatever and Figures out what's going on. You can see that in that small Schematics there. It's it's not that complex. We already talked about I mean what how you can imagine that is basically when the PCA maps firmware at the reset vector means like the reset vector on Intellect 66 system is just below 4 gigabyte, right? I like always and what the pch does it maps your 16 MB or 30 to be like in the last 16 MB or 32 MB of that For gear but I guess it's only possible with 16. So there's some other element It's extended. Yeah, so 16 was I think To coffee leg or so. Yeah, but they extended that nowadays on the new generation platforms But still okay, let's assume it's the last 16 MB of your just below the 40 for gigabytes That's also why in the image that we put in there basically shows you have to imagine on the left-hand side There is like zero gigabyte right and on the on the right-hand side where the fit Is located the fit point is located. That's four gigabytes And that's also the reason why the BIOS has its own SPI driver Because if it's more than 16 megabytes memory maps, then you need to have your SPI driver You need to go through the SPI control actually to fetch more code. Yeah Yeah The next part is that the ACM passes to fit which is basically And they are to figure out where the cam is located so the cam and ACM are part of the BIOS firmware so and This is what it does and then the ACM also reads the the public key hash from the Intel MEE if users verifies the KM passes its data Uses the public key inside the cam to verify and load for the technologies. Yeah, right? So I mean this is quite easy It's just like a handover the key manifest is more to make it flexible for multiple security technologies But that's how it goes and after that Technologies like Intel comes into play. Yeah, so we will talk about that later I mean, that's exactly that that structure that we just talked about right look the ACM first verify that part and then Check against the KM if that is the better part, you know And from there you can actually take it and bury the bury that that Trust into the CPU and the PCA tried and then you have your your setup ready to go And you have you know that that the KM that you actually loaded is valid, right? The ACM is valid and from there you can take it That's basically the same for it for all the security technology that they have Yeah, this is completely true. Yeah Okay, um, yeah So after that that brief overview on how conversion beauty Works basically We can we can go a little bit more into into boot guard and trust execution technology, right? So that's the tool of these inter technology that they merge together And we can we can skip a little bit through these To to get a better feeling on that because that is that is the main topic of the talk here basically um so, yeah, I Think two generations ago or three generations ago Interdecided basically to merge and and and yes start that strategy that you just talked about right and to merge The first part was to watch boot guard and txt into one technology because they are all of those of these technology are based on ACMs and that you don't have like three ACMs to to have post technology working You don't need to anymore, right? And they named it converge boot guard and txt so in a short before it's cvng pretty catch a catchy name if you if you take it and as I said it contains two technologies that has boot guard in there and it has trust execution technology in there In the boot guard. So both of these technology have like a different purpose, right? So and That also makes sense boot guard is It actually protects the first part of the code that you load right at the reset vector and txt on the other hand This is just an execution environment, right? You have runtime measurements. So you have the DRTM instead of an SRTM You probably want to explain what SRTM and DRTM is. Yeah, static route of trust for measurement is basically a thing where you have the bios code starting measuring stuff into tpm So it's a chain of trust down to the operating system You measure our code before you load it and execute it the next code is measuring before loads the next code And so on and so it's static if you're having something like DRTM, which is more like runtime measurements You can just invoke during runtime secure code base or let's say secure trust anchor which then does active measurements Of something. Yeah, and and SRTM is always yeah as the name already says statically right from Basically from when when the CPU starts you start your your chain of trust right all down to the operating system DRTM can be involved at any time. It's dynamic. Yeah, that's basically the D in the name Yeah, it also has some I will I will menu protection Mechanisms and it's starting some something called measured launch environment. I don't want to get too deep into that But it's used in Windows 10 in device guard for example So Windows 10 makes extensive uses of trusted execution environments and until TXT is one of those Yeah, and it's verified through the covert security technology nowadays so TNT Exactly follows the the scheme that you that you just explained basically And you have a couple of important things that you actually have there of course you have the ME again, right or the Server part of the management engine You have a couple of famous security headers. Of course, you got fit table as always you got a KAM as always But this time you also BPM. I think we will go into that later on We have an initial boot block And of course, you need some bias Vice you buy a few more code. I probably don't need it But it would be better for some kind of technologies. So yeah, yeah, that's if you want to put something in general It would be nice. Yeah, so for sure All right. Yeah, the intimate management engine it basically so besides the He fuses the fuses right so the the hash of the public key. It also come contains some configuration data, right? You can actually configure CBNT or the bootguard part of CBNT to run in different modes. So either can be completely disabled We have it in verified or measure boot or basically in both right? Yeah What you can also do is Enable txt or disable txt. So even though they merge these technologies together together, you can still Enable only one part right? So if you only need the bootguard feature From CBNT just enable boot guard and off you go, right? If you only need txt feature of that of CBNT only enable txt and off you go And that also that all the things are is actually put into the inter management engine, right? Yeah, and it also contains What to do if an error occurs when you actually start a bootguard, right? So Imagine if you start your system and basically You don't start the code that you expect to start right so the measurements are wrong What are you doing, right? Yeah, do you do nothing? So basically you say, okay, I don't care I got a remote as station later on Why then having wood got it all but okay, but for D by me proposes or for example, that's quite nice You can shut down immediately, which is you don't get your computer on anymore Or you can say okay, you got x seconds or minutes to actually solve the problem So that you get some good guy some keep up with a funny part is that this and Enforcement policy is one of the dangerous things they ever introduced because there's the do nothing option And some balance already configured to do nothing options. So the security is basically not there I mean for remote is station a better feature would be enough So you can then it's it's basically also the question if you want to shut down the platform Normally a measure boot is not enforcing which is quite good. And so yeah, yeah Yeah, that makes sense. Yeah, and that's also one one of our key things here These configuration are quite opaque, right?  Yes, we have to nothing and they would don't worry, right? Let's think Yeah, what's the initial boot block? Yeah, as I already said, it's the first code that is loaded as part of your firmware code It can can consist of multiple sections. So that doesn't mean it it does not have one have to be one sequential part of Binary code in your firmware, right? So it can be at different places and your firmware actually loads different parts of that code, right? so that means These initial boot block basically is defined in the BPM, right? And there you can actually find multiple IVBs like initial book blocks and not only one obviously But which makes sense and the idea of these IVBs is that before the firmware start These parts already already get measured into the TPR, right? Yeah, and they are basically verified like in the secure boot or very file boot environment, right? So so they use those sections defined in the BPM. They also have multiple hashes with different crypto algorithms Which is the final hash and then the K-Kool-Aid Is all those IVBs together and get a final hash and if that matches the BPM you can say you're good to go Yeah, that's how it works and additionally to that you can also the ACM also measures it into the TPM if you activated measure Boot-based in the internal management engine for later use I know remote is stationary if you want to just have your your measurement lock, right? Yeah, these things make sense. Yeah, and basically the core part here is that boot policy manifest It enforces the boot policy, which is partially the ACM You can configure multiple protection and platform features in that I think we also in the demo later on we can go a little bit through that like what kind of options do you have there? As we already said it defines IVBs and also the expected hash values for these IVBs And a signature protected right and that that hash of that public key Where the private key actually signed that BPM that hash is in the KAM, right? And that is how we extend the chain because KAM is already verified by ACM So, you know, that is vetted and in T. You're basically and in that KAM, there are hashes of the public key of the BPM and with that Public key you can actually verify the signature of the BPM, right? So that is how you how you extend your chain there also through the BPM And again, it's binary data format. No weeks in my chains I think I think that's for nearly all the structures which are in firmware. Yeah Yeah, and the last last part is the by-sync. I firmware code We are which you need you can find a great source how we did it implemented because it's open So we implemented it as part of the corporate project for customers No, and you can find it is basically to report CBNT errors and statuses But it's also there for the initializing the dynamic route of trust for measurements because it's an additional ACM for the operating systems hypervisor, so You need to load an additional ACM which is signed by Intel at runtime inside the operating system or before the operating system inside the bootloader and So where you can build out can build up your your dynamic route of trust for measurement, right? Yeah, you have exactly two ACMs for CBNT, right? So the first one's a startup ACM which Gets loaded before all the other firmware codes gets loaded right and it verifies exactly what you said, right? Against the ME fuses it very afraid where fights the KM and these kind of things and you have the acid and ACM Which is there for the DRTM later on which you are now loading in team for example. Yeah, that's correct All right So we sketched a little bit the inter CVT boot flow here As Yeah Basically, it's the same as a little bit or it's it's similar to what what we do with the KM So the ACM first verifies or first loads and then verifies the BPM So it does check if the if the hash of the of the public key Of the BPM is actually in the KM and if it's the same If that is correct and verified it Parses the BPM then it looks for these IBB sections Which are defined in that BPM because it knows the BPM is valid and can be trusted It looks for these IBB sections and calculate Calculates of hash value of these sections in firmware, right? So the final hash it's just one hash. So it's basically has to get yeah, right the final hash of these all these sections And then it compares what it's calculated on it on its own on the actual firmware with what should it be? Which is defined in the BPM, right? And if these hash values are equal it knows all right Everything's fine My my IBB is still what I expected to be basically and then it hands off to reset vector and off you go Yeah, if it's not if it's not valid or can't be verified it with directly as we say shut down or shut down After a specific amount of time. Yeah, and that's it or do nothing if you put in do nothing Okay, so we come to the more interesting topic. I would say we explained law of information regarding inter security technologies So we have something called converge security suite. That's Something we developed Sometime ago, so two years ago. We started with it basically So we until then we were running graphical tools into tools. Yeah, basically Underline it's not only until it's also MD and other companies. So and it was really a horrible user experience The problem is also how do you automate that if that's a graphical user interface How do you do automation with some kind of automatic signing processes or whatever? It's just it's just 2022 So and there was also no testing available for the operating system So you could test Insights a ufi shell with your family, but you always had to restart you have to execute it inside the shell and somehow load it I mean, it's possible, but it's really horrible Interfacing it's complicated and it's it's not really why don't you do that in the operating system works still fine So you probably you have to to set some specific options for the kernel or create an ISO image Which can do that, but why do we need a ufi shop for that? Yeah, and it's it also means it only supports you if I right if you have anything else like like So female like cobalt of these kind of things you out of the game because yeah, all you have to know tianocore then all those tools Even though the graphical tools for for creating those manifest like BPM on KM. We're completely ufi centric So this is like not really cool. So Short story we started on our own Yeah, so basically the converged security suite you can find it on github It's open source tooling for platform security features at the moment. We support internet AMD Platform security features AMD is currently let's say work in progress, but they're already started with it Yeah, it's fear Magnostic. We don't care about fear mess So just give us an image and so all those technology headers and whatever is completely Agnostic from from from the firmware which is used even if it's cobalt df is limbo load or whatever So it's not a problem for our suite It can be used for provisioning which is more important for the odm's or ibv's like us Which means female images provisioning creating those manifest and so on a testing for runtime testing Which is really nice if you can for example do tx intertix t runtime verification So if the tx implementations correct and but also binary testing research and security audits are also really important Yeah, so this is where it's basically used. I mean we started from the testing part, right? So that's that's where we came from, right? Yeah, so we had to check if all the txc features Actually there and available and from there it just evolved because then we notice okay We actually it's not how it should be and now we want to provision our own platform And there's also no tooling right and the fun part now is We can do everything with ufi because like we include ufi However, it doesn't work the other way around right like the open source firmware image images do not work in Windows 2 It works like that. Thanks. Yeah, that's correct Funny part is we have vsd 3 license. So that's quite good We are hosted on github written in pure golem Which is really great because we don't have C dependency or whatever you can in theory We can run the tool we wrote or some tools you can run on windows as well So we didn't do that until now But probably someone want to go for it because for us linux was more important We use the file system parser called fiano, which is really nice because it should implement all firmware file systems Which are basically not really well known. So check it out, please. It's really nice. I added some reference later on We also so at the moment we have support for cbt provisioning for txt provisioning for txt testing at runtime And we have a pcr0 diagnostics tool So the most people don't know but the tpm pcr0 is basically calculated from specific type of Of code and money system whatever From those binary images. So it's really and from runtime information. So it's really complicated to do that That's why we have those tools and that's plenty and yeah, that's right I mean, that's especially nice if you if you want to check pcr0, right? I mean, that's like the most important one basically If you want to see okay, what does the acm measures here and if you want to do some precalculation all these kind of things pcr0 is actually the the prejudices that you're looking for and Yeah, it's it's important that you know what's going on there, basically I think we also have boot guard provisioning on the way at least Okay That is that is I used it already. Yeah, say like that It's not production. It's not production in the end and not all NDAs are cleared, but it's on the way. That's good. Yeah Yeah, aside from that, how did we make it public even with NDA? So first of all, there are tons of official public code Documentation from Intel so you can find it. It's hard to find but you can find it and they already Made a lot of code public So we only had some parts which we're hard to figure out which we use trying error methods to Get some information out of this by key generation signal generation hash calculation and female platform conversions basically boot code built and brick and Do that for a long time. So it's really it's exhausting. It takes a lot of resources. It's painful But we did it so and what we all did for for structures with which can't be public We will be renames them all to reserve Standard Ray and Intel data sheets, but it's under one person. I would say also of our code base, which is fine Yeah, I guess it only has problem this into PFR, which is not really public yet Yeah, so but yeah, this is kind of cool. Yeah, I think we we did a pretty good job there on finding all these Public coding documentation right on on different I think we used eight or ten different repos and there was some some structures here and some structures there and actually Sometimes I know field A and B were Publicly available, but on the other repo food if you'd am B were reserved, right? So they're not publicly known, but you got food see it. So we mixed it all together and basically Got like the biggest common nanner of all these things out there And yeah, so that way we could actually make it public because it was already public But we had to gather the information and that that Was actually quite quite a lot of work That's that's true But the good thing is interest going into more open direction for for for fear of security or hardware security technologies I think this will change Later and it would be good if we can show them that we have a cool convert security suite Which is public and can be everywhere integrated Yeah, and also to mention, I mean we work with Intel engineers together on these kinds of things for sure. Um, so that is That is also we have a good working relationship with them and yeah, they helped us out here and there. So that's that's cool stuff Yeah, so what's the roadmap for the future? So we want to have basically more AMD tooling So AMD has similar stuff Which needs to be passed for example AMD PSP provisioning AMD five system support all that strange things We have Intel PFR. It just not yet is there yet We want we want also to implement a CBNT test suite. I think this is not done yet, but we'll probably Happen later or sooner depending on how much pressure we get from the customer side as well But we also have already some other companies working on on our culture. So it's not like we are alone Yeah, um, yeah, we want to do Linux distro packages integration probably someone wants to do windows as well I'm open for it And we will move all five system related packages to fiano So please check it out. Which is a nice goal and library for fmv passing I think we already moved a lot of stuff over right, but it's not complete yet. Yeah, not completed So and next we have a short as no demonstration. I guess we're running out of time, but Um, however, we still like to show you And and how you can use it right So I already cloned the repo In into our into our go source folder What do you have fears like our normal structure of the directory and in the command folder? You can find a couple of tools, right? So we got the CBNT provisioning tool We got the PCI-02 we got the txt provisioning tool in the txt test suite All right, we could probably start with the CBNT provisioning tool You just type go build and it bits it And you got the CBNT provisioning tool here, which you can run on the command line It gives you a couple of options that you can use Yeah, I have let me check it out I have I Have some demo folder made up Which I have to jump over They got the CBNT provisioning tooling that I just Did I just build and we got two images? We got a ufi image and we got the corporate image, right? So it doesn't matter which one to show. So we just go for let's say the ufi image And what it gives you so let's let's move from the top here You know it's so as you see it's a lot of information So first of all it prints you like the whole fit table that you have Which is which is that one here? It gives you like what type of entry do you have we got the header entry first of all We got I know microwave updates. We got a couple of skip entry entries We got the startup ACM, right? We got a couple of other ACMs here And we got a couple of legacy policy records even though it's it's it's for a CBNT platform OEMs and tend to include everything they have basically Just to be feature complete. However The we always We always do these sections here With the with the with the four dashes and there comes a boot policy manifest Within the boot policy manifest you have a couple of structures, right? First of all, you have the header we have like signature and revision and these kind of things in there and then we have the most Interest into interesting part is actually segment elements part. So that is where your IBB's Defined later on right here is also the the ash value that you can expect later on that gets measured into Or should have get measured into the TPR And you can also find a defined a couple of IBB segments as shown here Which which the ACM then should measure right and these are exactly the parts that we talked about Which the ACM looks into the BPM and gets these IBB segments and measures all these parts from the firmware into into the TPM for example or at least measure hash them all together and compares the calculated hash values of these IBB segments with the with the hash values here on top and If they're equal everything's fine and they move on, right? Yeah, you also have tons of other options I guess that would be too much for now because we are already running out of time So and you could also show your provision it But it's all also documented in the github repository so you can figure out everything yourself The txt is free tooling you can also execute on your own laptop and figure out if your txt are compliant It's very strict. So it's probably showing errors even if you have a ufi which supports into txt, which is really nice No, yeah, but aside from that. That's how it works. You can see the KMS BPM and to fit table So and also it's signature and so on. Yeah, so I think this is also quite helpful I think so too. So that is the KM part here also, you have like general information here on top and then that is exactly the The hash of the of the public key part of the signing key of the BPM, right? And that is exactly in here So that is how how you extend the chain and it also If you print something like I think it's game show Yeah, this is a data section of the KM right, okay And it's a ufi image right so it's a little bit yeah, so vendor section which additional I don't know data or whatever which yeah, so you can also only part only show like the KM part and BPM part You can also extract it if you want to You can all do stitch like new BPMs in there you can sign and BPM you can create Or generate and and BPM five based on the Jason configuration and these kind of things right so you can use that Who we have the tool for it just checking out what's in the firmware But also extracting everything from the firmware provisioning everything changing stitching all these kind of things that you probably need All right, and the other thing that we can show is the probably the test suite right the txt one We don't have a txt system So So it will give us a lot of errors. However, just that you that you see How you can how you can do it I Got to execute tests right yeah, and there you get we have like 75 tests implemented right now And a lot of these fail on this machine obviously because we don't have we don't have a TPM for example Yeah, but that is on an all the system you would you could check okay All these rules are actually in place and are we compliant to the to the txt spec, right? Okay That's so can you switch as a project again that would be helpful. Okay. Thank you So I've only last two slides. I need to speed up Call to action. Yes Jonas. It's open source here mess like a slack dot osf W dot death with the convert security channel Please also get in contact with us to get up. So if you've code ideas or bugs just Publish let's say make a pull request or whatever be open for everything and spread the word Especially for all the elements like quanta or this trend and also for the female security pentas that which also might Be interested in that. Yeah, that might be it. Yeah Does it work? No, not really but I think it broke. Okay, so Looks like the keyboard went out That's perfect. It's not even live right? Yeah I just attached to public resources at the end just figures it out and yeah Thanks for listening and joining us for the talk. Yeah. Thanks everyone Yeah, have fun with the remaining talks on the open source summit and Yeah Getting contact with us if you want to know more about the conversion to sweet or any Intersecurity related things problems whatsoever. I think we can help you out You


Okay. So the question was, or let's do a little lecture, I guess, on this type of a problem. When you see something like this, and they're asking for redox stuff, okay? So we want to think about the different types of reactions, and when you see a reaction like this, you should be able to tell it's a redox reaction because when you have these two different metals reacting together, oftentimes if there are different oxidation states, what you'll have in the product is a redox reaction where the different atoms have kind of switched oxidation states. One has raised its oxidation state and one has lowered its oxidation state, okay? So the first thing, this reaction is kind of giving you some clues as to how to finish it, okay? Or at least the starting materials of the reaction. So first thing you want to do is look at the starting materials, put your arrow there because you have to finish your reaction, okay? So when it says two and just a plus one, it's kind of giving you a clue as to what the oxidation state of zinc is supposed to be, okay? So zinc and silver are both transition metals, so they don't have regular oxidation states, or at least unless you memorize their oxidation states you wouldn't know them, okay? But the clue that this is kind of giving you is to tell you that zinc is in a two plus oxidation state. The one thing you want to do is remember that when it doesn't have a plus or a minus, remember that is at oxidation state of zero, okay? So plus means plus one, okay? So there's two plus ones, so this is at an oxidation state of zero, so when they switch it's going to be going to zinc plus two, okay? Does that make sense? Yeah. So let's just write that down, okay? And in chemistry lingo, we don't say plus two, we say two plus, okay? And the other thing that's happening here is that silver is going to an oxidation state of zero, okay? So they're kind of, like I said, switching oxidation states, okay? But we still have two silver atoms, okay? We can't create or destroy matter, so we've got to put that two over there, okay? So if you start with two, you're going to end with two, okay? But it's at silver zero, okay? So whenever you see something in a chemical equation that doesn't have a charge on it, it's always at oxidation state zero. So we usually don't even show this unless we're doing, like, redox reactions or electrochemistry or something like that, okay? So that's the finished equation there, okay? So now let's talk about, what did it ask? What is the oxidizing agent, right? Yeah. So is it an oxidizing agent? Okay. Which one is an oxidizing agent? Well, we'll figure out which one's the oxidizing agent in all of that business, okay? So in a redox reaction, the way I always remember it, especially when we're doing GenCAM stuff in organic, it's a little different, okay? So the rules for GenCAM are very good to remember, but when you're doing it organic, you can do a little shortcut is what I'm saying. So when we're talking about GenCAM, and the reason I'm saying that to anybody who's watching this is because I have two students here. One's a GenCAM student and one's an organic student, okay? But when we're doing GenCAM stuff, we want to remember the acronym, Leo the lion says GER, okay? So Leo and GER. You think you can remember that? Leo the lion says GER. Yeah, okay. So what does this mean? It means lose electrons. That's oxidation. Yeah, you remember this from GenCAM, right? So lose electrons. I use oil rig. Yeah, oil rig is another one, right? It's oxidation. And gain electrons is reduction, okay? So in Texas, I think, since I've been here, people use oil rig much more. I think it's kind of culturally more significant than Leo the lion says GER. Anyways, so when we look at these things, we're going to remember, so remember, electrons are negatively charged, right? So when we're losing electrons, what's happening here? So zinc is going from zero to plus two, right? So do you see that thing get lost electrons, right? Yeah. Silver gained electrons because remember, the electrons are negative one. So pretend we only have one silver. If I added a negative one to that, I'd give silver zero, right? Does that make sense, okay? So what happened here, it gained electrons, right? So this thing from here to here, it got reduced. Does that make sense? Yeah. And another way to think about it is that this number here gets lower or reduced, okay? That's the way it's, that's like why the nomenclature is there, right? Positive one going to zero, that's reducing that number. Does that make sense? Okay, so if that got reduced, remember this is a redox reaction, okay? The other thing got oxidized, right? So zinc went from zero to plus two, right? It lost electrons, so it got oxidized. Does that make sense? Yes. Okay, so now we've got to think of which is the oxidizing agent and which is the reducing agent, okay? So when we think about zinc got oxidized, right? So the other thing has to be the oxidizing agent because it got, because zinc got oxidized. So this thing is oxidizing zinc. Does that make sense? Yes. Okay, so this silver plus is the oxidizing agent, okay? It's really easy to get these kind of things backwards. So you've got to kind of, what do you say, use this kind of train of logic. If you do it this way, you'll never get them wrong, okay? And then of course, the other one's going to be the reducing agent, right? So if we look, right, silver got reduced. So something else must have reduced it, right? The only other thing in there is zinc. Does that clear up your... Yeah, I mean one of the, because the part two of the question was what are the electrons, whatever, like the numbers in the bottom? I don't know if that's the question I'm asking, but... So it's probably what, you know, what we did first is like figure out what the oxidation states of these two atoms. Oh, okay. Yeah, I'm sure that's what it was. Yeah, so, or it could have asked what's the change in oxidation number, okay? So let's do that question. What's the change in oxidation number from the reactants in zinc to the products of zinc, okay? So we're going from zero to plus two, right? Okay. So that change is a plus two change, right? If we're going from plus one to zero, that's a negative one change. Okay. Does that make sense? So change in oxidation of zinc is going from a zero to a plus two. So it's a plus two change, right? And change, remember delta is change, okay? Oxidation of silver is going from a plus one to a zero, so it's a negative one change. Okay. Okay. Does that make sense? Yes. Okay, any other questions about it? No. Okay, cool.  Sure.


Hey guys, it's Nate, aka The Foot Account, and welcome back to the channel. EA turned up the content yesterday with crazy SPCs, one of which it seems like everybody is doing because SPC fodder is going up, and prices that link to that card of other players are going up as well. But it's definitely not the cheapest content. With everyone doing these SPCs, fodder is going crazy, guys, and there's more SPCs coming. Will it ever come down so we can buy more? Because of the SPCs that are coming, we'll talk about that in today's video, and look forward to today's content on Saturday. If you're excited for it, drop a thumbs up, subscribe if you're new. Let's start with the objective content. Start from the bottom and work our way up. Objective, Kallin Wilson. We talked about it in yesterday's video. Would maybe have some market impact, and I think it actually has. It's not a bad card. It's also not an amazing card. The best part about it is, it's pretty easy to do. I think seven games? Is that all that it is? Yes, win seven matches with three Premier League players minimum, and you're starting 11. I've played a couple games with Champs and already got working on this card. It is three star, three star, which is not the best, but he does have the finesse, power header, and first touch play styles. Not play style plus, but just play styles. So not a bad free card. Other Premier League strikers like Aldi Watkins, that we mentioned in yesterday's video, are actually dropping on the market, and I think it's largely due to that card yesterday. Now, before we go into the SPCs, which were the biggest part of yesterday's content, let's take a look at the players that are in packs, right? The insane team, Jude, Salah, Griezmann, Hansen, an insane set of players in packs. I mean, guys, we've got four cards that are right around that one million-coin mark, or above with Griezmann, also 700k, and Kunde at 500,000 coins. It is a nice team of players. It feels like if you pack one of these, you're hitting something that's worth some coins, and that's nice, right? Because especially as the market keeps crashing, and these gold cards keep just dying in value, it doesn't seem like packing something cool gets you a lot of coins, but when a promo drops like this, and the prices are pretty inflated or pretty high for a lot of the cards, that does kind of feel nice. Now, I will say the pack weight for a lot of these is pretty low, except for the guys on the bottom line here, Acosta, Herrera, Garasi, and Wagner, and Caroline as well. These cards are pretty easy to pack, and I think they actually bring up. If you take a look at the store, I think they bring up the pack odds a decent amount, but it is a really, really nice team that is in packs, and a lot of people are opening packs. Yesterday, of course, a ton of people were ripping the store packs, saved up packs as well, and we had the first ever 100k packs of FC24, 4.1% chance of a Trailblazers player in this pack. I'm going to open this Prime Gold Players pack from Objectives really quick. I opened all my packs yesterday. I didn't get anything super good, as we're again here just getting an 83-read card, and it seemed like the pack weight yesterday was just okay. It wasn't that amazing, which is a little bit disappointing, but also, it's kind of what we expected, right? And also, the way that we were expecting the market to move was based off of that pack weight as well, and it kind of did end up happening. So, nothing huge packed for me yesterday, but it was more about getting fodder for SBCs, and we'll talk more about fodder in just a second, but let's talk about those SBCs that absolutely took the content yesterday from good to kind of crazy. Guys, we had the best SBC of the entire year dropped yesterday, and it just fell out right here. Rod Rigo. Guys, this SBC is taking over this game right now, not just because it's a really solid upgrade, and it got a playstyle. Plus, I think it's just we have fodder. A lot of people opened those packs from preseason rewards, two weekend leagues in now, and just packs saved up from rivals and stuff like that. People now have enough fodder to accumulate to be able to finish an SBC of this price. Coming in right now at kind of a price that's really inflated, guys, 420,000 coins for Rod Rigo. When he was first dropped yesterday, he was only 350K. Fodder has gone up so much even after the content drop that this SBC has gotten a lot more expensive, but it's not that bad to do because it's only four squads, 84, 86, 87, and an 88. At the very least, I think this is an SBC you could chip away at over time because it's only four squads. And guys, I think a lot of people look at the first touch playstyle plus and they're like, is that really a good playstyle to have? When I've watched some of the play reviews and some people actually use this card already, I think it's one of those playstyles that's gonna fly under the radar that when you actually feel how he plays in game, you're gonna really notice that difference, right? Read the description. Has a minimal error when trapping the ball and is able to transition to dribbling much faster with greater control and that fits his dribbling stats perfectly and his pace stats as well, along with the explosive accelerate type. I can imagine this card is very, very good in game and his dribbling is gonna be absolutely insane. Some people don't like his shooting. 80 shot power seems maybe a little bit low. Of course, strength and aggression pretty low as well. But guys, that, especially being able to play striker and on the right side and left wing as well. An absolutely insane, insane SBC that a lot of people were able to do yesterday. But again, it's not super cheap, but 350, 400,000 coins is definitely craftable over a couple weeks of rewards. Maybe a couple of upgrade packs here or there and objective packs that are still to be given out. And of course, guys, with all the hype of that SBC being released, we have Madrid links that are absolutely flying. The most popular of which definitely is the Modric Road to the Knockouts. Guys, this card, Modric RTTK was 220,000 coins and I believe right now he's approaching 260, even with all the supply that this card had. So crazy of a pack weight for Modric's this last week. His card price is absolutely flying. Jude Bellingham's team of the weak card is flying up in price as well. He was basically 300,000 coins yesterday before the content drop. He is now 350K. I also flipped a Valverde who went up a crazy amount after content because of all the Madrid links. Even gold cards like Rutiger and Edermilitau are exploding in price as a lot of the market is exploding in price after yesterday's pack spam because of those links to that SBC. So we'll talk more about the market and how prices are moving in just a minute. But two other major SBCs yesterday, the Rafele Al Play of the Month and Hyunmin Sun. Guys, I'm definitely gonna be locked into the Hyunmin Sun. What a card. Of course, being a Spurs fan, I have to get that one done. I like the upgrades that EA gave these. They're not massive upgrades, but they're good enough. And guys, I'm gonna say it this way. Hyunmin Sun looks expensive for being, what is he now? As fodder has gone up, 813,000 coins. This was like 700K at the content drop yesterday. Fodder is just absolutely flying. If this card was on the market, I mean, I would believe that he would probably be around 700 to 800K. So I think this is a fairly valued SBC. And I like the five star weak foot. I like the four star skills, all the positions that he can play. I don't think it's a terrible value SBC. It is just, I mean, 700, 800K. It is expensive. And I like that it's only six squads, but it does require a lot of high ratings and that's where the market is moving the most. Now for my, in my opinion as well, Rafael Leal, I think he's overpriced. Again, it is an expensive SBC once again for the upgrade that he got. I mean, he's 512K compared to his gold card. You know, Sun already has two upgrades over his gold layout. This is just his first. I personally think is overpriced. I think if this card was on the market, it would maybe not be 512K. That's just my opinion. So I think Leal is a little overpriced and Sun is a bit of decent value compared to him, but it kind of comes down to just what you prefer. If you prefer one or the other, then go for it, get it done. You got time to craft either of these. They're both out for 30 days and that is very nice. Now really quickly, I got to point it out as well. Two other SBCs yesterday that we're gonna talk about. The team of the week upgrade, which was very nice. I had duplicates 83, 84 rated. All that you needed was 185 and the rest of an 83 rated squad to complete the team of the upgrade two different times you could complete it. Is it two times per day that we can do this thing? It is. You can see right now it's gonna refresh in 12 hours, which will be the content drop time, two times per day. That's also gonna keep team of the week prices in check for at least the next week or so in this game. EA is giving us the opportunity to open this, which is actually really dope. I like that. And it's also a place where we can put 82, 83, 84 rated fodder because I have loads of that. I'm sure a lot of you guys do as well so we can go in there. And the trailblazers challenge one. Guys, we've been asking for challenge SBCs like this for tradable packs. They finally dropped one. It's not a massive pack, but watch out for more of these. Not only because it's trailblazers challenge one and you expect more to come out, but with SBC fodder prices flying as much as they have, EA has to control the fodder market somehow. And I think those are gonna be, those SBCs are gonna be part of the way that they try to do it. Now, let's talk about the market because fodder is probably the number one place on the markets being talked about right now. These prices have just absolutely exploded then. And it's not even just before content yesterday. Yes, before content, 89s were 24,000 coins. They went up with the Hyunmin Sun and Rockville Laos SBCs. They went back down, headed into content as people were worried about supply. But then we had an absolutely crazy Rodrigo and all the SBCs that were still out before that, the Sun and the Laos. Really, I think it's Sun and Rodrigo that are causing this. But look at Casimiro from 25K all the way now up to 35,000 coins. Guys, these cards are exploding. And part of the reason that they keep going up as well is, number one, people don't have these cards in their clubs. They're not packing 89s and 90s that often. They have to go and buy them to complete the SBCs. And number two, we have the promise of more great SBCs to come. Guys, we have leaks of a Laurent Blanc icon SBC. We still have a Declan Rice SBC upcoming. The Hero SBC pack for a Hero 87 max rated. That's still out there, right? That is why fodder keeps rising because I think a lot of people aren't selling it as investors right now. They're still holding because it has so much promise to actually continue to go up because there's just a lot more demand on the horizon than supply. So fodder is going up like crazy on the high tier. On the lower tier, 84 is still discard. 85s were just under 4K a minute ago. They're right around the 4,000 coin range, which really, if you take a look at their graphs, they didn't even move that much. It was that higher tier fodder because that's what everybody needs, right? When you're doing those high rated 87, 88 rated squads, you need to buy those types of players to get it done. I mean, personally working on the Hyunmin Sun SBC, I'm short a couple of basically 88, 89 rated cards of getting this SBC done. That's the type of fodder that I need to be able to finish this. And I'm gonna have to spend some coins to go out and do that. But honestly, it just looks like it's gonna keep going up. Now we'll talk a little bit more in a second of how maybe EA could drop fodder prices over the weekend and into the week if they wanted to or if they just wanna keep draining coins off of the market. But guys, speaking of the market and prices, the market has life. The market has, like it seems healthy, man. You know, last week we were talking about how prices just dropped and dropped and dropped. Well, yesterday it actually went down. Like we said, it was going to. We had a lot of supply right around the content drop. The best time to buy some players for your team was in that first 30 minutes to an hour after the content drop. If we take a look at Erling Holland as an example, he's 240,000 coins right now. During that content hour, he went, well he started out at about 280. Was panic sold until content. He went down in that first hour of content down to 220. And then there was a massive rise back on the market even with all of the SBCs, like Rodrigo's son and Leao taking coins off the market as people were buying fodder cards to turn into those SBCs. You had so many coins from Week in Leagues, from packs that were opened yesterday, right? Whenever there's a promo where there's a lot of saved packs, which is exactly what happened yesterday, whether it's rivals rewards, people still take tradable, marquee matchups, maybe even some like footchamps rewards from like last week that might been not too many people saving packs for that long. But you know, 100K packs in the store. So many coins are put into people's accounts from opening those packs, selling players the quick sell value of those players as well. And you often see big rebounds after that. That is what we talked about in yesterday's video. And that is the exact thing that happened. Hollerman from 227 up to 259. Another card that I watched yesterday with all of the hype and the movement on the market as well was Rashford. Rashford went from 190 down to 158 back up to 180,000 coins, which is a little bit lower than he is right now. He's 173, but that was how the market moved yesterday on a lot of your gold meta cards. So if you bought during that dip, that was a great time. And even if you're waking up today and you're like, Nate, you see that Rashford, he was down just a little bit from where he was or Hollen was 240 and he was 260. Guys, I think that some of these prices have gotten just a little bit lower into the early Saturday hours. And I think they will rise into the day today. The market seems very healthy. People have coins, they are buying cards for teams, playing the Week in League, playing foot jams. And it's actually a great place to be on the market right now and to be trading. That's why I'm actually broke at the moment. Road to the Knockouts went up very well as well. I picked up two Lewandowski's with the loud league hype of everybody wanting to use the brand new Rodrigo. I was like, you know what? This is a card that might do pretty well. And a lot of your Road to the Knockouts are doing well. Of course, Modric with the insane rise. You've got Dembele that's rising now. Joel Pedro, I picked up one of him at 240. He's now 267. So you're starting to see a lot of these Road to the Knockouts continue to go up in price as well. Klaus finally got a price range update. Guys, I think this is a card you want to buy one of. Stick it in your club. 17K is the perfect price, but he's quickly rising as a lot of people are investing in this. So if you can get one around 17K, I think that's a good value investment. I picked up a couple of those. You can see them here on my transfer list. I was able to snipe them for like 16K, 16K flat yesterday during the content. But that's a card, same thing with the OWRs and the Gootses that I plan to sit on my transfer list for honestly a couple of weeks and hopefully they can continue to rise. You know, maybe a Bundesliga card comes out that Gootsa links to, he gets his upgrades, and then boom, he goes to like 30K or something and then coins just doubled in two or three weeks. That's the hope for a card like this related to the market. Now, for the rest of the market yesterday, for some of these like the Trailblazers cards, I know a lot of you guys probably want to try some of them out with the play styles that were added to them. These guys were fluctuating like crazy. I picked up a Coondae at 500,000 coins, sold it at 570. I would expect to see a few of these cards rise up into the day today on Saturday, as we normally do see on Saturdays. But also what I would expect to see for them is a drop between like maybe three, four hours before content and then right leading up into the content drop. This happens almost every single Saturday. We talk about it a lot. Is the new promo cards rise up as people wake up to play champs and then they get panic sold into content most weeks as people are afraid of new store packs and new supply coming. Weekendly rewards are gonna be opened up all day today too, supplying these cards a little bit. I literally just watched one of my buddies pack Hanson from Player Picks and Rewards. Like it's tough to pack these cards. So that's an insane pull. But there's gonna be people that will hit them today tradable and untradable from rewards and I do think that it will drop their prices down. But I think you first might see a bit of a rise. Griezmann was 700K. He's already starting to go up. DeLaRenzo, Ruben Diaz actually, I know 65 pace does not look good for Ruben Diaz but he's got the anticipate plus play style. I can't imagine that he's just that bad in game. I almost wouldn't be mad to try out that card just to see how he feels compared to somebody like Voron with a lot less pace but insane defensive stats. So might suit your team there. But again, one gem I'm pointing on as well from this team is Mikotarian. I think Mikotarian for the value is a nuts freaking card. He's got the same play style plus now that KDB has the incisive pass. He still has finesse shot flair and Trivella and 75,000 coins for a plus two. I mean, plus six defending plus three passing and then one everywhere else over his informed card. But that, I don't know, I just think that's gonna be like a 50K card by the end of the weekend and that's gonna be a really, really good value for Syriot center attacking mid or center mid and maybe even CDM if you wanna test out that 67 defense. So I think that's one of the best budget cards from the promo. Now let's look ahead a little bit into today on Saturday because we talked about the market a little bit in relation today but let's talk about the content and SBCs we could expect. We already headlined some big SBCs that could be coming in terms of the players like Blanc. I really don't think Blanc is today guys. I'd be surprised. Last week on Sunday is when we got the Beckham. So maybe they do Blanc today and then maybe like the hero pack comes tomorrow on Sunday or maybe it's flipped and vice versa but I would expect to see Blanc here pretty soon and that could really hurt some other center back prices on the market. Depending on how much this Blanc is priced because Blanc, he's always one of those icons that is really good. And a lot of people would look forward to this SBC saying I could go ahead and get myself a play style plus with anticipate on Blanc. He's got jockey, bruiser and aerial as well. He's got all the great defensive play styles. 78 pace, 90 defense and 85 physical. He's only a 400,000 coin card. So if you think about the price of the SBC it should be around 400K as well but I have bad news since fodder is so expensive EA definitely prices these SBCs like multiple days before they drop them. We've seen this in previous installments of FIFA. I would not be surprised if the Blanc SBC is more than his card is actually on the market right now. And I don't think his card is really down that much after the leak. He got leaked and went from like 430 down to 420K and 407 where he is now. If he gets panic sold today and you see the SBC come out and it's very expensive or at least like more than 50 to 60K above what the card price is on the market his card price might rebound a little bit but that could be an SBC that comes out soon. Just watch out for that kind of fluctuation there and his price. I really think the best chance for a player SBC today would be Declan Rice. Player SBCs are like so common on Saturdays. Like every brand new promo we get a player SBC on Friday on Saturday and Sunday most times. I think he could be coming today. So watch out for like even my team like this technically would fit into my team as I've got some prem links in my squad. Hopefully he's got a decent pace boost. I don't know how much they're gonna juice up his pace maybe his defense but this one would hopefully be an SBC that would be a little bit more affordable as well. Declan Rice has got 71 pace. So you know, 77 pace would be super nice and he'd probably be like 87, 88 rated. Two star three star is not the best but he could be a nice prem defensive midfielder if they boost up the card in the right positions. And again, it could be an actual a cheaper SBC that maybe makes some of your lower tier fodder move. Isn't there an opportunity through this weekend to invest in the fodder parts of the market that have not moved yet? And to answer that question, I think I would say yes. Especially as I look at 86s, they were down at 7.5K yesterday during the content. That was probably their lowest point. If you can get 86s under 8,000 coins or right around 8K that's probably the fodder investment that I would be looking into right now. Maybe 85s under 4,000 coins as well. If you're gonna buy anything we still have a lot of SBCs that drop coming and especially I'm thinking about that hero pack. I feel like that one might be one where maybe EA does an 85 rated squad for the hero pack but they require like an 87 on top of it. So 87s could still go higher as well. You see the gap here between 87s and 88s. 7,000, 8,000 coins between those two. I think they could go up higher if the 88s start going up higher as well. So watch for 85, 86s and 87s if you wanna make a speculative fodder play. This is usually the time of the week where fodder is pretty low but it's just not on the higher tier right now because of all the SBCs that we have. So that's kind of a little bit of a risky play because fodder is already up but with so many SBCs of coming it doesn't look like a bad investment in my opinion especially for somebody like me. I need some 86s to get the Hyunmin Sun SBC working so I'm gonna look into that. Now also for today's Saturday content watch out for more of these tradable packs. Now it's not gonna impact a fodder market that much. Maybe it will take a slight hit if we don't have that much good content and they drop a pack here in the store but a gold players pack it would have to be like a pack maybe like a 25K pack or better. This is not a 25K, I think it's a 12.5K pack is what this is but if they drop a 25K pack or better that could make fodder prices dip just a little bit and now honestly create an opportunity to get in and to buy a few of those cards before they would go up further but guys the game right now just feels rejuvenated a little bit and I think it's really because of this Rodrigo. I know it's expensive and some of you guys may be like Nate I can't get that done right now but I think EA have given us enough time two weeks to get it done via crafting through all the reward sets and I'm excited to see how we go throughout the rest of this weekend. We'll have a mini release coming, should be tomorrow and yeah EA this content started out nice yesterday. The players and packs make us wanna open packs and grind for the rewards through a week and lead because if you hit somebody big it feels like you're getting somebody good and then the SBC content again great players, big name players in here as well with good upgrades and the playstyle pluses are really dope. Last thing, oh I forgot to point this out. Guys, watch out for evolutions on the EA website. They mentioned that a number of evolution slots will be released during the two week campaign allowing you to celebrate players who have stood out for your club in ultimate team. Like we mentioned this promo is all about players who have been performing well in real life and some of the playstyle pluses actually relate to how they've been playing well. It's kind of a cool read up here on EA's website but this almost makes it sound like prior EVO cards that we've already been like evolved in our ultimate teams will have a potential to be further evolved, right? Celebrate players who have stood out for your club since the kickoff of FC24. So that brings some hyped in my mind to evolutions again this week because they said that multiple different iterations a number of evolution slots will be unlocked. So I haven't started on Pacey Winger or the Bruiser Wingback at all and they expire in 11 days but it sounds like we have to be watching the evolution section of content or some more new stuff upcoming as well. But that's gonna be the video for today guys. If you did enjoy it, drop a thumbs up on it. Comment down below if you have any questions and of course subscribe if you're new. I will see you guys in a video tomorrow. It's been Nathan with Accountant Peace.


All of his soldiers were ready for battle. On our command sergeant, Mary Mortensen, will now case the 166 Armored Covers as Lieutenant Colonel Wellett in command sergeant, Mary Mortensen. On our case, the 166 Armored Covers. As Lieutenant Colonel Wellett in command sergeant, Mary Mortensen. Arrival at a really crucial time. I have to say thank you for attending the color-casing. I have to say an efficient ceremony today for the iron eyes that goes with Italian. We've been afforded the ability to dock the rigorous training site in Wellett. And recently transitioned here to live the weekend. It's our engine, X. It goes well just as soon as you guys are quite sensitive to the force. We're the army and proud of our name. We're the army and proudly proclaim.