So, for the next talk of today, we're going to talk about a new open source, DBI framework, which is called QBDI, DBI means dynamic binary instrumentation, you know, binary also. Instrumentation means to observe, monitor and modify some parts of a program or a library. And we have a speaker, Charles Souben, they are both security researchers, Charles likes attacking white box crypto and Club Mate with RAM. And Cedric instead, he's focused on reverse engineering and he likes whiskey. There you go, the stage is yours. Give them a hand, please. So I think the heroes did a good job at introducing us. So we both work at Quark's lab, which is a French consulting security company. And during our work, we use a lot of DBI and for the past two and a half, we've been together researching DBI frameworks and also working on our own DBI framework. And what we want today is to try to demystify what the DBI framework is, how it works, and try to show you how we went about implementing our own DBI and we hope to inspire you about the usage of DBI framework and maybe even helping us on our own. So I'll start easy and start with an introduction of what is exactly instrumentation. So basically this idea is the transformation of a program into its own measurement tool. So you're making an instrument. And this instrument, what you can do is that it can observe any state of the program any time during the runtime. And then after that, the tool will automate the data collection and the processing of those data. So that's quite abstract. So what could you do with that kind of instrumentation? Well, I'm pretty sure most of you, if you program in C or C++, you've already used Valgrind and maybe the Memcheck tool. And Valgrind is an instrumentation framework and Memcheck is an instrumentation tool. And what it does, it's quite simple. It will track memory allocation and the allocation during the runtime and also track memory accesses. And with that information, it is able to both detect use after free, memory leaks, double free, but also out-of-bond memory access. And then it can tell you, well, you are accessing this array two bytes outside of the boundary that array that you've allocated at that place in the program. So it's quite useful. Another popular use case is fuzzing. So in fuzzing, you're generating random input and sending it to a program and trying to make it crash. But one of the things you want to do is to generate interesting random inputs. So you want to know if between two random inputs, if the new one you're generating are exploring more part of the code, are generating more state transition and things like that. So you want to measure the execution. And one of the main criteria you can measure is the measuring the code coverage. So a DBI framework is a very good thing to measure code coverage. And if you use WinIFL, basically, it's IFL using a DBI framework, which is in Telpin, to gather code coverage information. And if you go deeper, you can even use the information you have about what instruction are executed to try to build a symbolic representation of the program, et cetera, and then you get the DARPA cyber and current challenge that was held one year and a half ago. The last thing you can do is record simply execution traces, which means recording everything that happens in a program. Once you have that, you can replay those execution traces and you get something that looks like a timeless debugger where you can go forward and backward and you can try to track everything that's happening in the program without relaunching it. Also something that I've been working on before was software side-channel attack against cryptography. So you're using the execution trace to generate side-channel information and trying to recover key from obfuscated cryptography. So far, one of the questions you might be asking is, why not use debuggers? Because debuggers can do all of that. The problems that debuggers, although they are awesome, they are meant for human, not for machines. And they are very slow.  So the debugger sends a resume call to the kernel. The kernel decides to reschedule the execution of the target. So you have the whole scheduling of the process that happens. And then the target hit a breakpoint, which is like a trapped interrupt, which jumps back into the kernel. And then the kernel decides to, it says that the interrupt should be catched by the debugger basically. So it's going to send a signal to the debugger and reschedule the execution of the debugger. And while you're doing that for one continue and breakpoint hit, you're doing four boundary crossing between userland and kernel land. And also you're doing two process rescheduling. So it's quite slow. How slow? Maybe you've seen those kind of attacks you can do in CTFs where you have to reverse engineer and binary that checks the password. And what you do is you try to measure the execution time while you're trying different password. And not really the execution time, something more interesting, which is the instruction count, the number of instruction executed. And you can try to brute force a password to character by character this way. And what you see on the top is GDB. And what you see on the bottom is Intel PIN. So on the bottom you see that it actually can check a lot of cases and that you see the number of instruction executed.  So yeah, you don't want to use GDB. You don't want to use a debugger. You want to use a dynamic instrumentation framework. So the solution, well, it's to get rid of the kernel. And how? Well, the only solution, except if you want to really have a bare metal system, is to run the instrumentation inside the target. So instrumentation techniques. So there is a few different ways to do that. The first one is from source code. And I'm pretty sure everybody has done that, is just adding print statement to your code and get information. It's basically instrumentation. But you could be more smarter and try to do that automatically at compile time with the compiler plugin. The other solution is when you work from binary. And when you work from binary, it is basically to approach. The first one is to take your binary and statically patch it and add hooks to additional code you insert into the binary. And the last one is dynamic binary instrumentation. So from source code, it's really boring. There's nothing very complex and interesting to know about that. From static binary patching and hooking, well, it's crude and barbaric. Because you have to know in advance where you want to insert your hook, which is not really possible. And so this talk is about dynamic binary instrumentation. So there's a few existing frameworks. And the first one is Valgrind, as I mentioned, that exists in 2000, is open source. Valgrind only supports UNIX platforms and it's very complex to use, not to use in the command line tool, but to write your instrumentation tool. Another one is Dynamo Rio, which exists in 2002, which is open source. It's cross-platform, cross-architecture. However, it's very hard to use, too, because you basically have to manipulate the instructions in assembly yourself, which is quite error-prone. And the last one is Intel PIN, which is the most popular one, because it's very user-friendly. However, it only supports Intel platforms and it's closed source. So why we made our own? In 2015, what we wanted was to have a cross-platform and cross-architecture DBI framework. And all of those frameworks were developed quite a long time ago. So there was new things you could try to do that. And we wanted to focus on mobile and embedded targets, because that's basically what we're working on in our daily job. Also wanted to try to have something that was simpler and that was modular, meaning we could use it with other reverse engineering tools easily. And also, because of our past in cracking DRM, basically, we wanted to focus on heavy instrumentation, which means instrumenting a lot of things, generating lots of data. So I'm going now to understand the following of the talk. You need to understand how DBI exactly work. So I'm going to try to explain that if I get it correctly. So the simple idea is that dynamic writing instrumentation is about dynamically inserting the instrumentation, so the code you wrote inside the binary during running time. So it looked like this. You would disassemble the code that's going to be executed, then you pass the instructions to your instrumentation tool that analyze them and generate the appropriate instrumentation. And then the instrumentation gets inserted into the execution flow, and it's executed. And then you have backman for scale. However, I mean, this looks simple, but there's a few problems with this graphic. Backman, other problem. The first one is disassembly. You cannot just, you don't know when you get a binary what part of the binary is code, because code is data, data is code, and there's a lot of unpredictable branching and jump everywhere. So you cannot just disassemble the whole binary in advance. So you need to discover what is going to be the code of the binary as you go during the execution. Basically what this means is that you will execute a short piece of code, a block of code, something that a series of instructions you can predict will be executed, and then that ends with a control flow statement, like conditional jump or call that you cannot resolve. And you execute just this piece of code. And then you look where it wants to flow next, what's the next instruction you want to execute. And this way you discover the next block of code you want to execute, and you simply execute the next block of code. So this basically form a short cycle of execution. Now the other problem you have is about the instrumentation, the code that you're generating. Because the instrumentation code you generated is much larger than the original code, because it's the sum of the original code plus the instrumentation you're adding.  So there's not much space left around in the code segment of your binary. So you cannot instrument it in place. You cannot just add it in the binary. There's not enough space. So you need to write it somewhere else. And this introduced the problem of relocating the original code of the binary. So the problem with relocating is that the code contains relative reference to memory addresses. So you might have a jump to the instruction 20 bytes forward, or you might have a memory access that says, oh, now I need to access that piece of data, which is 1037 bytes backwards from my position. And if you remove everything, well, this reference becomes invalid. So this means we need to actually completely write the original code to fix all those references. Then in our engine and what we will present during this talk, this is what we call patching. So if you summarize everything you need to do, this is the cycle of life of a DBI engine. It starts by disassembling the first piece of code it wants to execute. Then it patches to make it relocatable. Then it adds instrumentation to the patched piece of code. It assembles it somewhere in executable memory, somewhere else. And then it can execute it. And once the execution finish, it looks at what's the next piece of code it should execute and start again. So now I let Cedric explain some of the low level abstraction we have to deal with all of that. As Charles said, we have seen the basic principle of the DBI, but I know we want to design our own DBI. So for this, we need some very low level things before building up on them. So Charles said also, basically, a DBI starts from an entry point and do automatic discovery discovery of the code. And this work on what we call a basic block, so it's a series of instructions that are linked together and they are composing what is called a control flow. So at the end of a basic block, you have a terminator instruction, which can be a gem, for example. And let's go to another one. And with this kind of structure, the control flow just go on. I mean, you start a function and it just executes every basic block and you don't have any way to interact with it. So what we want, it's some kind of under control flow. And by this, I mean, we want, after the first block, to take the control back. We want to be able to skip the jump or force it, modify it to jump inside our own code. There we will execute the logic of the engine and we will be able to go to the next basic block and so on. But here, in fact, everything is about keeping control of the execution. And this is much more difficult than we can expect. Because what we want, it's forces, it requires to modify the original instruction of the binary. But we don't want to modify the original behavior of the software. We want to be able to execute it as it was untouched. And this is quite difficult and requires lots of low-level tools. So what do we need, in fact? Very, very simple thing. We need a multi-architecture disassembler and we also need a multi-architecture assembler. And if possible, it should be also cross-platform, please. And we need some kind of intermediate representation to work on. And this representation should be linked, a link between the disassembler and the assembler. So these requirements were quite strong. And also what we don't want, well, basically we don't have unlimited resources. So if possible, we don't want, in fact, to implement a multi-architecture disassembler and assembler. But also, about the intermediate representation, we don't really want to, like, pass every single manual for every CPU of every single architecture we want to support because, yeah, I like developer manual but not that fun. So we don't have 10 years to spend on passing them. But things have changed recently since a few years, there is a new player. This player is called LLVM. What is LLVM? LLVM basically was created to focus on compiler technology, especially just-in-time engine. But basically LLVM is the core foundation, the core framework of a very well-known software today, which is the Clang compiler. I'm sure everybody in this room knows the Clang compiler, but it's more than this.  So in fact, for us, LLVM already has everything. We support lots of architecture, like all the major ones, ARM, X86, X864. It provides both a disassembler and an assembler, but more than this, it also provides this intermediate representation that links, basically, the disassembly and the assembler. Some of you already heard about the LLVM intermediate representation, but here, this is not this one. This is not the intermediate representation which is used for the compiler pass. It's another one, a more low-level one, which is called LLVM matching code, or LLVM-MC. And this low-level representation is this glue between the disassembler and assembler. So what is LLVM-MC? Let's start with a very basic, simple instruction here. For the DBI, in the process of exploring the code, an instruction is just a series of bytes. So basically, what LLVM provides us, we feed it with this list of bytes, and LLVM just provides us this. And this, in fact, is an intermediate representation already. It's a very simple one. You have two tips, there is the MC INST, which is the instruction, and the instruction is composed of a list of operand. But basically, even if it's simple, you have all the interesting information that you need, and it's already something that we can work on. So LLVM-MC, it's, as you've seen, very minimalist, with only a few structures. And it's also totally generic. So for all the architecture, they use the same representation, which is quite good to work on, because we can do things in a totally generic way. But still, it encodes lots of things about an instruction. So at least everything we need to work on the instruction. But at the downside, it's kind of very raw. Okay, it's simple, but structures are simple. But using them to do complex things, it's kind of feel like something a bit complex, and we will see why. And also, they wanted it to be generic. So for this, we made some compromises. And for example, they don't encode everything, but an instruction that it's a lot of glue code a bit of everywhere, in fact. And it's make using this layer a bit tricky. So for example, we want to create instruction. It's one thing that we will need to do for DBI. And if every instruction use the same representation, in fact, they use it in slightly a bit different way. For example, here we have a MOV. And this MOV, as we have seen, is like, okay, a series of operand grouped inside an instruction. But the thing is, this representation, it's not documented, it's not really standard. Every instruction possibly use its own encoding. And to know it, you need to look at the glue code. So it's not, it has not been created to be an intermediate representation that you can work on, basically. And here, we also want to patch instruction. So we need to modify it. So if you take a look at the jump, it's very simple, only like one instruction, one operand, which is an immediate. But if you want to modify it, we will need to go from this to this. And you can see, okay, it's totally different. We will be forced to create some, like, hardcore modification on them. And we also have, we want to create patch. So a series of transformations. And here it's very easy, very simple example of what we are, what is an instruction that we will need to patch, in fact. Here it's an instruction which is referencing memory using the program counter. So basically, as Charles said, at the moment, we will need to move this instruction elsewhere in the memory. But if you move the instruction elsewhere, there the reference will be broken because it was based on the current address of this instruction, which is here. So let's have a look. We are moving it. But what we will be forced to do is, okay, we have moved the instruction. It's located in another address in memory. But we need to replace the register of the program counter with another register. And this register will be loaded with the original address value. And by this way, when we will execute this instruction, the reference will be the same. But as you can see, we are broken things here. We are modifying the behavior of the program because we are erasing this register. So basically, what you need is also to back up this register. And after executing the modifying instruction, you also need to restore that restriction. So as you can see, creation, creation, creation, modification, lots of operations here on an intermediate representation, which is kind of hard, kind of difficult to work in. And so the encoding is a bit painful to work on. And you can see here it was a very, very simple patch. And it's already quite complex with a lot of transformation and a lot of steps. And we also add a feeling, which is you see that we have been forced to back up something, to back up a register. So you can feel that it will be not the only patch when you need to back up a register. So you can feel that you will need some generic steps that will be needed like a bit everywhere. So basically, we need abstractions. And the idea here is to have like a magical engine, which really can call the patch engine. It's real name, in fact. And this engine will take one instruction, an input, one original instruction, apply our transformation on it using abstraction. And then output a list, one or more instruction. For this, basically, we are the vision, like some twisted vision. We have said, OK, maybe, maybe, we can identify the steps that are required to apply the transformation. So maybe you can say, OK, this patch is in fact just a series of transformations. Some of them are totally generic. So maybe we can just regroup them and try to integrate them in sort of like a language, a specific language which will be specialized in patching binary. And another part of the idea was, OK, the instruction, even if the representation is generic, the representation, every instruction we will have will be architecture-specific. So the patch will be architecture-specific. But possibly, maybe, that the language can be generic and express the modification for more than one architecture. And so, yeah, after some headache, we have this schematic. I will not explain everything here. But what we can explain is that, basically, the issue that you have is that you have two words. You have the word of the original program. And you have the word of the DBI. So one guest, one host. And you have interaction between them. So the idea of the abstraction was trying to make things a bit more organized to, in fact, be able to see the relation, the precise relation between them. And by identifying this relation, also trying to create abstraction that allows us to work more easily with the binary and to express the complex theme in a simple way. I will show you what it really means by using this. This is something which is part of the language. And it's something which is a temporary register. So you have seen a temporary register before in this example. So this is the same example than before. And this was our temporary register. And with our language, if you want to create something like this, this series of instructions, in fact, you can just say, OK, I want a temporary register. So I want a temp. And the register here will be chose as a free register, automatically by the engine. And it will be identified by an ID. So you can work with later. And by working on it, I mean, OK, this backup, whether needed for modifying this original instruction. To do this modification, in fact, what we are doing here, it's basically replacing a register in an original instruction. So we are doing a substitution with a temporary register on the original register, which is PC, and by using a reference here to a temporary one. So you can see it's kind of a language with keywords and kind of variables and things like this. And another idea was basically patching a binary is just applying a series of rules. Because if you want to modify something, it's because there is a need to do it. There is, in fact, a condition, one or more condition, that for an input instruction will apply a series of actions. And these actions, basically, there are our transformations that we want to apply on. So let's have a look at what we call a rule, in fact. So this is just extracted from the original code of the DBI. And this is our patch. This is the things that replace the program counter with a temporary register. And you see there is one condition here. So this is only one rule. One condition. The condition is it must use a register, PC. And then the action, you can see there is some of them. But I will not enter in the detail, but you can find here the substitute with temp and the temporary register and so on. And a nice thing with this rule, it's generic. I mean, it's exactly the same rule that we are using on ARM and x8664. And another example here is pure ARM. And here, we basically need to replace the jump, as you have seen. So that's exactly what you are doing here. The condition is a bit more complex because we have a condition which apply on several instructions. But the idea is always the same. You have keywords for your language, variables, and things like this. So what do we learn first? LLVM is really a magic piece of software. It's very robust. It provides tons of things. And basically, it just saves us on this. But the problem we had was the intermediate representation was so simple, in fact, that it became very complex to play with. And you can do it by ARM. You can really create a patch by ARM, like with a giant switch case. It doesn't work.  So you really need to focus on abstraction. And we were quite surprised or difficult it was to create this abstraction. And honestly, it's still a work in progress. But it allows us to make quite complex transformation in something that is very easy to read. You just have your list of operations. It's very easy to understand what the DBI is doing on your binary. So I will get the remote to Charles for the next part. So the next part I want to talk about is how you need to think about cross-architecture support. So if some of the DBI firmware, like Intel PIN, has had trouble supporting instructions at like ARM, they actually tried. And then they decided they would not support it anymore. And one of the reasons is that if you don't think about cross-architecture support from the start, it can become very complex. And I showed you how we handle this issue in our DBI engine. So if you think about what's going on in the process, you can divide the space into two entities. The first one is the host. So the host contain the DBI engine and the instrumentation tool you've written. And the second part is the guest. And the guest contain the original binary and the instrumented code generated by the DBI engine. So you see that this host guest terminology is taken from the VM world because it kind of makes sense. Now this is not a VM. So the problem is these two contexts, they share the same memory and the same CPU context because they are just one process. And this means that we're going to need to switch between the two contexts of the host and the guest at every cycle during the execution. However, we do not get any help from the kernel or the CPU because this is not a VM. We're not going to use a visualization extension and things like that. So this basically means saving and restoring the CPU context from the guest and the host and vivasa at every time you switch between the two. However, you need to avoid any side effect on the guest because the host is aware that it's a DBI and does its DBI thing, but the guest is not aware and should not be aware that you're doing context switches between basically another process inside this process. So this means that you cannot modify its stack and you cannot erase any of its register or else the program will just crash. And the only way to have something that work this way is that the guests need to be able to relatively access memory from the host because you cannot just compute a memory address in a register because you cannot erase a register and you cannot save that register you want to erase on the stack because you cannot modify the stack. So the only way is that you need to be able to do direct reference to a relative memory address in the guest. However, relative addressing is extremely constrained by CPU architecture. So under x86, you can do 32-bit relative memory address. But under ARM, you only have 12 bits. And basically, if you look at the encoding, this means that you're limited by a plus 40, 4,096-bit forward or minus under ARM. So the conclusion of this is that if you want to have a context switch that works nicely on the cross architecture support, you need to have a situation where you have host memory really close to the guest code, to the instrumented code you generated. The other problem is that we want to play nice with data execution prevention. So we could put data next to the guest. It's simple because we're generating that code. However, you cannot have a memory page that would be read, write, execute because on some operating system, this is not allowed. So what we're doing, basically, is allocating two contiguous memory page. One of them is read, execute. The other right is read, write. And this way, we can have satisfy all those conditions. So it looks like this. So this is the first page, we call the code block. And this is the second page, we call the data block. This one is read, execute. This one is read, write. So the first piece of code in the code block is the prolog, which is basically in charge of doing the context switch. And to do that context switch, you can simply store the host context there and load the guest context there using relative addressing. This is the instrumented code, the one we generate with the engine. And this is the epilogue, which does the inverse switch. So the idea behind the exec block, basically, is to bind instrumented code with instrumentation data. So data is guaranteed to be directly addressable. However, when I said one memory page, one memory page, it's four kilobytes in the most operating system. And this is a lot of space. So if you take one basic block and then you use 4K page per basic block, you're never going to, well, you could, but you need a lot of RAM. So the solution is that you need to be able to put multiple instrumented basic block into the code block. And you basically have also a lot of data space left. So you can try to do things with that data space. So this is basically what we got in the end. Here we have a very special thing, which is a selector. And the selector is a jump to someplace inside the code block. And this selector, basically, is a programmable jump. But we cannot modify the code block because it's really execute. So what it does, it's a jump to an address that's actually contained in the data block. And this way, we can really select which basic block, because here we're going to store multiple basic block, which basic block we want to execute. And each basic block jumped to the epilogue at the end. So if you just program the selector and then start the execution from the top, you will execute the basic block you want. From the data space, we are exploiting the remaining data space for things we call constant and shadows, basically. So the instrumentation constant, well, you've seen in the patch example that we wanted to replace the program counter and we wanted to load a constant. So this works very well on the X86 where you have a mouth that has a 64-bit immediate into a register. But this is because it's a Sysc instruction set. But under ARM, you're also very limited in the size of the immediate you can load into a register. So basically, we use this constant space in the same way as ARM literal pool. If you're already reversed engineer ARM code, you know that there is piece of code and then next to it piece of data and constant that are directly loaded reference by the code. And this work the same way. So this way, we can load any kind of data we want into our instrumentation without wasting code space. And the other thing which is a more interesting concept is what we call instruction shadows. This is not entirely new. It's inspired from Valgrind. Valgrind, the way they track memory allocation, the allocation, is that they create what they call memory shadows. So for one page of memory you allocate in your program, they create a small buffer that, inside the buffer, each bits represent the states basically of each byte of the memory page. And this is shadowing basically the memory. And so it's some kind of variable that's binded to the memory. And we wanted to do the same stuff but for instruction. So it's basically a means for us to abstract the idea of having variables inside your instrumentation code to make inline instrumentation very easy. One of the main use case right now is to record memory access. So memory access are a bit of a problem if you want to record everything that's going on in your program. Because to record read memory access, you need to instrument before the instruction, write memory access, you need to instrument after the instruction. So you're adding a lot of instrumentation. And for example, if you want to call your own code in a callback, then you need to switch context again. So you're making two context switch point instruction and then your instrumentation becomes very slow. So the solution is to do what we call inline instrumentation, where you are going to do the recording of the memory access directly in assembly without using the instrumentation tool itself. And these variables, the shadows, basically are used for that. So for the instruction that do a memory access will create shadows that are used to simply store the memory access and the address access. So you can execute a whole basic block and then at the end you can just query the shadows of that basic block to know which address and what data were transferred. So to realize all of that, it's not easy if you're thinking about in a multi-architecture context because we need a cross-platform MMU, basically, memory management unit. And we need an abstraction of that because we want to allocate memory pages and we want to change those page permissions. And also, we want a cross-architecture assembler that works in memory. We don't want to create a binary on the disk. And it's not that simple. A lot of assemblers simply assume that they are going to create sections and a binary object and things like that. But this is not the case. But guess what? LLVM saves us again because when the LLVM project was started, it was LLVM for low-level virtual machine. So they had that bytecode that was nearly cross-architecture. And one of the things they did is build just in time engine to execute that bytecode. And being a just-in-time engine, it means it's very close to the design of a DBI. And so they have everything we would need for that. And we cannot use directly the just-in-time engine, however, because although they're very well designed, they do not really fit our use case and the way we work. But inside LLVM, you have all the functions you need if you want to create a just-in-time. All the cross-architecture memory management abstractions and also this powerful in-memory assembler, which is LLVM MC. So what we learned from that is that really if you want to create a just-in-time, LLVM is really perfect for the job. But also designing a just-in-time engine for a DBI taking into account the cross-architecture problem is really difficult because you can easily be locked down into a CPU architecture if you start assuming that you can simply access memory with a 32-bit offset, for example. And so you need to think about portability from the start if you want to design that kind of project. Thank you. So all of this, in fact, are small parts of our project, which is called QBDI. QBDI stands for Quark's Lab, Dynamic Binary Instrumentation. We are very imaginative. So it's a cross-platform, cross-architecture DBI framework. By cross-platform, it means that today it runs on Linux, Mac OS, Windows, Android, and iOS. And we really focused on the last few months to having something user-friendly, which is kind of hard. You have a big engine. It's a very complex machinery. But we really wanted to have something really easy. So basically, we focused on clean APIs, extensive documentation. And we also provide binary packages for major operating system or Linux distribution. And it's a modular design. And by this, what we mean is basically the core engine of the DBI should only do what is essential for DBI. So no anti-anti-VM stuff or nothing related to anti-debug. I don't know. Like everything which is not part of the DBI. And the other idea was of keeping the thing simple is that by keeping the thing simple, you don't force users to do things in your way. Basically, we don't have one injection method that you need to use and that force you to do things in a certain way and limit you, basically, by doing this. What we have at the end, it's basically easy integration because our DBI is just a library, a static or dynamic library, your choice. So we have created with this library Python Bidings to allow very fast experimentations. And we also have full-featured integration with Frida. Frida, I'm sure lots of you already know what it is. It's a very, very nice framework for instrumenting binary in a different way. They are really perfect by using together. Really, if you combine the power of the DBI, QDBI, and Frida, it's something really impressive. We will see with a demo. Current run map. Basically, we are a bit late for the ARM support. But as you have seen, it's basically adding rules. In fact, the engine itself is already here, is already working, running on ARM. We just need to just finish the rules and maybe also focus on the 64. We need to improve the memory access because currently we don't have the SIMG memory access, which is a bit of a problem also. And we also want to focus on multistrading and exception but not in the same way that most of the engine work because we really want to keep the core very simple. So it will be probably integrating with something like an Alper library or something a bit aside of the project, but we don't know all exactly right now. So demo time. So first demo will be on the engine itself and its Python bindings. So we just need to, I hope we will not break everything by doing this. Yeah. Maybe we should just drag and drop this. Yeah, I think it's OK. So it's a very simple demo. I just want to show you how easy and simple we try to make the API. So this is a simple binary that check a password on inputs. And the password, well, you cannot find it easily if you just look at the software. So that's where I'm very glad that my colleague use freaking Azzatik keyboards, which is, yeah, Azzatik works. So yeah, so what we're going to try to do is just display every memory access made by the program. And because there's a lot of read memory access, usually we're just going to focus on writes. So we use the PyQBDI bindings. And the main thing is this callback, which is called when the DBI want to start. And we simply do two things. We add the memory access callback and we run the engine from start to stop. So the memory callback is just right here. And it does just get an analysis of the instruction and information about the memory access made and simply print while you wrote blah, blah, blah. Oh, yeah, great. So it's no. No, no, it's a bad idea. Is there your password somewhere? No. But we want to run it, maybe. Yeah. Yeah. OK, we want to run it. It's not in the history because it was too easy. So yeah, by the clear, we'll do this. OK, so there we go. Yeah, thank you. So yeah, we can run it. And you can see there's a lot of memory access that are made by this thing. So right now it's not really readable. There's a lot of memory pointer stuff. So maybe because we know it's a password, we want to filter by memory access that are one byte long. So there we do that. We check if the size is one. We only print if the size is one. So let's run that tool. So here it's more interesting. We can see we have byte value on the left. And we have a lot of instructions that print that. And there is a bit of soar in there and maybe soar. So when you see soar, you really think crypto or weird image manipulation algorithm. So what we can do is now simply do the same stuff. But we also filter for soar instruction to see what we get. Yeah, and so now there's not that many soar instruction left. And while it looks like random at the beginning, the end is interesting because it's always in the same kind of memory range that looks like ASCII. So the last thing, the last idea is simply to aggregate those bytes into a buffer. So you see that you have a data array there. It's passed as a parameter to the callback. And so on each of those instructions would simply append the data to our array. And we'll print the array at the end. And if we do that, we can see we have some garbage. And then at the end, some text that looks like import triton. So if we do, well, it's the correct password. So it was simply decrypted in memory. And we can look at it at the end. So this shows you how simple this kind of binding can be. And that's really not hard to use a DBI. OK, we have time for another demo. So that I will just maybe, oh, I don't know. Yeah, OK. I will try to do it on the remote screen, Tini, but. At least you don't have to use another Tiki board. Yeah, I'm French. So yeah, we have a demo binary. If we launch it, it's small. But if we increase the size, we can see, OK, it's done nothing. Like it takes, oh, I have an input screen, which is illo. And it's do things with illo and boop. OK. And the idea is, OK, we want to reverse engineering it and to understand what it does. So we will do this using the Frida framework. And OK, so I rebooted my laptop, in fact. OK, so first, we will load Frida, demo failure. Then we will load the binary, which is located, I think, our local share binary. OK, Frida framework. And we'll say, Frida, OK, I want to load the demo binary. So yeah, we are launching Frida.  So OK, I take control. OK, so here we are in Frida. It's the Frida environment. Most of you already know if you have used Frida. And what we can do with Frida, basically, is things like, OK, I have been reversed a bit the binary. And I've seen that there is a function, which is called like secret. So I will just do a call. It's only a Frida API, which is OK. I want the address of secret. So Frida just returned the address of secret. I say, OK, I will need an input for this function. And basically, I will use a string for this input. So Frida allows us to basically do a remote allocation of memory and inject the string inside the remote process memory. And using this, you can say, OK, I want an active function.  And by doing a seg function, so there is completion. If you do seg input, basically, Frida is executing your remote function with the input that I've forwarded like LOR. OK, so what we can do with a DBI and the integration that we can simply create a virtual CPU. So we will allocate our DBI. So by doing this, simply, OK, so we have a VM object. With them, we will create a CPU state using like the completion. Very easy. And then we will create a stack using history, not completion, because we don't have lots of time. And here we go, we have basically a virtual CPU, which is we have initialized its state and we have initialized a virtual stack for it. And what we need to do now is to say, OK, we want to instrument the demo binary. There it's to avoid the call to the external library. This is a feature of our DBI. It's that we can really choose what part of the code we want to instrument and really let all the things executed by themselves. So here we are ready. You can just do a call and calling. So you're using the native function pointer of Frida. And then a list of input, a list of arguments, sorry, which is input. And you say, OK, we have exactly the same output and the same return value. And you say, OK, but you have exactly the same thing. So your DBI is can I do less? No. We are adding right now. What we can do, it's adding instrumentation to it because here we have just executed the original code but inside the binary, the DBI, sorry. And to add the instrumentation, you just need to use the history and create something like an instruction callback. OK? So here, what I have done basically is I have created a JavaScript function that will be called at runtime for every instruction. And this callback will basically here just dump the general purpose registers and also ask for a total analysis of the instruction in order to have the assembly, the disassembly, sorry, and the original address. And this kind of analysis, by the way, they are managed by the DBI and there is cache. There is a lot of things behind. But it's very simple here. We don't know what happened, but it's magic. You have the analysis of the instruction. And after this, you only need to add your callback. So I cheat again. So what I ask here is that I add a code callback before every instruction and I will call my JavaScript function. So now the callback is added and we can just go back and call again our input function. And here we go. What we have is our JavaScript function which has been executed. And as we see for every instruction, we have the address, we have the instruction, we have the full GPR context, so the general purpose registers. Well, there's lots of them. We can see also that in between we have the call for the external library. Here we are jumping outside the DBI and it's basically the standard library of the Lipsy which is doing stuff. And at the end, oh, not surprising, we have a red instruction and it's returning zero. So everything works as before. So QDBi is an open source project which I've just released it a few days ago. So don't hesitate to give it a try. It has also been released under a permissive license. So feel free for any suggestions or pull requests or anything. We have a channel on FreeNode. And yeah, just join us if you are interested in this project. And I would like to end by really giving a big thanks to our colleague at Quark's lab and for all the beta tests and for supporting us every day. And also especially to Paul and Joe because they have done major contribution to this release it will not be the same without them. And also a big thanks for Quark's lab, our company, to allow us to release this software like with a permissive license and allow it to grow by its own. So yeah, thank you very much. See if you want to ask questions. It's like a speed dating. We only have one minute, 10 seconds left. I'll try, hopefully, a quick answer. Can you contrast this with Dtrace and its user-land support? Dtrace is really cool, but it's not really cross-platform and not cross-architecture. The main point to be very, very fast because we don't have time, the main point is like here you really have, it's all about the granularity. And here you have the granularity is instructions and more than that you can be before or after every instruction. And this, only a DBI can provide you or a debugger if you have tons of time. But yeah, this is really the main difference. It's complementary tools, basically. But you can get them later. And the next talk will be 15 minutes. It's growing up software development. Thanks. Thank you very much. Thank you.


This study examined the levels of for neuropeptides, alpha-melanocyte stimulating hormone, MSH, beta-endorphin, neurotensin, and oxytocin in the cerebrospinal fluid, CSF, E and plasma of patients with schizophrenia, bipolar disorder, BD, and major depressive disorder, MDD. The results showed that the levels of these neuropeptides were similar across all three groups, suggesting that they are not involved in the pathophysiology of any of the conditions. Additionally, no correlation was found between the levels of these neuropeptides and either psychiatric symptom scores or cognitive function scores. This article was authored by Shinsuke Hides, Fuuko Yoshida, Iki Yoshida, and others.


Will I reach my potential? I wonder if any of you have thought about this question, and if so, where it took you. Seven years ago when this question struck me, I was leading a small digital marketing group and worked with a really great team of people. But I knew that in the work that I was doing, it wasn't going to help me build a career that would make the world a better place, and it wasn't going to allow me to reach my own personal goals and aspirations. And so I did what probably anybody would do when their midlife crisis hit them 20 years too early. Started doing research and looking for a lot of possibilities. I applied to jobs and global development, I looked for post-grad opportunities, and I applied to fellowship programs like Acumens. And with every single opportunity that then presented itself to me, I would ask myself, not will I like this, not will I learn something, not does this excite me, but rather, will this help me reach my full potential? That's a very, very different measuring stick. And along the way, even though I got rejected for most of the things that I applied to, I realized that if I wanted to do this, it was really my responsibility. And I think there's a side lesson there. But what I also figured out was that if I wanted to reach mine, I had to go learn and spend time with people and with organizations that had reached their potential. So I decided to spend a year traveling and volunteering my skills around the world in hopes of doing just that. My first stop was in Nepal. Here's a picture of me supporting the Nepal Wireless Initiative. A brilliant program started by Mahabir Pune. He's figured out how to sway the foothills of the Himalaya to the most remote villages with very cheap Wi-Fi. Put in solar powered computer labs in schools, train the teachers how to use them, and then use revenue from trekkers coming through the region to access that Wi-Fi. To create and support those programs, and also create extra revenue opportunities for the schools. From there, I got to spend time with all these inspiring organizations. And I wish all of them could have been with us here today. But one that really struck me was an organization called Wanaka Waste Busters in New Zealand. At its groundbreaking ceremony 15 years ago, the mayor bet $100 that it wouldn't stay in business for one year. It's now the largest employer in Wanaka, not just of people with professional skills, but also those with special needs. And they do that by collecting waste, upcycling it, and using revenue from those programs to fund national education and awareness campaigns about how to keep their country clean. And in this process of spending time with these organizations, I developed incredible skills. Things like operating in ambiguity, working across cultures, working on innovation and doing more with less. But I also learned some more personal skills. Things like empathy, consciousness, and I think selflessness. Things that I think are more important than ever in our interconnected societies. I also picked up valuable experiences, learned what it was like for organizations to scale up initiatives and make hard decisions about shutting some down. And I built an incredible network with impact investors, with global development partners. And of course, I met my incredible co-founder, Dirk Nord, who worked on this problem of how do we get talent into the most remote areas of the world at scale? And so now at SoCAP, I can't help but ask us the same question. With all our investment, with all our ideas, are we capable of reaching our full potential? And of course, we're here because we believe it's true. But what I'll argue is not if we don't have the right experience, the right skills, and the right network to do just that. In fact, if we don't have people to lead us, we won't achieve the progress we want. And this is not just my own observations. The United Nations has said that behind an access to capital, access to talent is a second leading barrier to growth. Fellow SoCAP member of the Aspen Network of Developmental Entrepreneurs has said that in some economies like India and Brazil, that lack of access to talent is the leading barrier to progress. To help make this more real, here are pictures from MamiMade, an incredible organization that we support in Lebanon. They take refugee women in vulnerable populations. They harness their skills in the kitchen, teach them business and hospitality skills. And with those, procure catering opportunities where they're able to use revenue to fund not only their education, but just as importantly, their job placement programs. It was started by a group of engineers, a brilliant and passionate bunch, but they didn't know anything about marketing. They didn't know how to tailor their value propositions to different members. They didn't know what a customer relationship management system or a CRM system was and how to harness that. So they looked to us and we were able to connect them with a brilliant young lady named Ali, who went there, learned about their challenges, and in just a number of months was able to help them develop their sales strategy and also understood that there were some incredible connections for nonprofits like the Sales Force Foundation, where they could get free licenses to CRM tools as a nonprofit. And with those, she was able to help them grow. Another organization very different from an organizational standpoint is eBanks. Operating out of Brazil, it helps consumers now in Brazil and also across Latin markets access products and services online. It's backed by an incredible organization endeavor. It has a global network. It's received pro bono consulting teams from EY. And yet, three years ago, it was a team of 10 people and they didn't have the elbow grease needed to really get to the next level. They needed help with international partnerships and they looked to us and we connected them to Nicole. Brilliant woman with seven years of international development experience in creating international partnerships. Since then, they've grown from 10 people to 120, creating 110 local jobs in the process. And it's that catalytic effect when we align the right capital with the right leaders, with the right skills, that we can truly make new bounds in development. But no organization is immune to this talent gap from small organizations all the way up to the Fortune 50 organizations struggle when they don't have access to quality leaders. In fact, 76% of global CEOs say that a lack of access of globally ready leaders is one of their biggest challenges. And not only that, they don't have plans in place to develop it. And all that said, leadership development budgets are still increasing in corporations at a rate of 15% a year trying to harness these challenges. And it's for good reason. According to famed GE CEO Jack Welch, if you build the best team, you win. And I think we know that here at SoCAP, if we build the best team of global leaders, of entrepreneurs, of impact investors, we too can achieve the goals that we're setting out to achieve. But we have to be real. Small organizations in the field need technical skills. But we can marry that with the fact that large corporations need global leaders. And if you believe in ancient wisdom or sayings to teach us to learn twice, or I hear and I forget, I see and I remember, I do and I understand, then you know that people learn through experience. So let's harness these opportunities. Let's take people that have skills on their own or through corporate programs, connect them to small organizations around the world where they can address specific technical skills, and let's help these organizations grow and create jobs. And when these people return, they'll return with the same skills that I returned with, collaboration, empathy, innovation. They'll return into their companies ready to lead in our global interconnected world. So a few examples of this. Here's a program that we support at Microsoft. It'll send 200 volunteers across the African continent next year to connect people to nonprofits, startups, small and growing businesses, partners, schools and governments. The picture here is a NAND. He's helping startups implement Microsoft's power business intelligence tool, a free software. In just one to two weeks, he's able to help them grow. Yesterday on this stage, Neil Myrick from the Tableau Foundation talked about how they're now extending their data visualization tools also for free to nonprofits, and they have the Tableau Service Corps to follow suit to help make sure that it's being implemented correctly. It doesn't take a lot of time to solve challenges. Here's a picture of Jamie. I think this crowd will really like her story. She got to go work on and monitoring an evaluation project in Latin America with Systema Bay, the Latin American sister company to the benefit corporation movement here in the States. She worked on creating data to convince investors to invest in social enterprises and get social enterprises to commit to being benefit corporations across Latin America. And here's a picture of Ali, the expert here that we sent to Lebanon, a picture of her working in the mommy-made office. And these programs, they're really working. Over 90% of people attribute this as one of the best global leadership experience they've ever had. We partnered with the wonderful organization called the Merging World on the Microsoft Project. They've collected other data from other corporate and individual programs to show that of the participants, almost everybody has gains in dealing with ambiguity. One in the middle that I love is self-confidence. We need confident leaders to step into these challenges and of course, being able to see things from different perspective and solve solutions. Two days ago, I was at the Corporate Citizenship Center conference in DC. They're one of the communications directors at Samsung talked about how these pro bono programs also build empathy. Something hard to measure, but something we all know is vital to creating sustainable systems. But I mean, this is really working. Organizations in the field are saying that 89% feel that in as short as one to two weeks of getting technical expertise, a sustainable difference is made to their organization. 94% are saying that the organizational capability is growing and 100% say that it positively impacts staff through connections, skills, networks, and experience. So this brings us back here to SOCAP. Will we reach our full potential? And my stance on this is we can. But if you think about how the waves of economic growth and sinkholes might affect us, how environmental crises might slow us down, how political issues might create major challenges, behind every single idea, behind every single initiative, at the end of the day, we have people. And if we invest in those people, they can grow and they can lead us to the place that we want us to go. And so for impact investors, organizations that come to you that maybe they aren't ready, maybe they don't need another business plan, maybe they need somebody who can help them implement an accounting system. For those that receive investment, maybe they need help scaling. For individuals listening in, you have a vacation, you have a sabbatical, you have some free time, or maybe you have a gap year. Think about how you could use your skills to catalyze growth in the areas where it's needed the most. And for corporations, you have the greatest asset of all. You have people's brains. And if you can unleash that capital, that human capital for good, they will return more innovative, more engaged, and more ready to take not only themselves to their full potential, but also your company to theirs. So can we reach our full potential? Of course we can. As long as we take the time to develop the people that are capable of getting us there. Thank you so much for your time.


Well guys, the hits keep on coming today. We know about the Nintendo Direct Mini Partner Showcase and we knew that news, at least according to a rumor from Nate Drake, that we were, Nate, the hate Nate Drake, you guys know who he is, that we were gonna get Mario plus rabbit sparks of hope news this week. And I had already been predicting that we were gonna see Mario plus rabbit sparks of hope tomorrow in the Nintendo Direct Mini Partner Showcase. And not only does it look like we're gonna see it, we now have details that have leaked because Ubisoft made a whoopsy and accidentally sent one of their websites live for Mario plus rabbit sparks of hope. I can't believe that it just happened. They did it. This clearly was gonna be shown tomorrow and live tomorrow. Let's take a look after I remind you, hey, you know what, we're almost to 80,000 subscribers. When we get there, we got a big giveaway plan for Breath of the Wild replica master sword, an actual steel sword, a replica Hylian Shield and a replica Deku Shield that we're gonna give away when we hit 80,000 subscribers. So go ahead and hit that subscribe and let's get right into this stuff. So I've initially saw this here, my Wario 64 out on Twitter said Mario plus rabbit sparks of hope October releasing 20th according to Ubisoft's official store. And you see here, Mario plus rabbit sparks of hope, there's a gold edition, whatever's in the gold edition. I don't know. And you see the date here of 2010, 2022, which this obviously is 10, 2020, 2022. Beyond that, we go down. Some people got some stuff in here. You forgot there's photos of Bowser in the game confirming his playable. Now I don't know if this confirms he's playable, but he's definitely in the game and he's not facing Mario and the gang. So yeah, Bowser might be playable here. That's pretty incredible. Oh, moving on. Bowser's got a gun. Rabbit Rosalina doesn't look as shocked as Mario or as impressed. So Mario's like, huh? And rabbit, ooh. So yeah, definitely looks like Bowser is playable.  Oh, we're not done yet though. We're not done yet though. There was another one in here. I believe that had four screen just here we go. One more after this. So we see a screen right here. So Bowser's part of the gang. You got this guy back here just kind of, oh yeah, I'm too cool to be with a gang. It must be on the mothership here. You see Mario out here with his double guns going to town here in one of the levels. Next up, we obviously see some more gameplay goodness here in these screen shots. I suspect we're gonna see a lot of this in an actual trailer tomorrow. So still a reason to watch for this game because we're not seeing it in motion here. And then obviously here's another look at another world. Oh, is that like based on the Titanic back there? That's really, really cool. I love the art direction of this game. It's very rabid, it's very Mario. Mixes so well together. And here you see where Bowser is sort of the leader of the gang here. Walking down, collecting the coins, getting to whatever these things are. I have no idea if those are enemies that you fight just randomly in the world or what's up with that. I'm just kind of glancing here at, if this person might have posted anything else, I'm gonna go glance at their Twitter. I don't know that they themselves posted much else. One thing though is that I did wanna click on this link and just see what happens. Cause I hadn't clicked on it yet and it's gone. They took it down. They took it down. Hey, are you lost? They took it down. Of course they took it down. Man, oh, man, oh, man. That is so exciting. I can't believe. Well, you know what? Maybe I can cause honestly, Mario Plus Rabbids leaked back in right the day before. You guys remember E3 2017? Mario Plus Rabbids, all this art and imagery and stuff leaked literally the day before the Ubisoft event at E3. And then obviously kind of spoiled one of the surprises. Now we already know about Sparks of Hope. So the game itself isn't a surprise. And honestly, it's still slated for 2022. It is made by a third party company. It obviously was going to be part of this third party direct tomorrow, which I also think Bayonetta 3 is going to be part of that third party direct as well. So I think this was an obvious thing, but I am stunned that Ubisoft themselves made this mistake. See, last time it was just assets from the press site leaking. This wasn't even assets from the press site. This was the Ubisoft store accidentally sending the page live for a moment. Maybe they were just testing and hoped no one would notice, but they should know better. You want to always test with a page that isn't public because once you make it public, the internet is going to grab it right away. This is just wow. I am literally like stoked. Like immediately after recording this, I'm going to go straight into editing while talking on the phone with Eric because I got to let Eric know this is his most anticipated game in 2022. And it is now confirmed Nintendo is positioning this as one of their big holiday sellers. This is going to be coming out October 20th, 2022. We're going to see more of this tomorrow. Can't wait. Oh man, this just got my hype levels even higher. And if you are hyped as well, be sure to come to our live stream that we have happening at 8 p.m. Central Time about two and a half hours or so from now because we are going to be, going to be giving out a bunch of predictions and yes, talking about the Sparks of Hope news and more, I am awesome. Now, are you guys excited for this game? The last game according to numbers from the development team sold around 8 to 8.5 million copies. I have no idea if this game is going to sell as well as the original. Is it going to outsell the original? Like Splatoon 2 massively outsold Splatoon 1 is that what we're going to see here is hype even higher for this. And I want to know your guys' hype. Obviously we have Rosalina characters in here. Will Rosalina herself eventually be playable? I have no idea. There's clearly some Mario Galaxy vibes being added in. Maybe that's going to drive the hype even further. Maybe if there's a Mario Plus Rabbids, three down the road, maybe they bring Mario Odyssey in the mix and some crazy zany things happen there. I just am so glad that this IP is moving forward and that Nintendo and Ubisoft are positioning this as a major holiday game. This pairs perfectly with Pokemon. You can kind of get to the middle slash end of October. You drop this and then you drop Pokemon the following month. That's a very good combo of games for the holidays. Yeah, it's not the same. You know, it doesn't slap the same as like if Breath of the Wild 2 was in October. It's not going to give you the same slapping like a new Mario Odyssey game or Breath of the Wild 2, but it does confirm that it is not only not delayed and not only still coming this year that they are treating it like a major title for this holiday and we're going to be here so much more about Sparks of Hope as we head into later of the year. Oh my God, I can't believe this actually came out right now. I'm stunned. I am stunned at the moment. So I got to get to editing this video guys. You guys are amazing. I'll catch you guys all at the live stream tonight and at the Nintendo Direct Mini Showcase tomorrow. We'll be live an hour before the show starts at 7 a.m. bright and early. See all you guys there. Peace out.


Did I go too hard with the purple eyeshadow this morning? You tell me. Good morning my beautiful internet friends. Welcome back to my channel Thanks for joining me here today. It is a crazy time in our country and in our world at the moment There's a lot of uncertainty a lot of fear and a lot of changes One of the biggest changes is this idea of social distancing or in some places quarantine or orders to shelter in place It's getting a little more intense every day and something that a lot of people are facing is what to do when you're stuck Home for days on end generally we have some kind of schedule where we can go out and do things We might meet friends for coffee once a week or go downtown. I don't know if you're cool like that I'm not I know from personal experience that a change of routine a change of the things that we're used to can really add to Uncertainty and fear and just feeling really uncomfortable So I have a few suggestions of what to do to stay sane and these are all free if there are any paid options here I will call them out So you know I know that a lot of people have had to spend money on Supplies like we have and there isn't necessarily a ton of extra cash So these are things that are completely free if you have a computer or a phone if you live in a house or an apartment Or anywhere that is a building these are all things that you can do quick backstory if you're new to my channel I have stayed at home in place pretty much on this couch for months on end I've had many surgeries most recently in the last two years I've had a leg amputation and then a revision where they had to amputate more of my leg And I spent a lot of time indoors looking at these four walls trying not to lose my mind So though I've not gone through this type of period in our country before where everyone is being ordered to do the same things I have been basically stuck on home for weeks on end with the only respite being going to a doctor's appointment And it can it can take a lot not to lose your mind So here are a few tips and tricks that I have learned that helped me through that Okay, so this first recommendation is in super sexy or glamorous We'll get to the fun stuff in just a second But this is actually one thing that I think is the most powerful thing for keeping your mind during a time like this And it's really really focusing on the things that you can control Even when I was stuck at home and had nothing to do no one to see I would still get up in the morning I'd still wash my face I would change clothes and I'd read a page every day out of a book called The Daily Stoic It was just something I did to start my day that little bit of Routine in a time when everything was upside down was really really good for Stabilizing my mind and reminding me that I'm still the person I still have a schedule I can still get through this really focusing on what is in your power in a time when everything is spinning out of control Outside of you is really important. So that could look like journaling every morning That could look like still doing your makeup Even if you're not leaving the house that could look like fill in the blank Whatever that is for you having some kind of start and end to the day is really important because that's something That's completely in your control. A lot of people have suggested Video calling people to stay in touch when you can't see your friends in person and that I would highly recommend However, there's an app that I used all throughout my recovery that I would highly recommend I am not affiliated with this company in any way. It's called Marco Polo. Many of you guys might know it It's basically like sending video text messages back and forth I use it with my friend John pretty much constantly in my recovery and it was a lifesaver because I was talking to someone But it was on my own time. I could see their face We would have full conversations, but it wasn't real time. So check it out I'll leave a link in the description down below brain development apps now I don't know how much science there is behind these are not but it is something that's really fun There's an app called Elevate. It's a free version. You don't have to pay for it I think there are things you can pay for within it, but it's basically brain training apps from math to language to anything in between It's really fun to kind of stretch your mind, but it keeps you alert It keeps you awake It gives you a reason to expand your mind a little bit and I would highly recommend it This is one I actually just learned about I have not tried this myself just yet But EDX or edX is a site where you can actually take courses from major colleges and universities for free You can audit them so you can learn the information you can go through the program, but you don't have to pay for it It's a great way to get some really really good learning really good education for free If you would normally be going out and doing stuff and let's say you have five hours in the evening Where if you're just stuck at home, maybe spend three of those watching Netflix as many of us do and the other two learning something new Okay, I know that this one might sound a little woo-woo, but stick with me on it Create a vision board of some kind. This isn't just a girly weird thing as I used to think it was I started having vision board planning parties once a year with my friends and it's actually been really helpful If you don't know what a vision board is, I'll put some links down below But it's a good way to envision the future and think about what you're really shooting for in your life It's an easy and fun way to refer back to that and focus on it And I think that things like this are really important, especially in a time when everything is so uncertain Focusing on what you want for your life really clarifying that and coming up with some idea of how you want to get there Can be really helpful at least for me It helps remind me that today is not everything that this is temporary That eventually life will look different than it does now and it helped me. Yes, pretty much everyone has said this But exercise of some kind I know that people watching this are all different ages all different exercise levels and activity types something I would really recommend is yoga by Adrienne. It's a totally free YouTube channel There are a ton of yoga workouts and yoga flows on it. I've used it myself I really like how she presents things and it's totally free So if you have 10 minutes a day and you want to do a little bit of stretching a little bit of yoga Check it out. It's a good way.  I'm not sure there are a ton of different ways to exercise and keep your body healthy But this is one that I really like appreciate and have used I'm ashamed to say that I honestly forgot to do this sometimes But get fresh air of some variety whether that's sitting in your backyard if you have a backyard Or standing outside your front door for a few minutes stay away from people as recommended But being outside is still safe being stuck at home for a long time I almost stopped thinking about the outside world But eventually I started going in my backyard for a few minutes a day to sit and read and drink some coffee And I found that it really really helped my mind stay in a better place actually Feeling fresh air actually looking at nature around me and Realizing that my four walls are not the only thing that still exists fresh air is really healthy for you too So give that a shot as long as it's safe where you are this one I have not tried personally yet But I have friends who have showed me it rave about it and absolutely love it Learn a new language and there are some cool free apps to do that duo lingo is one I have not personally tried but again, I've seen it. It's pretty cool You can kind of compete with your friends on how quickly you're going through exercises and learning things So it's kind of like a game, but you're also learning a new language, which is really flipping cool I always wanted to get better at Spanish because in college I took a couple years in high school I took a couple years and I don't really remember anything I think it'd be a good and a fun idea to expand my mind and learn new language So I'm going to be giving that a shot and let me know if you are going to try it as well They have a ton of different languages and again, it's totally free How cool would it be if after all this quarantine and social distancing you could talk to someone at least a few You know conversations in a different language. I think that'd be pretty awesome This one only works if you have stamps or if you're going to the grocery store to get supplies You can get stamps at most grocery stores But send an actual written piece of mail to someone you like or care about I occasionally do send written letters or cards and it's a really interesting I don't know. It's nice to sit down and actually put a pen to paper And who doesn't like receiving personal mail in the mail because all I ever get is bills or advertisements and that's annoying So actually getting something handwritten from someone who cares about you can be a really great way to encourage someone Who you care about and at least currently the mail is still running. So fingers crossed that that continues I know you guys have heard me talk about this before but audio books and before you tune out and think I don't have money to pay for audible. There are actually other options Audio books, uh, which I will link down below is an app that you can listen to classics on meaning that there Isn't any licensing meaning you don't have to pay for it. It's a great way to listen to some classics I've done it before I used to work for a cleaning company Where I use this app to listen to history books and classics language might not be particularly modern on some of them But they're great books and great stories and great ways to learn things anyways Also, if you have a library card, Libby is an app that allows you to listen to free audio books from your library How cool is that you do need a library card? So if you don't have one, unfortunately, this will not apply to you But if you do have one, check it out. It's actually really cool. I saw this going around on a few articles You can take a virtual museum tour. That's actually really awesome. Occasionally Brian and I will go up to the Museum of art in Denver. It's a really cool place But there's a lot of walking missing a leg that wasn't always the easiest thing for me to do So virtual museum tour sounds really cool. You can learn about, you know, different places different civilizations different people Who you never knew about art history, whatever's your jam. That sounded really awkward. Do people say whatever your jam is anymore? I don't think they do. I think I'm the one holdout still saying that phrase But go to a museum safely now that we have all this extra time on our hands and a lot of us are experiencing anxiety And uncertainty made me now is a great time to try meditation Headspace and calm are two apps that are free. I think they have paid versions But they are free that you can learn basic meditation whether it's 10 minutes a day or 20 minutes a day It's really challenging for me. Meditation is something I really struggle with but I think most people struggle with it And it's a great practice pretty much everyone who knows anything about it agrees And it's a really healthy thing for your mind and your body So if you want give it a try and those are two apps I'd recommend as I have tried them myself Now if you are going to sit down and watch some television shows as I definitely have and will continue to do There were a couple that I'd recommend. This is just me personally. I really like the show Chuck I think it's really funny. You can watch it with kids for the most part older kids. I'm not sure find out for yourself I don't have kids. I don't know. It's a it's a really sweet little show If you're into documentaries my favorite documentary of all time I'd recommend that absolutely anyone watches it is called a fear of 13. It's not a scary show It is pretty serious. It's the story of someone who was on death row Wrongfully for his entire life and he is one of the most incredible people I've ever heard speak New girl is a fantastic show if you haven't watched it. I believe that there are seven seasons. It's one of my favorites I love how the series ends and I would recommend you check it out. It's for girls or guys It doesn't matter if you've been on youtube any amount of time. I know that you've heard of this company I've talked about it before they've sponsored previous videos Skillshare is a learning platform where you can learn all different kinds of things from Photoshop to video editing to photography. It is really really cool. I've used it myself Like I said, I've been sponsored by them before I'm gonna leave a link in the description It is an affiliate link meaning that if you click it if you sign up I will get some of that revenue But there are two months that you can get totally free as in you have to put in your credit card information But if you cancel before that two months, there is absolutely no charge So if you want to learn some new things for free for two months, give it a shot Starting to write again is something that I've been trying to do I struggle with it and so I took a course on creative writing which I will link down below along with the Skillshare link because this is something I am personally calling myself out for There are always projects around the house that I'm like I should really do that on a Saturday And then Saturday comes around and I don't do it for me. It is organizing the closet in my office Everything just accumulates there. I think we all have spaces like that So if you can set aside a few hours in an evening or morning or on a weekend Where you're not doing anything else to actually tackle the projects that you've been telling yourself You should really really do you should really clean that thing or organize that thing Now is the perfect time to do it as you probably know already But I thought I would mention it anyways because I need a reminder to do those things every once in a while Try drawing something and you may think hey Joe. I'm not an artist. So that's not my jam I just said it again, but here's the thing. I wasn't an artist for most of my life I picked up a book called drawing from the right side of your brain And suddenly something kind of unlocked for me and I've been working on art ever since so Maybe if you don't consider yourself an artist or maybe if you used to be and you haven't done it in a really long time It doesn't matter if you have art supplies or not if you have a pencil or a pen and a piece of paper You can start trying things out if you want to check out that book I will link it down below that book unfortunately is not free However, it is something I would highly recommend reading if you are interested in art or improving your artistic expertise If you don't do this already journaling is something that can be really really beneficial to a lot of people It has been for me in my own life. I did a journal reading a few videos ago I will link it up above and down below But I have personally found that journaling is a great way to just stop for a second Especially when I feel out of control or if you're nervous or like things are imploding or exploding around me It's a great way to nurture self-awareness And it's also awesome to have a record of your thoughts and your feelings at different points in your life If you've thought about journaling and you've just never done it now could be a great time to pick it up I have been slowly getting back into it through the writing that I've been doing and through actually taking a pen And writing down on pages what I've been thinking and feeling so I'd highly recommend giving a shot You don't need to have an actual physical hard journal to do this in you can always just type in a word document Or find some pages around the house and give it a shot All right, so that is my exhaustive list of things I'd recommend trying I hope some of these are things you haven't thought of or heard before that might be a little bit interesting to you Let me know which ones you have tried or would like to try down below I personally am going to be downloading Duolingo today and picking a language Probably Spanish like I said to try to get a little bit better at I heard a statistic once that most people in the world can speak two languages And it makes me feel like a very dumb american that I only know english So I'm gonna try to expand myself a little bit that way I'd love to hear your thoughts and suggestions down below of what you're doing indoors while we're stuck in this weird time I know that it can be really uncomfortable. I know what cap and fever feels like it is a real thing I used to kind of think it's a joke. It's easy to get a little stir crazy being in the same place for the majority of the time But there is a way through it. There is another side to this It's really important to adhere to what your county or state or country is recommending to keep everyone safe Stay healthy sane and stay inside guys. Thanks to my patrons who make these videos possible I truly appreciate your support, especially in this tumultuous time Thank you for all you do for me. If you're curious what patreon is I will leave a link up on screen But thank you for spending a few minutes out of your day watching this video here with me I truly appreciate you could be anywhere in the world doing anything and you chose to spend a bit of your time With me. I really appreciate that. I love you guys. I'm thinking about you and I will see you in the next video From the sky