|
Home >
Enterprise >
Participants >
FireEye >
Results
|
|
Procedure
Legitimate user Debbie clicked and executed malicious self-extracting archive (Resume Viewer.exe) on <IP_ADDRESS> (Nimda)
Footnotes
- The scan type used to produce this alert is On-access, which means the scan occurs on file writes and executions.
- The vendor reported that this file would have been quarantined and prevented from executing.
[2]
Procedure
Previously executed batch file (pdfhelper.cmd) launched a DLL payload (update.dat) using Rundll32
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Previously executed batch file (pdfhelper.cmd) moved a separate batch file (autoupdate.bat) to the Startup folder
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
Procedure
Previously executed batch file (pdfhelper.cmd) moved a separate batch file (autoupdate.bat) to the Startup folder
Footnotes
- The alert mapped to two ATT&CK Techniques (T1059 - Command-Line Interface and T1105 - Remote File Copy), but they were not directly related to the Registry Run Keys / Startup Folder Technique under test in this procedure.
[2]
[3]
[4]
Procedure
Cobalt Strike: C2 channel established using port 53
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Cobalt Strike: C2 channel established using DNS traffic to freegoogleadsenseinfo.com
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Cobalt Strike: 'ipconfig -all' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'echo' via cmd to enumerate specific environment variables
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net config workstation' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net localgroup administrators' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net localgroup administrators -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net group \"Domain Admins\" -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net user -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net user george -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'reg query' via cmd to enumerate a specific Registry key
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: Built-in process injection capability executed to inject callback into cmd.exe
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
- The vendor stated the process injection detection capability is a HX plugin that is only available within the Managed Defense Service, and the data is reported to a separate cloud server which is not accessible to customers at this time.
[2]
Procedure
Cobalt Strike: 'net group \"Domain Controllers\" -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'net group \"Domain Computers\" -domain' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'netsh advfirewall show allprofiles' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'reg query' via cmd to remotely enumerate a specific Registry key on Conficker (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
[5]
Procedure
Cobalt Strike: C2 channel modified to use port 80
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Cobalt Strike: C2 channel modified to use HTTP traffic to freegoogleadsenseinfo.com
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Cobalt Strike: C2 channel modified to split communications between both HTTP and DNS
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Added user Jesse to Conficker (<IP_ADDRESS>) through RDP connection
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Cobalt Strike: 'schtasks' via cmd to create scheduled task that executes a DLL payload (updater.dll)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: 'tree \"C:\Users\debbie\"' via cmd
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Cobalt Strike: Built-in keylogging capability executed to capture keystrokes of user Debbie
Procedure
Cobalt Strike: Built-in screen capture capability executed to capture screenshot of current window of user Debbie
Procedure
Cobalt Strike: 'ls' (List) via Win32 APIs to enumerate a network shared drive (Wormshare) on Conficker (<IP_ADDRESS>)
Procedure
Cobalt Strike: Built-in download capability executed to a collect file (Shockwave_rackb_diagram.vsdx) from a network shared drive (Wormshare) on Conficker (<IP_ADDRESS>)
Procedure
Batch file (autoupdate.bat) previously written to Startup folder executed when user Debbie logs on to Nimda (<IP_ADDRESS>), launching a DLL payload (update.dat) using Rundll32
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
[5]
Procedure
Scheduled task executed when user Debbie logs on to Nimda (<IP_ADDRESS>), launching a DLL payload (updater.dll) using Rundll32
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
RDP connection to Conficker (<IP_ADDRESS>) authenticated using previously added user Jesse
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
RDP connection made to Conficker (<IP_ADDRESS>) as part of execution of persistence mechanism
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: C2 channel established using port 443
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: C2 channel established using HTTPS traffic to freegoogleadsenseinfo.com
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
Procedure
Empire: Encrypted C2 channel established using HTTPS
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
Procedure
Empire: 'whoami -all -fo list' via PowerShell
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: Built-in WinEnum module executed to programmatically execute a series of enumeration techniques
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: WinEnum module included enumeration of clipboard contents
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: WinEnum module included enumeration of established network connections
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: 'net group \"Domain Admins\" -domain' via PowerShell
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: 'Net Localgroup Administrators' via PowerShell
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: 'net group \"Domain Computers\" -domain' via PowerShell
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire:'reg query' via PowerShell to enumerate a specific Registry key
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: Built-in UAC bypass token duplication module executed to launch new callback with elevated process integrity level
Footnotes
- A Configuration Change was made in order to collect Windows Event Logs for events 4627 (Group Membership Information) and 4673 (A privileged service was called).
[2]
Procedure
Empire: UAC bypass module downloaded a new Empire stager (wdbypass) over port 8080
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: 'get-content' via PowerShell to collect sensitive file (it_tasks.txt) from a network shared drive (Wormshare) on Conficker (<IP_ADDRESS>)
Procedure
Empire: 'net use' via PowerShell to brute force password spraying authentication attempts to Morris (<IP_ADDRESS>) and Nimda (<IP_ADDRESS>) targeting credentials of usersKmitnick, Bob, and Frieda
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
[5]
[6]
Procedure
Empire: 'net use' via PowerShell to brute force password spraying authentication attempts to Morris (<IP_ADDRESS>) and Nimda (<IP_ADDRESS>) targeting credentials of usersKmitnick, Bob, and Frieda
Footnotes
- The vendor indicated the un-redacted passwords could be observed in triage/acquistion data.
[2]
[3]
[4]
[5]
[6]
Procedure
Empire: 'net use' via PowerShell to brute force password spraying authentication attempts to Morris (<IP_ADDRESS>) and Nimda (<IP_ADDRESS>) targeting credentials of usersKmitnick, Bob, and Frieda
Footnotes
- A configuration change was made to allow for the capture of Windows Security Event ID 4625.
[2]
[3]
[4]
[5]
[6]
Procedure
Empire: Successful authentication targeted Windows admin share on Conficker (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: Successful authentication targeted Windows admin shares on Conficker (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: 'net use' via PowerShell to successfully authenticate to Creeper (<IP_ADDRESS>) using credentials of user Kmitnick
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: Built-in move capability executed to write malicious VBScript (update.vbs) to disk on Creeper (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Empire: 'sc create' via PowerShell to remotely create a service on Creeper (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
- All five of the sc.exe events are rolled under the same SC Execution alert.
[2]
[3]
Procedure
Empire: 'type' via PowerShell to remotely enumerate a specific file (update.vbs) on Creeper (<IP_ADDRESS>)
Procedure
Empire: 'sc start' via PowerShell to remotely launch a specific service on Creeper (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
- All five of the sc.exe events are rolled under the same SC Execution alert.
[2]
Procedure
Empire: 'copy' via PowerShell to overwrite magnify.exe with cmd.exe
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: 'Get-ChildItem' via PowerShell to enumerate a network shared drive (Wormshare) on Conficker (<IP_ADDRESS>)
Procedure
Empire: 'copy' via PowerShell collected a file (Shockwave_network.vsdx) from a network shared drive (Wormshare) on Conficker (<IP_ADDRESS>)
Procedure
Empire: File dropped to disk is a renamed copy of the WinRAR binary
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: Built-in upload module executed to write binary (recycler.exe) to disk on CodeRed (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created compressed archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) created encrypted archive (old.rar) of previously collected file
Procedure
Empire: Executed binary (recycler.exe) is a renamed copy of the WinRAR binary
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
[5]
[6]
Procedure
Empire: Sequence of 'echo' commands via PowerShell to populate commands in text file (ftp.txt), which is then executed by FTP to exfil data through network connection separate of existing C2 channel
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
Procedure
Empire: Sequence of 'echo' commands via PowerShell to populate commands in text file (ftp.txt), which is then executed by FTP to exfil data through network connection separate of existing C2 channel
Procedure
Empire: Sequence of 'echo' commands via PowerShell to populate commands in text file (ftp.txt), which is then executed by FTP to exfil data through network connection separate of existing C2 channel
Procedure
Empire: Sequence of 'echo' commands via PowerShell to populate commands in text file (ftp.txt), which is then executed by FTP to exfil data through network connection separate of existing C2 channel
Procedure
magnifer.exe previously overwritten by cmd.exe launched through RDP connection made to Creeper (<IP_ADDRESS>)
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
[3]
[4]
Procedure
RDP connection made to Creeper (<IP_ADDRESS>) as part of execution of persistence mechanism
Footnotes
- Managed Defense Reports are reports provided by FireEye's managed detection and response (MDR) service. FireEye provided reports to MITRE after the completion of the evaluation to mimic what they would produce in a real incident.
[2]
Procedure
Established C2 channel (<IP_ADDRESS>) via rcs.3aka3.doc payload over TCP port 1234
Criteria
Established network channel over port 1234
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Spawned interactive powershell.exe
Criteria
powershell.exe spawning from cmd.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Recursively collected files found in C:\Users\Pam\ using PowerShell
Criteria
powershell.exe reading files in C:\Users\Pam\
Procedure
Read and downloaded ZIP (Draft.zip) over C2 channel (<IP_ADDRESS> over TCP port 1234)
Criteria
The rcs.3aka3.doc process reading the file draft.zip while connected to the C2 channel
Procedure
Spawned interactive powershell.exe
Criteria
powershell.exe spawning from powershell.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Executed API call by reflectively loading Netapi32.dll
Criteria
The NetUserGetGroups API function loaded into powershell.exe from Netapi32.dll
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Executed API call by reflectively loading Netapi32.dll
Criteria
The NetUserGetLocalGroups API function loaded into powershelle.exe from Netapi32.dll
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Created a new service (javamtsup) that executes a service binary (javamtsup.exe) at system startup
Criteria
powershell.exe creating the Javamtsup service
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Read the Chrome SQL database file to extract encrypted credentials
Criteria
accesschk.exe reading files within %APPDATALOCAL%\Google\chrome\user data\default\
Procedure
Masqueraded a Chrome password dump tool as accesscheck.exe, a legitimate Sysinternals tool
Criteria
Evidence that accesschk.exe is not the legitimate Sysinternals tool
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Exported a local certificate to a PFX file using PowerShell
Criteria
powershell.exe creating a certificate file exported from the system
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Captured and saved screenshots using PowerShell
Criteria
powershell.exe executing the CopyFromScreen function from System.Drawing.dll
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Read data in the user's Downloads directory using PowerShell
Criteria
powershell.exe reading files in C:\Users\pam\Downloads\
Procedure
Exfiltrated collection (OfficeSupplies.7z) to WebDAV network share using PowerShell
Criteria
powershell executing Copy-Item pointing to an attack-controlled WebDav network share (<IP_ADDRESS>:80)
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Enumerated remote systems using LDAP queries
Criteria
powershell.exe making LDAP queries over port 389 to the Domain Controller (<IP_ADDRESS>)
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Established WinRM connection to remote host Scranton (<IP_ADDRESS>)
Criteria
Network connection to Scranton (<IP_ADDRESS>) over port 5985
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Established SMB session to remote host Scranton's (<IP_ADDRESS>) IPC$ share using PsExec
Criteria
SMB session to Scranton (<IP_ADDRESS>) over TCP port 445/135 OR evidence of usage of a Windows share
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Executed python.exe using PSExec
Criteria
python.exe spawned by PSEXESVC.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Recursively collected files found in C:\Users\Pam\ using PowerShell
Criteria
powershell.exe reading files in C:\Users\Pam\
Procedure
Staged files for exfiltration into ZIP (working.zip in AppData directory) using PowerShell
Criteria
powershell.exe creating the file working.zip
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Encrypted staged ZIP (working.zip in AppData directory) into working.zip (on Desktop) using rar.exe
Criteria
powershell.exe executing rar.exe with the -a parameter for a password to use for encryption
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Compressed staged ZIP (working.zip in AppData directory) into working.zip (on Desktop) using rar.exe
Criteria
powershell.exe executing rar.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Read and downloaded ZIP (working.zip on Desktop) over C2 channel (<IP_ADDRESS> over TCP port 8443)
Criteria
python.exe reading the file working.zip while connected to the C2 channel
Procedure
Deleted rar.exe on disk using SDelete
Criteria
sdelete64.exe deleting the file rar.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Deleted working.zip (from Desktop) on disk using SDelete
Criteria
sdelete64.exe deleting the file \Desktop\working.zip
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Deleted SDelete on disk using cmd.exe del command
Criteria
cmd.exe deleting the file sdelete64.exe
Procedure
Executed persistent service (javamtsup) on system startup
Criteria
javamtsup.exe spawning from services.exe
Procedure
Executed PowerShell payload via the CreateProcessWithToken API
Criteria
hostui.exe executing the CreateProcessWithToken API
Procedure
Manipulated the token of the PowerShell payload via the CreateProcessWithToken API
Criteria
hostui.exe manipulating the token of powershell.exe via the CreateProcessWithToken API OR powershell.exe executing with the stolen token of explorer.exe
Procedure
Decoded an embedded DLL payload to disk using certutil.exe
Criteria
certutil.exe decoding kxwn.lock
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Established Registry Run key persistence using PowerShell
Criteria
Addition of the Webcache subkey in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Executed PowerShell stager payload
Criteria
powershell.exe spawning from from the schemas ADS (powershell.exe)
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Established C2 channel (<IP_ADDRESS>) via PowerShell payload over port 443
Criteria
Established network channel over port 443
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Used HTTPS to transport C2 (<IP_ADDRESS>) traffic
Criteria
Established network channel over the HTTPS protocol
Procedure
Used HTTPS to encrypt C2 (<IP_ADDRESS>) traffic
Criteria
Evidence that the network data sent over the C2 channel is encrypted
Procedure
Created and executed a WMI class using PowerShell
Criteria
WMI Process (WmiPrvSE.exe) executing powershell.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Downloaded and dropped Mimikatz (m.exe) to disk
Criteria
powershell.exe downloading and/or the file write of m.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Enumerated the domain controller host NewYork (<IP_ADDRESS>) using LDAP queries
Criteria
powershell.exe making LDAP queries over port 389 via functions from System.DirectoryServices.dll
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Executed the ConvertSidToStringSid API call by reflectively loading Advapi32.dll
Criteria
powershell.exe executing the ConvertSidToStringSid API function by loading Advapi32.dll
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Established a WinRM connection to the domain controller host NewYork (<IP_ADDRESS>)
Criteria
Network connection to NewYork (<IP_ADDRESS>) over port 5985
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Read and collected a local file using PowerShell
Criteria
powershell.exe reading the file MITRE-ATTACK-EVALS.HTML
Procedure
Mapped a network drive to an online OneDrive account using PowerShell
Criteria
net.exe with command-line arguments then making a network connection to a public IP over port 443
Footnotes
- The logic for this detection was enabled after the start of the evaluation so the detection is identified as a Detection Configuration Change.
Procedure
Executed Run key persistence payload on user login using RunDll32
Criteria
rundll32.exe executing kxwn.lock
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Executed WMI persistence on user login
Criteria
The WMI process (wmiprvse.exe) executing powershell.exe
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Established a WinRM connection to the remote host Scranton (<IP_ADDRESS>) using the Golden Ticket as credentials
Criteria
Network connection to Scranton (<IP_ADDRESS>) over port 5985
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Procedure
Added a new user to the remote host Scranton (<IP_ADDRESS>) using net.exe
Criteria
net.exe adding the user Toby
Footnotes
- Though no image was captured, MITRE confirmed that the vendor has the capability to show available telemetry in a separate view.
Criteria
fodhelper.exe spawns cmd.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Process Monitoring
Criteria
fodhelper.exe spawns cmd.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Script Logs
- Process Monitoring
Criteria
explorer.exe reads C:\Users\jsmith\AppData\Local\Temp\Klog2.txt over to <IP_ADDRESS>
Data Sources
- Network Monitoring
Criteria
powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Process Monitoring
Criteria
powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Process Monitoring
Criteria
powershell.exe spawns samcat.exe as a high-integrity process (note: Due to the configuration of the environment, the adversary's process was high by default. This sub-step was evaluated based on the criteria of detecting data related to process integrity level as well as the executed mechanics of the UAC bypass)
Data Sources
- Windows Registry
- Process Monitoring
Criteria
AccountingIQ.exe queries HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\ and loads dll329.dll


Preparation time
30 mins to 1 hour
Cooking time
10 to 30 mins
Serves
Makes about 20
These deep-fried parcels of spicy chicken loveliness make a great starter for a dinner party. You will need 20 cocktail sticks for this recipe.
In a pestle and mortar (or a small blender), pound together the garlic, coriander root and the galangal. Add the palm sugar and make a smooth paste.
Put the mixture into a large bowl. Add the lime juice and a good pinch of white pepper. Add the sesame oil, Thai fish sauce and soy sauce. Mix thoroughly with the chicken in a shallow dish, cover with cling film and marinade in the fridge for half an hour.
For the sauce, mix all the sauce ingredients together in a bowl. Pour into a suitable serving bowl and leave to one side.
Take a large pan of boiling water and gently ease in the pandan leaves, blanching for 30 seconds and then remove and dry with some kitchen paper.
 Repeat to use up all the chicken and leaves.
Heat the oil in a pan, wok or a deep-fat fryer to 180C/350F (CAUTION: hot oil is dangerous. Do not leave unattended.)
Fry for eight minutes, or until the pandan is golden-brown and the chicken cooked through. You will need to cook the parcels in batches. Remove with a slotted spoon and drain on a plate lined with kitchen paper.
Serve with the sauce and wedges of lime.


Cash out requests are processed every Friday. Requests must be submitted by end of Thursday each week.
If you have any questions please contact<EMAIL_ADDRESS>You have no pending cash outs.
| Amount | Submitted | Status | Payment Method |
|---|---|---|---|
| {{cashOut.amount | currency}} | {{cashOut.created_at | date}} |
Pending
Sent {{cashOut.sent_at | date}}
Refunded {{cashOut.sent_at | date}}
Please Contact Customer Support
|
{{cashOut.type | title}} |


Cattleya Alliance Orchid Pages
Blc. Ports of Paradise 'Emerald Isle'
FCC/AOS
Cattleya Cognac 'The Best' x Fort Motte 'Cheetah'
Pot. Hoku Gem
Ctna. Cosmo-Sanguine
Go to the
Triangle Orchid Society's Homepage
Back to
Merlise Clyde's Homepage


Unicode Character Identifier (Javascript)info |
home | sources:
html -
css -
js
Automatic
DetailedChars: 0
✕
Unicode Character Identifier
Enter characters in the text field and click Submit to display character identification results. If the first checkbox
is ticked, the text will be processed automatically as you input it. If the second checkbox is ticked, the output will
include much more detailed information about each character.
The basic output looks like this:
a - U+0061 - LATIN SMALL LETTER A
[character] - [Unicode value] - [name]
In the detailed output, there are a number of character attributes that may displayed. Some, but not all, of these
are present on a given character. In some cases an attribute field may be omitted from the output because
it is missing, or because it has the "normal" or default value, as explained below.
General category: One of several classifications for a character.
Canonical combining classes: This attribute indicates how a combining character is ordered with the character
it combines with. Characters with a default value of 0 here do not display this attribute in their output.
Bidrectional category: Indicates the character's text directionality, such as left-to-right for Latin
characters.
Character decomposition mapping: Some characters can be represented by two or more "combining" characters, such
as an accented letter being represented by the unaccented letter plus the accent character. Other characters have a
single "normalized" form associated with them, such as full-width letters associated with their ordinary Latin
counterparts. The codes for any such characters appear in this field.
Decimal/digit/numeric value: If a character has an associated numeric value, it is indicated in one or more of
these attributes, with each accepting a different interpretation of a numeric value.
Mirrored: Whether a character is considered a mirrored form of another character (such as ">"). This attribute
always exists but is only shown in the output if the chracter is mirrored.
Lowercase mapping: The code for the lowercase equivalent of a character appears in this field.
Uppercase mapping: The code for the uppercase equivalent of a character appears in this field.
Titlecase mapping: The code for the titlecase equivalent of a character appears in this field.
This attribute is only shown in the output if it is different from "Uppercase mapping."


Game DB
A small example of a frontend for a computer game database.
Search
{{ props.row.game_igdb_id }}
{{ props.row.game_igdb_name }}
{{ props.row.game_rating | ratingdecimal }}
{{ props.row.game_rating_count }}


Based on your ROI needs and goals, we offer affordable and quality website design services that will sharply reflect your businesses.
Note: *Indicates start price of the package
Basic small business website development package. Perfect for start-ups or Home-business...
Very Popular small-business marketing package includes several tools to help promote your business and drive revenue...
Very Popular small-business marketing package includes several tools to help promote your business and drive revenue...
We strive to understand the clients’ requirements. Here, we listen to you to obtain objectives of the process. At this step, you can ask as many questions as you want and we assure you satisfactory answers to them.
After contemplating your requirements, we consider paper designing as part of the planning process. Sketching is all about how a simple pen and paper can transform the process of web designing unique and manageable.
The next step, we form a mock-up design to acquire feedback from the end users. We understand how important it is to accomplish the objectives and at the same time turn the design work well for the end users too.
At this step, we send you the design for reviewing, tweaking and approving the mock-ups until you are satisfied with the design. This is the right time to make changes, not after the design has been coded and developed.
It’s coding time. Here, we slice the final Photoshop mock-up and write the HTML and CSS code for the basic web design. We get the visuals together on the screen and validate all the code before moving ahead.
We run the website through the final diagnostics using the available tools from the developer end. At MandyWebDesign, we assure pixel-perfect design and make sure it is responsive and as per the W3C validation.
Now we fill the content provided by the client or our in-house writers. We establish a content management system to create and manage the digital content of your website without the interaction of a webmaster.
The next step, we take all the measures that can be taken directly within your website so that we improve its position in the search rankings. We optimize the content or may improve the meta tags too as a part of our website design services in India worldwide.
Also, as a part of web design services in India and worldwide, we provide image optimization services too. The image optimization leads to performance improvements for your website with largest byte savings. Thereby, the browser can download your website faster.
A vital part of the web design services in India and worldwide is the quality assurance stage. Prior to the launch of your website, we conduct final QA testing so that your website works according to your expectations and is user-friendly too.
delivered
We are not only aimed to provide the best website design and development, but also help you with the most engaging services to attract your target users.


Welcome, I'm Egemen and I'm an engineer and web developer from Turkey.
I've been working as a superstructure engineer at Turkish State Railways
I like to create web and mobile applications and games.
Don't hesitate to contact with me. I'm here for you!
akto[at]itu.edu.tr


UK weather forecast: 'Scandinavian chill' to grip Bonfire Night before snow hits
Temperatures are set to plunge to -4C this week with frost, ice and snow expected and Britain possibly set for its coldest November since 2010, say weather forecasters
by Chris Kitching, https://www.mirror.co.uk/authors/chris-kitching/Britain could see its coldest November since the 2010 Big Freeze with a 1,200-mile wide 'Scandinavian shiver' set to grip the country from Guy Fawkes Night.
Overnight temperatures are set to plunge to -4C in parts of the country this week, there is a risk of frost and ice and snow is expected over high ground from midweek.
The Met Office is predicting colder-than normal conditions lasting for at least a week, but the chilly snap could go on for much of the month.
Britons who are heading to Bonfire Night festivities have been told to wrap up and keep warm as cold air from Scandinavia arrives on Tuesday.
Most will shiver through 6-8C daytime maximum temperatures from Wednesday, with nights falling from -2C on Tuesday night to -4C by the weekend in the north.
Lows in the south will be just above the freezing mark.
Midweek sees Scotland face snow on high ground and ice worries, with 50mph gusts in the South West.
Heavy rain was falling in parts of Scotland on Sunday with flood alerts for Aberdeenshire and Dundee and Angus.
In England, there were two flood warnings (for Bristol Avon from Chippenham to Melksham, and River Esk from Briggswath to Ruswarp) and 43 alerts following Saturday's torrential downpours.
A flood warning was issued for the River Ritec at Tenby in Wales, in addition to four alerts as of Sunday evening.
The weather is set to turn colder after Britain was battered by hurricane-force winds of 109mph and heavy rain that caused flooding on Saturday.
Computer forecast models point to this November being the coldest since 2010, said The Weather Outlook.
A November average temperature under 4.9C, 1.3C below normal, would be the UK's coldest November since 2010, Met Office records show.
Weather maps show all of the UK with temperatures between 1C and 3C below average over the next week, a forecast by the UK-based European Centre for Medium-Range Weather Forecasts said.
The Big Freeze in 2010 began with -18C lows in Wales on November 28, followed by a month-long whiteout and travel mayhem with lows down to -19C in England and -21C in Scotland.
The Weather Outlook forecaster Brian Gaze said: “After a number of mild Novembers in recent years, computer models for the month ahead suggest this November is set to be the coldest since 2010.”
Forecaster John Hammond, of weathertrending, said: “There are similarities between the current set-up and November 2010.”
Met Office forecaster Luke Miall said: “A much colder spell of weather arrives as cold air sinks down from Scandinavia and the Arctic from Tuesday.
“Wrap up warm for Bonfire Night and wear wellies. After recent rain, there's the risk of cancellations for events using parking on grass.
“Tuesday night looks dry but frosty, with -2C lows in Scotland, with cold nights in the south as well later in the week and -4C possible
“Daytime temperatures will struggle to 6-8C for many this week, with midweek showers cold enough for snow in Scotland and to lower levels on Shetland, with 50mph gusts forecast in the South West.
“The pool of cold air stays with us and it looks like remaining on the cold side from the weekend onwards.”
A Met Office forecaster said: “Temperatures may stay below average this week, bringing the risk of frost and ice.
“November 17 to December 1 is more likely to be below-average at the start of the period, then become near-average towards the end of the month.”
Met Office five-day weather forecast
Sunday night
Rain will become heavy and locally persistent across eastern Scotland, accompanied by a strengthening easterly wind.
Elsewhere further bands of showery rain moving north-east.
Clear periods in between will lead to fog patches.
Monday
Heavy rain and strong winds will continue across eastern Scotland.
Elsewhere, fog patches may be slow to clear.
Many places will then see showers, locally heavy, with some bright spells.
Tuesday to Thursday
Rain across eastern areas on Tuesday but drier conditions in the northwest following south-east.
Frost early Wednesday but more rain spreading east, becoming persistent and heavy in places into Thursday.


Module: Utopia::Redirection
- Defined in:
- lib/utopia/redirection.rb
Overview
A middleware which assists with redirecting from one path to another.
Defined Under Namespace
Classes: ClientRedirect, DirectoryIndex, Errors, Moved, RequestFailure, Rewrite
Constant Summary collapse
- DEFAULT_MAX_AGE =
We cache 301 redirects for 24 hours.
3600*24


I get that little package in the mail, feeling like a kid on Christmas morning. Looking at it, I think I must have been tricked.   Trying this plant for the first time takes a bit of courage, for it is not marijuana. Salvia space can be quite scary. There are certainly no guarantees as to what this plant will bring.
Remember how most people don’t get high the initial time they smoke marijuana? The same is also true, oddly enough, for the much more powerful salvia. Smoking the first few bowls, I may still think I paid $20 for a gram of old coffee. At the start, I may only get a little tease of the drug’s effects. A few colors may drift through my visual field when I close my eyes. I might experience that distinct, yet hard to pinpoint, feeling of being slightly off-baseline. This is only the beginning of my voyages with this incredible plant teacher.
I will finally break through. Light alcohol usage can help get my mind into the proper space. It doesn’t take much more than a beer to potentiate salvia. When I finally break through, the experience will take me away. There is no going back. I remember when this happened to me for the first time. I was standing out on my porch smoking a bowl, when I realized that I had better find the nearest seat. Plopping down in an outdoor lawn chair, I began a very unusual mindtrip, which culminated in my stumbling inside due to the extreme cold.
The trip usually begins with a strange body sensation. All of a sudden, I feel as if a whole ton of weight has been pressed on top my body. Gravity takes on a new meaning. This is not the motion euphoria of alcohol or DXM. On the other hand, the sensation certainly brings no pain. For me, it serves as a nice segue into the experience, a physical correlation to being pulled into another mental world. Once the effects start, I am in for quite a ride. Salvia is definitely better than that rollercoaster I went on with in Disneyland!
It would be extraordinarily complicated to describe everything that might happen to me while under the influence. Nevertheless, it is appropriate to describe a few of the many sensations I have encountered in the land of salvia. Most notably, there is the Lady Salvia, whom I will meet sometimes during my journies. Apparently, she manifests herself quite frequently when people consume salvia. All in all, the Lady is quite an extraordinary woman. As my main spirit guide, it is her responsibility to take me to the myriad states of consciosuness I will experience while I travel. More than a simple tour guide, she also happens to be an unusually talented and passionate teacher. She will direct her insights through my brain and into my conscious mind. These tidbits of information will help me live my life in a more fulfilling manner, for the Lady wants me to exist as best I can.
Like my strict high school English teacher, who looked like an old witch, the Lady Saliva prefers not to mess around. She keeps no room in her classroom for those looking to get “messed up.” Similarly, she accepts new visitors with open arms. Those who are serious will take much wisdom from her. Those who like to joke around and get high will be shipped out of class, most probably to the Vice Principal’s Office. As I learned rather quickly, salvia space is no joke.
Unlike many other psychoactives, salvia has but a few physical effects. There is a definite heaviness present throughout the trip, but not comparable to the one experienced while stoned. After I return to Earth, I feel relaxed and content, almost as if I had just taken a hot bath after a long and trying day. This might be a good time to settle down to an enjoyable book, or, for the less intellectual explorers, to turn on the television. Feeling takes on a new meaning while under the grasp of salvia, but this is difficult to describe. In a few of my experiences, for example, my hands have taken on the role of a fence between different worlds. Physical concerns usually seem unimportant during these voyages. I certainly won’t be worrying about how I am feeling while I are entering and exiting different universes.
Guidelines for the trip will make a salvia journey much more comfortable and enjoyable. As with any strong psychedelic, I do not want to control the trip too much by setting excessive limitations. However, a few common sense rules will make things easier for the user. First of all, experiences with salvia should only occur when I have plenty of time to integrate what I will learn. This is not something I take a quick “hit” of at 5:30 before going out to dinner at 6:00. The effects of this drug do not last long, so any quiet time will serve well.
Physical settings have a huge impact upon the success or failure of a particular session. A powerful psychoactive like salvia should be taken in a calm environment. I never light up a bowl of this stuff at a concert or large party. Preferably, the voyage is taken alone, so that there are as few distractions as possible. A sober trip sitter could come in handy here, but is not entirely necessary if I remain lying in my bed or large recliner. Having the experience with a few friends could add to the atmosphere of exploration and discovery. These friends, however, should be seriously dedicated to working on themselves and finding new and more creative states of mind. Once again, salvia is not something to take with my drinking buddies.
The people involved in using the drug should probably go one at a time, while the others observe. At this point, silence is essential. Most trippers want the room to be dimly lit, free of commotion, and also devoid of noise. Any movement or sound can disturb the experience, for these special states of consciousness seem to be fragile. When the person emerging from salvia space wants to talk, then it is appropriate to begin discussing what that person went through. As a sacred plant, salvia is at its heart a way to expand the mind. It is not a party drug. It is not a toy. We all need to treat it carefully and respectfully.
Most people will tell I salvia is not a fun drug. They are absolutely right. For many people, this substance just doesn’t do the trick. It certainly doesn’t fit the bill for ordinary psychoactives. That is fine. Nevertheless, some psychonauts find this material extremely valuable. It is legal, enjoyable to consume, interesting, and safe. Not many drugs meet that high of a standard.
Experience Reports are the writings and opinions of the individual authors who submit them.
Some of the activities described are dangerous and/or illegal and none are recommended by Erowid.


T
- Tuple type.public interface TStream<T> extends TopologyElement
TStream
is a declaration of a continuous sequence of tuples. A
connected topology of streams and functional transformations is built using
Topology
. filter
, map (or transform)
or sink
this declared stream using a
function.
TStream
is not a runtime representation of a stream,
it is a declaration used in building a topology.
The actual runtime stream is created once the topology
is submitted
to a runtime.
| Modifier and Type | Method and Description |
|---|---|
TStream<java.lang.String> |
asString()
Convert this stream to a stream of
String tuples by calling
toString() on each tuple. |
TStream<T> |
filter(Predicate<T> predicate)
Declare a new stream that filters tuples from this stream.
|
<U> TStream<U> |
flatMap(Function<T,java.lang.Iterable<U>> mapper)
Declare a new stream that maps tuples from this stream into one or
more (or zero) tuples of a different type
U . |
java.util.Set<java.lang.String> |
getTags()
Returns the set of tags associated with this stream.
|
<K> TWindow<T,K> |
last(int count,
Function<T,K> keyFunction)
Declare a partitioned window that continually represents the last
count
tuples on this stream for each partition. |
<K> TWindow<T,K> |
last(long time,
java.util.concurrent.TimeUnit unit,
Function<T,K> keyFunction)
Declare a partitioned window that continually represents the last
time seconds of
tuples on this stream for each partition. |
<U> TStream<U> |
map(Function<T,U> mapper)
Declare a new stream that maps (or transforms) each tuple from this stream into one
(or zero) tuple of a different type
U . |
TStream<T> |
modify(UnaryOperator<T> modifier)
Declare a new stream that modifies each tuple from this stream into one
(or zero) tuple of the same type
T . |
TStream<T> |
peek(Consumer<T> peeker)
Declare a stream that contains the same contents as this stream while
peeking at each element using
peeker . |
<U> TStream<U> |
pipe(Pipe<T,U> pipe)
Declare a stream that contains the output of the specified
Pipe
oplet applied to this stream. |
TSink<T> |
print()
Utility method to print the contents of this stream
to
System.out at runtime. |
TSink<T> |
sink(Consumer<T> sinker)
Sink (terminate) this stream using a function.
|
TSink<T> |
sink(Sink<T> oplet)
Sink (terminate) this stream using a oplet.
|
java.util.List<TStream<T>> |
split(int n,
ToIntFunction<T> splitter)
Split a stream's tuples among
n streams as specified by
splitter . |
TStream<T> |
tag(java.lang.String... values)
Adds the specified tags to the stream.
|
TStream<T> |
union(java.util.Set<TStream<T>> others)
Declare a stream that will contain all tuples from this stream and all the
streams in
others . |
TStream<T> |
union(TStream<T> other)
Declare a stream that will contain all tuples from this stream and
other . |
topology
TStream<T> filter(Predicate<T> predicate)
t
on this stream will appear in the returned stream if
filter.test(t)
returns true
. If
filter.test(t)
returns false
then then t
will not
appear in the returned stream.
Examples of filtering out all empty strings from stream s
of type
String
TStream<String> s = ...
TStream<String> filtered = s.filter(t -> !t.isEmpty());
predicate
- Filtering logic to be executed against each tuple.<U> TStream<U> map(Function<T,U> mapper)
U
. For each tuple t
on this stream, the returned stream will contain a tuple that is the
result of mapper.apply(t)
when the return is not null
.
If mapper.apply(t)
returns null
then no tuple
is submitted to the returned stream for t
.
Examples of transforming a stream containing numeric values as
String
objects into a stream of Double
values.
// Using lambda expression
TStream<String> strings = ...
TStream<Double> doubles = strings.map(v -> Double.valueOf(v));
// Using method reference
TStream<String> strings = ...
TStream<Double> doubles = strings.map(Double::valueOf);
mapper
- Mapping logic to be executed against each tuple.U
mapped from this
stream's tuples.<U> TStream<U> flatMap(Function<T,java.lang.Iterable<U>> mapper)
U
. For each tuple
t
on this stream, the returned stream will contain all non-null tuples in
the Iterator<U>
that is the result of mapper.apply(t)
.
Tuples will be added to the returned stream in the order the iterator
returns them.
t
.
Examples of mapping a stream containing lines of text into a stream of words split out from each line. The order of the words in the stream will match the order of the words in the lines.
TStream<String> lines = ...
TStream<String> words = lines.flatMap(
line -> Arrays.asList(line.split(" ")));
U
- Type of mapped input tuples.mapper
- Mapper logic to be executed against each tuple.U
mapped and flattened from this
stream's tuples.java.util.List<TStream<T>> split(int n, ToIntFunction<T> splitter)
n
streams as specified by
splitter
.
For each tuple on the stream, splitter.applyAsInt(tuple)
is
called. The return value r
determines the destination stream:
if r < 0 the tuple is discarded else it is sent to the stream at position (r % n) in the returned array.
Each split TStream
is exposed by the API. The user has full
control over the each stream's processing pipeline. Each stream's
pipeline must be declared explicitly. Each stream can have different
processing pipelines.
An N-way split()
is logically equivalent to a collection of N
filter()
invocations, each with a predicate to select the tuples
for its stream. split()
is more efficient. Each tuple is analyzed
only once by a single splitter
instance to identify the
destination stream. For example, these are logically equivalent:
List<TStream<String>> streams = stream.split(2, tuple -> tuple.length()); TStream<String> stream0 = stream.filter(tuple -> (tuple.length() % 2) == 0); TStream<String> stream1 = stream.filter(tuple -> (tuple.length() % 2) == 1);
Example of splitting a stream of log records by their level attribute:
TStream<LogRecord> lrs = ...
List<<TStream<LogRecord>> splits = lrr.split(3, lr -> {
if (SEVERE.equals(lr.getLevel()))
return 0;
else if (WARNING.equals(lr.getLevel()))
return 1;
else
return 2;
});
splits.get(0). ... // SEVERE log record processing pipeline
splits.get(1). ... // WARNING log record processing pipeline
splits.get(2). ... // "other" log record processing pipeline
n
- the number of output streamssplitter
- the splitter functionn
streamsjava.lang.IllegalArgumentException
- if n <= 0
TStream<T> peek(Consumer<T> peeker)
peeker
. t
on this stream, peeker.accept(t)
will be
called.peeker
- Function to be called for each tuple.this
TSink<T> sink(Consumer<T> sinker)
t
on this stream
sinker.accept(t)
will be called. This is
typically used to send information to external systems, such as databases
or dashboards.
If sinker
implements AutoCloseable
, its close()
method will be called when the topology's execution is terminated.
Example of terminating a stream of String
tuples by printing them
to System.out
.
TStream<String> values = ...
values.sink(t -> System.out.println(tuple));
sinker
- Logic to be executed against each tuple on this stream.TSink<T> sink(Sink<T> oplet)
sink(Consumer)
with a full life-cycle of
the oplet as well as easy access to
runtime services
.oplet
- Oplet processes each tuple without producing output.<U> TStream<U> pipe(Pipe<T,U> pipe)
Pipe
oplet applied to this stream.U
- Tuple type of the returned stream.pipe
- The Pipe
oplet.TStream<T> modify(UnaryOperator<T> modifier)
T
. For each tuple t
on this stream, the returned stream will contain a tuple that is the
result of modifier.apply(t)
when the return is not null
.
The function may return the same reference as its input t
or
a different object of the same type.
If modifier.apply(t)
returns null
then no tuple
is submitted to the returned stream for t
.
Example of modifying a stream String
values by adding the suffix 'extra
'.
TStream<String> strings = ...
TStream<String> modifiedStrings = strings.modify(t -> t.concat("extra"));
This method is equivalent to
map(Function<T,T> modifier
).
modifier
- Modifier logic to be executed against each tuple.T
modified from this
stream's tuples.TStream<java.lang.String> asString()
String
tuples by calling
toString()
on each tuple. This is equivalent to
map(Object::toString)
.TSink<T> print()
System.out
at runtime. Each tuple is printed
using System.out.println(tuple)
.TSink
for the sink processing.<K> TWindow<T,K> last(int count, Function<T,K> keyFunction)
count
tuples on this stream for each partition. Each partition independently maintains the last
count
tuples for each key seen on this stream.
If no tuples have been seen on the stream for a key then the corresponding partition will be empty.
keyFunction
.
For each tuple on the stream keyFunction.apply(tuple)
is called
and the returned value is the tuple's key. For any two tuples ta,tb
in a partition
keyFunction.apply(ta).equals(keyFunction.apply(tb))
is true.
equals()
and hashCode()
correctly.
To create a window partitioned using the tuple as the key use identity()
as the key function.
To create an unpartitioned window use a key function that returns a constant,
by convention unpartitioned()
is recommended.
K
- Key type.count
- Number of tuples to maintain in each partition.keyFunction
- Function that defines the key for each tuple.count
tuples for each partition.<K> TWindow<T,K> last(long time, java.util.concurrent.TimeUnit unit, Function<T,K> keyFunction)
time
seconds of
tuples on this stream for each partition. If no tuples have been
seen on the stream for a key in the last time
seconds then the partition will be empty.
Each partition independently maintains the last
count
tuples for each key seen on this stream.
keyFunction
.
For each tuple on the stream keyFunction.apply(tuple)
is called
and the returned value is the tuple's key. For any two tuples ta,tb
in a partition
keyFunction.apply(ta).equals(keyFunction.apply(tb))
is true.
equals()
and hashCode()
correctly.
To create a window partitioned using the tuple as the key use identity()
as the key function.
To create an unpartitioned window use a key function that returns a constant,
by convention unpartitioned()
is recommended.
K
- Key type.time
- Time to retain a tuple in a partition.unit
- Unit for time
.keyFunction
- Function that defines the key for each tuple.count
tuple.TStream<T> union(TStream<T> other)
other
. A stream cannot be unioned with itself, in this case
this
will be returned.other
- this
and other
.TStream<T> union(java.util.Set<TStream<T>> others)
others
. A stream cannot be unioned with itself, in
this case the union will only contain tuples from this stream once. If
others
is empty or only contains this
then this
is returned.others
- Stream to union with this stream.this
and others
.TStream<T> tag(java.lang.String... values)
values
- Tag values.java.util.Set<java.lang.String> getTags()
Copyright IBM 2015,2016 - 2f6ad0e-20160307-0902


Golo Elevator
Code Elevator, Golo powered by
TypeUnSafe inc.
@typeunsafe
Based on the
Code Story contest
.


Jim Jefferies: ‘Life of Brian taught me more about religion than Sunday school'
by Harriet GibsoneThe Australian-American standup, political commentator and writer on the things that make him laugh the most
The funniest standup I’ve ever seen …
The first time I saw Andrew Maxwell down at the London Comedy Store. He completely destroyed.
The funniest sketch I’ve ever seen …
Tim Robinson’s “The bones are their money, so are the worms” from I Think You Should Leave. It’s parodying Johnny Cash making up a song, and then the guy on bass pipes in about skeletons. It’s too hard to explain. Go watch it.
The funniest heckle I’ve ever had …
I don’t know about funniest, but getting punched in the head at the Manchester Comedy Store was the most memorable. He may have said something funny before he hit me, but I was too concussed to remember.
The funniest TV show I’ve ever seen …
When I moved to Britain in 2000, I watched Da Ali G Show. I found it groundbreaking at the time and I still do.
The funniest film I’ve ever seen …
[Monty Python’s] Life of Brian is the funniest movie ever. I learned more about religion in Life of Brian than I did in Sunday school.
The funniest meal I’ve ever eaten …
I once had a beef wellington where they served spinach on the side. Hilarious. Who would put that together? It’s still a great story at parties.
The funniest joke I’ve ever heard …
“I don’t have a girlfriend, but I do know a woman who’d be mad at me for saying that” – Mitch Hedberg.


Intro
Transcript By: Bryan Bishop
Category: Conference
Introduction
Why are we here? We are here to write papers, code, make UI/UX mock-ups. If you want to work on something and it doesn’t fit into that category, then let us know. There might be other people that want to work on it too. We want you to find something you enjoy working on. If you feel you’re not as productive as you would like to be, then let us know and we’ll find something better for you to work on.
This is a new space, and we’re not the greatest at writing things down. Even if we write things down, it’s usually not up to date or easily indexable. Don’t assume that you know the terms. Define your terms, if you’re a community insider. The reason for these events is to get more people involved.
I want to call on Christopher Allen to give a little history about this work.
History of Rebooting
About 5 years ago, I met with some old timers. These were people working on the original pre-internet stuff, some of which are represented here, like the Xanadu team and people working on early RSA encryption but not on the internet stack. I also met with some of the early pioneers of security like the CTO of PGP or the coauthor of the TLS standard and so on. An argument ensued as to, how do we solve the problems we didn’t solve 20 years ago? A lot of people were very focused on incrementalism, like fixing the PGP problems or the TLS 1.3 problems. Or certificate transparency is going to solve all the problems of certificate authorities. My argument was no, we’ve hit the limits of our architecture and it’s time to reboot.
At that time, I was entering into the blockchain field. I was doing digital currency off and on since 1988. I did Digicash and lots of early stuff. I went away from it, though, ebcause it didn’t work and had other problems. Bitcoin proved to the world that there might be a solution here. The legacy security community was not really listening to this, and they were very skeptical of this, and in some cases for good reasons. But at least something was happening.
I brought together some leaders from the blockchain community and the security community and I wanted them to reboot the web of trust. At the first meeting, we had Vitalik Buterin and three of the lead Bitcoin Core developers. We had security folks from everywhere. We were short on diversity and things outside of the immediate blockchain community. We had some, but not enough.
Someone volunteered and said governments might be interested in this. Our next event, then, was at the United Nations. The refugee use case– the person who submitted the topic paper at the first Rebooting wasn’t able to make it, but her topic paper influenced the entire event. Almost all of the papers referred to the refugee use case in some fashion. We continued at the United Nations to define some requirements and figure out what problems we’re going to solve. Identifiers turned out to be that problem. Verifiable credentials already existed, but it is helped by having DIDs and DID documents. We continued to iterate on that.
We’re not at 4.5 years later. We’ve had over 50 high quality whitepapers submitted by you, on a wide variety of topics. A lot of interesting synergy. I hear there’s people interested in secure storage. Key management and social key recovery and all of that aspect of things; there were 3 or 4 papers with very different approaches with how to do key management. A lot of other topics emerging. How do we integrate our thoughts in regards to law and property and the real world of what is identity, with our thinking about self-sovereign identity? There were a number of papers submitted on that.
I think one of the biggest important commonalities was the human-ness of everything. We’re all people, and we’re a lot more than our digital selves. This is the first principle of self-sovereign identity: we are more than our digital world. I appreciate you coming to this event, not just the coder or the UI person or the policy expert. Thank you very much for being here.
rwot9
We want people to get into a collaborative mindset where we can think about creating new things. At the end of the day, we will self-divide into a few groups and then we will write an abstract about what our paper is going to be about. Over the next few days, we will write about what our paper is going to be about. Usually we have some good outlines, maybe some part of the text, and then we finish it up in the weeks or months that follow. My personal goal is to try and have papers done before the next Rebooting Web of Trust if possible. It’s not an absolute requirement; I’m happy to work with you however long it takes you. I have 3 that I am actively working on from rwot8 and probably a few others I don’t know about.
One of the things we wanted to do is do a call out to the papers that we finished from rwot8, which are 5 of them.
The first paper was “Evaluating social schemes for recovering control of an identifier”. The second one was “how SSI will survive capitalism”. Also the rwot8 DID specification refinement. We’ve done this a couple of times now where we get people together and we talk about the DID specification and how we can expand it and improve it. Also the “peer DID methods specification report”. It doesn’t actually use a blockchain or anything. Another one was a markdown-based javascript sandbox, using Jupyter. It’s a python tool, actually. This was a javascript version of it that Joe really wanted to push out. There was another one about DID-auth.


| TEZ-3219 |
Allow service plugins to define log locations link for remotely run task attempts |
Major |
. |
Hitesh Shah |
Hitesh Shah |
| TEZ-3227 |
Tez UI: Replace UI1 with UI2 |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3232 |
Disable randomFailingInputs in testFaulttolerance to unblock other tests |
Major |
. |
Hitesh Shah |
Hitesh Shah |
| TEZ-3207 |
Add support for fetching multiple partitions from the same source task to UnorderedKVInput |
Major |
. |
Ming Ma |
Ming Ma |
| TEZ-3203 |
DAG hangs when one of the upstream vertices has zero tasks |
Critical |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3233 |
Tez UI: Have LLAP information reflect in Tez UI |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3193 |
Deadlock in AM during task commit request |
Blocker |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3245 |
Race condition between addKnowInput and clearAndGetOnepartition of InputHost |
Major |
. |
Zhiyuan Yang |
Zhiyuan Yang |
| TEZ-3250 |
TezTaskRunner2 should accept ExecutorService |
Major |
. |
Prasanth Jayachandran |
Prasanth Jayachandran |
| TEZ-3251 |
Allow ability to add custom counters to TaskRunner2Callable |
Major |
. |
Prasanth Jayachandran |
Prasanth Jayachandran |
| TEZ-3256 |
[Backport HADOOP-11032] Remove Guava Stopwatch dependency |
Major |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-3254 |
Tez UI: Consider downloading Hive/Pig explain plans |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3255 |
Tez UI: Hide swimlane while displaying running DAGs from old versions of Tez |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3259 |
Tez UI: Build issue - File saver package is not working well with bower |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3237 |
Corrupted shuffle transfers to disk are not detected during transfer |
Major |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3262 |
Tez UI : zip.js is not having a bower friendly versioning system |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3257 |
Flaky TestUnorderedPartitionedKVWriter |
Major |
. |
Ming Ma |
Ming Ma |
| TEZ-3280 |
LOG MRInputHelpers split generation message as INFO |
Major |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-3276 |
Tez Example MRRSleep job fails when tez.staging-dir fs is not same as default FS |
Major |
. |
Sushmitha Sreenivasan |
Harish Jaiprakash |
| TEZ-3281 |
Tez UI: Swimlane improvements |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3289 |
Tez Example MRRSleep job does not set Staging dir correctly on secure cluster |
Major |
. |
Sushmitha Sreenivasan |
Harish Jaiprakash |
| TEZ-3264 |
Tez UI: UI discrepancies |
Minor |
UI |
Zhiyuan Yang |
Sreenath Somarajapuram |
| TEZ-2846 |
Flaky test: TestCommit.testVertexCommit_OnDAGSuccess |
Major |
. |
Hitesh Shah |
Hitesh Shah |
| TEZ-3292 |
Tez UI: UTs breaking with timezone change |
Blocker |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3290 |
Set full task attempt id string in configuration object |
Major |
. |
Prasanth Jayachandran |
Prasanth Jayachandran |
| TEZ-3295 |
TestOrderedWordCount should handle relative input/output paths |
Major |
. |
Sushmitha Sreenivasan |
Sushmitha Sreenivasan |
| TEZ-3298 |
Tez fails to compile against hadoop 2.8 after MAPREDUCE-5870 |
Major |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-3294 |
DAG.createDag() does not clear local state on repeat calls |
Major |
. |
Harish Jaiprakash |
Harish Jaiprakash |
| TEZ-3296 |
Tez job can hang if two vertices at the same root distance have different task requirements |
Critical |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3304 |
TestHistoryParser fails with Hadoop 2.7 |
Major |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-3305 |
TestAnalyzer fails on Hadoop 2.7 |
Major |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-3288 |
Tez UI: Display more details in the error bar |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3314 |
Double counting input bytes in MultiMRInput |
Major |
. |
Harish Jaiprakash |
Harish Jaiprakash |
| TEZ-3293 |
Fetch failures can cause a shuffle hang waiting for memory merge that never starts |
Critical |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3286 |
Allow clients to set processor reserved memory per vertex (instead of per container) |
Major |
. |
Wei Zheng |
Hitesh Shah |
| TEZ-3313 |
ATSFileParser : Wrong args passed in VersionInfo |
Minor |
. |
Rajesh Balamohan |
Rajesh Balamohan |
| TEZ-3318 |
Tez UI: Polling is not restarted after RM recovery |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3223 |
Support a NullHistoryLogger to disable history logging if needed. |
Trivial |
. |
Hitesh Shah |
Hitesh Shah |
| TEZ-3325 |
Flaky test in TestDAGImpl.testCounterLimits |
Major |
. |
Zhiyuan Yang |
Zhiyuan Yang |
| TEZ-3329 |
Tez ATS data is incomplete for a vertex which fails or gets killed before initialization |
Critical |
. |
Sushmitha Sreenivasan |
Sreenath Somarajapuram |
| TEZ-3337 |
Do not log empty fields of TaskAttemptFinishedEvent to avoid confusion |
Major |
. |
Zhiyuan Yang |
Zhiyuan Yang |
| TEZ-3356 |
Fix initializing of stats when custom ShuffleVertexManager is used |
Major |
. |
Peter Slawski |
Peter Slawski |
| TEZ-3348 |
NullPointerException in Tez MROutput while trying to write using Parquet's DeprecatedParquetOutputFormat |
Major |
. |
Piyush Narang |
Piyush Narang |
| TEZ-3333 |
Tez UI: Handle cases where Vertex/Task/Task Attempt data is missing |
Major |
. |
Sreenath Somarajapuram |
Sreenath Somarajapuram |
| TEZ-3379 |
Tez analyzer: Move sysout to log4j |
Trivial |
. |
Rajesh Balamohan |
Rajesh Balamohan |
| TEZ-3382 |
Tez analyzer: Should be resilient to new counters |
Minor |
. |
Rajesh Balamohan |
Rajesh Balamohan |
| TEZ-3384 |
Fix TestATSV15HistoryLoggingService::testDAGGroupingGroupingEnabled unit test |
Major |
. |
Sushmitha Sreenivasan |
Sushmitha Sreenivasan |
| TEZ-3398 |
Tez UI: Bread crumb link to Application from Application details dag/configuration tab is broken |
Critical |
. |
Sushmitha Sreenivasan |
Sreenath Somarajapuram |
| TEZ-3352 |
MRInputHelpers getStringProperty() should not fail if property value is null |
Major |
. |
Prasanth Jayachandran |
Prasanth Jayachandran |
| TEZ-3413 |
ConcurrentModificationException in HistoryEventTimelineConversion for AppLaunchedEvent |
Blocker |
. |
Jonathan Eagles |
Jonathan Eagles |
| TEZ-2852 |
TestVertexImpl fails due to race in AsyncDispatcher |
Critical |
. |
Jeff Zhang |
Zhiyuan Yang |
| TEZ-3009 |
Errors that occur during container task acquisition are not logged |
Major |
. |
Jason Lowe |
Jason Lowe |
| TEZ-3426 |
Second AM attempt launched for session mode and recovery disabled for certain cases |
Critical |
. |
Jonathan Eagles |
Jason Lowe |
| TEZ-3284 |
Synchronization for every write in UnorderdKVWriter |
Critical |
. |
Gopal V |
Jonathan Eagles |


This document describes the format of the Ace of Spades version 1 map file.
It is unclear what happens if you don't obey the "surface" voxel rule, i.e. supply colors for voxels which are hidden. They may work correctly, or they might break the voxlap engine since it loads the data unaltered. I haven't checked.
Similarly, I don't know what would happen if you stored data out of order or tried to encode 0-length top color runs.
The AoS map consists of a 2D array of "columns" of voxels. The 2D array is width * height in size; in the current file format width and height are both 512.
Each voxel column is stored independently of every other column.
AoS distinguishes between three kinds of voxels: open voxels (which represent air), solid voxels (which represent solid space, but which aren't visible), and colored voxels (which represent solid blocks which are visible, and so must be drawn as some particular color). Colored voxels are also called "surface voxels", because to be visible they must be exposed to air on at least one side, that is, they represent the "surface" of the object.
The file contains no header. The only way to detect that a file is an AoS map of type version 1 is to check the first 4 bytes and see if they are a legitimate span descriptor (see below).
The file stores the column data for each of the 2D map squares. These are stored left-to-right, top-to-bottom; the first column stored is (0,0), the 511th column stored is (511,0), and the 512th column stored is (0,1).
A span consists of the following runs of voxels in order:
(Note the straightforward rationale for this encoding: between any open voxel and invisible solid voxel, there must be a colored voxel. In a normal map, the ground is solid and the sky is air, so when encoding from the sky down, it makes sense to start with a run of air and end with a run of solid.)
Spans are stored sorted from top to bottom (from z=0 to z=63).
Each span is stored as the following sequence of bytes:
byte offset name meaning 0 N length of span data (N*4 bytes including span header) 1 S starting height of top colored run 2 E ending height of top colored run (length is E-S+1) 3 A starting height of air run (first span ignores value and assumes A=0) 4 + i*4 b blue color for colored voxel #i 5 + i*4 g green color for colored voxel #i 6 + i*4 r red color for colored voxel #i 7 + i*4 a alpha channel for colored voxel #i, actually used for shading in unknown way
Colors of both the top run and bottom run are stored in the array. i goes from 0 to N-1, first encoding the top colors, and then encoding the bottom colors. The voxel heights for the bottom colors are implied by the starting height of the air run of the next span; they appear just above the air.
The next byte after the above list (at 8+N*4) is the first byte of the next span of the column. Thus the location of the air run of the next span is at (8+N*4+3).
As a special case, an N value of 0 means this is the last span of the column. The last span contains air, a top-colored span, and all voxels below down to 63 are solid. The actual storage used by the span is determined by the number of top colors; in other words, it is 4*(1 + (E-S+1)). Thus, that is the offset to the first span of the next column.
We now summarize the interpretation of the lengths and positions of the runs.
Let K = E - S + 1
Let Z = (N-1) - K, or 0 if N=0
Let M = A stored in *next* span, or 64 if the last span of the column
Run Start End Length air A S-1 S-A top S E E-S+1 solid E+1 M-Z-1 M-Z - (E+1) bottom M-Z M-1 Z
Note the map is stored as 'map[x][y][z]', which is reversed from the traditional C way of storing things.
/* * this code is adapted from the sample code in vxlform.txt */ void setgeom(int x, int y, int z, int t) { assert(z >= 0 && z < 64); map[x][y][z] = t; } // need to convert for endianness here if we read 32-bits at a time void setcolor(int x, int y, int z, uint32 c) { assert(z >= 0 && z < 64); color[x][y][z] = c; } void load_map(uint8 *v, int len) { uint8 *base = v; int x,y,z; for (y=0; y < 512; ++y) { for (x=0; x < 512; ++x) { for (z=0; z < 64; ++z) { setgeom(x,y,z,1); } z = 0; for(;;) { uint32 *color; int i; int number_4byte_chunks = v[0]; int top_color_start = v[1]; int top_color_end = v[2]; // inclusive int bottom_color_start; int bottom_color_end; // exclusive int len_top; int len_bottom; for(i=z; i < top_color_start; i++) setgeom(x,y,i,0); color = (uint32 *) (v+4); for(z=top_color_start; z <= top_color_end; z++) setcolor(x,y,z,*color++); len_bottom = top_color_end - top_color_start + 1; // check for end of data marker if (number_4byte_chunks == 0) { // infer ACTUAL number of 4-byte chunks from the length of the color data v += 4 * (len_bottom + 1); break; } // infer the number of bottom colors in next span from chunk length len_top = (number_4byte_chunks-1) - len_bottom; // now skip the v pointer past the data to the beginning of the next span v += v[0]*4; bottom_color_end = v[3]; // aka air start bottom_color_start = bottom_color_end - len_top; for(z=bottom_color_start; z < bottom_color_end; ++z) { setcolor(x,y,z,*color++); } } } } assert(v-base == len); }
Note the map is stored as 'map[x][y][z]', which is reversed from the traditional C way of storing things.
int is_surface(int x, int y, int z) { if (map[x][y][z]==0) return 0; if (x > 0 && map[x-1][y][z]==0) return 1; if (x+1 < 512 && map[x+1][y][z]==0) return 1; if (y > 0 && map[x][y-1][z]==0) return 1; if (y+1 < 512 && map[x][y+1][z]==0) return 1; if (z > 0 && map[x][y][z-1]==0) return 1; if (z+1 < 64 && map[x][y][z+1]==0) return 1; return 0; } void write_color(FILE *f, uint32 color) { // assume color is ARGB native, but endianness is unknown // file format endianness is ARGB little endian, i.e. B,G,R,A fputc((uint8) (color >> 0), f); fputc((uint8) (color >> 8), f); fputc((uint8) (color >> 16), f); fputc((uint8) (color >> 24), f); } #define MAP_Z 64 void write_map(char *filename) { int i,j,k; FILE *f = fopen(filename, "wb"); for (j=0; j < 512; ++j) { for (i=0; i < 512; ++i) { int written_colors = 0; int backpatch_address = -1; int previous_bottom_colors = 0; int current_bottom_colors = 0; int middle_start = 0; k = 0; while (k < MAP_Z) { int z; int air_start; int top_colors_start; int top_colors_end; // exclusive int bottom_colors_start; int bottom_colors_end; // exclusive int top_colors_len; int bottom_colors_len; int colors; // find the air region air_start = k; while (k < MAP_Z && !map[i][j][k]) ++k; // find the top region top_colors_start = k; while (k < MAP_Z && is_surface(i,j,k)) ++k; top_colors_end = k; // now skip past the solid voxels while (k < MAP_Z && map[i][j][k] && !is_surface(i,j,k)) ++k; // at the end of the solid voxels, we have colored voxels. // in the "normal" case they're bottom colors; but it's // possible to have air-color-solid-color-solid-color-air, // which we encode as air-color-solid-0, 0-color-solid-air // so figure out if we have any bottom colors at this point bottom_colors_start = k; z = k; while (z < MAP_Z && is_surface(i,j,z)) ++z; if (z == MAP_Z || 0) ; // in this case, the bottom colors of this span are empty, because we'l emit as top colors else { // otherwise, these are real bottom colors so we can write them while (is_surface(i,j,k)) ++k; } bottom_colors_end = k; // now we're ready to write a span top_colors_len = top_colors_end - top_colors_start; bottom_colors_len = bottom_colors_end - bottom_colors_start; colors = top_colors_len + bottom_colors_len; if (k == MAP_Z) fputc(0,f); // last span else fputc(colors+1, f); fputc(top_colors_start, f); fputc(top_colors_end-1, f); fputc(air_start, f); for (z=0; z < top_colors_len; ++z) write_color(f, color[i][j][top_colors_start + z]); for (z=0; z < bottom_colors_len; ++z) write_color(f, color[i][j][bottom_colors_start + z]); } } } fclose(f); }
The Ace of Spades file format is an adaptation of the Voxlap VXL file format, by Ken Silverman. (http://advsys.net/ken)
The C code for reading a map provided above is a refactoring of the code from VXLFORM.TXT by Ken Silverman, refactored by Sean Barrett.
The C code for writing a map provided above and the textual description of the file format are by Sean Barrett. (http://silverspaceship.com)
This document is in the public domain. Please be polite when you change it.


Greetings commander,
Welcome to Primordial Prophecy, a multiplayer sci-fi game where you take control of your own spacecraft, and go on amazing adventures.
The game is in very very early stages of development, so there's bound to be crazy bugs, but I hope you still want to be a part of shaping the game to whatever you want it to be.
I hope you have lots of fun, see you in space.
Avo


When using next export
to do Static HTML export statically prerender pages, Next.js will detect if the page supports AMP and change the exporting behavior based on that.
For example, the hybrid AMP page pages/about.js
would output:
out/about.html
- HTML page with client-side React runtimeout/about.amp.html
- AMP pageAnd if pages/about.js
is an AMP-only page, then it would output:
out/about.html
- Optimized AMP pageNext.js will automatically insert a link to the AMP version of your page in the HTML version, so you don’t have to, like so:
<link rel="amphtml" href="/about.amp.html" />
And the AMP version of your page will include a link to the HTML page:
<link rel="canonical" href="/about" />
When trailingSlash
is enabled the exported pages for pages/about.js
would be:
out/about/index.html
- HTML pageout/about.amp/index.html
- AMP page


the and for was were The patients adenovirus with {background that CI: type margin {border-style epidemic infection px;} transmission #ffffff;} number outbreak this trainees median period rate time days disease dormitory duration from distribution generation not Medicine are had incubation respiratory symptoms unit hospitalization individuals intervals who Sciences control data influenza new susceptible used using attack characteristics clinical days). during military probability symptom than treatment which All Health Theater camp health isolated px; reproductive trainers within {font-family %), Fig Legend: Northern November after all among basic did fever file. font-size have human infected one patients. severe virus (DOCX) Adenoviruses Click Dis. Infect LINK []. acute additional area between body cases days, double; estimated here onset patient prevention provided rates training two (HN) .%, China Disease Patients Table border-color border-width contact different epidemiological function high hospital isolation solid; such temperature their three total trainees, {font-style {font-weight .). CDC China, Infectious LesslerJ, Nos. These This Viral bold boot but caused center closed collected courier; data. days. dining districts each em; individual information investigation method other outbreaks pt;} reason recruits refers respectively. results sent showed shown significantly symptoms. then time, types


BundleUtilities¶
Functions to help assemble a standalone bundle application.
A collection of CMake utility functions useful for dealing with .app
bundles on the Mac and bundle-like directories on any OS.
The following functions are provided by this module:
fixup_bundle
copy_and_fixup_bundle
verify_app
get_bundle_main_executable
get_dotapp_dir
get_bundle_and_executable
get_bundle_all_executables
get_item_key
get_item_rpaths
clear_bundle_keys
set_bundle_key_values
get_bundle_keys
copy_resolved_item_into_bundle
copy_resolved_framework_into_bundle
fixup_bundle_item
verify_bundle_prerequisites
verify_bundle_symlinks
Requires CMake 2.6 or greater because it uses function, break and
PARENT_SCOPE
. Also depends on GetPrerequisites.cmake
.
DO NOT USE THESE FUNCTIONS AT CONFIGURE TIME (from CMakeLists.txt
)!
Instead, invoke them from an install(CODE)
or
install(SCRIPT)
rule.
fixup_bundle(<app> <libs> <dirs>)
Fix up <app>
bundle in-place and make it standalone, such that it can be
drag-n-drop copied to another machine and run on that machine as long
as all of the system libraries are compatible.
If you pass plugins to fixup_bundle
as the libs parameter, you should
install them or copy them into the bundle before calling fixup_bundle
.
The <libs>
parameter is a list of libraries that must be fixed up, but
that cannot be determined by otool
output analysis (i.e. plugins
).
Gather all the keys for all the executables and libraries in a bundle, and then, for each key, copy each prerequisite into the bundle. Then fix each one up according to its own list of prerequisites.
Then clear all the keys and call verify_app
on the final bundle to
ensure that it is truly standalone.
As an optional parameter (IGNORE_ITEM
) a list of file names can be passed,
which are then ignored
(e.g. IGNORE_ITEM "vcredist_x86.exe;vcredist_x64.exe"
).
copy_and_fixup_bundle(<src> <dst> <libs> <dirs>)
Makes a copy of the bundle <src>
at location <dst>
and then fixes up
the new copied bundle in-place at <dst>
.
verify_app(<app>)
Verifies that an application <app>
appears valid based on running
analysis tools on it. Calls message(FATAL_ERROR)
if the application
is not verified.
As an optional parameter (IGNORE_ITEM
) a list of file names can be passed,
which are then ignored
(e.g. IGNORE_ITEM "vcredist_x86.exe;vcredist_x64.exe"
)
get_bundle_main_executable(<bundle> <result_var>)
The result will be the full path name of the bundle’s main executable
file or an error:
prefixed string if it could not be determined.
get_dotapp_dir(<exe> <dotapp_dir_var>)
Returns the nearest parent dir whose name ends with .app
given the
full path to an executable. If there is no such parent dir, then
simply return the dir containing the executable.
The returned directory may or may not exist.
get_bundle_and_executable(<app> <bundle_var> <executable_var> <valid_var>)
Takes either a .app
directory name or the name of an executable
nested inside a .app
directory and returns the path to the .app
directory in <bundle_var>
and the path to its main executable in
<executable_var>
.
get_bundle_all_executables(<bundle> <exes_var>)
Scans <bundle>
bundle recursively for all <exes_var>
executable
files and accumulates them into a variable.
get_item_key(<item> <key_var>)
Given <item>
file name, generate <key_var>
key that should be unique
considering the set of libraries that need copying or fixing up to
make a bundle standalone. This is essentially the file name including
extension with .
replaced by _
This key is used as a prefix for CMake variables so that we can associate a set of variables with a given item based on its key.
clear_bundle_keys(<keys_var>)
Loop over the <keys_var>
list of keys, clearing all the variables
associated with each key. After the loop, clear the list of keys itself.
Caller of get_bundle_keys
should call clear_bundle_keys
when done with
list of keys.
set_bundle_key_values(<keys_var> <context> <item> <exepath> <dirs>
<copyflag> [<rpaths>])
Add <keys_var>
key to the list (if necessary) for the given item.
If added, also set all the variables associated with that key.
get_bundle_keys(<app> <libs> <dirs> <keys_var>)
Loop over all the executable and library files within <app>
bundle (and
given as extra <libs>
) and accumulate a list of keys representing
them. Set values associated with each key such that we can loop over
all of them and copy prerequisite libs into the bundle and then do
appropriate install_name_tool
fixups.
As an optional parameter (IGNORE_ITEM
) a list of file names can be passed,
which are then ignored
(e.g. IGNORE_ITEM "vcredist_x86.exe;vcredist_x64.exe"
)
copy_resolved_item_into_bundle(<resolved_item> <resolved_embedded_item>)
Copy a resolved item into the bundle if necessary.
Copy is not necessary, if the <resolved_item>
is “the same as” the
<resolved_embedded_item>
.
copy_resolved_framework_into_bundle(<resolved_item> <resolved_embedded_item>)
Copy a resolved framework into the bundle if necessary.
Copy is not necessary, if the <resolved_item>
is “the same as” the
<resolved_embedded_item>
.
By default, BU_COPY_FULL_FRAMEWORK_CONTENTS
is not set. If you want
full frameworks embedded in your bundles, set
BU_COPY_FULL_FRAMEWORK_CONTENTS
to ON
before calling fixup_bundle. By
default, COPY_RESOLVED_FRAMEWORK_INTO_BUNDLE
copies the framework
dylib itself plus the framework Resources
directory.
fixup_bundle_item(<resolved_embedded_item> <exepath> <dirs>)
Get the direct/non-system prerequisites of the <resolved_embedded_item>
.
For each prerequisite, change the way it is referenced to the value of
the _EMBEDDED_ITEM
keyed variable for that prerequisite. (Most likely
changing to an @executable_path
style reference.)
This function requires that the <resolved_embedded_item>
be inside
the bundle already. In other words, if you pass plugins to fixup_bundle
as the libs parameter, you should install them or copy them into the
bundle before calling fixup_bundle
. The libs
parameter is a list of
libraries that must be fixed up, but that cannot be determined by
otool output analysis. (i.e., plugins
)
Also, change the id of the item being fixed up to its own
_EMBEDDED_ITEM
value.
Accumulate changes in a local variable and make one call to
install_name_tool
at the end of the function with all the changes at
once.
If the BU_CHMOD_BUNDLE_ITEMS
variable is set then bundle items will be
marked writable before install_name_tool
tries to change them.
verify_bundle_prerequisites(<bundle> <result_var> <info_var>)
Verifies that the sum of all prerequisites of all files inside the
bundle are contained within the bundle or are system
libraries,
presumed to exist everywhere.
As an optional parameter (IGNORE_ITEM
) a list of file names can be passed,
which are then ignored
(e.g. IGNORE_ITEM "vcredist_x86.exe;vcredist_x64.exe"
)
verify_bundle_symlinks(<bundle> <result_var> <info_var>)
Verifies that any symlinks found in the <bundle>
bundle point to other files
that are already also in the bundle… Anything that points to an
external file causes this function to fail the verification.