00:00:00.067-->00:00:05.072
>>So um, hi. I am Jeff and
I have a problem. I like to do,
eh, eh sorry [applause] I like

00:00:08.642-->00:00:13.647
to do bad things to worse
programming languages and for
the purposes of this talk, that

00:00:16.149-->00:00:21.555
means JAVA. Um.... >>Hiiiii Jeff
>>Thank you. Um, so, I'm going
to, right before I get into

00:00:21.555-->00:00:25.092
this, I, I do want to say that,
this is really like a
forty-minute talk distilled into

00:00:25.092-->00:00:30.264
twenty minutes. So, I have a lot
more material in the slides then
I'm specifically covering. I go

00:00:30.264-->00:00:35.936
through it really fast. And uh,
you, I recommend going through
the slides on their own, uh at

00:00:35.936-->00:00:41.041
some other point since they have
a lot of gems hidden in them. Uh
but so, getting back to, what is

00:00:41.041-->00:00:45.679
this talk about and why does it
matter? Um, this talk is about
injecting uh JRuby into Android

00:00:45.679-->00:00:49.149
applications to do function
hooking. And this might be
useful to you if you reverse

00:00:49.149-->00:00:53.754
Android apps or if you develop
them, it's just another
debugging tool honestly. Or if

00:00:53.754-->00:00:58.558
you have some strange
fascination with Ruby and/or
REPLs. So, um, going back in

00:00:58.558-->00:01:04.798
time a little bit um, I was
reversing this chat app called
Line that's really screwy and

00:01:04.798-->00:01:08.502
aside from the ProGuarding and
stuff which doesn't really
matter, um the main annoying

00:01:08.502-->00:01:12.572
part of it was that everything
was like an interface of
something else. And it was

00:01:12.572-->00:01:16.209
really annoying to find out what
objects actually weren't Runtime
and I was just writing a bunch

00:01:16.209-->00:01:20.447
one off hooks to like see what
the object was and then go off
and do it again. And this was

00:01:20.447-->00:01:25.419
getting real boring real fast.
So I decided, ya know, what if
we took all the interesting

00:01:25.419-->00:01:30.223
functions and wrapped them in
REPLs ya know. So you drop down
like a shell and you just kind

00:01:30.223-->00:01:33.860
of poke around at Runtime and
see what things are and see what
they have inside them all ad-hoc

00:01:33.860-->00:01:36.063
style so you don't have to like
write some code and then run it,
and then write some code and run

00:01:36.063-->00:01:41.735
it all over and over and again.
Um, so to take a step back a
little bit. Let's, let's talk

00:01:41.735-->00:01:45.706
about kind of what the, the
things you can do on Android
right now are. So you can use

00:01:45.706-->00:01:49.276
LD_PRELOAD. It's pretty
old-school. Native, native
hooking with native code for

00:01:49.276-->00:01:54.614
native functions. Ya know of
things like Lib C calls and
stuff. Um, I'm kind of skipping

00:01:54.614-->00:01:58.785
code as I go, I, I recommend
going over my slides as I said.
Um, then, then of course there's

00:01:58.785-->00:02:03.223
actually using the debugger
which is basically, um the JDWP
that you have in the normal JVM.

00:02:03.223-->00:02:07.594
ADB uh, exposes it. And there
are various ways of, of getting
into it, either be the app is

00:02:07.594-->00:02:12.866
debuggable or you have root and
stuff. The useful things from it
are that it can uh list all

00:02:12.866-->00:02:17.904
active instances of objects, uh
of all Java objects and, when
you set break points you can

00:02:17.904-->00:02:22.609
execute code in them from the
context of the frame where the
breakpoint got hit. Um so you

00:02:22.609-->00:02:26.546
can hit like, uh you can hit
like protected stuff and private
variables that can be hit by the

00:02:26.546-->00:02:31.251
code normally. It slows down the
app massively though, like
almost to the be point of being

00:02:31.251-->00:02:36.256
unusable. Um, but it is useful
for things. Um, it, there's a
lot of GUI stuff, a lot of GUI

00:02:36.256-->00:02:40.260
stuff. It's all terrible and
even the command line stuff for
it is basically toxic. You, you,

00:02:40.260-->00:02:44.598
you hit up and you get this
horrible 'A' character thing
because it doesn't handle like

00:02:44.598-->00:02:50.804
arrow keys. Uh, but it works.
Uh, moving on we have Frida,
which is sort of a new hotness,

00:02:50.804-->00:02:54.941
uh for a while. It works on
Android, it actually stomps over
the actual instructions in

00:02:54.941-->00:03:00.747
memory to ya know jump to its
own hooks. Um it also recently
has the capability to, uh

00:03:00.747-->00:03:04.951
inspect and list all the active
Java objects so you can just tap
one specific object. The

00:03:04.951-->00:03:08.388
functions hooks are generally
speaking being implemented in
Java scripts. Which is not, not

00:03:08.388-->00:03:11.892
something I like but uh, but it
works for many people and if you
don't want to do that you can

00:03:11.892-->00:03:17.697
use the um, the native C/GLIB
code, um Frida-gum to, to do
hooking with anything that

00:03:17.697-->00:03:22.703
compiles them like ya know
native code. Um there are many
ways to get it working. Um, but

00:03:22.703-->00:03:27.607
the hooks are fairly simple. Um
then of course we have Zygote,
which is the uh, uh sorry Xposed

00:03:27.607-->00:03:31.311
which is kind of the big main
framework for doing function
hooking on Android. Which

00:03:31.311-->00:03:36.483
actually modifies Zygotes uh
sort of, in it process that
forks into the actual apps. And,

00:03:36.483-->00:03:40.754
the really nice thing about it,
is that aside from being like
Java first or Dalvik first which

00:03:40.754-->00:03:45.025
means you just write stuff that
actually kind of has native
reflections access, into, into

00:03:45.025-->00:03:49.196
the code you're hooking. The
other cool thing is that it
hooks like always at the start

00:03:49.196-->00:03:53.967
of app start, reliably, even
early in boot um and so you can,
you can get very reliable hooks

00:03:53.967-->00:04:00.040
running without missing them by
accident. Um, it, it has a lot,
a lot, a lot of scaffolding but

00:04:00.040-->00:04:04.778
eventually you get to something
like, something like this. Where
um, it's, it's more or less the

00:04:04.778-->00:04:09.049
same thing as the, the Java
script code. Um, so now I have a
question for you. Who, who's

00:04:09.049-->00:04:13.753
that Pokémon? [inaudible
audience response] Meowth,
that's right, right, no that's

00:04:13.753-->00:04:18.091
wrong, sorry, Parasect, Parasect
is right. Um, so why am I
talking about Pokémon at my

00:04:18.091-->00:04:22.963
talk? [laughter] Um so Parasect
is a mushroom Pokémon and if you
didn't know um, the mushroom

00:04:22.963-->00:04:28.702
part on top of it is, is
actually the Pokémon. The uh,
the bug is, is a dead husk kind

00:04:28.702-->00:04:33.740
of marionetted by the mushroom
at this point. The dead white
milky eyes are sort of a hint.

00:04:33.740-->00:04:38.812
So, why, why again am I talking
about this? I wrote a tool
called ParaSpectre. And uh it,

00:04:38.812-->00:04:44.484
it carries basically all the
same roots as, as Parasect does
for the puns and things. Plus,

00:04:44.484-->00:04:50.624
plus what I got to
introspection. Um, and, and we
get this cute little guy. Um, so

00:04:50.624-->00:04:55.962
what is it actually though? Um
ParaSpectre is a function method
hooking tool for Android uh

00:04:55.962-->00:05:01.968
focused on Java. Um it injects a
full JRuby interpreter into a
target process so that you, the

00:05:01.968-->00:05:06.173
hooks that you run are JRuby.
They're easily reloaded every
time that you, you restart the,

00:05:06.173-->00:05:10.043
the um app. As opposed to Xposed
where every time you change the
code you actually have to reboot

00:05:10.043-->00:05:14.447
the phone itself. Um, its
implemented using Xposed but of
course the Java part doesn't

00:05:14.447-->00:05:20.854
change when you, when you change
your hook. Um and it has a bunch
of selectors that you can

00:05:20.854-->00:05:26.826
configure based on classes and
methods. Such as superclasses or
interfaces that are actually

00:05:26.826-->00:05:31.331
implemented by a class, um
it'll, it'll just figure out a
Runtime and if you don't want to

00:05:31.331-->00:05:35.435
pay the searching cost you can
just hardcode the name of the
class in. So, if you, if you

00:05:35.435-->00:05:38.872
just want to figure out what you
want to hook, you can, you can
use these and you can hard code

00:05:38.872-->00:05:43.710
it later so subsequent runs are
much faster. Um, not that
they're much slower in general.

00:05:43.710-->00:05:47.814
Um method matching uses the
method name, the argument type
signature, the return type and

00:05:47.814-->00:05:52.953
the exception signature and then
whatever the total set of those
combined, uh it'll, it'll find

00:05:52.953-->00:05:56.857
it or you can be as vague as you
want. If you just want to hook
two string on object, uh

00:05:56.857-->00:06:00.961
anything this subclasses object
you're going to get a lot of
stuff. Um, Ruby, uh JRuby really

00:06:00.961-->00:06:06.366
specifically is pretty useful in
this case. Much better that
Groovy was when I attempted it

00:06:06.366-->00:06:11.805
the first time. It has very good
interop with, with the Java
parts. Um, there are only a few

00:06:11.805-->00:06:15.108
cases where you have to do a
little bit of reflection to get
around some of the annoying

00:06:15.108-->00:06:18.778
ProGuard stuff. But in general
it doesn't really matter. The
really useful thing with the way

00:06:18.778-->00:06:22.882
that I load it in, is that I
load it under the sub- uh under
the class loader that is

00:06:22.882-->00:06:27.921
actually for the app itself. So,
it has native access to load
classes from the app without

00:06:27.921-->00:06:32.692
reflection. Whereas with Xposed,
you, you'd have to use a lot of
reflection to manipulate things.

00:06:32.692-->00:06:36.696
Um the other cool thing is that
because of this, you can
actually define your own

00:06:36.696-->00:06:43.236
subclasses and int-, interface
implementers for the Java code
of the actual app itself and

00:06:43.236-->00:06:48.642
then plug them in any functions
that take a callback function
basically. Um, but I kind of

00:06:48.642-->00:06:53.647
started this conversation with
REPLs and I'm getting back to it
now eventually. Um I use this

00:06:53.647-->00:06:57.617
thing called Pry which is a much
better REPL that IRB, the
default one that comes with Ruby

00:06:57.617-->00:07:01.254
which also didn't really want to
speak well over the network. Um
and it's got a whole bunch of

00:07:01.254-->00:07:06.059
fancy stuff that allows you to
introspect the sort of Ruby
runtime but also the Java one

00:07:06.059-->00:07:11.831
because of JRuby much better
than IRB would have, even. Um
there is this thing called

00:07:11.831-->00:07:18.238
pry-remote which is a gem that
kind of wraps Pry with this
crazy, crazy thing called DRuby

00:07:18.238-->00:07:22.208
which is basically Corpa for
Ruby. And if you know what Corpa
is you're shaking and throwing

00:07:22.208-->00:07:27.213
up, please, please do it in the
empty seat next to you. Um, it
has no authentication by its own

00:07:27.213-->00:07:32.452
which is scary because it's
basically without, without even
like using this to send strings

00:07:32.452-->00:07:36.556
to eval it basically is a dual
eval between the client and the
server in any direction

00:07:36.556-->00:07:41.328
apparently. So, its super scary
and doesn't have authentication.
So, I, I modified it, at least

00:07:41.328-->00:07:46.900
the one that I install on the
phone um to add authentication.
Then for the one you run locally

00:07:46.900-->00:07:51.371
I have an authenticating proxy I
wrote to sort of speak to that
so that at least other apps

00:07:51.371-->00:07:55.909
can't compromise the one that
you're actually hooking when
you're hooking it. Uh, then you,

00:07:55.909-->00:08:01.014
you drop down into uh, basically
with some connect back tmux
window that pops up with your

00:08:01.014-->00:08:04.451
shell and things work. For apps
that don't actually have the
internet permissions, this this

00:08:04.451-->00:08:09.789
needs networking and so I have a
bunch of hooks in using Xposed
that will basically force the

00:08:09.789-->00:08:13.193
internet permission in apps that
don't request it. They really
don't like that but I get it to

00:08:13.193-->00:08:18.465
work anyway. Um, for configuring
all this, this monstrosity I
actually have a jetty Servlet

00:08:18.465-->00:08:23.703
web app I actually run from the
device itself. Which was an
exercise in frustration but it

00:08:23.703-->00:08:28.708
works. Um and all the edits that
you make are actually tracked in
a Git repo on-device. So, if you

00:08:28.708-->00:08:33.146
really screw something up bad
you can always like ADB pull
that off the device and revert

00:08:33.146-->00:08:37.951
back to what you need to. Um,
it's also worth mentioning that,
that has authentication as well

00:08:37.951-->00:08:42.956
that works decently enough. Um,
but overall the flow is pretty
simple. Um, it, it, you edit

00:08:45.058-->00:08:49.996
config files, they're world
readable so that the hooks that
run within the context of the

00:08:49.996-->00:08:55.301
app you're hooking can read
them. Um, then I set up the
JRuby environment and then I

00:08:55.301-->00:08:59.172
iterate through all the classes
to do the searching and
selecting and stuff and then

00:08:59.172-->00:09:04.043
Xposed actually used to set up
the actual hook and then that
hook runs your Ruby code. Um,

00:09:04.043-->00:09:09.015
this is kind of what a hook
look, it's kind of quick and
dirty. Um, we hook this method

00:09:09.015-->00:09:14.354
and this class and then we just
print out what the argument is
and move on. But for anything

00:09:14.354-->00:09:18.425
more involved you'll use
something like this where you'll
actually have a file that you

00:09:18.425-->00:09:23.196
can also edit through the uh,
the web interface. Um, which
looks something like this. And

00:09:23.196-->00:09:28.334
this guy disables uh cert
validation, cert pinning and
also hard codes. My, my HB

00:09:28.334-->00:09:33.306
proxy, so that all the requests
made using okay HTP go through
my proxy even though that they

00:09:33.306-->00:09:38.611
normally speaking ignore, the
uh, the system proxy setting
unlike the WIFI setting. Um,

00:09:38.611-->00:09:43.683
you'd think this would be slow
but I, I cheat really, really
hard wherever I can. Um, so my,

00:09:43.683-->00:09:50.657
I try to load as much as the
JRuby in at uh, Zygote in it, um
and because of the way I do it I

00:09:50.657-->00:09:55.528
have to play some reflection
dark magic so I can force in the
class loader of the app to be

00:09:55.528-->00:09:59.432
the parent of the JRuby class
loader so that the classes
resolve correctly through the

00:09:59.432-->00:10:03.670
app instead of just up through
the default set of classes in
Android, um, that Zygote can

00:10:03.670-->00:10:09.175
see. Um, due to some bugs in
Android I can't actually set up
a whole container instance that

00:10:09.175-->00:10:13.313
runs the scripts in Zygote.
Because if Zygote takes too long
to start up the whole thing

00:10:13.313-->00:10:16.716
deadlocks. I have no idea why
this happens. It's really
spooky, I like it to s-, I'd

00:10:16.716-->00:10:21.921
like to see it get fixed. Um,
but uh so I have to, I have to
start up the containers actually

00:10:21.921-->00:10:26.092
in the app itself. And this,
this takes like six to seven
seconds generally but I try to

00:10:26.092-->00:10:30.597
paralyze it out so it's not
observable until a hook actually
runs and then it'll, it'll have

00:10:30.597-->00:10:35.134
to actually finish before the
hook will run. Um, for the class
searching and stuff, uh because

00:10:35.134-->00:10:39.472
the normal like class loader
searching stuff actually
searches the parent class loader

00:10:39.472-->00:10:44.744
first before it searches the
child, I yank out the internal
class loader for the, the DEX

00:10:44.744-->00:10:49.616
classes stuff on Android. Um,
using reflection and then I run
that and that saves a ton of

00:10:49.616-->00:10:55.355
time. Um, there's still this
problem with uh basically the
threading so um, there's this,

00:10:55.355-->00:10:59.425
the class loader lock you can't
actually load a class between,
it, it'll lock when you try to

00:10:59.425-->00:11:04.464
load a class. And so, the more
threads you have the slower it
goes. Um, so I eventually I

00:11:04.464-->00:11:07.534
might start parsing the DEX
files manually but I'm not at
that point yet because I haven't

00:11:07.534-->00:11:12.505
hit that as a performance road
block yet. Um, things run fast
enough, this went from taking

00:11:12.505-->00:11:15.875
thirty seconds of overhead to
being quote on quote
nigh-instantaneous. Which means

00:11:15.875-->00:11:20.280
that if you hit that six or
seven seconds you have to pay
for it. Um, searching is fast

00:11:20.280-->00:11:23.283
enough unless you hit something
like the Facebook app. Which
literally has a hundred thousand

00:11:23.283-->00:11:27.220
classes in it as of last time I
checked. And uh because of the
threading thing, that, that

00:11:27.220-->00:11:33.059
takes a while to go through
about thirty seconds. Um, yep.
Um, but this is still a lot

00:11:33.059-->00:11:36.763
faster than Xposed stuff, which
you know, you write your Java
code. You compile it, that takes

00:11:36.763-->00:11:41.434
however long, that takes. Um,
you actually copy it to the
device and then you install it

00:11:41.434-->00:11:44.070
and then you have to reboot the
file and then wait like two
minutes for the whole thing to

00:11:44.070-->00:11:48.775
finish if the phones encrypted.
So, let's, let's do some demos
shall we? Let's hope the

00:11:48.775-->00:11:55.248
download Gods are with us. So, I
have, um this phone, you can see
on the screen. Let's, let's do

00:11:55.248-->00:12:00.019
some math, shall we? What's a
good number, you know the life,
answer to life the universe and

00:12:00.019-->00:12:05.758
everything? [audience response]
Oh yea. So, let's, let's get
there shall we? Oh, what's that?

00:12:05.758-->00:12:12.565
That's interesting, that's,
that's not supposed to happen.
Apparently, we have a new

00:12:12.565-->00:12:17.570
answer. Um, so moving on, uh
like to what that way. Um, I
have this hook and hopefully

00:12:19.739-->00:12:23.243
it's, it's seeable on the screen
without too much of the flashing
giving people epileptic

00:12:23.243-->00:12:28.381
seizures. But basically, I have
this weird method in the
ProGuarded code. IT has this

00:12:28.381-->00:12:32.218
horrible function signa-,
signature. But it returns this
string. The string it returns is

00:12:32.218-->00:12:36.923
actually the result of the
calculation. And so, whenever
the, I- I- I- invoke it

00:12:36.923-->00:12:41.394
specifically um within the code
and when the value is something
I like, I do something entirely

00:12:41.394-->00:12:46.399
different. Um, moving on, I have
this, this UI demo where
basically um, I, I have a bunch

00:12:51.337-->00:12:55.675
of buttons and you, you click
the buttons and they, they do
stuff. And, and this, this is

00:12:55.675-->00:12:59.345
bad, if you've ever seen uihook
bridged you know that, that last
button is wrong. Let's do that

00:12:59.345-->00:13:04.083
one more time. You see, that's
now, that's what I'm talking
about. Um, attention duelists my

00:13:04.083-->00:13:09.756
hair has an announcement. Um,
so, the hook on this is
basically just on the, the text

00:13:09.756-->00:13:16.362
view stuff in the, the UI. And I
actually, when I see this hello
duelist string, I, I completely

00:13:16.362-->00:13:20.733
replace the on-click listener
associated with the button. So
the event handler for the button

00:13:20.733-->00:13:25.705
I replace with my own
implementation that sub classes
the on click listener class that

00:13:25.705-->00:13:30.443
is, is what it actually needs as
an interface to pass it to. So,
this one is now, when I hit the

00:13:30.443-->00:13:35.214
button the first time it swaps
out with my own class instance.
And then the second time

00:13:35.214-->00:13:40.219
actually jumps straight into my
code, no hooks anymore. Um, and
so moving on. Now let's, ya know

00:13:42.922-->00:13:47.927
this is fine and good and all.
Let's, let's tweet. Oh, what's
this? This is a shell. Who are

00:13:50.530-->00:13:55.535
you? Oh, main activity. Hmmm. It
says do some math fo- for me.
Ooo, ten. Okay, so, so this is,

00:14:00.840-->00:14:06.646
I'm in the shell right now. I
have access to all sorts of
things. This is the Pry. But

00:14:06.646-->00:14:10.316
let's, let's Tweet. Does
anybody, does anybody have any
requests? I know I'm asking a

00:14:10.316-->00:14:16.989
weird question to a weird crowd.
Anyone? Anyone want me to tweet
something? Anything. >>Yay

00:14:16.989-->00:14:21.994
>>Yay? Ok yay. >>Def Con
twenty-five. >>Okay. And now
we're back, we're back in the

00:14:28.000-->00:14:33.406
app. Um, and I actually, oh, I
need internet. That's, that's
important. That's super

00:14:33.406-->00:14:38.411
important actually. Let's see if
that worked. If it didn't work
I'll do it again. Nope. So,

00:14:44.751-->00:14:48.721
we'll, we'll do it one more
time. I, I have the one resume
method hooked and so every time

00:14:48.721-->00:14:53.726
it goes back to main activity,
uh, it'll jump back to my hook.
Uh, [inaudible sound] mmm, there

00:14:56.529-->00:15:01.467
you go. Kay, back here. Let's
see if it did something. Yea
okay, that one worked. Ok cool,

00:15:09.375-->00:15:14.380
networking how does it work.
[applause] Uh, so, so this hook
is a little bit interesting. Um

00:15:17.183-->00:15:23.122
if only because, uh let me skip
past the. The, these are the
proxy ones from before, from the

00:15:23.122-->00:15:27.527
slides. Uh, this one is a little
interesting because the uh, the
code for this. I , I actually

00:15:27.527-->00:15:31.831
just made my own method that
does a whole bunch of horrible
reflection and stuff into uh,

00:15:31.831-->00:15:35.935
into the insides of the Twitter
wrap. And I figured out what the
actual necessary functions to

00:15:35.935-->00:15:40.373
call for their rest APIs are
internally that actually do the
tweeting. I have no idea how to

00:15:40.373-->00:15:44.177
make replies right now. There
are some weird parameters in
here in this map thing that I

00:15:44.177-->00:15:49.482
think have to do with the reply
IDs and stuff but, whatever. It
works. Um, one interesting thing

00:15:49.482-->00:15:53.553
is that I do, I do load class
with reflection if only because
there's this, this 'A' field

00:15:53.553-->00:15:58.858
here which is a static um, when
you have a static internal
class, nested class that matches

00:15:58.858-->00:16:02.595
a static field um, with the
ProGuarding, you, you sort of
have to do this because the

00:16:02.595-->00:16:07.667
resolution order in JRuby takes
the method, uh, or takes the
field first and not the, not the

00:16:07.667-->00:16:14.507
class. Um, but, now where, where
can you get this magic tool?
You'll be able to get it there

00:16:14.507-->00:16:18.978
soon. The installation stuff I
want to clean up just a little
bit. Um, there's no way I'm

00:16:18.978-->00:16:21.814
getting around having to
reinstall it twice because of
the thing with the internet

00:16:21.814-->00:16:27.420
permission. It actually sets up
a hook for itself so that it can
grant permissions itself. But

00:16:27.420-->00:16:31.290
that requires you to reinstall
it so that the second install,
the hook runs in the package

00:16:31.290-->00:16:36.295
manager that then allows it to
take the permissions. Uh, so
only it can take the permission

00:16:36.295-->00:16:39.999
that it needs to grant
permissions and only it can be
used to grant the internet

00:16:39.999-->00:16:43.803
permissions to apps that don't
request it. So that's at least
pretty secure and locked down.

00:16:43.803-->00:16:47.807
Um, limitations. The DRuby stuff
is super scary. I'm going to get
to it. That's probably going to

00:16:47.807-->00:16:52.445
be its own talk, honestly. Since
it's just super, super
dangerous. Um, adding gems, not

00:16:52.445-->00:16:55.748
quite supported yet. Requires
some shenanigans. I'll, I'll
probably get around to that

00:16:55.748-->00:17:00.419
soon. Um, so the stuff, the
gems, I might make a UI to make
it fancier. Might just make it

00:17:00.419-->00:17:05.324
easier to do in the build
process. Um, the UI could use
just a little bit of work maybe.

00:17:05.324-->00:17:08.895
Um Android 7 compatibility isn't
there yet. Because Xposed
doesn't support it yet. Um, if

00:17:08.895-->00:17:14.233
and when it does, I have, I know
what I have to fix. Um, if it
doesn't, I, I have some plans on

00:17:14.233-->00:17:17.770
how I can, I can stop using
Xposed. But I'd, I'd prefer to
use it, because it's, it's

00:17:17.770-->00:17:21.073
useful for a whole bunch of
stuff. Um, I'd like to think a
whole bunch of people

00:17:21.073-->00:17:27.013
specifically, um Marcos, the
Scorpion Writer. Uh, aka Josie
our former intern who I

00:17:27.013-->00:17:32.652
basically sacrificed to this
thing, is a lot, for QA work.
Um, she wasn't able to make it

00:17:32.652-->00:17:37.657
out here today, but uh, thank,
thank you Josie. Um are there
any questions? You. [off-mic

00:17:41.427-->00:17:47.333
question] Oh, you want to know,
yea, of course, of course. So,
uh. Trump the Ruby has, has

00:17:47.333-->00:17:51.904
this, this wonderful thing. It's
just string replace. So, if we,
we go to search for um, well

00:17:51.904-->00:17:56.909
maybe not our favorite president
but a president. I mean some,
someone's favorite, ya know? He

00:17:59.278-->00:18:04.216
uh, he's apparently a fan.
[laughter] [applause] Uh, any,
any other questions? [applause]

00:18:12.591-->00:18:17.596
Uh, was that a, no, what that a
question? Ok. Anyone else? Okay,
thank you everyone. [applause]