InCTF2021

InCTF 2021

find_plut0

find_plut0.txt 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
import angr
import claripy
from z3 import *
flag = claripy.BVS("flag", 8 * 30)
p = angr.Project("binaries/find_plut0")
base = 0x400000

state = p.factory.blank_state(addr=base + 0xBA0)

state.memory.store(base + 0x202100, flag)

sim = p.factory.simgr(state)

for byte in flag.chop(8):
    state.add_constraints(byte >= 32) # ' '
    state.add_constraints(byte <= 128) # '~'

def myfind(state):
    rip = state.solver.eval(state.regs.rip)
    print(hex(rip))
    return base + 0xADB  == rip

res = sim.explore(find=myfind, avoid=[base + 0xAFD])
print(res.found)
resState = res.found[0]
flag2 = resState.memory.load(base + 0x202100, 30)
print(resState.solver.eval(flag2, cast_to=bytes))
print(resState.solver.eval(flag, cast_to=bytes))

REplica

main_replica.txt

输入由命令行输入，在比较位置下断点提取数据观察即可。

简单的 rust 逆向

1
2
3
4
5
6
7
8
9
10
11
target = '0kedtZ6fYO3aX4lPNMSgQbRwh'
t1 = '0123456789XABCDEFGHIJKLMN'
t2 = 'NMKG98F76JED54LICB32HAX10'
t3 = []
result = [0] * 25
for c in t2:
    t3.append(t1.find(c))

for i in range(25):
    result[t3[i]] = target[i]
print("".join(result))

Alpha Pie

bfs 转弯, 算法太差了, 要靠运气跑通

在规定转弯次数内将图移动成指定样子

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
from pwn import *
import copy

context.log_level = 'debug'
p = remote("misc.challenge.bi0s.in", 1337)
p.sendlineafter(b"Press 'y' to start: ", b"y")

def recv_level():
    p.recvuntil(b"Max number of moves allowed:")
    max_moves = int(p.recvline(), 10)
    p.recvline()
    mat1 = []
    mat2 = []
    while True:
        data = p.recvline()
        data = data.strip()
        data = data.replace(b" ", b"")
        if b'+-------' in data:
            break
        cords = [c for c in data.split(b"|") if c != b""]
        baseline = len(cords) // 2
        mat1.append(cords[0:baseline])
        mat2.append(cords[baseline:])
    return mat1, mat2, max_moves

def get_fucks(mat):
    return [(x, y) for y in range(len(mat)) for x in range(len(mat[y])) if mat[y][x] != b'0']

def make_hist(start_p, end_p, mat,hist):
    sym = mat[start_p[1]][start_p[0]]
    if start_p[0] == end_p[0]: # y diffs
        start_pos = min(start_p[1], end_p[1])
        end_pos =  max(start_p[1], end_p[1])
        for i in range(start_pos, end_pos):
            hist[i][start_p[0]].append(sym)
        return

    if start_p[1] == start_p[1]:
        start_pos = min(start_p[0], end_p[0])
        end_pos =  max(start_p[0], end_p[0])
        for i in range(start_pos, end_pos):
            hist[start_p[1]][i].append(sym)
        return
    raise

def gen_next(mat1, targetPos, history, curPoint):
    x = curPoint[0]
    y = curPoint[1]
    assert mat1[y][x] != b'0'

    target = targetPos[mat1[y][x]]
    if target  == (x, y):
        return []
    # find mat1[y][x] in mat2

    saved_x, saved_y = x, y
    next_dir = []

    # left
    while x - 1 >= 0 and mat1[y][x] not in history[y][x - 1] and mat1[y][x - 1] == b'0' and x - 1 >= target[0]:
        x -= 1
    if saved_x != x:
        next_dir.append((x, y))
    x, y = saved_x, saved_y

    # right
    while x + 1 < len(mat1[0]) and mat1[y][x] not in history[y][x + 1] and mat1[y][x + 1] == b'0' and x + 1 <= target[0]:
        x += 1
    if saved_x != x:
        next_dir.append((x, y))
    x, y = saved_x, saved_y

    # up
    while y - 1 >= 0 and mat1[y][x] not in history[y - 1][x] and mat1[y - 1][x] == b'0' and  y - 1 >= target[1]:
        y -= 1
    if saved_y != y: 
        next_dir.append((x, y))

    x, y = saved_x, saved_y
    
    # down
    while y + 1 < len(mat1) and mat1[y][x] not in history[y + 1][x] and mat1[y + 1][x] == b'0' and y + 1 <= target[1]:
        y += 1
    if saved_y != y: 
        next_dir.append((x, y))
    return next_dir

def printMat(mat):
    for y in mat:
        for x in y:
            print(x.decode('ascii'), end=" ")
        print("")
    print("=============")

def solve():
    mat1, mat2, max1 = recv_level()

    targetPos = dict()

    for y in range(len(mat2)):
        for x in range(len(mat2[0])):
            if mat2[y][x] != b'0':
                targetPos[mat2[y][x]] = (x, y)
    

    def dfs(mat1, history, track):
        #printMat(mat1)
        if mat1 == mat2:
            print("find:", track)
            # check valid
            if len(track) <= max1:
                solved = track
                print("real find:", track)
                return track
            else:
                return None
        if len(track) > max1:
            return None

        for f in get_fucks(mat1):
            all_next = gen_next(mat1, targetPos, history, f)
            
            for the_next in all_next:
                new_mat1 = copy.deepcopy(mat1)
                new_hist = copy.deepcopy(history)
                new_track = copy.deepcopy(track)

                make_hist(f, the_next, mat1, new_hist)
                #new_hist[f[1]][f[0]].append(new_mat1[f[1]][f[0]])
                
                new_mat1[the_next[1]][the_next[0]] = new_mat1[f[1]][f[0]]
                new_mat1[f[1]][f[0]] = b'0'
                new_track.append((f, the_next))
                res = dfs(new_mat1, new_hist, new_track)
                if res != None:
                    return res 

    hist = [[[] for i in range(len(mat1))] for j in range(len(mat1[0]))]
    solved = dfs(mat1, hist, [])
    if solved != None:
        for way in solved:
            fx = way[0][1]
            fy = way[0][0]
            tx = way[1][1]
            ty = way[1][0]
            tt = "%d,%d,%d,%d" % ((fx, fy, tx, ty))
            p.sendlineafter(",to-y-cord ' : ", tt)

for i in range(9):
    solve()
p.interactive()

Adventures of Lonely Knight

full_game.nes

模拟器 + 调试器: https://github.com/SourMesen/Mesen/releases

参考链接: https://blog.attify.com/flare-on-6-ctf-writeup-part8/

这道题，思路大概是先找到血量，再下内存断点找到读写血附近的代码。

再分析死亡逻辑，找到关键变量地址 0x68 ， 只要该值不为 0 就可以直接通关(其实是非预期解)

钥匙判断逻辑

FlagChecker

flagchecker.txt

虚拟机逆向，需要编写 decompiler

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
bytecode = [0x00000006, 0x00000000, 0x0000000B, 0x00000006, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x00000008, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000010, 0x0000000B, 0x00000008, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x00000018, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000006, 0x0000001F, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000004, 0x00000009, 0x00000003, 0x0000008C, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000001, 0x0000000B, 0x00000002, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x00000009, 0x0000000B, 0x00000006, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000011, 0x0000000B, 0x00000001, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x00000019, 0x0000000B, 0x00000000, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000009, 0x00000003, 0x000000E1, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000002, 0x0000000B, 0x00000000, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000A, 0x0000000B, 0x00000004, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000012, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x0000001A, 0x0000000B, 0x00000002, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000006, 0x00000020, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000004, 0x00000009, 0x00000003, 0x0000012B, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000003, 0x0000000B, 0x00000008, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000B, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000013, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x0000001B, 0x0000000B, 0x00000007, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000009, 0x00000003, 0x00000167, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000004, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000C, 0x0000000B, 0x00000008, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000014, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x0000001C, 0x0000000B, 0x00000008, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000006, 0x00000021, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000004, 0x00000009, 0x00000003, 0x000002B1, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000005, 0x0000000B, 0x00000006, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000D, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000015, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x0000001D, 0x0000000B, 0x00000006, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000009, 0x00000003, 0x00000190, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000006, 0x0000000B, 0x00000001, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000E, 0x0000000B, 0x00000000, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000016, 0x0000000B, 0x00000004, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x0000001E, 0x0000000B, 0x00000002, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000006, 0x00000022, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000004, 0x00000009, 0x00000003, 0x000001F4, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000006, 0x00000007, 0x0000000B, 0x00000005, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000000, 0x00000006, 0x0000000F, 0x0000000B, 0x00000003, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000001, 0x00000006, 0x00000017, 0x0000000B, 0x00000001, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000002, 0x00000006, 0x00000023, 0x0000000B, 0x00000008, 0x00000007, 0x00000004, 0x00000001, 0x00000008, 0x00000003, 0x00000009, 0x00000003, 0x000001EB, 0x00000004, 0x00000002, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000005, 0x0000000A, 0x00000003, 0x00000081, 0x00000004, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000005, 0x0000000C, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000]

class disasm:
    def __init__(self, bytecode) -> None:
        self.bytecode = bytecode

    def addr_transfer(self, addr):
        return "_" + hex(addr)[2:]

    def disasm(self):
        pc = 0
        all_asm = ''
        while pc < 3828:
            opcode = self.bytecode[pc]
            asm_text = ''
            if opcode == 1:
                asm_text = "%s: reg_char = Memory[reg_addr]" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 2:
                asm_text = '%s:  puts("Checking flag...");' % self.addr_transfer(pc)
                pc += 1
            elif opcode == 3:
                asm_text = "%s: reg_int = %d" % (self.addr_transfer(pc), self.bytecode[pc + 1])
                pc += 2
            elif opcode == 4:
                asm_text = """%s:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;""" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 5:
                asm_text = "%s: reg_int += 1" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 6:
                # reg_char = flag[bytecode[i + 1]];
                asm_text = "%s: reg_char = flag[%d]" % (self.addr_transfer(pc), self.bytecode[pc + 1])
                pc += 2
            elif opcode == 7:
                asm_text = "%s: reg_int = reg_char" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 8:
                asm_text = "%s: buffer[%d] = reg_char" % (self.addr_transfer(pc), self.bytecode[pc + 1])
                pc += 2
            elif opcode == 9:
                asm_text = """%s:
buffer2 = malloc(0xC8uLL);
buffer2 = sub_117B(buffer);
v9 = 0;
buffer = malloc(5uLL);""" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 10:
                asm_text = """%s: 
if ( Memory[reg_int] != buffer2[v9]) )
    v6 = 10;
++v9;""" % self.addr_transfer(pc)
                pc += 1
            elif opcode == 11:
                asm_text = "%s: if ((char)(reg_char %% 9) != %d) v6 = 10;" % (self.addr_transfer(pc), self.bytecode[pc + 1])
                pc += 2
            elif opcode == 12:
                asm_text = "%s: putchar(Memory[reg_int + v6])" % self.addr_transfer(pc)
                pc += 1
            else:
                print(opcode, pc)
            asm_text += ";\n"
            all_asm += asm_text
        open("result.cpp", "w").write(all_asm)
dis = disasm(bytecode)
dis.disasm()

得到反编译结果如下 (片段)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
_0: reg_char = flag[0];
_2: if ((char)(reg_char % 9) != 6) v6 = 10;;
_4: reg_int = reg_char;
_5:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr
_6: reg_char = Memory[reg_addr];
_7: buffer[0] = reg_char;

_9: reg_char = flag[8];
_b: if ((char)(reg_char % 9) != 5) v6 = 10;;
_d: reg_int = reg_char;
_e:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;;
_f: reg_char = Memory[reg_addr];
_10: buffer[1] = reg_char;
_12: reg_char = flag[16];
_14: if ((char)(reg_char % 9) != 8) v6 = 10;;
_16: reg_int = reg_char;
_17:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;;
_18: reg_char = Memory[reg_addr];
_19: buffer[2] = reg_char;
_1b: reg_char = flag[24];
_1d: if ((char)(reg_char % 9) != 3) v6 = 10;;
_1f: reg_int = reg_char;
_20:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;;
_21: reg_char = Memory[reg_addr];
_22: buffer[3] = reg_char;
_24: reg_char = flag[31];
_26: if ((char)(reg_char % 9) != 3) v6 = 10;;
_28: reg_int = reg_char;
_29:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;;
_2a: reg_char = Memory[reg_addr];
_2b: buffer[4] = reg_char;
_2d:
buffer2 = malloc(0xC8uLL);
buffer2 = sub_117B(buffer);
v9 = 0;
buffer = malloc(5uLL);;
_2e: reg_int = 140;
_30:
v3 = base64(reg_int, dest, 10);
strcpy(dest, v3);
reg_addr = strtol(dest, 0LL, 16);
reg_int = reg_addr;;
_31:  puts("Checking flag...");;
_32: 
if ( Memory[reg_int] != buffer2[v9]) )

这是一组数据的验证，一共有 8 组这样的验证，一共验证 flag 36 个字符。

这一组验证中，flag[x] 经过变换得到 buffer [n] 且 需要满足模数条件， 一组 buffer 计算完成后调用 sub_117B 进一步计算，最终再把该函数的返回值与目标数据比较。

flag[x] 到 buffer[n] 不是唯一映射, 所以有模数限制。

映射关系如下

1
2
// Input: 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
// Output:8472001712585036770886014270876835165635f3254476f3554f516ff338

sub_117B 的输入是4个字符或5个字符，字符集为0 - 8

这个函数利用 fork 实现递归，简单 patch 后进行爆破即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
from pwn import *
import json
import os
from multiprocessing.dummy import Pool as ThreadPool

threads = 10

tasks2 = [[] for i in range(threads)]
tresult = []
def RunT2(n):
    for m in tasks2[n]:
        while True:
            try:
                p = process("/home/pandaos/Desktop/fuck/f%d/flagchecker1" % n, cwd = "/home/pandaos/Desktop/fuck/f%d/" % n)
                try:
                    path = "/home/pandaos/Desktop/fuck/f%d/check" % n
                    if os.path.exists(path):
                        os.remove(path)
                except Exception:
                    pass
                p.sendline(m.encode("ascii"))
                data = p.recvline()
                if b'Can' in data or b'Cannot' in data:
                    raise
                break
            except Exception:
                continue
            finally:
                p.close()

        tresult.append((m, data))

fuck_table = '012345678'
i = [0] * 5
data_map = dict()
tasks = []
k = 0
tmp_task = []
for i[0] in fuck_table:
    for i[1] in fuck_table:
        for i[2] in fuck_table:
            for i[3] in fuck_table:
                for i[4] in fuck_table:
                    test = "".join(i)
                    tasks.append((test, k % 10))
                    tasks2[k % 10].append(test)      
                    k += 1

mythreads = []
for i in range(threads):
    th = threading.Thread(target=RunT2, args=(i, ))
    th.start()
    mythreads.append(th)

for th in mythreads:
    th.join()

print(tresult)
open("ffk.json", "w").write(str(tresult))

提取比较数据后在爆破结果中查找对应的输入

比较数据与对应的 sub_117B 输入参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
84721
234231224221234231224221233423312324232124342431242424212434243124242421243342433124324243212342312242212342312242212334233123242321343124213431242133433132432143443142442143443142442143344331432443213431242134312421334331324321

1138
44244442444432443442444452445412414124141324134124141524151421414214143214314214145214511211112111132113112111152115

80481
224221242124242421244241224221242125242521254251254242542125442541252425212542512242212421242424212442412242212421242141424421444124214152452154515424542154454152452154512421414244214441242141

224262646622426264663232432632633436362242626466224262646632324326326334363632324326326334363632324326326334363633233243326332633334336336

57518
444244444124414342434431243145424544512451444244444124414342434431243145424544512451434424344434124341433424334433124331435424354435124351344234434123413342334331233135423543512351344234434123413342334331233135423543512351334423344334123341333423334333123331335423354335123351544254454125415342534531253155425545512551544254454125415342534531253155425545512551534425344534125341533425334533125331535425354535125351

343335344343345343335344343345344434433445344343345343335344343345343335242325244243245242325244243245244424432445244243245242325244243245242325

02162
34334234433442346334623463346231331231433142316331623163316224324224432442246324622463246221321221432142216321622163216253435342534435344253463534625346353462531353125314353142531635316253163531625243524252443524425246352462524635246252135212521435214252163521625216352162343342344334423463346234633462313312314331423163316231633162243242244324422463246224632462213212214321422163216221632162

1854
424424442442342344234254254425444444443434434545445124124412412312341231251254125141441413134131515415Try Again

最后计算 flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
flag = [0] * 36

t1 = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\]^_`{|}~'
t2 = '80230103415684857787827121576760008653455327627513233564681454fffffff3003058723412112363462845'

dict_data = {}
for i in range(len(t2)):
    if t2[i] not in dict_data:
        dict_data[t2[i]] = []
    dict_data[t2[i]] += t1[i]
print(dict_data)

def mrev(ch, idx):
    tt = '658332610045238537383836556104255318'
    for x in dict_data[ch]:
        if ord(x) % 9 == int(tt[idx]):
            return x
    raise

#84721
flag[0]  = mrev('8', 0)
flag[8]  = mrev('4', 1)
flag[16] = mrev('7', 2)
flag[24] = mrev('2', 3)
flag[31] = mrev('1', 4)

#1138
flag[1] =  mrev('1', 5)
flag[9] =  mrev('1', 6)
flag[17] = mrev('3', 7)
flag[25] = mrev('8', 8)

#80481
flag[2]  = mrev('8', 9)
flag[10] = mrev('0', 10)
flag[18] = mrev('4', 11)
flag[26] = mrev('8', 12)
flag[32] = mrev('1', 13)

#7786
flag[3]  = mrev('7', 14)
flag[11] = mrev('7', 15)
flag[19] = mrev('8', 16)
flag[27] = mrev('6', 17)

#57518
flag[4]  = mrev('5', 18)
flag[12] = mrev('7', 19)
flag[20] = mrev('5', 20)
flag[28] = mrev('1', 21)
flag[33] = mrev('8', 22)

#2445
flag[5]  = mrev('2', 23)
flag[13] = mrev('4', 24)
flag[21] = mrev('4', 25)
flag[29] = mrev('5', 26)

#02162
flag[6]  = mrev('0', 27)
flag[14] = mrev('2', 28)
flag[22] = mrev('1', 29)
flag[30] = mrev('6', 30)
flag[34] = mrev('2', 31)

#1854
flag[7]  = mrev('1', 32)
flag[15] = mrev('8', 33)
flag[23] = mrev('5', 34)
flag[35] = mrev('4', 35)
print(flag)

总结一下，这道题逻辑比较简单，提取数据过程比较繁琐，适合用来练习调试技巧与IDA脚本的编写。

CTF
Reverse MISC

本博客所有文章除特别声明外，均采用 CC BY-SA 4.0 协议 ，转载请注明出处！