// https://syzkaller.appspot.com/bug?id=0a52da0bbfd5ff2cd097edb1607fd2bda63a1c4d // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) { strcat(opts, ",errors=withdraw"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } #define FS_IOC_SETFLAGS _IOW('f', 2, long) static void remove_dir(const char* dir) { int iter = 0; DIR* dp = 0; const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW; retry: while (umount2(dir, umount_flags) == 0) { } dp = opendir(dir); if (dp == NULL) { if (errno == EMFILE) { exit(1); } exit(1); } struct dirent* ep = 0; while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); while (umount2(filename, umount_flags) == 0) { } struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } int i; for (i = 0;; i++) { if (unlink(filename) == 0) break; if (errno == EPERM) { int fd = open(filename, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno != EBUSY || i > 100) exit(1); if (umount2(filename, umount_flags)) exit(1); } } closedir(dp); for (int i = 0;; i++) { if (rmdir(dir) == 0) break; if (i < 100) { if (errno == EPERM) { int fd = open(dir, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno == EBUSY) { if (umount2(dir, umount_flags)) exit(1); continue; } if (errno == ENOTEMPTY) { if (iter < 100) { iter++; goto retry; } } } exit(1); } } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); if (symlink("/dev/binderfs", "./binderfs")) { } } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_mount_image$ext4 arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 74 34 00} (length 0x5) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: mount_flags = 0xc901 (8 bytes) // opts: ptr[in, fs_options[ext4_options]] { // fs_options[ext4_options] { // elems: array[fs_opt_elem[ext4_options]] { // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // chdir: int8 = 0x1 (1 bytes) // size: len = 0x4bb (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x4bc) // } // ] // returns fd_dir memcpy((void*)0x200000000040, "ext4\000", 5); memcpy((void*)0x200000000500, "./file0\000", 8); *(uint8_t*)0x200000000280 = 0; memcpy( (void*)0x200000000a00, "\x78\x9c\xec\xdd\xdf\x6b\x1c\x5b\x1d\x00\xf0\xef\x4c\xb2\xb5\x3f\x52\x93" "\xaa\x0f\xb5\x60\x2d\xb6\x92\x16\xed\x6e\xd2\xd8\x36\xf8\x50\x2b\x88\x7d" "\x2a\xa8\xf5\xbd\x8d\xc9\x26\x84\x6c\xb2\x21\xbb\x69\x9b\x50\x34\xc5\x3f" "\x40\x10\x51\xc1\x27\x9f\x7c\x11\xfc\x03\x04\xe9\x9f\x20\x42\x41\xdf\x45" "\x45\x11\x6d\xef\x7d\xb8\x0f\xf7\x76\x2f\xbb\x3b\xdb\x1f\xb9\xbb\x49\xca" "\xdd\x64\x4a\xf6\xf3\x81\x93\x39\x33\xb3\xbb\xdf\xef\xc9\xb2\x67\x67\xe6" "\x1c\x76\x02\x18\x58\xe7\x22\xe2\x66\x44\xbc\x68\x34\x1a\x97\x22\x62\x34" "\xdb\x9e\x66\x25\xb6\xda\xa5\xf9\xb8\xe7\xcf\x1e\xcd\x36\x4b\x12\x8d\xc6" "\x9d\xff\x25\x91\x64\xdb\x3a\xaf\x95\x64\xcb\x13\xd9\xd3\x8e\x46\xc4\x0f" "\x6e\x45\xfc\x28\xf9\x64\xdc\xda\xc6\xe6\xd2\x4c\xa5\x52\x5e\xcb\xd6\x4b" "\xf5\xe5\xd5\x52\x6d\x63\xf3\xf2\xe2\xf2\xcc\x42\x79\xa1\xbc\x32\x35\x35" "\x79\x6d\xfa\xfa\xf4\xd5\xe9\x89\xbe\xb4\xb3\x99\xd3\x8d\xef\xfc\xeb\x97" "\x3f\xfb\xdd\x77\x6f\xfc\xe9\xeb\x0f\xfe\x7e\xf7\x3f\x17\x7f\xdc\x4c\x6b" "\x24\xdb\xff\x7a\x3b\xfa\xa9\xdd\xf4\x42\xeb\x7f\xd1\x31\x1c\x11\x6b\xfb" "\x11\x2c\x07\x43\x59\x7b\x0a\x79\x27\x02\x00\xc0\x9e\x34\x8f\xf1\x3f\x17" "\x11\x5f\x89\x88\x4b\x31\x1a\x43\xad\xa3\x39\x00\x00\x00\xe0\x30\x69\x7c" "\x6b\x24\x3e\x4c\x22\x1a\x00\x00\x00\xc0\xa1\x95\xb6\xe6\xc0\x26\x69\x31" "\x9b\x0b\x30\x12\x69\x5a\x2c\xb6\xe7\xcb\x7e\x21\x8e\xa7\x95\x6a\xad\xfe" "\xb5\xf9\xea\xfa\xca\x5c\x7b\xae\xec\x58\x14\xd2\xf9\xc5\x4a\x79\x22\x9b" "\x2b\x3c\x16\x85\xa4\xb9\x3e\xd9\xaa\xbf\x5a\xbf\xb2\x6d\x7d\x2a\x22\x4e" "\x45\xc4\x2f\x46\x8f\xb5\xd6\x8b\xb3\xd5\xca\x5c\xde\x17\x3f\x00\x00\x00" "\x60\x40\x9c\xd8\x76\xfe\xff\xfe\x68\xfb\xfc\x1f\x00\x00\x00\x38\x64\xc6" "\xf2\x4e\x00\x00\x00\x00\xd8\x77\xf7\xf2\x4e\x00\x00\x00\x00\xd8\x77\xc6" "\xff\x01\x00\x00\xe0\x50\xfb\xde\xed\xdb\xcd\xd2\xe8\xdc\xff\x7a\xee\xfe" "\xc6\xfa\x52\xf5\xfe\xe5\xb9\x72\x6d\xa9\xb8\xbc\x3e\x5b\x9c\xad\xae\xad" "\x16\x17\xaa\xd5\x85\xd6\x6f\xf6\x2d\xef\xf6\x7a\x95\x6a\x75\xf5\x1b\xb1" "\xb2\xfe\xb0\x54\x2f\xd7\xea\xa5\xda\xc6\xe6\xdd\xe5\xea\xfa\x4a\xfd\xee" "\xe2\x1b\xb7\xc0\x06\x00\x00\x00\x0e\xd0\xa9\x2f\x3f\xf9\x5b\x12\x11\x5b" "\xdf\x3c\xd6\x2a\x4d\x47\xf2\x4e\x0a\x38\x10\xb7\xde\xe6\xc1\xff\xdc\xbf" "\x3c\x80\x83\x37\x94\x77\x02\x40\x6e\x86\xf3\x4e\x00\xc8\x4d\x21\xef\x04" "\x80\xdc\x25\xbb\xec\xef\x39\x79\xe7\xcf\xfd\xcf\x05\x00\x00\xd8\x1f\xe3" "\x5f\xec\x3d\xfe\xbf\xf3\xb5\x81\xad\xf4\x00\xd2\x03\xf6\x91\x0f\x31\x0c" "\x2e\xe3\xff\x30\xb8\x8c\xff\xc3\xe0\x2a\x38\x02\x80\x81\xb7\xff\xe3\xff" "\x8d\xc6\x5b\x25\x04\x00\x00\xf4\xdd\x48\xab\x24\x69\x31\x1b\x0b\x1c\x89" "\x34\x2d\x16\x23\x4e\xb6\x6e\x0b\x50\x48\xe6\x17\x2b\xe5\x89\x88\xf8\x6c" "\x44\xfc\x75\xb4\xf0\x99\xe6\xfa\x64\xeb\x99\xc9\xae\xe7\x0c\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x5b" "\xa3\x91\x44\x03\x00\x00\x00\x38\xd4\x22\xd2\x7f\x27\xd9\xfd\xbf\xc6\x47" "\x2f\x8c\x6c\xbf\x3e\x70\x24\xf9\x60\xb4\xb5\x8c\x88\x07\xbf\xb9\xf3\xab" "\x87\x33\xf5\xfa\xda\x64\x73\xfb\xff\x5f\x6e\xaf\xff\x3a\xdb\x7e\x25\x8f" "\x2b\x18\x00\x00\x00\xc0\x76\x9d\xf3\xf4\xce\x79\x3c\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xd3\xf3\x67" "\x8f\x66\x3b\xe5\x20\xe3\xfe\xf7\xdb\x11\x31\xd6\x2d\xfe\x70\x1c\x6d\x2d" "\x8f\x46\x21\x22\x8e\xbf\x97\xc4\xf0\x6b\xcf\x4b\x22\x62\xa8\x0f\xf1\xb7" "\x1e\x47\xc4\xe9\x6e\xf1\x93\x66\x5a\x31\x96\x65\xd1\x2d\xfe\xb1\x1c\xe3" "\xa7\x11\x71\xa2\x0f\xf1\x61\x90\x3d\x69\xf6\x3f\x37\xbb\x7d\xfe\xd2\x38" "\xd7\x5a\x76\xff\xfc\x0d\x67\xe5\xd3\xea\xdd\xff\xa5\x2f\xfb\xbf\xa1\x1e" "\xfd\xcf\xc9\x3d\xc6\x38\xf3\xf4\x0f\xa5\x9e\xf1\x1f\x47\x9c\x19\xee\xde" "\xff\x74\xe2\x27\x3d\xe2\x9f\xdf\x63\xfc\x7b\x3f\xdc\xdc\xec\xb5\xaf\xf1" "\xdb\x88\xf1\xae\xdf\x3f\xc9\x1b\xb1\x4a\xf5\xe5\xd5\x52\x6d\x63\xf3\xf2" "\xe2\xf2\xcc\x42\x79\xa1\xbc\x32\x35\x35\x79\x6d\xfa\xfa\xf4\xd5\xe9\x89" "\xd2\xfc\x62\xa5\x9c\xfd\xed\x1a\xe3\xe7\x5f\xfa\xe3\x8b\x9d\xda\x7f\xbc" "\x47\xfc\xb1\x5d\xda\x7f\x61\x8f\xed\xff\xe8\xe9\xc3\x67\x9f\x6f\x57\x0b" "\xdd\xe2\x5f\x3c\xdf\xfd\xfd\x3f\xdd\x23\x7e\x9a\x7d\xf7\x7d\x35\xab\x37" "\xf7\x8f\x77\xea\x5b\xed\xfa\xeb\xce\xfe\xfe\x2f\x67\x77\x6a\xff\x5c\x8f" "\xf6\xef\xf6\xfe\x5f\xdc\x63\xfb\x2f\x7d\xff\xa7\xff\xd8\xe3\x43\x01\x80" "\x03\x50\xdb\xd8\x5c\x9a\xa9\x54\xca\x6b\x2a\x2a\x03\x57\xf9\xc9\xbb\x91" "\xc6\x3b\x59\xc9\xbb\x67\x02\x00\x00\xfa\xed\xd5\x41\x7f\xde\x99\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x3a\x88\x9f" "\x13\xdb\x1e\x73\x2b\x9f\xa6\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xec\xe8\xe3\x00\x00\x00" "\xff\xff\x8b\x89\xda\x33", 1212); syz_mount_image( /*fs=*/0x200000000040, /*dir=*/0x200000000500, /*flags=MS_REC|MS_SILENT|MS_RDONLY|MS_NODIRATIME|0x100*/ 0xc901, /*opts=*/0x200000000280, /*chdir=*/1, /*size=*/0x4bb, /*img=*/0x200000000a00); // syz_mount_image$ext4 arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 74 34 00} (length 0x5) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) // } // flags: mount_flags = 0x1c916 (8 bytes) // opts: ptr[in, fs_options[ext4_options]] { // fs_options[ext4_options] { // elems: array[fs_opt_elem[ext4_options]] { // fs_opt_elem[ext4_options] { // elem: union ext4_options { // nobarrier: buffer: {6e 6f 62 61 72 72 69 65 72} (length 0x9) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // noblock_validity: buffer: {6e 6f 62 6c 6f 63 6b 5f 76 61 6c 69 // 64 69 74 79} (length 0x10) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // journal_dev: fs_opt["journal_dev", fmt[hex, int32]] { // name: buffer: {6a 6f 75 72 6e 61 6c 5f 64 65 76} (length // 0xb) eq: const = 0x3d (1 bytes) val: int32 = 0x9 (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // nodelalloc: buffer: {6e 6f 64 65 6c 61 6c 6c 6f 63} (length // 0xa) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // max_batch_time: fs_opt["max_batch_time", fmt[hex, int32]] { // name: buffer: {6d 61 78 5f 62 61 74 63 68 5f 74 69 6d 65} // (length 0xe) eq: const = 0x3d (1 bytes) val: int32 = 0x400 // (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // resgid: fs_opt["resgid", fmt[hex, gid]] { // name: buffer: {72 65 73 67 69 64} (length 0x6) // eq: const = 0x3d (1 bytes) // val: gid (resource) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // resuid: fs_opt["resuid", fmt[hex, uid]] { // name: buffer: {72 65 73 75 69 64} (length 0x6) // eq: const = 0x3d (1 bytes) // val: uid (resource) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // errors_remount: buffer: {65 72 72 6f 72 73 3d 72 65 6d 6f 75 // 6e 74 2d 72 6f} (length 0x11) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // resgid: fs_opt["resgid", fmt[hex, gid]] { // name: buffer: {72 65 73 67 69 64} (length 0x6) // eq: const = 0x3d (1 bytes) // val: gid (resource) // } // } // comma: const = 0x32 (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // chdir: int8 = 0x1b (1 bytes) // size: len = 0x4c5 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x4c5) // } // ] // returns fd_dir memcpy((void*)0x200000000100, "ext4\000", 5); memcpy((void*)0x200000000500, "./file1\000", 8); memcpy((void*)0x200000000000, "nobarrier", 9); *(uint8_t*)0x200000000009 = 0x2c; memcpy((void*)0x20000000000a, "noblock_validity", 16); *(uint8_t*)0x20000000001a = 0x2c; memcpy((void*)0x20000000001b, "journal_dev", 11); *(uint8_t*)0x200000000026 = 0x3d; sprintf((char*)0x200000000027, "0x%016llx", (long long)9); *(uint8_t*)0x200000000039 = 0x2c; memcpy((void*)0x20000000003a, "nodelalloc", 10); *(uint8_t*)0x200000000044 = 0x2c; memcpy((void*)0x200000000045, "max_batch_time", 14); *(uint8_t*)0x200000000053 = 0x3d; sprintf((char*)0x200000000054, "0x%016llx", (long long)0x400); *(uint8_t*)0x200000000066 = 0x2c; memcpy((void*)0x200000000067, "resgid", 6); *(uint8_t*)0x20000000006d = 0x3d; sprintf((char*)0x20000000006e, "0x%016llx", (long long)0xee01); *(uint8_t*)0x200000000080 = 0x2c; memcpy((void*)0x200000000081, "resuid", 6); *(uint8_t*)0x200000000087 = 0x3d; sprintf((char*)0x200000000088, "0x%016llx", (long long)0xee01); *(uint8_t*)0x20000000009a = 0x2c; memcpy((void*)0x20000000009b, "errors=remount-ro", 17); *(uint8_t*)0x2000000000ac = 0x2c; memcpy((void*)0x2000000000ad, "resgid", 6); *(uint8_t*)0x2000000000b3 = 0x3d; sprintf((char*)0x2000000000b4, "0x%016llx", (long long)0xee00); *(uint8_t*)0x2000000000c6 = 0x32; *(uint8_t*)0x2000000000c7 = 0; memcpy( (void*)0x200000000ec0, "\x78\x9c\xec\xdd\x5f\x6b\x5b\xe7\x19\x00\xf0\xe7\x1c\x5b\x59\xfe\x38\xb3" "\xc3\x76\x91\x05\x96\x85\x25\xc3\x0e\x5b\x24\x3b\x5e\x12\xb3\x8b\x6c\x83" "\xb1\x5d\x05\xb6\x65\xf7\x99\x67\xcb\xc6\x58\xb6\x8c\x25\x27\xb1\x09\x9b" "\xc3\x3e\xc0\x60\x94\xb6\xd0\xab\x5e\xf5\xa6\xd0\x0f\x50\x28\xf9\x08\xa5" "\x10\x68\xef\x4b\x5b\x5a\x4a\x9b\xb4\x17\xbd\x68\xa3\xa2\x7f\xa9\xe3\x48" "\xb1\x4d\x64\x29\x58\xbf\x1f\x1c\xeb\x3d\x47\x47\x7e\x9e\x47\x42\xaf\xf4" "\x9e\xf3\xa2\x13\x40\xdf\x3a\x13\x11\x17\x23\xe2\x51\xa5\x52\x39\x1f\x11" "\xc3\x8d\xed\x69\x63\xb9\x77\x2c\x22\x36\xeb\xfb\x3d\x7c\x70\x67\xa6\xba" "\x24\x51\xa9\x5c\xff\x22\x89\xa4\xb1\xad\xba\xff\xd8\x96\xff\xd9\x78\x48" "\x1c\x8e\x88\xbf\xff\x25\xe2\x5f\xc9\xd3\x71\x4b\xeb\x1b\x8b\xd3\x85\x42" "\x7e\xb5\xb1\x9e\x2b\x2f\xad\xe4\x4a\xeb\x1b\x17\x16\x96\xa6\xe7\xf3\xf3" "\xf9\xe5\xc9\xc9\x89\xcb\x53\x57\xa6\x2e\x4d\x8d\x77\xa4\xce\xa1\x88\xb8" "\xfa\xa7\x4f\x5e\xfe\xdf\x1b\x7f\xbe\xfa\xce\x6f\x6e\x7d\x78\xe3\xb3\xb1" "\x7f\x27\x8d\xed\xb1\xa5\x8e\x4e\xab\x97\x9e\xa9\x3d\x17\x4d\x83\x11\xb1" "\xba\x1f\xc1\x7a\x60\xa0\x51\x4f\xa6\xd7\x89\x00\x00\xb0\x2b\xcd\xef\xf9" "\xbf\x8c\x88\xf3\x31\x1c\x03\xb5\x6f\x73\x00\x00\x00\xc0\x41\x52\xf9\xfd" "\x50\x7c\x9b\x44\x54\x00\x00\x00\x80\x03\x2b\xad\xcd\x81\x4d\xd2\x6c\x63" "\x1e\xc0\x50\xa4\x69\x36\x5b\x9f\xc3\xfb\xd3\x38\x9a\x16\x8a\xa5\xf2\xaf" "\xe7\x8a\x6b\xcb\xb3\xf5\xb9\xb2\x23\x91\x49\xe7\x16\x0a\xf9\xf1\xc6\x5c" "\xe1\x91\xc8\x24\xd5\xf5\x89\x5a\xfb\x87\xf5\x8b\xdb\xd6\x27\x23\xe2\x44" "\x44\xbc\x34\x7c\xa4\xb6\x9e\x9d\x29\x16\x66\x7b\x7d\xf0\x03\x00\x00\x00" "\xfa\xc4\xb1\x6d\xe3\xff\xaf\x87\xeb\xe3\x7f\x00\x00\x00\xe0\x80\x19\xe9" "\x75\x02\x00\x00\x00\xc0\xbe\x33\xfe\x07\x00\x00\x80\x83\xcf\xf8\x1f\x00" "\x00\x00\x0e\xb4\xbf\x5e\xbb\x56\x5d\x2a\xcd\xeb\x5f\xcf\xde\x5c\x5f\x5b" "\x2c\xde\xbc\x30\x9b\x2f\x2d\x66\x97\xd6\x66\xb2\x33\xc5\xd5\x95\xec\x7c" "\xb1\x38\x5f\xfb\xcd\xbe\xa5\x9d\xfe\x5f\xa1\x58\x5c\xf9\x6d\x2c\xaf\xdd" "\xce\x95\xf3\xa5\x72\xae\xb4\xbe\x71\x63\xa9\xb8\xb6\x5c\xbe\xb1\xf0\xc4" "\x25\xb0\x01\x00\x00\x80\x2e\x3a\xf1\x8b\x7b\x1f\x24\x11\xb1\xf9\xbb\x23" "\xb5\xa5\xea\x50\xaf\x93\x02\xba\x62\x70\x2f\x3b\x7f\xbc\x7f\x79\x00\xdd" "\x37\xd0\xeb\x04\x80\x9e\xd9\xd3\xe7\x3f\x70\xa0\x64\x7a\x9d\x00\xd0\x73" "\xc9\x0e\xf7\xb7\x9d\xbc\xf3\x6e\xe7\x73\x01\x00\x00\xf6\xc7\xe8\xcf\x5a" "\x9f\xff\x4f\x76\x3c\x36\xb0\x99\x76\x29\x45\x60\x9f\x38\xfe\x07\xfd\xcb" "\xf9\x7f\xe8\x5f\xce\xff\x43\xff\xca\xc4\x40\x18\xc8\x43\x7f\xdb\xff\xf3" "\xff\x95\xca\x9e\x12\x02\x00\x00\x3a\x6e\xa8\xb6\x24\x69\x36\xa2\x76\x1c" "\x60\x28\xd2\x34\x9b\x8d\x38\x5e\xbb\x2c\x40\x26\x99\x5b\x28\xe4\xc7\x23" "\xe2\xc7\x11\xf1\xfe\x70\xe6\x47\xd5\xf5\x89\xda\x23\x93\x1d\xc7\x0c\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x40\x5d\xa5\x92\x44\x05\x00\x00\x00\x38\xd0\x22\xd2\x4f\x93\xc6\xf5\xbf" "\x46\x87\xcf\x0d\x6d\x3f\x3e\x70\x28\xf9\x66\xb8\x76\x1b\x11\xb7\x5e\xbb" "\xfe\xca\xed\xe9\x72\x79\x75\xa2\xba\xfd\xcb\xc7\xdb\xcb\xaf\x36\xb6\x5f" "\xec\xc5\x11\x0c\x00\x00\x00\x60\xbb\xe6\x38\xbd\x39\x8e\x07\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x4e\x7a" "\xf8\xe0\xce\x4c\x73\xe9\x66\xdc\xcf\xff\x18\x11\x23\xad\xe2\x0f\xc6\xe1" "\xda\xed\xe1\xc8\x44\xc4\xd1\xaf\x92\x18\xdc\xf2\xb8\x24\x22\x06\x3a\x10" "\x7f\xf3\x6e\x44\x9c\x6c\x15\x3f\xa9\xa6\x15\x23\x8d\x2c\x5a\xc5\x3f\xd2" "\xc3\xf8\x69\x44\x1c\xeb\x40\x7c\xe8\x67\xf7\xaa\xfd\xcf\x1f\x5a\xbd\xff" "\xd2\x38\x53\xbb\x6d\xfd\xfe\xbb\x5c\xeb\xa1\x9e\x5f\xfb\xfe\x2f\x7d\xdc" "\xff\x0d\xb4\xe9\x7f\x8e\xef\x32\xc6\xa9\xfb\x6f\xe5\xda\xc6\xbf\x1b\x71" "\x6a\xb0\x75\xff\xd3\x8c\x9f\xb4\x89\x7f\x76\x97\xf1\xff\xf9\x8f\x8d\x8d" "\x76\xf7\x55\x5e\x8f\x18\x6d\xf9\xf9\x93\x3c\x11\x2b\x57\x5e\x5a\xc9\x95" "\xd6\x37\x2e\x2c\x2c\x4d\xcf\xe7\xe7\xf3\xcb\x93\x93\x13\x97\xa7\xae\x4c" "\x5d\x9a\x1a\xcf\xcd\x2d\x14\xf2\x8d\xbf\x2d\x63\xfc\xff\xe7\x6f\x3f\x7a" "\x56\xfd\x47\xdb\xc4\x1f\xd9\xa1\xfe\x73\xbb\xac\xff\xbb\xfb\xb7\x1f\xfc" "\xa4\xde\xcc\xb4\x8a\x3f\x76\xb6\xf5\xeb\x7f\xb2\x4d\xfc\xb4\xf1\xd9\xf7" "\xab\x46\xbb\x7a\xff\x68\xb3\xbd\x59\x6f\x6f\x75\xfa\xcd\xf7\x4e\x3f\xab" "\xfe\xd9\x36\xf5\xef\xf4\xfa\x8f\xed\xb2\xfe\xf3\x7f\xfb\xef\x47\xbb\xdc" "\x15\x00\xe8\x82\xd2\xfa\xc6\xe2\x74\xa1\x90\x5f\xed\xeb\xc6\x73\x3d\x1b" "\xd5\xaf\x45\x2f\x44\x15\x1a\x7b\x6d\xfc\xe7\xc5\x48\xe3\x85\x6c\xf4\xb6" "\x5f\x02\x00\x00\x3a\xef\xe9\x31\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\xd0\x6d\xdd\xfc\x75\xbd\xa6\xcd\xde\x94\x0a\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\xf0\x4c\xdf\x07\x00\x00\xff\xff\xbc\xbe\xd4\xeb", 1221); syz_mount_image( /*fs=*/0x200000000100, /*dir=*/0x200000000500, /*flags=MS_POSIXACL|MS_REC|MS_SYNCHRONOUS|MS_SILENT|MS_NOSUID|0x904*/ 0x1c916, /*opts=*/0x200000000000, /*chdir=*/0x1b, /*size=*/0x4c5, /*img=*/0x200000000ec0); // openat$cgroup_ro arguments: [ // fd: fd_cgroup (resource) // file: ptr[in, buffer] { // buffer: {6d 65 6d 6f 72 79 2e 65 76 65 6e 74 73 00} (length 0xe) // } // flags: const = 0x26e1 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd memcpy((void*)0x200000000180, "memory.events\000", 14); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000180ul, /*flags=*/0x26e1, /*mode=*/0); if (res != -1) r[0] = res; // write$UHID_INPUT arguments: [ // fd: fd_uhid (resource) // data: ptr[in, uhid_req[UHID_INPUT, uhid_input_req]] { // uhid_req[UHID_INPUT, uhid_input_req] { // type: const = 0x8 (4 bytes) // data: uhid_input_req { // data: buffer: {72 84 e7 4c 46 d8 80 bf 8e eb cf 1e ab 33 42 40 dd // 53 4d ce 63 d4 13 37 ff df b7 56 cd 11 84 56 0b ff 6d 5b 6b 56 a7 // 78 6b 59 69 85 68 6e d4 6c 72 28 04 a8 7b 63 a1 0d cb 6f cc ea 62 // 89 72 78 e6 cb 93 35 10 f2 20 ee 93 01 23 ab 7e 93 91 8c e6 9c ce // 6c 22 b6 39 ec a2 bf 07 13 f0 9b a2 7b ac 41 96 92 1a 4c b5 1e ac // 36 f5 e9 35 e3 fe 9c 6f e0 d3 ad d2 aa 99 64 54 ce f6 ea 2a a0 b3 // c8 56 9f 3b dc 14 22 bf ab f2 7e df aa 0d 0c c4 27 ad 0d b5 2f 2f // 71 55 72 ca 28 a7 1b 15 da ac 15 66 37 39 54 b7 f2 b1 a1 fa 32 9e // 74 cb 72 e5 45 c7 2a 45 01 d6 9c 09 f7 f5 dd c4 0d f6 0c 8f 06 bf // 86 3d 91 50 65 46 c6 71 eb 5c 4f 59 d3 cf e4 71 86 4e e3 58 47 52 // 36 ca 00 5b 15 c9 ee 2a 48 2c 9d ff b7 0b 28 07 4c fe fb 70 21 c0 // be 7b 53 4d da 52 00 81 5f 00 4e 3f a0 0b e6 3f 19 b3 9b 42 e6 62 // 2a f5 e5 bc 1c 78 5e a2 14 13 ed 02 be c0 96 e1 e4 d2 dc d7 cb e1 // 45 20 05 bd e2 36 6c d1 77 06 d6 2a a1 8a 1a 24 7a ce 57 43 0c 83 // 32 3b e5 b0 db db aa d9 2a 7d c6 b5 8f 6b 22 21 3d bb 77 5f 76 1e // e8 57 a6 67 c8 dc 14 5e 2c 7b 80 d8 f2 f5 a5 15 9a 36 7e 96 aa 48 // 44 1c a0 f4 b4 26 67 09 55 0f f7 bf d1 fa 1a a8 6e 3a 94 c8 20 51 // a8 c3 58 38 8c f9 5d 7f 96 f0 86 7c 91 0a c7 5e 39 bf 4c aa 72 af // 61 9e 71 68 c8 76 cf 34 27 39 c9 e4 55 70 a7 8b d3 21 80 c4 ca 0f // 28 bb 51 13 04 58 e5 ce 94 84 50 89 d7 fa 99 0c 93 1b 98 c9 e5 76 // 5c 0d 0e 65 14 5b 59 50 72 6e 7f 0a 68 4c 5f c6 22 23 1d 95 38 17 // b7 53 90 de 63 b2 54 05 54 ae 84 61 d5 bb 35 7b 2e c3 88 33 38 c8 // 09 0d f3 86 93 8a ba 21 ed 5e f7 3e 56 e9 44 20 7c 77 f9 48 50 af // 15 b5 ea 91 7b 2d 14 85 31 e6 0d db c0 04 5e e8 6f 8b 97 f4 ed c5 // aa 6c 8e 44 2f a4 66 66 12 01 28 a9 aa b6 58 3b a8 c8 42 10 cc 60 // b3 79 77 16 73 fa b3 8f da ee ef 3f 2a 2b bf bc d7 b3 f2 5c 04 3a // e0 66 7e e5 fd 65 b5 f6 ec 3d 89 92 5e 3d 4e 49 55 ed 53 2b 15 f5 // fa 8d 07 ed b0 e9 d3 84 e7 bc 5a 66 61 3b 4e d4 92 95 ed 04 bf 3f // 3c 7d 95 59 c4 69 66 c8 f3 78 5e e0 d1 07 74 36 6d 2a 22 2e be b0 // b2 71 75 7f be ea d3 20 be 03 2e ae e0 05 64 b7 e9 1b 59 f5 51 fe // 7c ef 63 e1 3b af 4c 80 7b d1 6a 5c cb 51 e8 48 1a f2 cc fe f4 47 // 91 95 1e d5 45 2c 43 5e a0 b5 a1 ed e1 70 7a 9b 07 80 27 0f 91 eb // ea 34 ae 0f c7 da 60 78 91 a9 c3 2d 12 4b 50 42 86 56 6d 1c 7a 49 // 20 0d 99 cc bc 81 e9 07 0e a1 7d 30 91 2b 09 f3 40 31 c2 a7 20 80 // ae b3 5b d8 d0 95 f7 60 76 17 c2 22 b5 05 df 2c eb 15 06 12 53 31 // 95 5a 87 b3 b0 4d 00 42 60 b7 af 1d 30 f0 f9 86 6a 76 ae 37 20 c2 // da fb f1 67 81 75 b8 fa bb b7 fc 94 03 b5 e2 f7 b6 77 48 ef 1a 96 // 13 a7 95 7b 97 26 82 53 af 96 d1 be 69 a9 c5 b4 ea f0 b8 de 6a 73 // 57 5c bb 8e bf 1b 63 51 39 dc d6 a0 a5 bc e1 08 43 c7 8f 8a 14 be // 3d 9d 88 f6 f8 39 6a 2f a9 95 d0 ee 50 db df b8 41 03 34 b8 09 75 // 4f 3b d7 50 56 84 e6 a4 11 18 55 61 3b 0a 8a 6b 85 d5 ae cb b1 49 // 0e 4b 60 0f b4 3d 52 39 7f 09 b5 82 03 f0 25 b9 d0 9a de d8 87 0b // 82 2b 6d 78 86 7b 16 8f b9 f3 4f da 00 24 06 f2 e7 44 ad 7f ba f7 // cd 68 20 0d e8 72 13 8e 7d 10 2c c8 1d 89 48 e3 52 55 db 09 f7 37 // 7f 72 5b d9 7b 42 b8 ff 25 7e fd cf 61 6f 9d b9 b0 1d a2 21 ad a8 // 3b d7 bf 18 60 34 7b b3 09 6c b8 0c 7c 1e 20 5b 6f d7 17 4d 65 b9 // 65 d2 d8 96 a2 6a 32 f4 a2 2e 77 25 e7 f9 50 48 73 7a 6f a8 f1 4a // 8a 30 b5 c3 0f 9f 1e e7 4c 2e 24 6c 2a 0d 5b 0f a7 74 12 09 6e a2 // 5e 78 91 d3 c2 0d fe 42 e5 f8 90 2a 7f 38 c8 48 d9 1f 6a 51 99 58 // 64 66 59 8c 33 7d 6a 49 59 9b da cd 44 a1 33 75 d9 42 20 8b e0 56 // 08 bc f3 40 d9 fd fe e6 ea 50 a5 0b 3d d5 d0 4e e2 b4 09 ea 25 d6 // a2 ef e3 04 cb ee 73 84 4a d5 91 76 bb a3 a6 f8 73 d8 3a 36 54 62 // dc 07 62 eb ba 8c f3 b2 3e 91 4c a3 b0 09 fd 5d bb 85 13 08 f0 15 // f9 7a ab af 00 6e 87 89 fc 00 a7 65 49 95 a4 d0 1e 7c 6f 6a 78 f0 // 2e ae 4c 2f d7 2c 21 dd f8 d5 57 83 6e 81 09 1e 7c 6a dd 22 5f e7 // e0 61 59 49 7f fc 54 4c 8d bb 6d e0 4d 25 f0 a9 e7 42 79 93 91 11 // 02 a7 c4 23 5c 50 40 65 61 a2 a0 1a 8a 2d b3 2e 7f e4 69 d1 ef 1f // 72 cc 67 91 22 07 d8 96 c3 95 cc 10 16 dc 24 df 94 44 1b 04 8c f7 // f0 8b b7 3a 29 00 95 7f ac 32 d0 cd dd 33 00 51 c9 e7 5b ba 83 88 // ae f2 36 55 eb ea 44 f9 ca b1 40 47 ae fa d4 cd f7 13 08 85 e5 bc // b6 1e 3d ba bf 62 4c f5 f9 cb 94 0b 1d e2 1b 97 0f a2 79 7a 31 8e // da 45 79 6b 4b 73 44 da 8a 27 0d 79 0c e2 30 c6 22 29 30 d2 2e ba // b8 f6 98 8f 48 00 b7 cc 6c 0e cf 46 71 6f 57 85 9a 9b 9e a5 4e 9e // 8c 80 6b 13 a5 03 71 90 4d 50 26 04 c6 a6 e9 65 ec cb 4a 4a 71 77 // 5b a2 8c 77 8d 1c 2d 0b da 24 f6 7d 82 cd 34 88 2d d5 b8 ce f7 5f // a0 ce 1c 24 2e d9 bc da 06 b1 58 15 22 58 ca 43 18 bc 1c 0b b6 82 // 71 7a 70 c3 38 51 72 bc b7 bd 39 60 ee 15 ca aa d3 f1 0f c1 b2 17 // 16 d9 0c cc 45 bc db a0 eb 14 1a 63 bf ce 37 2b 9c e3 3f 53 84 5e // 3e 45 0a 22 4d 04 ff 16 e6 b0 72 76 6c 6b 9b a0 74 16 e0 f3 53 09 // 37 68 b0 82 d5 8e 8a bf ba 50 a4 ef 9c a5 33 46 0f 4a 10 e2 9f d0 // d0 73 b9 95 68 22 f6 74 3b 9e 0a 72 32 f6 68 b5 8d 95 a4 e4 5c 5b // 43 2d 1a e7 71 a3 9e d6 dd 8a fc 2e 8d 6a 5c 9f d2 45 f4 f8 46 d4 // 79 d1 9c 58 83 a6 3e 95 d9 59 40 eb 62 fb 39 0b 0d 5a 00 0f be 26 // 4e d3 a4 8b c1 99 d5 a1 65 f2 93 de 24 b0 45 1d 70 2c 91 40 6d af // 10 a8 ec 0a 23 80 1b a2 35 28 9f 89 d9 d2 30 6d 8f 7c ae ee 2e bd // 9e 7b f2 c5 a8 f9 b5 f6 13 9e 8a da b6 03 7b 02 63 0f 5e 25 46 ac // 9e 79 8f 6b 04 13 92 4a 97 c5 f3 26 d0 f1 82 86 97 0e a2 61 c6 db // 69 0e 56 71 77 ec 44 d0 a2 c1 5a fc 7b 37 95 af 1b e0 ae 56 fc 0c // a9 70 4f 56 91 ec 59 99 37 7b 65 96 99 db 40 55 c1 83 ab ac e5 38 // ea 5c 20 8f 95 b5 ba 26 ef 50 0f 61 2e 22 c4 3d 8c a6 a1 0d 15 fd // 60 84 cf 4d ed 3c b0 3f e4 51 4d fb 38 46 7e aa c5 e7 1f fa ff 69 // 6b 43 05 bd ab 84 c4 71 86 a7 d2 29 72 03 3d d6 ef 92 7d c6 cc 95 // 7a 8a c9 7d cb 1a 01 1c 3a ad 96 19 7d 48 83 50 bd bb 9a 5f be bf // b1 d6 96 da ba 95 8d 44 9d bd c0 ab f8 73 4a 62 fa 3a da 3c 93 ef // 0d fd b9 5c 73 a7 26 c5 b8 e2 a2 8b 78 f5 73 a6 27 fb 61 19 81 26 // 90 06 1c 24 36 24 ee 53 6a 6a d8 30 83 b1 25 8c db 8e f3 28 5e d0 // e3 16 ea 4d 60 92 92 37 96 6c 63 70 92 d1 72 51 f8 20 13 e3 83 a4 // 84 71 b4 3e 76 83 bb 26 d1 a7 01 d7 81 5f 18 f2 b0 d2 01 d6 cf af // cf 10 0e 81 f2 7a bd 55 4e 18 f4 c0 f9 df 59 0c b5 e2 39 38 00 5a // 18 90 00 a4 f0 d3 27 e8 05 99 e1 85 2c 30 e2 dc 60 ea c2 11 c8 e7 // 46 64 f6 8d 50 05 dc 97 a7 47 15 9d f4 1d 6d c5 ac dc 7e d7 26 e6 // 2c 67 59 87 29 94 11 d1 04 34 a6 92 07 f0 58 47 9d 7d 6c 3d 6c 09 // 47 bb ba 0e 74 d5 96 42 d3 18 52 c6 ad 8d 0b cd 64 13 2a 0a d5 3e // f7 d6 bf e8 3f e9 3d 17 25 88 4e bc 40 1c ff 35 34 be f8 45 e5 2a // c0 76 37 dd a7 48 71 9f 86 8a 4c 7b 94 e2 f4 0d e8 80 6a 72 b9 68 // 5d 9d b3 7d 8a d2 8a 5b a3 f1 29 1a 39 f8 da 98 66 eb c2 bf c2 df // 24 bc d8 67 a5 75 dc 07 05 ee f0 0c 66 aa 10 d7 48 8e 71 2c 4b 33 // 46 18 95 c3 a1 94 5f 91 71 a1 e8 bb f4 07 98 a8 e9 d3 8c cf a4 bf // 4f 2f fe 0d 85 5b de ec 66 87 fa 46 a9 a3 bf ad 1f 08 0f 01 46 6f // 5b 6e 80 85 8b 6f 82 55 ea 78 69 fb 12 ef 54 58 7f 54 4d 3f 6d 5b // b9 58 dd 12 ce 3b e1 dc 09 cf 20 cc a7 41 4e 61 e1 0f b2 c9 61 5e // d2 ec ea da 93 7f 56 70 86 aa d1 6e 53 01 7b 14 f2 28 1a fc 27 62 // 59 81 66 3a bd f3 7f 58 63 f4 53 25 4a ee 81 ce 5c 50 40 cb 93 07 // bc f7 9f 62 e0 fa da 8a f6 8b 8d a0 34 c8 0e a0 3c 08 48 38 dc 9e // b6 4b 6e 6d 6e ef c4 04 17 e9 1c 81 e9 dd e4 ed b4 4b 04 97 97 4f // 4f 65 c9 e0 4a c0 ba f1 1f a6 2d bb f5 e8 59 8c 6d b7 74 a8 56 77 // 98 65 cb ce 9a 39 9a a7 ad 6c 22 1c 16 91 a4 92 2f 1c 3f 06 a2 83 // 33 04 6e 17 a2 2e b0 45 0e fe ab c8 7a ea 56 59 a9 90 2d da 5a 1d // 4a 28 93 9f 31 41 69 87 c6 43 b7 d7 d0 11 b9 e2 c5 b0 73 b5 7e ec // 51 e2 00 bb 91 ae 03 3b c5 c4 de 62 58 1c 1e 29 0e 3d bc ea d8 2f // b4 2e c2 66 1b 10 1f 62 7a ea 8e bd cd 37 31 74 c6 20 1d 88 8b 47 // 61 80 59 18 7c 5a 63 40 aa 35 ab 14 74 99 6d 3c b2 5d 20 90 c0 cb // d2 f7 e4 f7 4a c0 e5 94 57 1a 72 5f 39 5e 41 fd 01 40 f4 0f 20 12 // ac 26 92 64 c1 d7 56 3d ed c5 15 49 ab 76 95 41 be e6 3c 64 a6 ea // 6d de 84 85 f9 8d 4e 1f 82 6c 65 e9 de 42 64 34 97 da 78 0e 4b 1c // 95 82 a6 de b0 59 bd 43 da be ce 6e 12 af 0a e8 0b e9 05 4b f6 83 // e1 02 61 36 e8 a1 45 92 80 ef 84 6e c7 87 80 c5 a8 07 bd 44 6a ef // 77 c5 72 e0 7b e7 73 f7 3a 11 77 92 c8 90 25 b0 7e 6f ac 09 53 9d // 30 6f 29 62 d5 e2 6e 03 53 17 3c f2 b5 c6 a1 f4 2f d6 01 34 ee 1a // c6 4a 24 36 0d 97 4e 3f 01 9f 42 db 20 e9 e9 6b 54 83 d4 42 0b 4e // 03 a9 1f 56 1e 38 a7 bf 30 75 32 69 de 29 17 29 70 06 2d f4 ef f6 // 99 07 9f 05 cd 72 ea b3 ab 4a 27 e6 e5 52 25 3a 19 6c 0c 50 02 df // a6 6a a5 a2 1f b0 f7 c1 af 1f a1 7b ce 79 ae d2 df 04 bc 19 19 70 // 28 5b 8f 00 19 f7 21 f1 32 23 40 1b f7 a0 16 3c a7 4f ab 87 1b 7a // 87 5e 49 19 08 30 67 09 59 44 24 30 2a 90 d8 7b 58 f8 af d1 f0 aa // 00 2a b9 f5 47 8c b7 09 e5 39 f5 36 23 11 07 55 4b 73 20 f3 35 11 // fe 90 87 67 8a fc 12 c5 f2 7c e0 ca f5 55 fc ce a5 0e dc e7 3f c9 // bb ce 2f aa ca cc 67 ca 70 e2 c2 13 39 69 b2 9a 56 a8 f9 af 4b 1b // 7f 2b b5 b3 2b 53 ac d7 93 93 cc c3 94 ba 8d 30 6c 13 6e db df 4d // 32 51 33 fc 09 38 58 5c 18 92 c1 9a 42 d4 69 d9 31 f8 05 f6 eb 2c // 85 78 d6 c9 5d 2d d8 af ee 71 3a bd 69 91 da 0d 66 34 11 17 7d ac // 51 2e 95 63 9f 0f d5 2b 23 0e 83 01 d4 c4 e3 bc ac 70 8f 06 df 38 // d3 06 ec 3e 60 b8 30 bf 99 07 40 b6 a6 6d 9d 71 9f 7b 36 ec 5a fd // cf 45 e5 65 ef 87 81 5c ae 0e b0 f5 7c 65 d8 b6 81 45 83 c2 8d 92 // be 48 56 2f fd b0 e2 31 fc e5 71 47 26 52 b5 66 d8 52 4d 51 c1 dd // 78 5a 9b 5a ef 13 73 c3 00 55 35 ea 1d 63 1f b5 91 64 64 aa a3 be // e4 ce 13 78 60 64 6a e1 2a fa 13 c7 05 5a 13 68 c4 eb f2 27 6b f0 // 54 b7 de b1 14 ce fa fe e7 bc 14 91 25 fc bb 7a 6f 01 49 14 99 9e // fc 96 13 18 aa 52 68 fc 31 1b 19 12 af ec 7d 6b de 6f d7 43 0b 9f // 8a a7 e2 1a a7 49 24 f1 26 db 5e f0 76 9d c4 4b c2 ba a3 a8 a8 90 // 84 24 fa 8f 07 3b ad 4c 5c 73 3a d5 c6 d7 79 3f 3c 54 6b 22 01 82 // 7f a2 79 17 89 04 1c 9d 34 6f b6 d9 e7 76 17 dc e2 12 1f 10 b9 c5 // 41 ce c3 10 3a 69 2a 82 06 fd 87 21 e5 f2 b0 7e 8e 9e ca f8 01 44 // 50 a8 7c 78 e3 1c ff 88 96 57 79 8b e7 80 12 36 61 0b af c8 93 54 // b3 68 2b 74 f7 0f cb 88 3f 90 4b 56 2d d8 7e a3 a0 14 ef b4 ae e0 // 7f 14 03 67 0c 5b 9d d9 6c 7c 4e 38 03 1f f7 aa be 83 f0 1e f8 d0 // 7d 15 a9 37 0c 24 b7 bc 69 c0 7c 45 4a c3 fa 07 67 0a 7d c0 86 27 // f2 f7 41 f9 3c 37 bc 15 61 4c 9d a6 a8 f2 bd 93 19 1f 8e dd a9 4e // d8 52 1e 70 8d 7c d3 13 c5 12 c2 02 6f fa 6c 09 e6 f7 6d fe 7a b0 // a4 3b 4f a9 3d 18 61 85 5c 60 07 e0 91 ba 38 9f a1 07 6c 0c 53 d5 // 1b 5d f5 3e 7b f8 e7 78 a2 b8 af 2c 88 d3 ae f7 fc 4a 12 3a 04 e1 // 0f bd 87 d6 10 ee 7f b2 ef 36 2f fe 94 2f a8 6d 0b 2f 0c c6 f9 d0 // e1 e8 7c ed 4b 7c 23 01 88 33 f5 ea 3a 07 66 66 42 a3 00 f2 df ab // 10 6f 75 5f 66 72 77 4c f6 a0 96 af 28 87 94 a4 05 be 6c c8 9f da // f3 f7 a7 d7 67 1b de 5f d4 1e b6 02 d9 f6 37 5a 2c d0 ca ee ec 56 // d5 73 92 c7 08 7d 93 58 ed 4a 58 c8 94 62 47 b4 3c c1 aa 26 63 7a // 14 de fa f6 c6 3c f8 00 68 22 43 0a c2 2a 61 ff 84 48 c9 a4 b3 45 // 6a 40 3d e3 e9 58 8e df d9 85 0b ee 93 92 d4 73 a2 ca a9 27 e8 f1 // 91 32 68 28 15 cb 2c 5e 05 8e 2c 26 e3 5e 53 4d 20 08 cf 51 70 6e // d2 7e 08 3c ce 60 7d 33 98 81 fe 20 32 0f 3e a9 53 c1 05 cd 65 41 // f9 fd 4a bf 8c 2c 4e 49 c9 0e 3f 79 6d 5d c1 b9 79 b4 9a 43 5f 1d // 08 1d ff 63 5d 45 b5 fc f6 28 fe dc 3c fc 60 b8 b5 5a 10 ea 12 8d // a0 aa e6 c8 59 22 72 2c 27 68 ae b7 1c f3 53 83 d2 92 cc 22 ef 89 // 29 e4 e2 19 ae 32 ef 96 45 74 67 2a 94 f5 bc 93 2b 4f 9b 99 df be // 29 bb 35 10 89 20 2f be bb d3 10 e7 dd 9f 34 02 b2 9d 01 f0 e9 22 // c3 7a f8 68 9f bc 6c 4e ad 5a 84 0f fd 62 09 8a 64 a1 f3 fe ab 5a // a3 ad b7 b4 ab e9 33 7d 49 ca 3b b2 76 f2 c2 c1 79 7b 67 da f4 00 // d2 96 4a a2 6d 8f 3a af 11 79 1b 3b 58 8c a1 8d e7 f5 85 05 14 f0 // d6 81 8a 02 99 24 65 9f cf 7f 01 fb 79 45 df 72 17 f2 26 5f a7 f6 // 99 17 d9 6b bf e1 81 95 57 89 50 f7 a8 2a 26 51 f0 14 ef 36 71 9a // 90 5b 95 88 bc 5a a6 76 8f 5b 2b 69 6d 65 74 a9 d7 e8 ab 2b ae 79 // b5 cc d8 07 89 e1 88 d1 79 81 46 9b 90 82 c9 a8 a7 8f 90 ca a9 71 // a0 8a ff 81 9a 84 71 06 56 e8 b1 f8 a0 0c 41 52 b1 d6 6a dd 52 da // d9 10 f1 7c d4 91 ee 1e a0 f9 3b f8 34 da 5b 5e 33 02 4d b6 99 a5 // bc dc fe ff 1e 0b f1 7a 97 1d 6b 6d f0 4c 19 b4 25 63 a0 6b cc 7d // 40 f0 29 7b 84 89 b5 09 a8 b7 c1 8b 68 87 85 0e 06 d3 f1 3b 3e 59 // 07 7e 96 9a 4a 07 a3 c6 b6 97 ba af c1 2d 5c 7e 67 f8 ec 72 6d 3a // 00 3c e3 43 57 3a 90 8b 29 30 87 4b 3d ba 19 61 8d 28 53 6c 88 a0 // 1b b9 b7 ed 74 a1 f6 a7 a5 b5 e8 bc 96 bb a6 bb 53 59 b8 ba 65 65 // 28 f1 c0 0d aa 10 48 ff 2f df 5d 43 72 4e 78 b6 9c 5c f6 3f 3c e1 // c0 97 78 22 fc eb 6c 57 94 d6 74 69 ad aa 94 db ff 35 f2 79 47 6f // e6 75 21 40 7a bb 03 ad b5 05 df 78 45 b2 d8 29 6d bf a5 2f 56 7d // 48 dc 53 c9 0a 26 90 9e 6b 5a 4a 82 df 91 cd 39 3e 97 d9 be c1 5a // af cc 71 6b 4b f3 e0 eb 3b 60 f3 3c 82 9d c0 82 c7 40 be 3f 9c f9 // a4 0c b3 69 ba f2 c9 2d ba 6a 2f b3 c7 04 c4 ae e9 3f 41 3f d8 7a // 92 4c 41 44 68 3e 51 f5 a5 83 38 d9 6d 65 c4 57 46 b6 c4 68 57 39 // 69 87 84 17 60 a0 03 ba ae} (length 0x1000) size: len = 0x1000 (2 // bytes) // } // } // } // len: len = 0x1006 (8 bytes) // ] *(uint32_t*)0x2000000013c0 = 8; memcpy( (void*)0x2000000013c4, "\x72\x84\xe7\x4c\x46\xd8\x80\xbf\x8e\xeb\xcf\x1e\xab\x33\x42\x40\xdd\x53" "\x4d\xce\x63\xd4\x13\x37\xff\xdf\xb7\x56\xcd\x11\x84\x56\x0b\xff\x6d\x5b" "\x6b\x56\xa7\x78\x6b\x59\x69\x85\x68\x6e\xd4\x6c\x72\x28\x04\xa8\x7b\x63" "\xa1\x0d\xcb\x6f\xcc\xea\x62\x89\x72\x78\xe6\xcb\x93\x35\x10\xf2\x20\xee" "\x93\x01\x23\xab\x7e\x93\x91\x8c\xe6\x9c\xce\x6c\x22\xb6\x39\xec\xa2\xbf" "\x07\x13\xf0\x9b\xa2\x7b\xac\x41\x96\x92\x1a\x4c\xb5\x1e\xac\x36\xf5\xe9" "\x35\xe3\xfe\x9c\x6f\xe0\xd3\xad\xd2\xaa\x99\x64\x54\xce\xf6\xea\x2a\xa0" "\xb3\xc8\x56\x9f\x3b\xdc\x14\x22\xbf\xab\xf2\x7e\xdf\xaa\x0d\x0c\xc4\x27" "\xad\x0d\xb5\x2f\x2f\x71\x55\x72\xca\x28\xa7\x1b\x15\xda\xac\x15\x66\x37" "\x39\x54\xb7\xf2\xb1\xa1\xfa\x32\x9e\x74\xcb\x72\xe5\x45\xc7\x2a\x45\x01" "\xd6\x9c\x09\xf7\xf5\xdd\xc4\x0d\xf6\x0c\x8f\x06\xbf\x86\x3d\x91\x50\x65" "\x46\xc6\x71\xeb\x5c\x4f\x59\xd3\xcf\xe4\x71\x86\x4e\xe3\x58\x47\x52\x36" "\xca\x00\x5b\x15\xc9\xee\x2a\x48\x2c\x9d\xff\xb7\x0b\x28\x07\x4c\xfe\xfb" "\x70\x21\xc0\xbe\x7b\x53\x4d\xda\x52\x00\x81\x5f\x00\x4e\x3f\xa0\x0b\xe6" "\x3f\x19\xb3\x9b\x42\xe6\x62\x2a\xf5\xe5\xbc\x1c\x78\x5e\xa2\x14\x13\xed" "\x02\xbe\xc0\x96\xe1\xe4\xd2\xdc\xd7\xcb\xe1\x45\x20\x05\xbd\xe2\x36\x6c" "\xd1\x77\x06\xd6\x2a\xa1\x8a\x1a\x24\x7a\xce\x57\x43\x0c\x83\x32\x3b\xe5" "\xb0\xdb\xdb\xaa\xd9\x2a\x7d\xc6\xb5\x8f\x6b\x22\x21\x3d\xbb\x77\x5f\x76" "\x1e\xe8\x57\xa6\x67\xc8\xdc\x14\x5e\x2c\x7b\x80\xd8\xf2\xf5\xa5\x15\x9a" "\x36\x7e\x96\xaa\x48\x44\x1c\xa0\xf4\xb4\x26\x67\x09\x55\x0f\xf7\xbf\xd1" "\xfa\x1a\xa8\x6e\x3a\x94\xc8\x20\x51\xa8\xc3\x58\x38\x8c\xf9\x5d\x7f\x96" "\xf0\x86\x7c\x91\x0a\xc7\x5e\x39\xbf\x4c\xaa\x72\xaf\x61\x9e\x71\x68\xc8" "\x76\xcf\x34\x27\x39\xc9\xe4\x55\x70\xa7\x8b\xd3\x21\x80\xc4\xca\x0f\x28" "\xbb\x51\x13\x04\x58\xe5\xce\x94\x84\x50\x89\xd7\xfa\x99\x0c\x93\x1b\x98" "\xc9\xe5\x76\x5c\x0d\x0e\x65\x14\x5b\x59\x50\x72\x6e\x7f\x0a\x68\x4c\x5f" "\xc6\x22\x23\x1d\x95\x38\x17\xb7\x53\x90\xde\x63\xb2\x54\x05\x54\xae\x84" "\x61\xd5\xbb\x35\x7b\x2e\xc3\x88\x33\x38\xc8\x09\x0d\xf3\x86\x93\x8a\xba" "\x21\xed\x5e\xf7\x3e\x56\xe9\x44\x20\x7c\x77\xf9\x48\x50\xaf\x15\xb5\xea" "\x91\x7b\x2d\x14\x85\x31\xe6\x0d\xdb\xc0\x04\x5e\xe8\x6f\x8b\x97\xf4\xed" "\xc5\xaa\x6c\x8e\x44\x2f\xa4\x66\x66\x12\x01\x28\xa9\xaa\xb6\x58\x3b\xa8" "\xc8\x42\x10\xcc\x60\xb3\x79\x77\x16\x73\xfa\xb3\x8f\xda\xee\xef\x3f\x2a" "\x2b\xbf\xbc\xd7\xb3\xf2\x5c\x04\x3a\xe0\x66\x7e\xe5\xfd\x65\xb5\xf6\xec" "\x3d\x89\x92\x5e\x3d\x4e\x49\x55\xed\x53\x2b\x15\xf5\xfa\x8d\x07\xed\xb0" "\xe9\xd3\x84\xe7\xbc\x5a\x66\x61\x3b\x4e\xd4\x92\x95\xed\x04\xbf\x3f\x3c" "\x7d\x95\x59\xc4\x69\x66\xc8\xf3\x78\x5e\xe0\xd1\x07\x74\x36\x6d\x2a\x22" "\x2e\xbe\xb0\xb2\x71\x75\x7f\xbe\xea\xd3\x20\xbe\x03\x2e\xae\xe0\x05\x64" "\xb7\xe9\x1b\x59\xf5\x51\xfe\x7c\xef\x63\xe1\x3b\xaf\x4c\x80\x7b\xd1\x6a" "\x5c\xcb\x51\xe8\x48\x1a\xf2\xcc\xfe\xf4\x47\x91\x95\x1e\xd5\x45\x2c\x43" "\x5e\xa0\xb5\xa1\xed\xe1\x70\x7a\x9b\x07\x80\x27\x0f\x91\xeb\xea\x34\xae" "\x0f\xc7\xda\x60\x78\x91\xa9\xc3\x2d\x12\x4b\x50\x42\x86\x56\x6d\x1c\x7a" "\x49\x20\x0d\x99\xcc\xbc\x81\xe9\x07\x0e\xa1\x7d\x30\x91\x2b\x09\xf3\x40" "\x31\xc2\xa7\x20\x80\xae\xb3\x5b\xd8\xd0\x95\xf7\x60\x76\x17\xc2\x22\xb5" "\x05\xdf\x2c\xeb\x15\x06\x12\x53\x31\x95\x5a\x87\xb3\xb0\x4d\x00\x42\x60" "\xb7\xaf\x1d\x30\xf0\xf9\x86\x6a\x76\xae\x37\x20\xc2\xda\xfb\xf1\x67\x81" "\x75\xb8\xfa\xbb\xb7\xfc\x94\x03\xb5\xe2\xf7\xb6\x77\x48\xef\x1a\x96\x13" "\xa7\x95\x7b\x97\x26\x82\x53\xaf\x96\xd1\xbe\x69\xa9\xc5\xb4\xea\xf0\xb8" "\xde\x6a\x73\x57\x5c\xbb\x8e\xbf\x1b\x63\x51\x39\xdc\xd6\xa0\xa5\xbc\xe1" "\x08\x43\xc7\x8f\x8a\x14\xbe\x3d\x9d\x88\xf6\xf8\x39\x6a\x2f\xa9\x95\xd0" "\xee\x50\xdb\xdf\xb8\x41\x03\x34\xb8\x09\x75\x4f\x3b\xd7\x50\x56\x84\xe6" "\xa4\x11\x18\x55\x61\x3b\x0a\x8a\x6b\x85\xd5\xae\xcb\xb1\x49\x0e\x4b\x60" "\x0f\xb4\x3d\x52\x39\x7f\x09\xb5\x82\x03\xf0\x25\xb9\xd0\x9a\xde\xd8\x87" "\x0b\x82\x2b\x6d\x78\x86\x7b\x16\x8f\xb9\xf3\x4f\xda\x00\x24\x06\xf2\xe7" "\x44\xad\x7f\xba\xf7\xcd\x68\x20\x0d\xe8\x72\x13\x8e\x7d\x10\x2c\xc8\x1d" "\x89\x48\xe3\x52\x55\xdb\x09\xf7\x37\x7f\x72\x5b\xd9\x7b\x42\xb8\xff\x25" "\x7e\xfd\xcf\x61\x6f\x9d\xb9\xb0\x1d\xa2\x21\xad\xa8\x3b\xd7\xbf\x18\x60" "\x34\x7b\xb3\x09\x6c\xb8\x0c\x7c\x1e\x20\x5b\x6f\xd7\x17\x4d\x65\xb9\x65" "\xd2\xd8\x96\xa2\x6a\x32\xf4\xa2\x2e\x77\x25\xe7\xf9\x50\x48\x73\x7a\x6f" "\xa8\xf1\x4a\x8a\x30\xb5\xc3\x0f\x9f\x1e\xe7\x4c\x2e\x24\x6c\x2a\x0d\x5b" "\x0f\xa7\x74\x12\x09\x6e\xa2\x5e\x78\x91\xd3\xc2\x0d\xfe\x42\xe5\xf8\x90" "\x2a\x7f\x38\xc8\x48\xd9\x1f\x6a\x51\x99\x58\x64\x66\x59\x8c\x33\x7d\x6a" "\x49\x59\x9b\xda\xcd\x44\xa1\x33\x75\xd9\x42\x20\x8b\xe0\x56\x08\xbc\xf3" "\x40\xd9\xfd\xfe\xe6\xea\x50\xa5\x0b\x3d\xd5\xd0\x4e\xe2\xb4\x09\xea\x25" "\xd6\xa2\xef\xe3\x04\xcb\xee\x73\x84\x4a\xd5\x91\x76\xbb\xa3\xa6\xf8\x73" "\xd8\x3a\x36\x54\x62\xdc\x07\x62\xeb\xba\x8c\xf3\xb2\x3e\x91\x4c\xa3\xb0" "\x09\xfd\x5d\xbb\x85\x13\x08\xf0\x15\xf9\x7a\xab\xaf\x00\x6e\x87\x89\xfc" "\x00\xa7\x65\x49\x95\xa4\xd0\x1e\x7c\x6f\x6a\x78\xf0\x2e\xae\x4c\x2f\xd7" "\x2c\x21\xdd\xf8\xd5\x57\x83\x6e\x81\x09\x1e\x7c\x6a\xdd\x22\x5f\xe7\xe0" "\x61\x59\x49\x7f\xfc\x54\x4c\x8d\xbb\x6d\xe0\x4d\x25\xf0\xa9\xe7\x42\x79" "\x93\x91\x11\x02\xa7\xc4\x23\x5c\x50\x40\x65\x61\xa2\xa0\x1a\x8a\x2d\xb3" "\x2e\x7f\xe4\x69\xd1\xef\x1f\x72\xcc\x67\x91\x22\x07\xd8\x96\xc3\x95\xcc" "\x10\x16\xdc\x24\xdf\x94\x44\x1b\x04\x8c\xf7\xf0\x8b\xb7\x3a\x29\x00\x95" "\x7f\xac\x32\xd0\xcd\xdd\x33\x00\x51\xc9\xe7\x5b\xba\x83\x88\xae\xf2\x36" "\x55\xeb\xea\x44\xf9\xca\xb1\x40\x47\xae\xfa\xd4\xcd\xf7\x13\x08\x85\xe5" "\xbc\xb6\x1e\x3d\xba\xbf\x62\x4c\xf5\xf9\xcb\x94\x0b\x1d\xe2\x1b\x97\x0f" "\xa2\x79\x7a\x31\x8e\xda\x45\x79\x6b\x4b\x73\x44\xda\x8a\x27\x0d\x79\x0c" "\xe2\x30\xc6\x22\x29\x30\xd2\x2e\xba\xb8\xf6\x98\x8f\x48\x00\xb7\xcc\x6c" "\x0e\xcf\x46\x71\x6f\x57\x85\x9a\x9b\x9e\xa5\x4e\x9e\x8c\x80\x6b\x13\xa5" "\x03\x71\x90\x4d\x50\x26\x04\xc6\xa6\xe9\x65\xec\xcb\x4a\x4a\x71\x77\x5b" "\xa2\x8c\x77\x8d\x1c\x2d\x0b\xda\x24\xf6\x7d\x82\xcd\x34\x88\x2d\xd5\xb8" "\xce\xf7\x5f\xa0\xce\x1c\x24\x2e\xd9\xbc\xda\x06\xb1\x58\x15\x22\x58\xca" "\x43\x18\xbc\x1c\x0b\xb6\x82\x71\x7a\x70\xc3\x38\x51\x72\xbc\xb7\xbd\x39" "\x60\xee\x15\xca\xaa\xd3\xf1\x0f\xc1\xb2\x17\x16\xd9\x0c\xcc\x45\xbc\xdb" "\xa0\xeb\x14\x1a\x63\xbf\xce\x37\x2b\x9c\xe3\x3f\x53\x84\x5e\x3e\x45\x0a" "\x22\x4d\x04\xff\x16\xe6\xb0\x72\x76\x6c\x6b\x9b\xa0\x74\x16\xe0\xf3\x53" "\x09\x37\x68\xb0\x82\xd5\x8e\x8a\xbf\xba\x50\xa4\xef\x9c\xa5\x33\x46\x0f" "\x4a\x10\xe2\x9f\xd0\xd0\x73\xb9\x95\x68\x22\xf6\x74\x3b\x9e\x0a\x72\x32" "\xf6\x68\xb5\x8d\x95\xa4\xe4\x5c\x5b\x43\x2d\x1a\xe7\x71\xa3\x9e\xd6\xdd" "\x8a\xfc\x2e\x8d\x6a\x5c\x9f\xd2\x45\xf4\xf8\x46\xd4\x79\xd1\x9c\x58\x83" "\xa6\x3e\x95\xd9\x59\x40\xeb\x62\xfb\x39\x0b\x0d\x5a\x00\x0f\xbe\x26\x4e" "\xd3\xa4\x8b\xc1\x99\xd5\xa1\x65\xf2\x93\xde\x24\xb0\x45\x1d\x70\x2c\x91" "\x40\x6d\xaf\x10\xa8\xec\x0a\x23\x80\x1b\xa2\x35\x28\x9f\x89\xd9\xd2\x30" "\x6d\x8f\x7c\xae\xee\x2e\xbd\x9e\x7b\xf2\xc5\xa8\xf9\xb5\xf6\x13\x9e\x8a" "\xda\xb6\x03\x7b\x02\x63\x0f\x5e\x25\x46\xac\x9e\x79\x8f\x6b\x04\x13\x92" "\x4a\x97\xc5\xf3\x26\xd0\xf1\x82\x86\x97\x0e\xa2\x61\xc6\xdb\x69\x0e\x56" "\x71\x77\xec\x44\xd0\xa2\xc1\x5a\xfc\x7b\x37\x95\xaf\x1b\xe0\xae\x56\xfc" "\x0c\xa9\x70\x4f\x56\x91\xec\x59\x99\x37\x7b\x65\x96\x99\xdb\x40\x55\xc1" "\x83\xab\xac\xe5\x38\xea\x5c\x20\x8f\x95\xb5\xba\x26\xef\x50\x0f\x61\x2e" "\x22\xc4\x3d\x8c\xa6\xa1\x0d\x15\xfd\x60\x84\xcf\x4d\xed\x3c\xb0\x3f\xe4" "\x51\x4d\xfb\x38\x46\x7e\xaa\xc5\xe7\x1f\xfa\xff\x69\x6b\x43\x05\xbd\xab" "\x84\xc4\x71\x86\xa7\xd2\x29\x72\x03\x3d\xd6\xef\x92\x7d\xc6\xcc\x95\x7a" "\x8a\xc9\x7d\xcb\x1a\x01\x1c\x3a\xad\x96\x19\x7d\x48\x83\x50\xbd\xbb\x9a" "\x5f\xbe\xbf\xb1\xd6\x96\xda\xba\x95\x8d\x44\x9d\xbd\xc0\xab\xf8\x73\x4a" "\x62\xfa\x3a\xda\x3c\x93\xef\x0d\xfd\xb9\x5c\x73\xa7\x26\xc5\xb8\xe2\xa2" "\x8b\x78\xf5\x73\xa6\x27\xfb\x61\x19\x81\x26\x90\x06\x1c\x24\x36\x24\xee" "\x53\x6a\x6a\xd8\x30\x83\xb1\x25\x8c\xdb\x8e\xf3\x28\x5e\xd0\xe3\x16\xea" "\x4d\x60\x92\x92\x37\x96\x6c\x63\x70\x92\xd1\x72\x51\xf8\x20\x13\xe3\x83" "\xa4\x84\x71\xb4\x3e\x76\x83\xbb\x26\xd1\xa7\x01\xd7\x81\x5f\x18\xf2\xb0" "\xd2\x01\xd6\xcf\xaf\xcf\x10\x0e\x81\xf2\x7a\xbd\x55\x4e\x18\xf4\xc0\xf9" "\xdf\x59\x0c\xb5\xe2\x39\x38\x00\x5a\x18\x90\x00\xa4\xf0\xd3\x27\xe8\x05" "\x99\xe1\x85\x2c\x30\xe2\xdc\x60\xea\xc2\x11\xc8\xe7\x46\x64\xf6\x8d\x50" "\x05\xdc\x97\xa7\x47\x15\x9d\xf4\x1d\x6d\xc5\xac\xdc\x7e\xd7\x26\xe6\x2c" "\x67\x59\x87\x29\x94\x11\xd1\x04\x34\xa6\x92\x07\xf0\x58\x47\x9d\x7d\x6c" "\x3d\x6c\x09\x47\xbb\xba\x0e\x74\xd5\x96\x42\xd3\x18\x52\xc6\xad\x8d\x0b" "\xcd\x64\x13\x2a\x0a\xd5\x3e\xf7\xd6\xbf\xe8\x3f\xe9\x3d\x17\x25\x88\x4e" "\xbc\x40\x1c\xff\x35\x34\xbe\xf8\x45\xe5\x2a\xc0\x76\x37\xdd\xa7\x48\x71" "\x9f\x86\x8a\x4c\x7b\x94\xe2\xf4\x0d\xe8\x80\x6a\x72\xb9\x68\x5d\x9d\xb3" "\x7d\x8a\xd2\x8a\x5b\xa3\xf1\x29\x1a\x39\xf8\xda\x98\x66\xeb\xc2\xbf\xc2" "\xdf\x24\xbc\xd8\x67\xa5\x75\xdc\x07\x05\xee\xf0\x0c\x66\xaa\x10\xd7\x48" "\x8e\x71\x2c\x4b\x33\x46\x18\x95\xc3\xa1\x94\x5f\x91\x71\xa1\xe8\xbb\xf4" "\x07\x98\xa8\xe9\xd3\x8c\xcf\xa4\xbf\x4f\x2f\xfe\x0d\x85\x5b\xde\xec\x66" "\x87\xfa\x46\xa9\xa3\xbf\xad\x1f\x08\x0f\x01\x46\x6f\x5b\x6e\x80\x85\x8b" "\x6f\x82\x55\xea\x78\x69\xfb\x12\xef\x54\x58\x7f\x54\x4d\x3f\x6d\x5b\xb9" "\x58\xdd\x12\xce\x3b\xe1\xdc\x09\xcf\x20\xcc\xa7\x41\x4e\x61\xe1\x0f\xb2" "\xc9\x61\x5e\xd2\xec\xea\xda\x93\x7f\x56\x70\x86\xaa\xd1\x6e\x53\x01\x7b" "\x14\xf2\x28\x1a\xfc\x27\x62\x59\x81\x66\x3a\xbd\xf3\x7f\x58\x63\xf4\x53" "\x25\x4a\xee\x81\xce\x5c\x50\x40\xcb\x93\x07\xbc\xf7\x9f\x62\xe0\xfa\xda" "\x8a\xf6\x8b\x8d\xa0\x34\xc8\x0e\xa0\x3c\x08\x48\x38\xdc\x9e\xb6\x4b\x6e" "\x6d\x6e\xef\xc4\x04\x17\xe9\x1c\x81\xe9\xdd\xe4\xed\xb4\x4b\x04\x97\x97" "\x4f\x4f\x65\xc9\xe0\x4a\xc0\xba\xf1\x1f\xa6\x2d\xbb\xf5\xe8\x59\x8c\x6d" "\xb7\x74\xa8\x56\x77\x98\x65\xcb\xce\x9a\x39\x9a\xa7\xad\x6c\x22\x1c\x16" "\x91\xa4\x92\x2f\x1c\x3f\x06\xa2\x83\x33\x04\x6e\x17\xa2\x2e\xb0\x45\x0e" "\xfe\xab\xc8\x7a\xea\x56\x59\xa9\x90\x2d\xda\x5a\x1d\x4a\x28\x93\x9f\x31" "\x41\x69\x87\xc6\x43\xb7\xd7\xd0\x11\xb9\xe2\xc5\xb0\x73\xb5\x7e\xec\x51" "\xe2\x00\xbb\x91\xae\x03\x3b\xc5\xc4\xde\x62\x58\x1c\x1e\x29\x0e\x3d\xbc" "\xea\xd8\x2f\xb4\x2e\xc2\x66\x1b\x10\x1f\x62\x7a\xea\x8e\xbd\xcd\x37\x31" "\x74\xc6\x20\x1d\x88\x8b\x47\x61\x80\x59\x18\x7c\x5a\x63\x40\xaa\x35\xab" "\x14\x74\x99\x6d\x3c\xb2\x5d\x20\x90\xc0\xcb\xd2\xf7\xe4\xf7\x4a\xc0\xe5" "\x94\x57\x1a\x72\x5f\x39\x5e\x41\xfd\x01\x40\xf4\x0f\x20\x12\xac\x26\x92" "\x64\xc1\xd7\x56\x3d\xed\xc5\x15\x49\xab\x76\x95\x41\xbe\xe6\x3c\x64\xa6" "\xea\x6d\xde\x84\x85\xf9\x8d\x4e\x1f\x82\x6c\x65\xe9\xde\x42\x64\x34\x97" "\xda\x78\x0e\x4b\x1c\x95\x82\xa6\xde\xb0\x59\xbd\x43\xda\xbe\xce\x6e\x12" "\xaf\x0a\xe8\x0b\xe9\x05\x4b\xf6\x83\xe1\x02\x61\x36\xe8\xa1\x45\x92\x80" "\xef\x84\x6e\xc7\x87\x80\xc5\xa8\x07\xbd\x44\x6a\xef\x77\xc5\x72\xe0\x7b" "\xe7\x73\xf7\x3a\x11\x77\x92\xc8\x90\x25\xb0\x7e\x6f\xac\x09\x53\x9d\x30" "\x6f\x29\x62\xd5\xe2\x6e\x03\x53\x17\x3c\xf2\xb5\xc6\xa1\xf4\x2f\xd6\x01" "\x34\xee\x1a\xc6\x4a\x24\x36\x0d\x97\x4e\x3f\x01\x9f\x42\xdb\x20\xe9\xe9" "\x6b\x54\x83\xd4\x42\x0b\x4e\x03\xa9\x1f\x56\x1e\x38\xa7\xbf\x30\x75\x32" "\x69\xde\x29\x17\x29\x70\x06\x2d\xf4\xef\xf6\x99\x07\x9f\x05\xcd\x72\xea" "\xb3\xab\x4a\x27\xe6\xe5\x52\x25\x3a\x19\x6c\x0c\x50\x02\xdf\xa6\x6a\xa5" "\xa2\x1f\xb0\xf7\xc1\xaf\x1f\xa1\x7b\xce\x79\xae\xd2\xdf\x04\xbc\x19\x19" "\x70\x28\x5b\x8f\x00\x19\xf7\x21\xf1\x32\x23\x40\x1b\xf7\xa0\x16\x3c\xa7" "\x4f\xab\x87\x1b\x7a\x87\x5e\x49\x19\x08\x30\x67\x09\x59\x44\x24\x30\x2a" "\x90\xd8\x7b\x58\xf8\xaf\xd1\xf0\xaa\x00\x2a\xb9\xf5\x47\x8c\xb7\x09\xe5" "\x39\xf5\x36\x23\x11\x07\x55\x4b\x73\x20\xf3\x35\x11\xfe\x90\x87\x67\x8a" "\xfc\x12\xc5\xf2\x7c\xe0\xca\xf5\x55\xfc\xce\xa5\x0e\xdc\xe7\x3f\xc9\xbb" "\xce\x2f\xaa\xca\xcc\x67\xca\x70\xe2\xc2\x13\x39\x69\xb2\x9a\x56\xa8\xf9" "\xaf\x4b\x1b\x7f\x2b\xb5\xb3\x2b\x53\xac\xd7\x93\x93\xcc\xc3\x94\xba\x8d" "\x30\x6c\x13\x6e\xdb\xdf\x4d\x32\x51\x33\xfc\x09\x38\x58\x5c\x18\x92\xc1" "\x9a\x42\xd4\x69\xd9\x31\xf8\x05\xf6\xeb\x2c\x85\x78\xd6\xc9\x5d\x2d\xd8" "\xaf\xee\x71\x3a\xbd\x69\x91\xda\x0d\x66\x34\x11\x17\x7d\xac\x51\x2e\x95" "\x63\x9f\x0f\xd5\x2b\x23\x0e\x83\x01\xd4\xc4\xe3\xbc\xac\x70\x8f\x06\xdf" "\x38\xd3\x06\xec\x3e\x60\xb8\x30\xbf\x99\x07\x40\xb6\xa6\x6d\x9d\x71\x9f" "\x7b\x36\xec\x5a\xfd\xcf\x45\xe5\x65\xef\x87\x81\x5c\xae\x0e\xb0\xf5\x7c" "\x65\xd8\xb6\x81\x45\x83\xc2\x8d\x92\xbe\x48\x56\x2f\xfd\xb0\xe2\x31\xfc" "\xe5\x71\x47\x26\x52\xb5\x66\xd8\x52\x4d\x51\xc1\xdd\x78\x5a\x9b\x5a\xef" "\x13\x73\xc3\x00\x55\x35\xea\x1d\x63\x1f\xb5\x91\x64\x64\xaa\xa3\xbe\xe4" "\xce\x13\x78\x60\x64\x6a\xe1\x2a\xfa\x13\xc7\x05\x5a\x13\x68\xc4\xeb\xf2" "\x27\x6b\xf0\x54\xb7\xde\xb1\x14\xce\xfa\xfe\xe7\xbc\x14\x91\x25\xfc\xbb" "\x7a\x6f\x01\x49\x14\x99\x9e\xfc\x96\x13\x18\xaa\x52\x68\xfc\x31\x1b\x19" "\x12\xaf\xec\x7d\x6b\xde\x6f\xd7\x43\x0b\x9f\x8a\xa7\xe2\x1a\xa7\x49\x24" "\xf1\x26\xdb\x5e\xf0\x76\x9d\xc4\x4b\xc2\xba\xa3\xa8\xa8\x90\x84\x24\xfa" "\x8f\x07\x3b\xad\x4c\x5c\x73\x3a\xd5\xc6\xd7\x79\x3f\x3c\x54\x6b\x22\x01" "\x82\x7f\xa2\x79\x17\x89\x04\x1c\x9d\x34\x6f\xb6\xd9\xe7\x76\x17\xdc\xe2" "\x12\x1f\x10\xb9\xc5\x41\xce\xc3\x10\x3a\x69\x2a\x82\x06\xfd\x87\x21\xe5" "\xf2\xb0\x7e\x8e\x9e\xca\xf8\x01\x44\x50\xa8\x7c\x78\xe3\x1c\xff\x88\x96" "\x57\x79\x8b\xe7\x80\x12\x36\x61\x0b\xaf\xc8\x93\x54\xb3\x68\x2b\x74\xf7" "\x0f\xcb\x88\x3f\x90\x4b\x56\x2d\xd8\x7e\xa3\xa0\x14\xef\xb4\xae\xe0\x7f" "\x14\x03\x67\x0c\x5b\x9d\xd9\x6c\x7c\x4e\x38\x03\x1f\xf7\xaa\xbe\x83\xf0" "\x1e\xf8\xd0\x7d\x15\xa9\x37\x0c\x24\xb7\xbc\x69\xc0\x7c\x45\x4a\xc3\xfa" "\x07\x67\x0a\x7d\xc0\x86\x27\xf2\xf7\x41\xf9\x3c\x37\xbc\x15\x61\x4c\x9d" "\xa6\xa8\xf2\xbd\x93\x19\x1f\x8e\xdd\xa9\x4e\xd8\x52\x1e\x70\x8d\x7c\xd3" "\x13\xc5\x12\xc2\x02\x6f\xfa\x6c\x09\xe6\xf7\x6d\xfe\x7a\xb0\xa4\x3b\x4f" "\xa9\x3d\x18\x61\x85\x5c\x60\x07\xe0\x91\xba\x38\x9f\xa1\x07\x6c\x0c\x53" "\xd5\x1b\x5d\xf5\x3e\x7b\xf8\xe7\x78\xa2\xb8\xaf\x2c\x88\xd3\xae\xf7\xfc" "\x4a\x12\x3a\x04\xe1\x0f\xbd\x87\xd6\x10\xee\x7f\xb2\xef\x36\x2f\xfe\x94" "\x2f\xa8\x6d\x0b\x2f\x0c\xc6\xf9\xd0\xe1\xe8\x7c\xed\x4b\x7c\x23\x01\x88" "\x33\xf5\xea\x3a\x07\x66\x66\x42\xa3\x00\xf2\xdf\xab\x10\x6f\x75\x5f\x66" "\x72\x77\x4c\xf6\xa0\x96\xaf\x28\x87\x94\xa4\x05\xbe\x6c\xc8\x9f\xda\xf3" "\xf7\xa7\xd7\x67\x1b\xde\x5f\xd4\x1e\xb6\x02\xd9\xf6\x37\x5a\x2c\xd0\xca" "\xee\xec\x56\xd5\x73\x92\xc7\x08\x7d\x93\x58\xed\x4a\x58\xc8\x94\x62\x47" "\xb4\x3c\xc1\xaa\x26\x63\x7a\x14\xde\xfa\xf6\xc6\x3c\xf8\x00\x68\x22\x43" "\x0a\xc2\x2a\x61\xff\x84\x48\xc9\xa4\xb3\x45\x6a\x40\x3d\xe3\xe9\x58\x8e" "\xdf\xd9\x85\x0b\xee\x93\x92\xd4\x73\xa2\xca\xa9\x27\xe8\xf1\x91\x32\x68" "\x28\x15\xcb\x2c\x5e\x05\x8e\x2c\x26\xe3\x5e\x53\x4d\x20\x08\xcf\x51\x70" "\x6e\xd2\x7e\x08\x3c\xce\x60\x7d\x33\x98\x81\xfe\x20\x32\x0f\x3e\xa9\x53" "\xc1\x05\xcd\x65\x41\xf9\xfd\x4a\xbf\x8c\x2c\x4e\x49\xc9\x0e\x3f\x79\x6d" "\x5d\xc1\xb9\x79\xb4\x9a\x43\x5f\x1d\x08\x1d\xff\x63\x5d\x45\xb5\xfc\xf6" "\x28\xfe\xdc\x3c\xfc\x60\xb8\xb5\x5a\x10\xea\x12\x8d\xa0\xaa\xe6\xc8\x59" "\x22\x72\x2c\x27\x68\xae\xb7\x1c\xf3\x53\x83\xd2\x92\xcc\x22\xef\x89\x29" "\xe4\xe2\x19\xae\x32\xef\x96\x45\x74\x67\x2a\x94\xf5\xbc\x93\x2b\x4f\x9b" "\x99\xdf\xbe\x29\xbb\x35\x10\x89\x20\x2f\xbe\xbb\xd3\x10\xe7\xdd\x9f\x34" "\x02\xb2\x9d\x01\xf0\xe9\x22\xc3\x7a\xf8\x68\x9f\xbc\x6c\x4e\xad\x5a\x84" "\x0f\xfd\x62\x09\x8a\x64\xa1\xf3\xfe\xab\x5a\xa3\xad\xb7\xb4\xab\xe9\x33" "\x7d\x49\xca\x3b\xb2\x76\xf2\xc2\xc1\x79\x7b\x67\xda\xf4\x00\xd2\x96\x4a" "\xa2\x6d\x8f\x3a\xaf\x11\x79\x1b\x3b\x58\x8c\xa1\x8d\xe7\xf5\x85\x05\x14" "\xf0\xd6\x81\x8a\x02\x99\x24\x65\x9f\xcf\x7f\x01\xfb\x79\x45\xdf\x72\x17" "\xf2\x26\x5f\xa7\xf6\x99\x17\xd9\x6b\xbf\xe1\x81\x95\x57\x89\x50\xf7\xa8" "\x2a\x26\x51\xf0\x14\xef\x36\x71\x9a\x90\x5b\x95\x88\xbc\x5a\xa6\x76\x8f" "\x5b\x2b\x69\x6d\x65\x74\xa9\xd7\xe8\xab\x2b\xae\x79\xb5\xcc\xd8\x07\x89" "\xe1\x88\xd1\x79\x81\x46\x9b\x90\x82\xc9\xa8\xa7\x8f\x90\xca\xa9\x71\xa0" "\x8a\xff\x81\x9a\x84\x71\x06\x56\xe8\xb1\xf8\xa0\x0c\x41\x52\xb1\xd6\x6a" "\xdd\x52\xda\xd9\x10\xf1\x7c\xd4\x91\xee\x1e\xa0\xf9\x3b\xf8\x34\xda\x5b" "\x5e\x33\x02\x4d\xb6\x99\xa5\xbc\xdc\xfe\xff\x1e\x0b\xf1\x7a\x97\x1d\x6b" "\x6d\xf0\x4c\x19\xb4\x25\x63\xa0\x6b\xcc\x7d\x40\xf0\x29\x7b\x84\x89\xb5" "\x09\xa8\xb7\xc1\x8b\x68\x87\x85\x0e\x06\xd3\xf1\x3b\x3e\x59\x07\x7e\x96" "\x9a\x4a\x07\xa3\xc6\xb6\x97\xba\xaf\xc1\x2d\x5c\x7e\x67\xf8\xec\x72\x6d" "\x3a\x00\x3c\xe3\x43\x57\x3a\x90\x8b\x29\x30\x87\x4b\x3d\xba\x19\x61\x8d" "\x28\x53\x6c\x88\xa0\x1b\xb9\xb7\xed\x74\xa1\xf6\xa7\xa5\xb5\xe8\xbc\x96" "\xbb\xa6\xbb\x53\x59\xb8\xba\x65\x65\x28\xf1\xc0\x0d\xaa\x10\x48\xff\x2f" "\xdf\x5d\x43\x72\x4e\x78\xb6\x9c\x5c\xf6\x3f\x3c\xe1\xc0\x97\x78\x22\xfc" "\xeb\x6c\x57\x94\xd6\x74\x69\xad\xaa\x94\xdb\xff\x35\xf2\x79\x47\x6f\xe6" "\x75\x21\x40\x7a\xbb\x03\xad\xb5\x05\xdf\x78\x45\xb2\xd8\x29\x6d\xbf\xa5" "\x2f\x56\x7d\x48\xdc\x53\xc9\x0a\x26\x90\x9e\x6b\x5a\x4a\x82\xdf\x91\xcd" "\x39\x3e\x97\xd9\xbe\xc1\x5a\xaf\xcc\x71\x6b\x4b\xf3\xe0\xeb\x3b\x60\xf3" "\x3c\x82\x9d\xc0\x82\xc7\x40\xbe\x3f\x9c\xf9\xa4\x0c\xb3\x69\xba\xf2\xc9" "\x2d\xba\x6a\x2f\xb3\xc7\x04\xc4\xae\xe9\x3f\x41\x3f\xd8\x7a\x92\x4c\x41" "\x44\x68\x3e\x51\xf5\xa5\x83\x38\xd9\x6d\x65\xc4\x57\x46\xb6\xc4\x68\x57" "\x39\x69\x87\x84\x17\x60\xa0\x03\xba\xae", 4096); *(uint16_t*)0x2000000023c4 = 0x1000; syscall(__NR_write, /*fd=*/r[0], /*data=*/0x2000000013c0ul, /*len=*/0x1006ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; use_temporary_dir(); loop(); return 0; }