// https://syzkaller.appspot.com/bug?id=da0d8a51e89e8a43bbe9f97163f12296725c796c // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) { strcat(opts, ",errors=withdraw"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_mount_image$udf arguments: [ // fs: ptr[in, buffer] { // buffer: {75 64 66 00} (length 0x4) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: mount_flags = 0x0 (8 bytes) // opts: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {6e 6f 61 64 69 6e 69 63 62 2c 6e 6f 73 74 72 69 // 63 74 2c 6d 6f 64 65 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 // 30 30 30 30 30 30 30 30 34 2c 75 69 64 3d 66 6f 72 67 65 74 2c 6e // 6f 61 64 69 6e 69 63 62 2c 75 6d 61 73 6b 3d 30 30 30 30 30 30 30 // 30 30 30 30 30 30 30 30 34 30 30 30 32 30 30 30 2c 6c 61 73 74 62 // 6c 6f 63 6b 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 // 30 31 33 2c 75 6e 64 65 6c 65 74 65 2c 70 61 72 74 69 74 69 6f 6e // 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 2c // 00} (length 0xab) // } // } // } // chdir: int8 = 0x43 (1 bytes) // size: len = 0xc11 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0xc11) // } // ] // returns fd_dir NONFAILING(memcpy((void*)0x200000000c40, "udf\000", 4)); NONFAILING(memcpy((void*)0x2000000000c0, "./file0\000", 8)); NONFAILING(memcpy( (void*)0x200000000100, "noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb," "umask=00000000000000040002000,lastblock=00000000000000000013,undelete," "partition=00000000000000000005,\000", 171)); NONFAILING(memcpy( (void*)0x200000000d00, "\x78\x9c\xec\xdd\x5d\x68\x5c\xe9\x79\x07\xf0\xe7\x9d\x23\xad\x46\xda\x34" "\xd1\x66\x13\x6f\xd2\x66\xd3\x81\x94\xc4\x28\xb5\xf1\x57\x6c\x05\x97\x20" "\x67\x15\xb5\x01\xc7\x1b\x22\x2b\x74\xaf\xa2\xd1\x87\x9d\x61\xe5\x91\x91" "\xe4\xc6\x9b\xb6\x41\x6d\x49\x0b\xbd\x09\xdd\x9b\xd2\x9b\x22\x9a\x2e\x2d" "\xe4\xa2\x57\xdd\x5e\x56\x69\xb6\x90\x50\x0a\x25\xe4\x22\xbd\x28\x08\x9a" "\x2c\x7b\xd1\x0b\x5d\x04\x0a\x2d\x1b\x85\x73\xe6\x1d\x69\x64\xcb\xb6\xb2" "\x5e\x5b\xd2\xee\xef\xb7\xcc\xfe\xcf\x9c\x79\xce\xf8\xfd\x18\x9f\x39\x02" "\xbf\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x44\x7c" "\xf6\x73\x97\x4e\x9d\x4e\x07\xdd\x0a\x00\xe0\x71\xba\x32\xf9\xa5\x53\x67" "\x7d\xff\x03\xc0\xbb\xca\x55\x3f\xff\x03\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xc0\x61\x97\xa2\x88\x63\x91\x62\xe8\xd5\xcd\x34\x5d\x3d\xef\xa8" "\x5f\x6e\xb5\x6f\xdd\x9e\x1a\x9f\xd8\xfb\xb0\xc1\x14\x29\x6a\x51\x54\xf5" "\xe5\xa3\x7e\xfa\xcc\xd9\x73\x9f\x3a\x7f\x61\xb4\x9b\xf7\x3f\xfe\xed\xf6" "\xe1\x78\x7e\xf2\xea\xa5\xc6\x73\x8b\x37\x6e\x2e\xcd\x2f\x2f\xcf\xcf\x35" "\xa6\xda\xad\xd9\xc5\xb9\xf9\x7d\xbf\xc3\xc3\x1e\x7f\xa7\x91\x6a\x00\x1a" "\x37\x5e\xbc\x35\x77\xed\xda\x72\xe3\xcc\xc9\xb3\xbb\x5e\xbe\x3d\xfc\xfa" "\xc0\x93\xc7\x86\x2f\x5e\x38\x71\x7e\xb4\x5b\x3b\x35\x3e\x31\x31\xd9\x53" "\xd3\xd7\xff\x96\xff\xf4\xbb\xdc\x6b\x85\xc7\x13\x51\x44\x33\x52\xbc\x39" "\xfc\x46\x6a\x46\x44\x2d\x1e\x7e\x2c\x1e\xf0\xd9\x79\xd4\x06\xab\x4e\x8c" "\x54\x9d\x98\x1a\x9f\xa8\x3a\xb2\xd0\x6a\xb6\x57\xca\x17\x53\x2d\x57\xd5" "\x22\x1a\x3d\x07\x8d\x75\xc7\xe8\x31\xcc\xc5\x43\x19\x8b\x58\x2d\x9b\x5f" "\x36\x78\xa4\xec\xde\xe4\xcd\xe6\x52\x73\x66\x61\xbe\xf1\xc5\xe6\xd2\x4a" "\x6b\xa5\xb5\xd8\x4e\xb5\x4e\x6b\xcb\xfe\x34\xa2\x16\xa3\x29\x62\x2d\x22" "\x36\x06\xee\x7e\xbb\xfe\x28\xe2\xa3\x91\xe2\xe5\x53\x9b\x69\x26\x22\x8a" "\xee\x38\x7c\xb2\x5a\x18\xfc\xe0\xf6\xd4\x1e\x41\x1f\xf7\xa1\x6c\x67\xa3" "\x3f\x62\xad\x76\x04\xe6\xec\x10\x1b\x88\x22\xae\x44\x8a\x9f\xbd\x76\x3c" "\x66\xcb\x31\xcb\x8f\xf8\x78\xc4\x17\xca\x7c\x35\xe2\x95\x32\x3f\x13\x91" "\xca\x0f\xc6\xb9\x88\x9f\xee\xf1\x39\xe2\x68\xea\x8b\x22\xfe\x3d\x52\x2c" "\xa6\xcd\x34\x57\x9d\x0f\xba\xe7\x95\xcb\x5f\x6e\x7c\xbe\x7d\x6d\xb1\xa7" "\xb6\x7b\x5e\x39\xf2\xdf\x0f\x8f\xd3\x21\x3f\x37\xd5\xa3\x88\x99\xea\x8c" "\xbf\x99\xde\xfa\xc5\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x6f\xb7\xc1\x28\xe2\xdb\x91\xe2\x4f\x9e\xfd\xbd\x6a\x5d\x71\x54\xeb" "\xd2\xdf\x77\x71\xf4\x3d\x2f\xfc\x76\xef\x9a\xf1\x67\x1e\xf0\x3e\x65\xed" "\xc9\x88\x58\xad\xed\x6f\x4d\x6e\x7f\x5e\x3a\x9c\x6a\xe5\x7f\x8f\xa0\x63" "\xec\x4b\x3d\x8a\xf8\x46\x5e\xff\xf7\x47\x07\xdd\x18\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x77\xb5\x22\x5e\x88\x14\x5f\x39" "\x71\x3c\xad\x45\xef\x3d\xc5\x5b\xed\xeb\x8d\xab\xcd\x99\x85\xce\x5d\x61" "\xbb\xf7\xfe\xed\xde\x33\x7d\x6b\x6b\x6b\xab\x91\x3a\x39\x96\x73\x3a\xe7" "\x6a\xce\xb5\x9c\xeb\x39\x37\x72\x46\x2d\x1f\x9f\x73\x2c\xe7\x74\xce\xd5" "\x9c\x6b\x39\xd7\x73\x6e\xe4\x8c\x22\x1f\x9f\x73\x2c\xe7\x74\xce\xd5\x9c" "\x6b\x39\xd7\x73\x6e\xe4\x8c\xbe\x7c\x7c\xce\xb1\x9c\xd3\x39\x57\x73\xae" "\xe5\x5c\xcf\xb9\x91\x33\x0e\xc9\xbd\x7b\x01\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\xde\x49\x6a\x51\xc4\xcf\x23\xc5\xb7\xbe\xb6\x99\x22\x45\xc4" "\x58\xc4\x74\x74\x72\x7d\xe0\xa0\x5b\x07\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x94\xea\xa9\x88\x93\x91\x62" "\xfd\x85\x7a\xf5\x7c\xad\x16\x71\x35\x22\x7e\xbe\xb5\xb5\xd5\x7d\x44\xc4" "\x66\x99\x0f\xeb\xa0\xfb\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x87\x56\x2a\xe2\x63\x91\xe2\xe9\xff\xdb\x4c\x8d\x88\xb8" "\x3d\xfc\xfa\xc0\x93\xc7\x86\x2f\x5e\x38\x71\x7e\xb4\x88\x22\x52\x59\xd2" "\x5b\xff\xfc\xe4\xd5\x4b\x8d\xe7\x16\x6f\xdc\x5c\x9a\x5f\x5e\x9e\x9f\x6b" "\x4c\xb5\x5b\xb3\x8b\x73\xf3\xfb\xfd\xe3\xea\x97\x5b\xed\x5b\xb7\xa7\xc6" "\x27\x1e\x49\x67\x1e\x68\xf0\x11\xb7\x7f\xb0\xfe\xdc\xe2\xcd\x97\x96\x5a" "\xd7\xbf\xba\xb2\xe7\xeb\x43\xf5\x4b\x33\xcb\x2b\x4b\xcd\xd9\xbd\x5f\x8e" "\xc1\xa8\x45\x4c\xf7\xee\x19\xa9\x1a\x3c\x35\x3e\x51\x35\x7a\xa1\xd5\x6c" "\x57\x87\xa6\xda\x3d\x1a\x58\x8b\x18\xdb\x6f\x67\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x38\x34\x86\x52\x11\x9f\x8b\x14\x3f" "\xf9\xaf\x73\xa9\xbb\x6e\xbc\xaf\xb3\xe6\xff\x57\x3a\xcf\x8a\xed\xda\x57" "\xfe\x60\xe7\x77\x01\x2c\xdc\x91\x5d\xbd\xbf\x3f\x60\x3f\xdb\x69\xbf\x0d" "\x1d\xa9\x16\xde\x37\xa6\xc6\x27\x26\x26\x7b\x76\xf7\xf5\xdf\x5d\x5a\xb6" "\x29\xa5\x22\x9e\x89\x14\x9f\x78\xf9\x43\xd5\x7a\xf8\x14\x43\x7b\xae\x8d" "\x2f\xeb\xde\x5b\xd6\xdd\x38\x97\xeb\x86\x7f\xad\xac\x5b\xdd\x55\x55\x1f" "\x99\x1a\x9f\x68\x5c\x59\x6c\x9f\xb8\xb4\xb0\xb0\x38\xdb\x5c\x69\xce\x2c" "\xcc\x37\x26\x6f\x36\x67\xf7\xfd\x8b\x03\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\xe0\x3e\x86\x52\x11\x3f\x8a\x14\xff\xf3\xf7" "\xff\x91\xba\xf7\x9d\xcf\xeb\xff\xfb\x3a\xcf\x7a\xd6\xff\xff\x56\xb5\x84" "\xbe\x52\x4f\xbb\x73\x5b\xb5\xb6\xff\xbd\xd5\xda\xfe\xce\xf6\xfb\x2e\x8e" "\x0e\x7d\xf4\xd9\x7b\xed\x7f\x14\xeb\xff\xcb\x36\xa5\x54\xc4\x37\x23\xc5" "\xd9\x1f\x7d\xa8\xba\x9f\x7e\x77\xfd\xff\xf4\x1d\xb5\x65\xdd\x9f\x45\x8a" "\x37\x9e\xfd\x48\xae\xab\x3d\x51\xd6\x35\xbb\xdd\xe9\xbc\xe3\xb5\xd6\xc2" "\xfc\xa9\xb2\xf6\xaf\x23\xc5\xaf\xbf\xd9\xad\x8d\xaa\xf6\x7a\xae\x7d\x7a" "\xa7\xf6\x74\x59\x3b\x18\x29\xfe\x72\x73\x77\xed\x57\x73\xed\x07\x76\x6a" "\xcf\x94\xb5\xc7\x23\xc5\xf7\xfe\x7b\xef\xda\x0f\xee\xd4\x9e\x2d\x6b\x7f" "\x12\x29\xfe\xe9\xef\x1a\xdd\xda\xa1\xb2\xf6\xf7\x73\xed\xb1\x9d\xda\x93" "\xb3\x8b\x0b\x73\x0f\x1a\xd6\x72\xfe\xbf\x13\x29\xfe\xf6\xca\xef\xa4\x6e" "\x9f\xef\x39\xff\x3d\xbf\xff\x61\xf5\x8e\xdc\x76\xd7\x9c\xdf\x7f\xfb\xed" "\x9a\xff\xe1\x9e\x7d\xab\x79\x5e\xff\x34\xcf\x7f\xf3\x01\xf3\x7f\x3e\x52" "\x7c\xa7\xfe\x91\x5c\xd7\x19\xfb\x99\xfc\xfa\x53\xd5\xff\x77\xe6\xff\x13" "\x91\xe2\x3f\xff\x6d\x77\xed\xb5\x5c\xfb\xfe\x9d\xda\xd3\xfb\xed\xd6\x41" "\x2b\xe7\xff\xdb\x91\xe2\xbb\x7f\xf5\xe3\xed\x3e\xe7\xf9\xcf\x23\xbb\x33" "\x43\xbd\xf3\xff\xab\x7d\xbb\x73\xfb\x53\x72\x40\xf3\xff\x54\xcf\xbe\xe1" "\xdc\xae\xd9\x5f\x72\x2c\xde\x8d\x96\x5f\xfa\xfa\x8b\xcd\x85\x85\xf9\x25" "\x1b\x36\x6c\xd8\xd8\xde\x38\xe8\x33\x13\x8f\x43\xf9\xfd\xff\xe7\x91\xe2" "\xff\x8f\x15\xa9\x7b\x1d\x93\xbf\xff\xdf\xd3\x79\xb6\x73\xfd\xf7\xbf\xdf" "\xd8\xf9\xfe\xbf\x78\x47\x6e\x3b\xa0\xef\xff\xf7\xf7\xec\xbb\x98\xaf\x5a" "\xfa\xfb\x22\xea\x2b\x37\x6e\xf6\x3f\x13\x51\x5f\x7e\xe9\xeb\x27\x5a\x37" "\x9a\xd7\xe7\xaf\xcf\xb7\xcf\x9c\x3e\xf5\xe9\x4f\x9f\x3f\x7d\xea\xf4\xf9" "\xfe\x27\xba\x17\x77\x3b\x5b\xfb\x1e\xbb\x77\x82\x72\xfe\x7f\x10\x29\x7e" "\xf8\x0f\x3f\xdc\xfe\x39\x66\xf7\xf5\xdf\xde\xd7\xff\x43\x77\xe4\xb6\x03" "\x9a\xff\xa7\x7b\xfb\xb4\xeb\xba\x66\xdf\x43\xf1\xae\x54\xce\xff\xdf\x44" "\x8a\xa7\x3e\xfb\xe3\xed\x9f\x37\xef\x77\xfd\xdf\xfd\xf9\xff\xf8\xc7\x76" "\xe7\xf6\xdf\xbf\x03\x9a\xff\x0f\xf4\xec\x1b\xce\xed\x6a\xfd\x92\x63\x01" "\x00\x00\x00\x00\x00\x00\x00\x00\x70\x94\x0c\xa5\x22\xfe\x22\x52\xfc\xee" "\x1f\xff\x66\xea\xae\x21\xda\xcf\xbf\xff\x9b\xbb\x23\xb7\x1d\xd0\xbf\xff" "\x3a\xd6\xb3\x6f\xee\x31\xad\x6b\xd8\xf7\x20\x03\x00\x1c\x22\xe5\xf5\xdf" "\x07\x23\xc5\x3f\x6f\x7d\x7f\x7b\x2d\xf7\xee\xeb\xbf\xf8\x8d\x6e\x6d\xef" "\xf5\xdf\xbd\x1c\x86\xfb\xff\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\xc0\x51\x97\xa2\x88\x3f\x8c\x14\x43\xaf\x6e\xa6" "\xf5\x81\xf2\x79\x47\xfd\x72\xab\x7d\xeb\xf6\xd4\xf8\xc4\xde\x87\x0d\xa6" "\x48\x51\x8b\xa2\xaa\x2f\x1f\xf5\xd3\x67\xce\x9e\xfb\xd4\xf9\x0b\xa3\xdd" "\xbc\xff\xf1\x6f\xb7\x0f\xc7\xf3\x93\x57\x2f\x35\x9e\x5b\xbc\x71\x73\x69" "\x7e\x79\x79\x7e\xae\x31\xd5\x6e\xcd\x2e\xce\xcd\xef\xfb\x1d\x1e\xf6\xf8" "\x3b\x8d\x54\x03\xd0\xb8\xf1\xe2\xad\xb9\x6b\xd7\x96\x1b\x67\x4e\x9e\xdd" "\xf5\xf2\xed\xe1\xd7\x07\x9e\x3c\x36\x7c\xf1\xc2\x89\xf3\xa3\xdd\xda\xa9" "\xf1\x89\x89\xc9\x9e\x9a\xbe\xfe\xb7\xfc\xa7\xdf\x25\xdd\x63\xff\x13\x51" "\xc4\xf7\x23\xc5\x9b\xc3\x6f\xa4\xef\x0e\x44\xd4\xe2\xe1\xc7\xe2\x01\x9f" "\x9d\x47\x6d\xb0\xea\xc4\x48\xd5\x89\xa9\xf1\x89\xaa\x23\x0b\xad\x66\x7b" "\xa5\x7c\x31\xd5\x72\x55\x2d\xa2\xd1\x73\xd0\x58\x77\x8c\x1e\xc3\x5c\x3c" "\x94\xb1\x88\xd5\xb2\xf9\x65\x83\x47\xca\xee\x4d\xde\x6c\x2e\x35\x67\x16" "\xe6\x1b\x5f\x6c\x2e\xad\xb4\x56\x5a\x8b\xed\x54\xeb\xb4\xb6\xec\x4f\x23" "\x6a\x31\x9a\x22\xd6\x22\x62\x63\xe0\xee\xb7\xeb\x8f\x22\xbe\x19\x29\x5e" "\x3e\xb5\x99\xfe\x65\x20\xa2\xe8\x8e\xc3\x27\xaf\x4c\x7e\xe9\xd4\xd9\x07" "\xb7\xa7\xf6\x08\xfa\xb8\x0f\x65\x3b\x1b\xfd\x11\x6b\xb5\x23\x30\x67\x87" "\xd8\x40\x14\xf1\x8f\x91\xe2\x67\xaf\x1d\x8f\xef\x0d\x44\xf4\x45\xe7\x11" "\x1f\x8f\xf8\x42\x99\xaf\x46\xbc\x52\xe6\x67\x22\x52\xf9\xc1\x38\x17\xf1" "\xd3\x3d\x3e\x47\x1c\x4d\x7d\x51\xc4\xb9\x48\xb1\x98\x36\xd3\x6b\x03\xe5" "\xf9\xa0\x7b\x5e\xb9\xfc\xe5\xc6\xe7\xdb\xd7\x16\x7b\x6a\xbb\xe7\x95\x23" "\xff\xfd\xf0\x38\x1d\xf2\x73\x53\x3d\x8a\xf8\x41\x75\xc6\xdf\x4c\xff\xea" "\xef\x35\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x21\x52\xc4" "\x5a\xa4\xf8\xca\x89\xe3\xa9\x5a\x1f\xbc\xbd\xa6\xb8\xd5\xbe\xde\xb8\xda" "\x9c\x59\xe8\x2c\xeb\xeb\xae\xfd\xeb\xae\x99\xde\xda\xda\xda\x6a\xa4\x4e" "\x8e\xe5\x9c\xce\xb9\x9a\x73\x2d\xe7\x7a\xce\x8d\x9c\x51\xcb\xc7\xe7\x1c" "\xcb\x39\x9d\x73\x35\xe7\x5a\xce\xf5\x9c\x1b\x39\xa3\xc8\xc7\xe7\x1c\xcb" "\x39\x9d\x73\x35\xe7\x5a\xce\xf5\x9c\x1b\x39\xa3\x2f\x1f\x9f\x73\x2c\xe7" "\x74\xce\xd5\x9c\x6b\x39\xd7\x73\x6e\xe4\x8c\x43\xb2\x76\x0f\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x78\x67\xa9\x45\x51\xdd\xc5" "\xfd\x5b\x5f\xdb\x4c\x5b\x03\x9d\xfb\x4b\x4f\x47\x27\xd7\xdd\x0f\xf4\x1d" "\xef\x17\x01\x00\x00\xff\xff\x49\x02\x74\xf7", 3089)); NONFAILING(syz_mount_image(/*fs=*/0x200000000c40, /*dir=*/0x2000000000c0, /*flags=*/0, /*opts=*/0x200000000100, /*chdir=*/0x43, /*size=*/0xc11, /*img=*/0x200000000d00)); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) // } // flags: open_flags = 0x42 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd NONFAILING(memcpy((void*)0x200000000080, "./file1\000", 8)); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000080ul, /*flags=O_CREAT|O_RDWR*/ 0x42, /*mode=*/0); if (res != -1) r[0] = res; // mmap arguments: [ // addr: VMA[0x600000] // len: len = 0x600000 (4 bytes) // prot: mmap_prot = 0x27ffff7 (8 bytes) // flags: mmap_flags = 0x4012011 (8 bytes) // fd: fd (resource) // offset: intptr = 0x0 (8 bytes) // ] syscall( __NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x600000, /*prot=PROT_GROWSUP|PROT_WRITE|PROT_READ|PROT_EXEC|0x7ffff0*/ 0x27ffff7ul, /*flags=MAP_UNINITIALIZED|MAP_NONBLOCK|MAP_LOCKED|MAP_FIXED|0x1*/ 0x4012011ul, /*fd=*/r[0], /*offset=*/0ul); // writev arguments: [ // fd: fd (resource) // vec: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: nil // len: len = 0x0 (8 bytes) // } // iovec[in, array[int8]] { // addr: nil // len: len = 0x0 (8 bytes) // } // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {94 b5 67 6b de be e0 5c e8 c5 9f 76 4d b8 14 cf 77 93 // f4 8c 58 f6 f6 74 73 5a 4a 46 4d a2 7a 0f be 31 1c 1d a7 99 56 // 77 c6 1c 59 86 c0 41 23 2b cf cc 47 6b c9 86 d9 09 00 c5 7c 7c // 38 a5 23 c7 00 30 a9 4f c8 b1 ed ba ae 40 64 b0 34 90 50 d2 28 // a1 b1 b9 e5 96 98 7a d8 02 52 f5 24 33 fe a6 66 e0 00 f5 8f 56 // a0 6c 23 92 c8 04 ed 9b ed cf 99 19 21 35 df 69 f0 82 dd 15 6a // 0c 99 fa 0f 42 7f d8 dc e5 75 b8 59 1f a9 b0 5f 57 88 50 31 f0 // aa b6 e1 85 dc f5 a4 12 3d 8f 62 e4 cf 17 a4 0e 49 29 32 f3 ee // e1 67 b0 0c ab ea 44 b9 1d 57 e9 f9 26 17 e8 29 45 cc fe 52 24 // 23 6e 01 76 dc 3f f5 57 00 3b 73 28 5d bc 24 b7 54 07 b6 24 b5 // 94 48 94 5f e8 d2 38 46 45 34 5a 81 0b 99 db f3 a3 6f 09 44 00 // 6f 34 ee 61 d7 88 83 31 d8 96 50 0b 04 7e 05 cb a1 74 a9 34 95 // d2 ce ea 6f 71 94 29 80 72 c9 e8 45 b8 96 c6 20 ea 05 7a 29 24 // 68 7e 34 27 b1 c3 b6 59 2b d1 46 6f ad b1 1b 78 37 6b eb d7 c2 // cf 43 84 65 d9 27 1a 6e 68 6b 8f f0 be d6 d8 9f b1 d0 b5 2e 74 // 63 10 d6 5b 31 db d4 e7 cb 36 e6 5a c2 2b 71 13 6f d9 30 9a d4 // 5f 1b 55 ba dc f1 38 b7 c9 d5 34 70 ed 5a 34 49 6d af 7d 1b 00 // 4d c4 ea 2d 24 09 bd b4 81 93 89 47 fa 5e 11 8b b6 c4 20 3c 39 // 17 28 c7 9d a4 e6 27 fc aa 4c 49 d5 43 cb e7 e5 cb 62 ec 39 b9 // 69 b8 08 ab 7d 76 a8 aa 04 cf 67 7b 56 67 ea 61 65 40 6d 2b 2d // 4b 43 45 5b ee fb 1b d3 fc 64 b6 b4 20 bd 64 1f 85 39 5c 37 1f // 0f 14 db d4 50 c4 78 6b 04 fa 6c e7 d5 c0 ad 0b 04 d7 f0 9f d4 // 35 97 59 e6 14 70 38 c8 8a 39 ae bc 54 0f 06 68 50 5f d0 60 1a // 68 62 8f 76 73 08 55 fe ce a7 29 ba 51 c0 8c 48 b2 26 bb 43 3f // f6 96 eb fb 4e 80 5e db 08 a0 3a 94 ce f2 4f ed 88 ab fe 46 06 // 0e f1 73 7b 25 9b 97 20 d2 d6 59 a0 a4 25 40 00 c4 87 4e 8e 61 // ea 68 c4 b7 78 9c e3 6f 3f 3d 64 20 8f 79 45 a8 f9 ae 81 23 d5 // 5f 48 1e 57 28 17 f1 6d 50 c9 7f 4c 3b 19 57 6e 22 bd 4f 76 90 // 00 27 d2 f9 5d fb aa d9 18 14 ea e5 32 2a 02 52 31 28 e8 bd da // 05 b0 0b 22 47 cf f7 98 26 bd fa 0f 64 a7 ed 5e 3c 26 11 0f 8c // a5 bb e1 a2 98 64 08 fa ce 35 04 56 b8 90 2e a8 5d 5d 77 b4 ff // 33 82 4e 5e e5 09 52 cb 77 94 b4 9f ca a4 f0 e5 90 df 69 72 5e // 8c 7f 08 db 26 c5 70 5b f1 8a 16 bb ba 17 1e f1 b5 12 96 cc de // 05 28 dc f4 68 d4 1e 25 f1 89 e9 b2 c6 24 45 1f 7a c8 b3 d7 8c // 33 a6 a3 d9 3e 60 66 3a 9d 14 8d 1d b5 29 9e 8e e2 ec 5b ab 6e // 30 a7 9b 65 ec 4c 1d 3e 43 92 ce 66 04 6f 5d f0 a0 91 c0 0a d1 // 49 e7 6c 6c 18 1a 93 8e 31 8c f8 d1 f6 cf d5 72 e5 1a aa 25 a7 // a7 a3 96 e6 92 39 7c 32 f2 9a 60 ac b6 1b 94 b9 87 fd 23 6a 74 // 10 67 4f bb 1b f2 98 5b 45 ff b6 5c c9 dd 94 08 7b ab 04 23 a9 // 7f c8 ac 89 b1 e2 29 a4 9a be 70 ba 6a 6d e8 18 03 f3 81 93 0a // 4e aa f5 e0 ab 49 c9 04 a0 d5 83 ca 40 e4 f8 e2 cc f1 e4 49 5f // ea 96 44 8e 86 7c 1d a2 00 59 a3 7c f8 4a ec 58 ab 52 0c 26 58 // 39 d8 bd e6 fe 28 22 6a 6c 2d a8 c1 7f 20 24 c9 27 fe d3 df d0 // 2a 20 ba c9 b3 d2 71 65 5e 25 c2 2d 91 30 e0 79 13 8b eb 18 10 // 09 dd 7f 39 b9 f1 1e 02 5d ee 77 ca 3b b7 60 bf c1 7a 3d d1 7a // e2 3a e4 cc 5f 7d 3a 30 26 fa 03 16 ef 61 8b a1 33 2d 96 19 a3 // ef 56 01 fe 25 88 a0 b9 7b d0 e4 11 d8 af fc e4 9b 05 ec ee b4 // fb 44 47 bf 65 5c 10 86 e7 ea d1 e8 9c 0f 69 f1 ce 25 14 15 26 // 38 52 19 db 94 f7 22 0d aa 0e 24 cd ee d0 c3 30 0e bc ee 56 15 // 8f 43 5a 68 33 ed 8f f2 e8 40 18 8f 5b ee 5a ab 41 51 c9 34 bb // 82 77 e7 ab 0b a4 80 2d 5e 82 35 6d 63 27 99 90 78 9d f8 a0 0c // 69 4e 64 2b 53 bb 23 94 f3 bc 0b 6c cf 45 e5 68 4b 0b 1f 8b 0c // 0e 3f 20 91 06 e1 f8 4b c3 79 c2 7b f6 b5 9b 3e bf 37 c1 89 a0 // 39 a6 44 60 0a 24 d2 a4 da 6a 52 bc 90 d2 81 8e cb 37 ea 57 50 // 5e 12 69 29 1e 9c ef 79 59 f9 47 a1 39 4b b0 df fa e1 6e 11 c1 // fe 8f 35 82 e1 97 61 a7 d1 4d 37 3a c4 c8 1e 78 a9 22 a9 3f 19 // 48 78 e2 e1 a5 40 c1 2f de 71 fe 47 e8 9e 02 36 62 02 7c 18 37 // dc d7 dc 34 64 cb 36 16 48 d4 a9 f4 3d 0a 91 e7 a9 38 18 d6 2a // ed 5c 2c 9b 56 15 60 ee 21 0a 67 be dc bf c8 c8 44 3d 23 bf 5e // d0 f8 99 63 2e 83 6e ee 7f 27 9c a1 06 58 59 41 12 b9 eb 21 36 // 49 a2 2d c9 b7 28 87 1b 9b 89 9c 8c 8d f5 fa d0 38 98 72 a1 a6 // 41 2d 40 a1 05 52 13 98 c0 c9 df e5 0d c2 78 43 a5 89 cd 5b 3e // 6b 38 c2 3c 52 13 80 7c d2 f2 df b3 a0 0e d5 73 f4 28 55 68 62 // 26 51 25 0b 71 de 1d 41 ec 9f eb 97 02 b5 7c 7c d3 49 66 d1 b3 // 05 b4 50 78 71 f9 66 27 c1 23 10 db 2d 35 86 f9 0c 15 f0 d4 f4 // 7a ac 38 ab 99 6f 29 d7 bb 4b b9 4a cb 27 80 59 69 5c 69 31 44 // d0 8d d6 9a 86 56 c4 3f 3a 17 08 d8 25 8b 08 8c ee a2 5f 67 b7 // ae cd 84 1c b7 f8 35 79 10 55 11 7f ce 53 2c 8a fe 04 18 90 89 // ab 18 e6 64 0a 3b fb 66 42 08 a2 a7 ac e1 22 6c 2b b6 b3 8d c3 // 3e 58 8e 2a 6f 44 61 04 62 3c 3e 2c e1 81 cf 27 46 4b db 03 ce // 20 66 63 b1 82 6e 37 70 eb 50 a2 3e 29 62 3c 3a b6 5f 71 10 02 // aa 42 2a c4 79 80 cd 1b c9 cb e6 de 01 89 f0 c7 18 1d f4 ea 7f // 8b c2 4d 36 9f e8 cd 14 42 54 2d d2 e6 d2 6c cd fe d1 fb 2b 14 // c8 dc e7 bb d6 2a e5 0a 13 53 d7 44 ed b4 bb 4b 75 69 ec 83 e0 // 26 f9 a0 1f 40 83 3a 93 c4 e0 ce 46 99 63 ac 70 3b a3 70 4b 94 // 6c 37 e8 c4 f2 cc fb 4c b6 04 b7 62 9c f2 70 78 e0 16 0a 63 a6 // 6e 10 8a 68 82 65 04 2c be 88 88 a6 6b a6 4b a2 e7 5e 8c 09 05 // 1f 90 e5 6f 93 07 11 35 e6 f0 fe ac f0 66 95 b6 fa 6c 06 63 38 // d4 14 6c 99 28 61 12 18 d4 db 14 39 26 d3 c2 aa 33 91 25 b3 bc // b7 38 e2 3e 06 83 23 c1 70 84 6c ff be 1b 80 29 e6 42 6b d1 06 // 12 f8 d8 d7 da 8d 28 35 1c c2 e0 c5 b3 bc 77 95 1d 8f 24 9f c9 // cb aa ed 45 02 87 bf e0 05 83 99 5d 47 1f e1 a3 ed 3f 54 c6 6a // 82 b9 98 4e 41 e8 3c 6f b4 f9 cf fe 63 0f 9a 5f 31 a2 2b 62 e0 // 8a 90 81 4e 71 e7 90 69 33 f2 db 8a da 41 37 1b 24 70 32 0f 91 // e0 c4 0c 5b db 27 9f 69 01 05 ab a7 20 01 9a ea c1 5c 0d 33 f7 // 6e a3 f2 76 61 18 ac 85 40 9c 16 71 e9 09 cf cf 7a ea 33 08 ec // a5 11 4b 86 0c 41 2d de bc 47 15 4e 7f 9b 65 83 8d 40 16 71 3c // 53 95 f7 35 a0 71 5b 9d 2c 9e ab 05 61 2c f0 ae 5f 63 ce 1c 8c // 06 9a 17 48 61 ba 7b 74 53 a6 bd bb f6 34 82 32 cc 38 40 ac 49 // 9b da 42 90 0a 81 a0 b5 5a 14 15 9b 66 77 83 3b 59 ff 32 4b 32 // 5f 31 eb c2 a7 9f d1 ff c5 d6 0c 6e 69 a9 3a 3f c7 c7 44 cf 70 // 97 50 be ac a8 dd e4 0b b3 8e b5 47 fb 46 b7 d3 89 f9 87 da 0d // dd 44 54 1d 24 c5 0f 61 5c 1b 6e b5 3b 98 53 72 4d 13 1f d6 ba // 63 71 4a d1 40 b4 ea 58 2c 9e 0e fb 3a b6 83 ab 0e 64 19 19 75 // 04 56 86 b4 2c 5e 7a 2c be cd 65 85 c8 79 4b 00 56 70 98 96 f7 // 59 53 1f a4 05 27 77 86 bd d1 f4 89 6c 9c 89 01 91 0a e3 10 ad // 0f ac 38 46 a6 61 a1 bf 44 71 a9 dd 06 cb 35 1f 3c 01 bc ba aa // c7 29 17 97 d6 8e e2 71 a4 ad 57 88 42 6e c5 a0 75 e9 d1 71 4f // fc cd 61 ba c2 1d 0e c1 7f c8 f8 f2 b8 30 16 1a 55 ee 01 28 52 // 08 c2 cd f4 43 b1 19 2e 5e 86 3e b1 bc d5 1c e2 ff 51 19 1c 7f // 7e 59 70 b5 6e 8d 25 69 12 7d ad 8f 52 f3 09 cb 53 4d 4d a7 4e // 53 d1 b6 30 2e ce bd c8 80 78 a4 8d 63 01 81 04 c8 64 55 74 25 // 83 95 18 bb ef 8b b3 09 31 59 03 4f 21 c2 f9 a4 45 83 12 71 2c // 00 50 2b 45 e2 33 96 df 94 1c a5 d2 15 1a 75 e2 38 12 d8 3b a8 // 7f 15 b0 78 a4 2a 9b 0f 6a f1 51 3a 6b bf 98 ea 93 5c 2e 49 1e // 68 ac d6 83 29 f1 ce e9 e4 c2 da 5b 86 3b 3b d0 d9 1d 24 f5 4a // 48 e0 de d8 51 ea d0 49 2b 4a fe 61 cf 6c 7e 17 14 c8 51 ee 89 // 70 ef ae 16 3e 77 4e 07 d2 06 8b 58 8a 24 7f 92 7b 24 54 4e 30 // 3b 92 26 28 29 e9 e8 0b 29 d0 b3 a5 ec c5 6f 44 fd db e9 22 a6 // e7 84 13 d4 cf 97 bd 82 25 37 5d 9a 7d 61 52 af 61 a0 85 85 55 // b4 6f 1a 1e 96 6f e7 f4 3d 0a 9f a8 24 11 b3 e0 c9 b0 3c f4 08 // 95 1b a2 a3 ff 8c c3 ba 4f c6 5c 02 53 90 47 bc 81 50 e1 b2 e2 // 8a 10 3f dc d4 1b 4c 21 3a 10 19 f2 f3 f1 41 53 31 60 ab fd 43 // 8a b5 4b dd 0e f6 27 6f bd 24 cd 90 ec dd ca 28 61 81 44 15 f1 // 45 47 17 49 da 54 fe 64 97 e9 8d 96 32 d0 fb ef fb 6c 41 19 36 // cf 1c 25 fc 1d 6a 70 51 47 a8 82 eb 87 46 87 e5 5c f5 4f c4 c1 // f7 86 cc b7 3e d0 c2 7e 3f 22 07 ff 06 c8 d5 46 06 2e 65 41 43 // 96 5d 11 33 1f 9e ee b5 28 ac 48 6e ee f1 64 23 d4 09 77 e5 f8 // ab 3d e1 04 ca a7 28 fe f9 5e 40 d3 09 76 94 d0 0c 68 57 55 7c // 34 a3 85 78 23 ea 95 1f 37 b9 68 0b 09 ab 46 df 58 97 c2 85 da // 2f 9b 57 f4 23 82 02 96 88 4e 87 9f 42 f7 09 8b 03 ff 62 2c 75 // 90 b0 4a ee 38 4a 44 27 98 85 ef 3e 40 38 bc 57 1c b1 a3 86 17 // 31 55 53 88 ba f0 e9 20 33 32 97 50 01 0d 60 13 7b ba fb 8a ab // 3a 23 47 7d 10 9b a6 c2 a2 8f 67 21 70 12 09 50 62 47 33 4d 5c // b4 c0 a8 cb 76 13 80 8c 44 50 c8 9f dc 92 d9 c6 65 61 8e c1 8f // c3 57 e6 3d 75 db 91 93 e4 ee 1f be 28 10 7d 54 ed 1a 55 c5 6c // a2 4c 22 6b f0 68 cc 1c 15 ad 10 fe b1 7d 3f 11 33 f3 94 12 bf // a6 02 da 66 e9 16 7e 2d 90 dc 46 c7 48 eb 51 dd fd 94 94 22 f8 // 9d 10 68 ae 37 98 cf d7 86 59 3e c1 a3 29 86 36 76 12 ce 42 1a // 67 3b 3a 44 64 3a d5 fb ec b1 59 f3 0f 94 28 93 54 d6 b3 94 14 // 4d 8e 40 02 dd 67 6e 2d cc 3a ab 70 6f f6 2d 87 2a 7d 9d 68 8e // c3 f8 d0 90 7e b1 5a 58 fd ae 62 95 03 1b da 54 1f da 84 55 cc // 5f e8 68 ab b9 ca 29 3c dd 8c 7e 25 7f 8e 7e f1 31 d2 6a 05 ef // e0 14 fb 1f be 92 6c 87 d9 89 f3 5f da e2 9d e8 32 48 80 94 22 // 67 33 74 e0 06 34 28 e9 72 e1 75 7a 7c 09 96 75 40 a7 ee ce f8 // 0f 2e a5 73 8a 39 15 6a 32 94 66 bc 80 24 75 db cc a9 85 fb 9b // e9 3a 86 f4 5f a3 79 c9 2e e8 f2 46 f0 a4 85 75 b6 95 64 89 ee // da e9 d1 b4 5e 1e a9 5c f8 f5 b5 64 4c d7 d6 a2 4e 84 35 a9 14 // d6 2b b5 d4 33 5d b6 ca 41 88 9d 1f 7b c0 df f5 73 a0 aa 7a db // bc 6b b8 da d7 5d 09 26 b4 56 35 10 64 5d 09 c2 6f e7 9d a7 da // 49 a6 d9 f3 ac d1 cd f3 ec df 99 58 90 a8 d3 2e de 47 76 ac 09 // dc ec 3d ca 83 b9 09 e8 9f 4c 32 b3 e4 7c b7 97 21 10 12 cd d0 // b3 18 48 3a 8b a9 93 20 ba 42 45 d1 da bc 8a 15 99 ec a5 da 5c // 65 d8 1b 56 dc cc 06 17 5a d0 dd 41 6b e5 29 f3 6b 97 d3 37 aa // e9 f4 ee fa ee 02 a1 00 7f 9a ea dc 8a 01 37 4a 6e 9e 45 4d 52 // 2b 9f a6 7c 7c 48 69 5f e5 8b 85 ee 54 d4 85 20 96 14 ad 9c 4d // f2 47 1a bd ac 47 95 34 21 f7 e1 50 3f 05 71 f1 a9 2d 78 3f 5f // 48 37 3f 88 2f 32 22 48 b3 b4 7f f0 10 da a2 dd 98 fd 6a 02 9b // 95 a7 c8 5d 20 59 4c 24 9b a0 70 68 c6 03 cd 73 8e 2f 5f 2a 37 // 40 2e a9 77 61 39 01 18 b5 87 34 3d f9 30 88 75 19 c1 d9 1a 9e // 25 d7 0a ff a3 45 41 e2 e7 34 f6 9d 09 2e f2 53 f2 0a 4c db 6a // 2a b4 70 c4 1d 7e ea fd d9 d9 9f 2c dc d3 5a af 6f 2a 56 b5 ff // 03 e8 c9 76 7d 1f ac b6 1c 78 a6 22 6e ae 6b 09 a3 35 f9 5c 9b // f1 71 50 06 2c 5d 11 44 b4 7e 75 ea 69 6f 38 8f 6d 09 06 6f 61 // c3 2a b2 a5 15 4d ed d7 bf 0a 5a c3 62 d1 a5 b2 76 d5 7f 6f 1c // d5 84 39 a2 57 c5 a8 cd cb 41 f7 4e 1a ce bd 08 2d ff 64 80 5f // 40 3e 04 6d 5a f9 96 f3 a0 98 26 2c bd c2 26 88 ff ba cc d4 ba // 51 a3 25 93 be da 27 5a be 5c 8d 05 10 38 ad 5c 3d e1 60 b5 8e // 66 e3 0a b7 51 43 56 11 3e 7e 95 82 7c 68 d9 f7 49 a9 c2 ea dc // 32 49 f8 25 1b 75 61 6e cd 68 51 47 6d 8d 9b 6f 47 96 07 03 57 // 19 c8 bd 39 89 8a 1f f6 15 4a 82 0c eb 2e c1 b7 1c 53 36 62 84 // fe 53 82 27 4a 96 2a b0 1a c5 ef f6 44 f5 fe 46 f9 34 4f 0a 4b // 3b 4d 68 09 ce c0 db a1 a8 e6 0f 20 96 18 ba bd 99 56 fb 81 d1 // 9a b7 11 33 cb 2f b4 c4 5c ae 72 a7 9f a4 33 fb e0 d9 45 eb 98 // cf 27 fa fe 32 e9 1d 92 3f 95 1f 51 51 af 27 59 f4 26 f1 9e 3a // 89 dd 28 19 f6 e9 da 9e 0e be 96 c7 f3 24 22 9f 07 be e7 37 84 // c3 26 af 25 d5 ba 09 39 69 e3 c1 c1 3f 11 87 13 a2 b3 1a 45 8c // 79 fe e6 03 cc 17 2f 5f 5d 29 d6 84 42 c7 19 53 21 50 5b 2c 87 // 8e 5f 10 ff 61 ec 5d 23 00 51 5c ac 24 90 2c ef ca a6 3f ca 05 // 1a 32 b1 3e 27 ed 82 d2 39 f0 b6 d4 90 f0 05 d0 76 66 d6 b1 a7 // 8e 6d a9 4d c7 c3 c6 a6 f0 0f 72 82 c8 cf ce 6d 4f af 30 68 a6 // af 1e 96 60 e4 64 10 53 84 4f 70 3f 07 7d 72 e3 ef 83 1e 4f b4 // 4e a0 d4 f1 21 8d bb 3f aa a9 bd 2c 96 81 07 07 1a cd b1 ec 4c // 07 c2 ac 3b 2a 8b 9f 90 ff 26 0d 0d 23 78 30 56 62 a0 89 8e 24 // a4 cf ff 70 b3 f5 0f 3c 9f b4 43 ca ca 16 95 5a a6 d1 9d fd 92 // 56 0b 14 51 63 f4 fd 99 8a 37 4e 25 08 0a 64 eb 12 95 5b c9 09 // d9 40 40 66 ee 77 67 78 dc 9f 82 81 42 81 cc f8 4a dc e1 81 40 // 98 85 1b 57 7f 0d b8 32 b0 fd e5 55 1f 22 b5 88 53 50 29 de 69 // 33 55 8a 52 f8 01 8f 26 43 fb 8f f7 7c 99 3b 60 e0 d9 86 5c 5c // cd 26 52 6a 17 9d f0 6e 5f 80 cb f0 32 65 79 1d ef 8e 84 70 41 // e9 c3 04 81 b6 14 08 38 fc 56 b2 57 9d 77 88 7e 78 05 5a 30 70 // 57 d5 8e 1f 0d a3 7a 9b a7 74 ca 5b 90 99 cf 24 c4 03 db bb 76 // 6a 39 dd 9c 39 31 37 51 ae db 20 43 c8 80 73 da 7c d5 37 74 d1 // 41 13 bf 9a b5 9a 86 b0 4b d3 d5 53 6d 82 45 42 ce 1f 4d 3e 2a // e8 c1 ee 26 8d 32 dc 94 7c 9e 8a 0d c4 85 a0 e2 54 04 7d 90 f3 // 53 0d 2e eb b8 81 5b d7 d1 d6 7a ef bd 09 07 c1 e7 a2 6c 3d f0 // 2d 55 6a 16 52 e6 5e ec 8d 2b 1d 46 d0 d5 6d 38 c3 56 18 f4 08 // af 86 50 b4 0a 06 4e bb 35 36 c0 33 a3 0d de 04 68 bb 79 30 dc // 4e 30 30 c7 c5 63 ca 01 dc 7e bb b2 a4 79 ab 81 19 98 b2 e2 d1 // 96 79 ca f1 0d 6d 7d c2 5f ab 6e b0 04 39 e8 4b 81 3e 65 7f 93 // 1b ac 65 ee a9 be d2 f8 9f f3 2a 4b 1e 68 ae bd a3 5b 74 1a b7 // 9b 5e 59 13 d3 a3 37 0c 52 1b 26 0f 37 57 d5 b7 dc 5a 57 f6 14 // df 5a 1d 9a cc 61 4d 1c d1 27 6a 94 66 60 5a f6 35 7a 1c 3f 69 // e3 c1 36 6a d4 a6 48 ce 1c a8 04 06 c4 d0 7c a4 69 a4 95 b9 4e // 80 ee 85 09 e7 41 88 5a 3d 3b be 80 b3 38 d7 e3 ab 3a 60 7f 9d // 19 5e b3 57} (length 0x1000) // } // len: len = 0x1000 (8 bytes) // } // } // } // vlen: len = 0x3 (8 bytes) // ] NONFAILING(*(uint64_t*)0x200000000040 = 0); NONFAILING(*(uint64_t*)0x200000000048 = 0); NONFAILING(*(uint64_t*)0x200000000050 = 0); NONFAILING(*(uint64_t*)0x200000000058 = 0); NONFAILING(*(uint64_t*)0x200000000060 = 0x200000001940); NONFAILING(memcpy( (void*)0x200000001940, "\x94\xb5\x67\x6b\xde\xbe\xe0\x5c\xe8\xc5\x9f\x76\x4d\xb8\x14\xcf\x77\x93" "\xf4\x8c\x58\xf6\xf6\x74\x73\x5a\x4a\x46\x4d\xa2\x7a\x0f\xbe\x31\x1c\x1d" "\xa7\x99\x56\x77\xc6\x1c\x59\x86\xc0\x41\x23\x2b\xcf\xcc\x47\x6b\xc9\x86" "\xd9\x09\x00\xc5\x7c\x7c\x38\xa5\x23\xc7\x00\x30\xa9\x4f\xc8\xb1\xed\xba" "\xae\x40\x64\xb0\x34\x90\x50\xd2\x28\xa1\xb1\xb9\xe5\x96\x98\x7a\xd8\x02" "\x52\xf5\x24\x33\xfe\xa6\x66\xe0\x00\xf5\x8f\x56\xa0\x6c\x23\x92\xc8\x04" "\xed\x9b\xed\xcf\x99\x19\x21\x35\xdf\x69\xf0\x82\xdd\x15\x6a\x0c\x99\xfa" "\x0f\x42\x7f\xd8\xdc\xe5\x75\xb8\x59\x1f\xa9\xb0\x5f\x57\x88\x50\x31\xf0" "\xaa\xb6\xe1\x85\xdc\xf5\xa4\x12\x3d\x8f\x62\xe4\xcf\x17\xa4\x0e\x49\x29" "\x32\xf3\xee\xe1\x67\xb0\x0c\xab\xea\x44\xb9\x1d\x57\xe9\xf9\x26\x17\xe8" "\x29\x45\xcc\xfe\x52\x24\x23\x6e\x01\x76\xdc\x3f\xf5\x57\x00\x3b\x73\x28" "\x5d\xbc\x24\xb7\x54\x07\xb6\x24\xb5\x94\x48\x94\x5f\xe8\xd2\x38\x46\x45" "\x34\x5a\x81\x0b\x99\xdb\xf3\xa3\x6f\x09\x44\x00\x6f\x34\xee\x61\xd7\x88" "\x83\x31\xd8\x96\x50\x0b\x04\x7e\x05\xcb\xa1\x74\xa9\x34\x95\xd2\xce\xea" "\x6f\x71\x94\x29\x80\x72\xc9\xe8\x45\xb8\x96\xc6\x20\xea\x05\x7a\x29\x24" "\x68\x7e\x34\x27\xb1\xc3\xb6\x59\x2b\xd1\x46\x6f\xad\xb1\x1b\x78\x37\x6b" "\xeb\xd7\xc2\xcf\x43\x84\x65\xd9\x27\x1a\x6e\x68\x6b\x8f\xf0\xbe\xd6\xd8" "\x9f\xb1\xd0\xb5\x2e\x74\x63\x10\xd6\x5b\x31\xdb\xd4\xe7\xcb\x36\xe6\x5a" "\xc2\x2b\x71\x13\x6f\xd9\x30\x9a\xd4\x5f\x1b\x55\xba\xdc\xf1\x38\xb7\xc9" "\xd5\x34\x70\xed\x5a\x34\x49\x6d\xaf\x7d\x1b\x00\x4d\xc4\xea\x2d\x24\x09" "\xbd\xb4\x81\x93\x89\x47\xfa\x5e\x11\x8b\xb6\xc4\x20\x3c\x39\x17\x28\xc7" "\x9d\xa4\xe6\x27\xfc\xaa\x4c\x49\xd5\x43\xcb\xe7\xe5\xcb\x62\xec\x39\xb9" "\x69\xb8\x08\xab\x7d\x76\xa8\xaa\x04\xcf\x67\x7b\x56\x67\xea\x61\x65\x40" "\x6d\x2b\x2d\x4b\x43\x45\x5b\xee\xfb\x1b\xd3\xfc\x64\xb6\xb4\x20\xbd\x64" "\x1f\x85\x39\x5c\x37\x1f\x0f\x14\xdb\xd4\x50\xc4\x78\x6b\x04\xfa\x6c\xe7" "\xd5\xc0\xad\x0b\x04\xd7\xf0\x9f\xd4\x35\x97\x59\xe6\x14\x70\x38\xc8\x8a" "\x39\xae\xbc\x54\x0f\x06\x68\x50\x5f\xd0\x60\x1a\x68\x62\x8f\x76\x73\x08" "\x55\xfe\xce\xa7\x29\xba\x51\xc0\x8c\x48\xb2\x26\xbb\x43\x3f\xf6\x96\xeb" "\xfb\x4e\x80\x5e\xdb\x08\xa0\x3a\x94\xce\xf2\x4f\xed\x88\xab\xfe\x46\x06" "\x0e\xf1\x73\x7b\x25\x9b\x97\x20\xd2\xd6\x59\xa0\xa4\x25\x40\x00\xc4\x87" "\x4e\x8e\x61\xea\x68\xc4\xb7\x78\x9c\xe3\x6f\x3f\x3d\x64\x20\x8f\x79\x45" "\xa8\xf9\xae\x81\x23\xd5\x5f\x48\x1e\x57\x28\x17\xf1\x6d\x50\xc9\x7f\x4c" "\x3b\x19\x57\x6e\x22\xbd\x4f\x76\x90\x00\x27\xd2\xf9\x5d\xfb\xaa\xd9\x18" "\x14\xea\xe5\x32\x2a\x02\x52\x31\x28\xe8\xbd\xda\x05\xb0\x0b\x22\x47\xcf" "\xf7\x98\x26\xbd\xfa\x0f\x64\xa7\xed\x5e\x3c\x26\x11\x0f\x8c\xa5\xbb\xe1" "\xa2\x98\x64\x08\xfa\xce\x35\x04\x56\xb8\x90\x2e\xa8\x5d\x5d\x77\xb4\xff" "\x33\x82\x4e\x5e\xe5\x09\x52\xcb\x77\x94\xb4\x9f\xca\xa4\xf0\xe5\x90\xdf" "\x69\x72\x5e\x8c\x7f\x08\xdb\x26\xc5\x70\x5b\xf1\x8a\x16\xbb\xba\x17\x1e" "\xf1\xb5\x12\x96\xcc\xde\x05\x28\xdc\xf4\x68\xd4\x1e\x25\xf1\x89\xe9\xb2" "\xc6\x24\x45\x1f\x7a\xc8\xb3\xd7\x8c\x33\xa6\xa3\xd9\x3e\x60\x66\x3a\x9d" "\x14\x8d\x1d\xb5\x29\x9e\x8e\xe2\xec\x5b\xab\x6e\x30\xa7\x9b\x65\xec\x4c" "\x1d\x3e\x43\x92\xce\x66\x04\x6f\x5d\xf0\xa0\x91\xc0\x0a\xd1\x49\xe7\x6c" "\x6c\x18\x1a\x93\x8e\x31\x8c\xf8\xd1\xf6\xcf\xd5\x72\xe5\x1a\xaa\x25\xa7" "\xa7\xa3\x96\xe6\x92\x39\x7c\x32\xf2\x9a\x60\xac\xb6\x1b\x94\xb9\x87\xfd" "\x23\x6a\x74\x10\x67\x4f\xbb\x1b\xf2\x98\x5b\x45\xff\xb6\x5c\xc9\xdd\x94" "\x08\x7b\xab\x04\x23\xa9\x7f\xc8\xac\x89\xb1\xe2\x29\xa4\x9a\xbe\x70\xba" "\x6a\x6d\xe8\x18\x03\xf3\x81\x93\x0a\x4e\xaa\xf5\xe0\xab\x49\xc9\x04\xa0" "\xd5\x83\xca\x40\xe4\xf8\xe2\xcc\xf1\xe4\x49\x5f\xea\x96\x44\x8e\x86\x7c" "\x1d\xa2\x00\x59\xa3\x7c\xf8\x4a\xec\x58\xab\x52\x0c\x26\x58\x39\xd8\xbd" "\xe6\xfe\x28\x22\x6a\x6c\x2d\xa8\xc1\x7f\x20\x24\xc9\x27\xfe\xd3\xdf\xd0" "\x2a\x20\xba\xc9\xb3\xd2\x71\x65\x5e\x25\xc2\x2d\x91\x30\xe0\x79\x13\x8b" "\xeb\x18\x10\x09\xdd\x7f\x39\xb9\xf1\x1e\x02\x5d\xee\x77\xca\x3b\xb7\x60" "\xbf\xc1\x7a\x3d\xd1\x7a\xe2\x3a\xe4\xcc\x5f\x7d\x3a\x30\x26\xfa\x03\x16" "\xef\x61\x8b\xa1\x33\x2d\x96\x19\xa3\xef\x56\x01\xfe\x25\x88\xa0\xb9\x7b" "\xd0\xe4\x11\xd8\xaf\xfc\xe4\x9b\x05\xec\xee\xb4\xfb\x44\x47\xbf\x65\x5c" "\x10\x86\xe7\xea\xd1\xe8\x9c\x0f\x69\xf1\xce\x25\x14\x15\x26\x38\x52\x19" "\xdb\x94\xf7\x22\x0d\xaa\x0e\x24\xcd\xee\xd0\xc3\x30\x0e\xbc\xee\x56\x15" "\x8f\x43\x5a\x68\x33\xed\x8f\xf2\xe8\x40\x18\x8f\x5b\xee\x5a\xab\x41\x51" "\xc9\x34\xbb\x82\x77\xe7\xab\x0b\xa4\x80\x2d\x5e\x82\x35\x6d\x63\x27\x99" "\x90\x78\x9d\xf8\xa0\x0c\x69\x4e\x64\x2b\x53\xbb\x23\x94\xf3\xbc\x0b\x6c" "\xcf\x45\xe5\x68\x4b\x0b\x1f\x8b\x0c\x0e\x3f\x20\x91\x06\xe1\xf8\x4b\xc3" "\x79\xc2\x7b\xf6\xb5\x9b\x3e\xbf\x37\xc1\x89\xa0\x39\xa6\x44\x60\x0a\x24" "\xd2\xa4\xda\x6a\x52\xbc\x90\xd2\x81\x8e\xcb\x37\xea\x57\x50\x5e\x12\x69" "\x29\x1e\x9c\xef\x79\x59\xf9\x47\xa1\x39\x4b\xb0\xdf\xfa\xe1\x6e\x11\xc1" "\xfe\x8f\x35\x82\xe1\x97\x61\xa7\xd1\x4d\x37\x3a\xc4\xc8\x1e\x78\xa9\x22" "\xa9\x3f\x19\x48\x78\xe2\xe1\xa5\x40\xc1\x2f\xde\x71\xfe\x47\xe8\x9e\x02" "\x36\x62\x02\x7c\x18\x37\xdc\xd7\xdc\x34\x64\xcb\x36\x16\x48\xd4\xa9\xf4" "\x3d\x0a\x91\xe7\xa9\x38\x18\xd6\x2a\xed\x5c\x2c\x9b\x56\x15\x60\xee\x21" "\x0a\x67\xbe\xdc\xbf\xc8\xc8\x44\x3d\x23\xbf\x5e\xd0\xf8\x99\x63\x2e\x83" "\x6e\xee\x7f\x27\x9c\xa1\x06\x58\x59\x41\x12\xb9\xeb\x21\x36\x49\xa2\x2d" "\xc9\xb7\x28\x87\x1b\x9b\x89\x9c\x8c\x8d\xf5\xfa\xd0\x38\x98\x72\xa1\xa6" "\x41\x2d\x40\xa1\x05\x52\x13\x98\xc0\xc9\xdf\xe5\x0d\xc2\x78\x43\xa5\x89" "\xcd\x5b\x3e\x6b\x38\xc2\x3c\x52\x13\x80\x7c\xd2\xf2\xdf\xb3\xa0\x0e\xd5" "\x73\xf4\x28\x55\x68\x62\x26\x51\x25\x0b\x71\xde\x1d\x41\xec\x9f\xeb\x97" "\x02\xb5\x7c\x7c\xd3\x49\x66\xd1\xb3\x05\xb4\x50\x78\x71\xf9\x66\x27\xc1" "\x23\x10\xdb\x2d\x35\x86\xf9\x0c\x15\xf0\xd4\xf4\x7a\xac\x38\xab\x99\x6f" "\x29\xd7\xbb\x4b\xb9\x4a\xcb\x27\x80\x59\x69\x5c\x69\x31\x44\xd0\x8d\xd6" "\x9a\x86\x56\xc4\x3f\x3a\x17\x08\xd8\x25\x8b\x08\x8c\xee\xa2\x5f\x67\xb7" "\xae\xcd\x84\x1c\xb7\xf8\x35\x79\x10\x55\x11\x7f\xce\x53\x2c\x8a\xfe\x04" "\x18\x90\x89\xab\x18\xe6\x64\x0a\x3b\xfb\x66\x42\x08\xa2\xa7\xac\xe1\x22" "\x6c\x2b\xb6\xb3\x8d\xc3\x3e\x58\x8e\x2a\x6f\x44\x61\x04\x62\x3c\x3e\x2c" "\xe1\x81\xcf\x27\x46\x4b\xdb\x03\xce\x20\x66\x63\xb1\x82\x6e\x37\x70\xeb" "\x50\xa2\x3e\x29\x62\x3c\x3a\xb6\x5f\x71\x10\x02\xaa\x42\x2a\xc4\x79\x80" "\xcd\x1b\xc9\xcb\xe6\xde\x01\x89\xf0\xc7\x18\x1d\xf4\xea\x7f\x8b\xc2\x4d" "\x36\x9f\xe8\xcd\x14\x42\x54\x2d\xd2\xe6\xd2\x6c\xcd\xfe\xd1\xfb\x2b\x14" "\xc8\xdc\xe7\xbb\xd6\x2a\xe5\x0a\x13\x53\xd7\x44\xed\xb4\xbb\x4b\x75\x69" "\xec\x83\xe0\x26\xf9\xa0\x1f\x40\x83\x3a\x93\xc4\xe0\xce\x46\x99\x63\xac" "\x70\x3b\xa3\x70\x4b\x94\x6c\x37\xe8\xc4\xf2\xcc\xfb\x4c\xb6\x04\xb7\x62" "\x9c\xf2\x70\x78\xe0\x16\x0a\x63\xa6\x6e\x10\x8a\x68\x82\x65\x04\x2c\xbe" "\x88\x88\xa6\x6b\xa6\x4b\xa2\xe7\x5e\x8c\x09\x05\x1f\x90\xe5\x6f\x93\x07" "\x11\x35\xe6\xf0\xfe\xac\xf0\x66\x95\xb6\xfa\x6c\x06\x63\x38\xd4\x14\x6c" "\x99\x28\x61\x12\x18\xd4\xdb\x14\x39\x26\xd3\xc2\xaa\x33\x91\x25\xb3\xbc" "\xb7\x38\xe2\x3e\x06\x83\x23\xc1\x70\x84\x6c\xff\xbe\x1b\x80\x29\xe6\x42" "\x6b\xd1\x06\x12\xf8\xd8\xd7\xda\x8d\x28\x35\x1c\xc2\xe0\xc5\xb3\xbc\x77" "\x95\x1d\x8f\x24\x9f\xc9\xcb\xaa\xed\x45\x02\x87\xbf\xe0\x05\x83\x99\x5d" "\x47\x1f\xe1\xa3\xed\x3f\x54\xc6\x6a\x82\xb9\x98\x4e\x41\xe8\x3c\x6f\xb4" "\xf9\xcf\xfe\x63\x0f\x9a\x5f\x31\xa2\x2b\x62\xe0\x8a\x90\x81\x4e\x71\xe7" "\x90\x69\x33\xf2\xdb\x8a\xda\x41\x37\x1b\x24\x70\x32\x0f\x91\xe0\xc4\x0c" "\x5b\xdb\x27\x9f\x69\x01\x05\xab\xa7\x20\x01\x9a\xea\xc1\x5c\x0d\x33\xf7" "\x6e\xa3\xf2\x76\x61\x18\xac\x85\x40\x9c\x16\x71\xe9\x09\xcf\xcf\x7a\xea" "\x33\x08\xec\xa5\x11\x4b\x86\x0c\x41\x2d\xde\xbc\x47\x15\x4e\x7f\x9b\x65" "\x83\x8d\x40\x16\x71\x3c\x53\x95\xf7\x35\xa0\x71\x5b\x9d\x2c\x9e\xab\x05" "\x61\x2c\xf0\xae\x5f\x63\xce\x1c\x8c\x06\x9a\x17\x48\x61\xba\x7b\x74\x53" "\xa6\xbd\xbb\xf6\x34\x82\x32\xcc\x38\x40\xac\x49\x9b\xda\x42\x90\x0a\x81" "\xa0\xb5\x5a\x14\x15\x9b\x66\x77\x83\x3b\x59\xff\x32\x4b\x32\x5f\x31\xeb" "\xc2\xa7\x9f\xd1\xff\xc5\xd6\x0c\x6e\x69\xa9\x3a\x3f\xc7\xc7\x44\xcf\x70" "\x97\x50\xbe\xac\xa8\xdd\xe4\x0b\xb3\x8e\xb5\x47\xfb\x46\xb7\xd3\x89\xf9" "\x87\xda\x0d\xdd\x44\x54\x1d\x24\xc5\x0f\x61\x5c\x1b\x6e\xb5\x3b\x98\x53" "\x72\x4d\x13\x1f\xd6\xba\x63\x71\x4a\xd1\x40\xb4\xea\x58\x2c\x9e\x0e\xfb" "\x3a\xb6\x83\xab\x0e\x64\x19\x19\x75\x04\x56\x86\xb4\x2c\x5e\x7a\x2c\xbe" "\xcd\x65\x85\xc8\x79\x4b\x00\x56\x70\x98\x96\xf7\x59\x53\x1f\xa4\x05\x27" "\x77\x86\xbd\xd1\xf4\x89\x6c\x9c\x89\x01\x91\x0a\xe3\x10\xad\x0f\xac\x38" "\x46\xa6\x61\xa1\xbf\x44\x71\xa9\xdd\x06\xcb\x35\x1f\x3c\x01\xbc\xba\xaa" "\xc7\x29\x17\x97\xd6\x8e\xe2\x71\xa4\xad\x57\x88\x42\x6e\xc5\xa0\x75\xe9" "\xd1\x71\x4f\xfc\xcd\x61\xba\xc2\x1d\x0e\xc1\x7f\xc8\xf8\xf2\xb8\x30\x16" "\x1a\x55\xee\x01\x28\x52\x08\xc2\xcd\xf4\x43\xb1\x19\x2e\x5e\x86\x3e\xb1" "\xbc\xd5\x1c\xe2\xff\x51\x19\x1c\x7f\x7e\x59\x70\xb5\x6e\x8d\x25\x69\x12" "\x7d\xad\x8f\x52\xf3\x09\xcb\x53\x4d\x4d\xa7\x4e\x53\xd1\xb6\x30\x2e\xce" "\xbd\xc8\x80\x78\xa4\x8d\x63\x01\x81\x04\xc8\x64\x55\x74\x25\x83\x95\x18" "\xbb\xef\x8b\xb3\x09\x31\x59\x03\x4f\x21\xc2\xf9\xa4\x45\x83\x12\x71\x2c" "\x00\x50\x2b\x45\xe2\x33\x96\xdf\x94\x1c\xa5\xd2\x15\x1a\x75\xe2\x38\x12" "\xd8\x3b\xa8\x7f\x15\xb0\x78\xa4\x2a\x9b\x0f\x6a\xf1\x51\x3a\x6b\xbf\x98" "\xea\x93\x5c\x2e\x49\x1e\x68\xac\xd6\x83\x29\xf1\xce\xe9\xe4\xc2\xda\x5b" "\x86\x3b\x3b\xd0\xd9\x1d\x24\xf5\x4a\x48\xe0\xde\xd8\x51\xea\xd0\x49\x2b" "\x4a\xfe\x61\xcf\x6c\x7e\x17\x14\xc8\x51\xee\x89\x70\xef\xae\x16\x3e\x77" "\x4e\x07\xd2\x06\x8b\x58\x8a\x24\x7f\x92\x7b\x24\x54\x4e\x30\x3b\x92\x26" "\x28\x29\xe9\xe8\x0b\x29\xd0\xb3\xa5\xec\xc5\x6f\x44\xfd\xdb\xe9\x22\xa6" "\xe7\x84\x13\xd4\xcf\x97\xbd\x82\x25\x37\x5d\x9a\x7d\x61\x52\xaf\x61\xa0" "\x85\x85\x55\xb4\x6f\x1a\x1e\x96\x6f\xe7\xf4\x3d\x0a\x9f\xa8\x24\x11\xb3" "\xe0\xc9\xb0\x3c\xf4\x08\x95\x1b\xa2\xa3\xff\x8c\xc3\xba\x4f\xc6\x5c\x02" "\x53\x90\x47\xbc\x81\x50\xe1\xb2\xe2\x8a\x10\x3f\xdc\xd4\x1b\x4c\x21\x3a" "\x10\x19\xf2\xf3\xf1\x41\x53\x31\x60\xab\xfd\x43\x8a\xb5\x4b\xdd\x0e\xf6" "\x27\x6f\xbd\x24\xcd\x90\xec\xdd\xca\x28\x61\x81\x44\x15\xf1\x45\x47\x17" "\x49\xda\x54\xfe\x64\x97\xe9\x8d\x96\x32\xd0\xfb\xef\xfb\x6c\x41\x19\x36" "\xcf\x1c\x25\xfc\x1d\x6a\x70\x51\x47\xa8\x82\xeb\x87\x46\x87\xe5\x5c\xf5" "\x4f\xc4\xc1\xf7\x86\xcc\xb7\x3e\xd0\xc2\x7e\x3f\x22\x07\xff\x06\xc8\xd5" "\x46\x06\x2e\x65\x41\x43\x96\x5d\x11\x33\x1f\x9e\xee\xb5\x28\xac\x48\x6e" "\xee\xf1\x64\x23\xd4\x09\x77\xe5\xf8\xab\x3d\xe1\x04\xca\xa7\x28\xfe\xf9" "\x5e\x40\xd3\x09\x76\x94\xd0\x0c\x68\x57\x55\x7c\x34\xa3\x85\x78\x23\xea" "\x95\x1f\x37\xb9\x68\x0b\x09\xab\x46\xdf\x58\x97\xc2\x85\xda\x2f\x9b\x57" "\xf4\x23\x82\x02\x96\x88\x4e\x87\x9f\x42\xf7\x09\x8b\x03\xff\x62\x2c\x75" "\x90\xb0\x4a\xee\x38\x4a\x44\x27\x98\x85\xef\x3e\x40\x38\xbc\x57\x1c\xb1" "\xa3\x86\x17\x31\x55\x53\x88\xba\xf0\xe9\x20\x33\x32\x97\x50\x01\x0d\x60" "\x13\x7b\xba\xfb\x8a\xab\x3a\x23\x47\x7d\x10\x9b\xa6\xc2\xa2\x8f\x67\x21" "\x70\x12\x09\x50\x62\x47\x33\x4d\x5c\xb4\xc0\xa8\xcb\x76\x13\x80\x8c\x44" "\x50\xc8\x9f\xdc\x92\xd9\xc6\x65\x61\x8e\xc1\x8f\xc3\x57\xe6\x3d\x75\xdb" "\x91\x93\xe4\xee\x1f\xbe\x28\x10\x7d\x54\xed\x1a\x55\xc5\x6c\xa2\x4c\x22" "\x6b\xf0\x68\xcc\x1c\x15\xad\x10\xfe\xb1\x7d\x3f\x11\x33\xf3\x94\x12\xbf" "\xa6\x02\xda\x66\xe9\x16\x7e\x2d\x90\xdc\x46\xc7\x48\xeb\x51\xdd\xfd\x94" "\x94\x22\xf8\x9d\x10\x68\xae\x37\x98\xcf\xd7\x86\x59\x3e\xc1\xa3\x29\x86" "\x36\x76\x12\xce\x42\x1a\x67\x3b\x3a\x44\x64\x3a\xd5\xfb\xec\xb1\x59\xf3" "\x0f\x94\x28\x93\x54\xd6\xb3\x94\x14\x4d\x8e\x40\x02\xdd\x67\x6e\x2d\xcc" "\x3a\xab\x70\x6f\xf6\x2d\x87\x2a\x7d\x9d\x68\x8e\xc3\xf8\xd0\x90\x7e\xb1" "\x5a\x58\xfd\xae\x62\x95\x03\x1b\xda\x54\x1f\xda\x84\x55\xcc\x5f\xe8\x68" "\xab\xb9\xca\x29\x3c\xdd\x8c\x7e\x25\x7f\x8e\x7e\xf1\x31\xd2\x6a\x05\xef" "\xe0\x14\xfb\x1f\xbe\x92\x6c\x87\xd9\x89\xf3\x5f\xda\xe2\x9d\xe8\x32\x48" "\x80\x94\x22\x67\x33\x74\xe0\x06\x34\x28\xe9\x72\xe1\x75\x7a\x7c\x09\x96" "\x75\x40\xa7\xee\xce\xf8\x0f\x2e\xa5\x73\x8a\x39\x15\x6a\x32\x94\x66\xbc" "\x80\x24\x75\xdb\xcc\xa9\x85\xfb\x9b\xe9\x3a\x86\xf4\x5f\xa3\x79\xc9\x2e" "\xe8\xf2\x46\xf0\xa4\x85\x75\xb6\x95\x64\x89\xee\xda\xe9\xd1\xb4\x5e\x1e" "\xa9\x5c\xf8\xf5\xb5\x64\x4c\xd7\xd6\xa2\x4e\x84\x35\xa9\x14\xd6\x2b\xb5" "\xd4\x33\x5d\xb6\xca\x41\x88\x9d\x1f\x7b\xc0\xdf\xf5\x73\xa0\xaa\x7a\xdb" "\xbc\x6b\xb8\xda\xd7\x5d\x09\x26\xb4\x56\x35\x10\x64\x5d\x09\xc2\x6f\xe7" "\x9d\xa7\xda\x49\xa6\xd9\xf3\xac\xd1\xcd\xf3\xec\xdf\x99\x58\x90\xa8\xd3" "\x2e\xde\x47\x76\xac\x09\xdc\xec\x3d\xca\x83\xb9\x09\xe8\x9f\x4c\x32\xb3" "\xe4\x7c\xb7\x97\x21\x10\x12\xcd\xd0\xb3\x18\x48\x3a\x8b\xa9\x93\x20\xba" "\x42\x45\xd1\xda\xbc\x8a\x15\x99\xec\xa5\xda\x5c\x65\xd8\x1b\x56\xdc\xcc" "\x06\x17\x5a\xd0\xdd\x41\x6b\xe5\x29\xf3\x6b\x97\xd3\x37\xaa\xe9\xf4\xee" "\xfa\xee\x02\xa1\x00\x7f\x9a\xea\xdc\x8a\x01\x37\x4a\x6e\x9e\x45\x4d\x52" "\x2b\x9f\xa6\x7c\x7c\x48\x69\x5f\xe5\x8b\x85\xee\x54\xd4\x85\x20\x96\x14" "\xad\x9c\x4d\xf2\x47\x1a\xbd\xac\x47\x95\x34\x21\xf7\xe1\x50\x3f\x05\x71" "\xf1\xa9\x2d\x78\x3f\x5f\x48\x37\x3f\x88\x2f\x32\x22\x48\xb3\xb4\x7f\xf0" "\x10\xda\xa2\xdd\x98\xfd\x6a\x02\x9b\x95\xa7\xc8\x5d\x20\x59\x4c\x24\x9b" "\xa0\x70\x68\xc6\x03\xcd\x73\x8e\x2f\x5f\x2a\x37\x40\x2e\xa9\x77\x61\x39" "\x01\x18\xb5\x87\x34\x3d\xf9\x30\x88\x75\x19\xc1\xd9\x1a\x9e\x25\xd7\x0a" "\xff\xa3\x45\x41\xe2\xe7\x34\xf6\x9d\x09\x2e\xf2\x53\xf2\x0a\x4c\xdb\x6a" "\x2a\xb4\x70\xc4\x1d\x7e\xea\xfd\xd9\xd9\x9f\x2c\xdc\xd3\x5a\xaf\x6f\x2a" "\x56\xb5\xff\x03\xe8\xc9\x76\x7d\x1f\xac\xb6\x1c\x78\xa6\x22\x6e\xae\x6b" "\x09\xa3\x35\xf9\x5c\x9b\xf1\x71\x50\x06\x2c\x5d\x11\x44\xb4\x7e\x75\xea" "\x69\x6f\x38\x8f\x6d\x09\x06\x6f\x61\xc3\x2a\xb2\xa5\x15\x4d\xed\xd7\xbf" "\x0a\x5a\xc3\x62\xd1\xa5\xb2\x76\xd5\x7f\x6f\x1c\xd5\x84\x39\xa2\x57\xc5" "\xa8\xcd\xcb\x41\xf7\x4e\x1a\xce\xbd\x08\x2d\xff\x64\x80\x5f\x40\x3e\x04" "\x6d\x5a\xf9\x96\xf3\xa0\x98\x26\x2c\xbd\xc2\x26\x88\xff\xba\xcc\xd4\xba" "\x51\xa3\x25\x93\xbe\xda\x27\x5a\xbe\x5c\x8d\x05\x10\x38\xad\x5c\x3d\xe1" "\x60\xb5\x8e\x66\xe3\x0a\xb7\x51\x43\x56\x11\x3e\x7e\x95\x82\x7c\x68\xd9" "\xf7\x49\xa9\xc2\xea\xdc\x32\x49\xf8\x25\x1b\x75\x61\x6e\xcd\x68\x51\x47" "\x6d\x8d\x9b\x6f\x47\x96\x07\x03\x57\x19\xc8\xbd\x39\x89\x8a\x1f\xf6\x15" "\x4a\x82\x0c\xeb\x2e\xc1\xb7\x1c\x53\x36\x62\x84\xfe\x53\x82\x27\x4a\x96" "\x2a\xb0\x1a\xc5\xef\xf6\x44\xf5\xfe\x46\xf9\x34\x4f\x0a\x4b\x3b\x4d\x68" "\x09\xce\xc0\xdb\xa1\xa8\xe6\x0f\x20\x96\x18\xba\xbd\x99\x56\xfb\x81\xd1" "\x9a\xb7\x11\x33\xcb\x2f\xb4\xc4\x5c\xae\x72\xa7\x9f\xa4\x33\xfb\xe0\xd9" "\x45\xeb\x98\xcf\x27\xfa\xfe\x32\xe9\x1d\x92\x3f\x95\x1f\x51\x51\xaf\x27" "\x59\xf4\x26\xf1\x9e\x3a\x89\xdd\x28\x19\xf6\xe9\xda\x9e\x0e\xbe\x96\xc7" "\xf3\x24\x22\x9f\x07\xbe\xe7\x37\x84\xc3\x26\xaf\x25\xd5\xba\x09\x39\x69" "\xe3\xc1\xc1\x3f\x11\x87\x13\xa2\xb3\x1a\x45\x8c\x79\xfe\xe6\x03\xcc\x17" "\x2f\x5f\x5d\x29\xd6\x84\x42\xc7\x19\x53\x21\x50\x5b\x2c\x87\x8e\x5f\x10" "\xff\x61\xec\x5d\x23\x00\x51\x5c\xac\x24\x90\x2c\xef\xca\xa6\x3f\xca\x05" "\x1a\x32\xb1\x3e\x27\xed\x82\xd2\x39\xf0\xb6\xd4\x90\xf0\x05\xd0\x76\x66" "\xd6\xb1\xa7\x8e\x6d\xa9\x4d\xc7\xc3\xc6\xa6\xf0\x0f\x72\x82\xc8\xcf\xce" "\x6d\x4f\xaf\x30\x68\xa6\xaf\x1e\x96\x60\xe4\x64\x10\x53\x84\x4f\x70\x3f" "\x07\x7d\x72\xe3\xef\x83\x1e\x4f\xb4\x4e\xa0\xd4\xf1\x21\x8d\xbb\x3f\xaa" "\xa9\xbd\x2c\x96\x81\x07\x07\x1a\xcd\xb1\xec\x4c\x07\xc2\xac\x3b\x2a\x8b" "\x9f\x90\xff\x26\x0d\x0d\x23\x78\x30\x56\x62\xa0\x89\x8e\x24\xa4\xcf\xff" "\x70\xb3\xf5\x0f\x3c\x9f\xb4\x43\xca\xca\x16\x95\x5a\xa6\xd1\x9d\xfd\x92" "\x56\x0b\x14\x51\x63\xf4\xfd\x99\x8a\x37\x4e\x25\x08\x0a\x64\xeb\x12\x95" "\x5b\xc9\x09\xd9\x40\x40\x66\xee\x77\x67\x78\xdc\x9f\x82\x81\x42\x81\xcc" "\xf8\x4a\xdc\xe1\x81\x40\x98\x85\x1b\x57\x7f\x0d\xb8\x32\xb0\xfd\xe5\x55" "\x1f\x22\xb5\x88\x53\x50\x29\xde\x69\x33\x55\x8a\x52\xf8\x01\x8f\x26\x43" "\xfb\x8f\xf7\x7c\x99\x3b\x60\xe0\xd9\x86\x5c\x5c\xcd\x26\x52\x6a\x17\x9d" "\xf0\x6e\x5f\x80\xcb\xf0\x32\x65\x79\x1d\xef\x8e\x84\x70\x41\xe9\xc3\x04" "\x81\xb6\x14\x08\x38\xfc\x56\xb2\x57\x9d\x77\x88\x7e\x78\x05\x5a\x30\x70" "\x57\xd5\x8e\x1f\x0d\xa3\x7a\x9b\xa7\x74\xca\x5b\x90\x99\xcf\x24\xc4\x03" "\xdb\xbb\x76\x6a\x39\xdd\x9c\x39\x31\x37\x51\xae\xdb\x20\x43\xc8\x80\x73" "\xda\x7c\xd5\x37\x74\xd1\x41\x13\xbf\x9a\xb5\x9a\x86\xb0\x4b\xd3\xd5\x53" "\x6d\x82\x45\x42\xce\x1f\x4d\x3e\x2a\xe8\xc1\xee\x26\x8d\x32\xdc\x94\x7c" "\x9e\x8a\x0d\xc4\x85\xa0\xe2\x54\x04\x7d\x90\xf3\x53\x0d\x2e\xeb\xb8\x81" "\x5b\xd7\xd1\xd6\x7a\xef\xbd\x09\x07\xc1\xe7\xa2\x6c\x3d\xf0\x2d\x55\x6a" "\x16\x52\xe6\x5e\xec\x8d\x2b\x1d\x46\xd0\xd5\x6d\x38\xc3\x56\x18\xf4\x08" "\xaf\x86\x50\xb4\x0a\x06\x4e\xbb\x35\x36\xc0\x33\xa3\x0d\xde\x04\x68\xbb" "\x79\x30\xdc\x4e\x30\x30\xc7\xc5\x63\xca\x01\xdc\x7e\xbb\xb2\xa4\x79\xab" "\x81\x19\x98\xb2\xe2\xd1\x96\x79\xca\xf1\x0d\x6d\x7d\xc2\x5f\xab\x6e\xb0" "\x04\x39\xe8\x4b\x81\x3e\x65\x7f\x93\x1b\xac\x65\xee\xa9\xbe\xd2\xf8\x9f" "\xf3\x2a\x4b\x1e\x68\xae\xbd\xa3\x5b\x74\x1a\xb7\x9b\x5e\x59\x13\xd3\xa3" "\x37\x0c\x52\x1b\x26\x0f\x37\x57\xd5\xb7\xdc\x5a\x57\xf6\x14\xdf\x5a\x1d" "\x9a\xcc\x61\x4d\x1c\xd1\x27\x6a\x94\x66\x60\x5a\xf6\x35\x7a\x1c\x3f\x69" "\xe3\xc1\x36\x6a\xd4\xa6\x48\xce\x1c\xa8\x04\x06\xc4\xd0\x7c\xa4\x69\xa4" "\x95\xb9\x4e\x80\xee\x85\x09\xe7\x41\x88\x5a\x3d\x3b\xbe\x80\xb3\x38\xd7" "\xe3\xab\x3a\x60\x7f\x9d\x19\x5e\xb3\x57", 4096)); NONFAILING(*(uint64_t*)0x200000000068 = 0x1000); syscall(__NR_writev, /*fd=*/r[0], /*vec=*/0x200000000040ul, /*vlen=*/3ul); // ftruncate arguments: [ // fd: fd (resource) // len: intptr = 0xd5 (8 bytes) // ] syscall(__NR_ftruncate, /*fd=*/r[0], /*len=*/0xd5ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; install_segv_handler(); loop(); return 0; }