// https://syzkaller.appspot.com/bug?id=5e2e50e2c145ca06459e9e0900c20eefd1a0877e // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } #define MAX_FDS 30 static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); setup_binderfs(); loop(); exit(1); } #define FS_IOC_SETFLAGS _IOW('f', 2, long) static void remove_dir(const char* dir) { int iter = 0; DIR* dp = 0; retry: while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) { } dp = opendir(dir); if (dp == NULL) { if (errno == EMFILE) { exit(1); } exit(1); } struct dirent* ep = 0; while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) { } struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } int i; for (i = 0;; i++) { if (unlink(filename) == 0) break; if (errno == EPERM) { int fd = open(filename, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno != EBUSY || i > 100) exit(1); if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW)) exit(1); } } closedir(dp); for (int i = 0;; i++) { if (rmdir(dir) == 0) break; if (i < 100) { if (errno == EPERM) { int fd = open(dir, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno == EBUSY) { if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW)) exit(1); continue; } if (errno == ENOTEMPTY) { if (iter < 100) { iter++; goto retry; } } } exit(1); } } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); if (symlink("/dev/binderfs", "./binderfs")) { } } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } #define FUSE_MIN_READ_BUFFER 8192 enum fuse_opcode { FUSE_LOOKUP = 1, FUSE_FORGET = 2, FUSE_GETATTR = 3, FUSE_SETATTR = 4, FUSE_READLINK = 5, FUSE_SYMLINK = 6, FUSE_MKNOD = 8, FUSE_MKDIR = 9, FUSE_UNLINK = 10, FUSE_RMDIR = 11, FUSE_RENAME = 12, FUSE_LINK = 13, FUSE_OPEN = 14, FUSE_READ = 15, FUSE_WRITE = 16, FUSE_STATFS = 17, FUSE_RELEASE = 18, FUSE_FSYNC = 20, FUSE_SETXATTR = 21, FUSE_GETXATTR = 22, FUSE_LISTXATTR = 23, FUSE_REMOVEXATTR = 24, FUSE_FLUSH = 25, FUSE_INIT = 26, FUSE_OPENDIR = 27, FUSE_READDIR = 28, FUSE_RELEASEDIR = 29, FUSE_FSYNCDIR = 30, FUSE_GETLK = 31, FUSE_SETLK = 32, FUSE_SETLKW = 33, FUSE_ACCESS = 34, FUSE_CREATE = 35, FUSE_INTERRUPT = 36, FUSE_BMAP = 37, FUSE_DESTROY = 38, FUSE_IOCTL = 39, FUSE_POLL = 40, FUSE_NOTIFY_REPLY = 41, FUSE_BATCH_FORGET = 42, FUSE_FALLOCATE = 43, FUSE_READDIRPLUS = 44, FUSE_RENAME2 = 45, FUSE_LSEEK = 46, FUSE_COPY_FILE_RANGE = 47, FUSE_SETUPMAPPING = 48, FUSE_REMOVEMAPPING = 49, CUSE_INIT = 4096, CUSE_INIT_BSWAP_RESERVED = 1048576, FUSE_INIT_BSWAP_RESERVED = 436207616, }; struct fuse_in_header { uint32_t len; uint32_t opcode; uint64_t unique; uint64_t nodeid; uint32_t uid; uint32_t gid; uint32_t pid; uint32_t padding; }; struct fuse_out_header { uint32_t len; uint32_t error; uint64_t unique; }; struct syz_fuse_req_out { struct fuse_out_header* init; struct fuse_out_header* lseek; struct fuse_out_header* bmap; struct fuse_out_header* poll; struct fuse_out_header* getxattr; struct fuse_out_header* lk; struct fuse_out_header* statfs; struct fuse_out_header* write; struct fuse_out_header* read; struct fuse_out_header* open; struct fuse_out_header* attr; struct fuse_out_header* entry; struct fuse_out_header* dirent; struct fuse_out_header* direntplus; struct fuse_out_header* create_open; struct fuse_out_header* ioctl; }; static int fuse_send_response(int fd, const struct fuse_in_header* in_hdr, struct fuse_out_header* out_hdr) { if (!out_hdr) { return -1; } out_hdr->unique = in_hdr->unique; if (write(fd, out_hdr, out_hdr->len) == -1) { return -1; } return 0; } static volatile long syz_fuse_handle_req(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3; struct fuse_out_header* out_hdr = NULL; char* buf = (char*)a1; int buf_len = (int)a2; int fd = (int)a0; if (!req_out) { return -1; } if (buf_len < FUSE_MIN_READ_BUFFER) { return -1; } int ret = read(fd, buf, buf_len); if (ret == -1) { return -1; } if ((size_t)ret < sizeof(struct fuse_in_header)) { return -1; } const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf; if (in_hdr->len > (uint32_t)ret) { return -1; } switch (in_hdr->opcode) { case FUSE_GETATTR: case FUSE_SETATTR: out_hdr = req_out->attr; break; case FUSE_LOOKUP: case FUSE_SYMLINK: case FUSE_LINK: case FUSE_MKNOD: case FUSE_MKDIR: out_hdr = req_out->entry; break; case FUSE_OPEN: case FUSE_OPENDIR: out_hdr = req_out->open; break; case FUSE_STATFS: out_hdr = req_out->statfs; break; case FUSE_RMDIR: case FUSE_RENAME: case FUSE_RENAME2: case FUSE_FALLOCATE: case FUSE_SETXATTR: case FUSE_REMOVEXATTR: case FUSE_FSYNCDIR: case FUSE_FSYNC: case FUSE_SETLKW: case FUSE_SETLK: case FUSE_ACCESS: case FUSE_FLUSH: case FUSE_RELEASE: case FUSE_RELEASEDIR: case FUSE_UNLINK: case FUSE_DESTROY: out_hdr = req_out->init; if (!out_hdr) { return -1; } out_hdr->len = sizeof(struct fuse_out_header); break; case FUSE_READ: out_hdr = req_out->read; break; case FUSE_READDIR: out_hdr = req_out->dirent; break; case FUSE_READDIRPLUS: out_hdr = req_out->direntplus; break; case FUSE_INIT: out_hdr = req_out->init; break; case FUSE_LSEEK: out_hdr = req_out->lseek; break; case FUSE_GETLK: out_hdr = req_out->lk; break; case FUSE_BMAP: out_hdr = req_out->bmap; break; case FUSE_POLL: out_hdr = req_out->poll; break; case FUSE_GETXATTR: case FUSE_LISTXATTR: out_hdr = req_out->getxattr; break; case FUSE_WRITE: case FUSE_COPY_FILE_RANGE: out_hdr = req_out->write; break; case FUSE_FORGET: case FUSE_BATCH_FORGET: return 0; case FUSE_CREATE: out_hdr = req_out->create_open; break; case FUSE_IOCTL: out_hdr = req_out->ioctl; break; default: return -1; } return fuse_send_response(fd, in_hdr, out_hdr); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 9; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); close_fds(); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: memcpy((void*)0x200001c0, "./file0\000", 8); res = syscall(__NR_openat, 0xffffff9c, 0x200001c0ul, 0x80c0ul, 0ul); if (res != -1) r[0] = res; break; case 1: memcpy((void*)0x20002080, "/dev/fuse\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20002080ul, 0x42ul, 0ul); if (res != -1) r[1] = res; break; case 2: memcpy((void*)0x200020c0, "./file0\000", 8); memcpy((void*)0x20002100, "fuse\000", 5); memcpy((void*)0x20002140, "fd=", 3); sprintf((char*)0x20002143, "0x%016llx", (long long)r[1]); memcpy((void*)0x20002155, ",rootmode=00000000000000000100000,user_id=", 42); sprintf((char*)0x2000217f, "%020llu", (long long)0); memcpy((void*)0x20002193, ",group_id=", 10); sprintf((char*)0x2000219d, "%020llu", (long long)0); syscall(__NR_mount, 0ul, 0x200020c0ul, 0x20002100ul, 0ul, 0x20002140ul); break; case 3: res = syscall(__NR_read, r[1], 0x2000a400ul, 0x2020ul); if (res != -1) r[2] = *(uint64_t*)0x2000a408; break; case 4: *(uint32_t*)0x20000ac0 = 0x50; *(uint32_t*)0x20000ac4 = 0; *(uint64_t*)0x20000ac8 = r[2]; *(uint32_t*)0x20000ad0 = 7; *(uint32_t*)0x20000ad4 = 0x1f; *(uint32_t*)0x20000ad8 = 0; *(uint32_t*)0x20000adc = 0; *(uint16_t*)0x20000ae0 = 0; *(uint16_t*)0x20000ae2 = 0; *(uint32_t*)0x20000ae4 = 0; *(uint32_t*)0x20000ae8 = 0; *(uint16_t*)0x20000aec = 0; *(uint16_t*)0x20000aee = 0; memset((void*)0x20000af0, 0, 32); syscall(__NR_write, r[1], 0x20000ac0ul, 0x50ul); break; case 5: memcpy( (void*)0x200021c0, "\xd5\x6c\xea\x33\x94\x6c\x0e\xae\x32\x41\xd3\x60\x4b\xfc\xe8\x9a\xdd" "\xdb\x2e\xb9\x69\x60\x33\x8d\xb7\x57\x2f\xa2\x54\xeb\x7c\x69\xdc\x0c" "\xb5\x26\x98\x96\x30\xe2\x62\x24\xc2\x58\xc8\xd7\x0c\xca\xcc\x55\x64" "\xd6\x77\x23\xf4\x75\x6c\x03\x99\x17\x4c\x54\x60\xc4\x99\x59\x42\xd2" "\x40\x92\xc3\x6d\xc8\x20\xe9\x73\x44\x79\x8b\x5b\xb4\x54\x23\xf8\x53" "\xbf\x50\xe3\x74\x32\x3a\xba\xcf\x03\x88\xcd\x09\x10\x16\xb7\xa3\xd7" "\x84\x3f\x4d\x3a\xe1\x65\x8b\xd3\x4d\x96\x7e\x33\x23\xa6\x49\x08\x44" "\x27\x88\xdb\xc9\x9c\x1f\x42\x48\xda\x53\xfb\x5b\xe2\xc8\x00\x12\x36" "\xb9\x94\xca\x59\x4e\x3b\x3c\x58\x8b\xea\xf3\xcb\x1c\x32\xc0\x72\xd7" "\x68\xb9\xe6\x65\xe7\xd8\x70\x44\xfd\xfc\x1f\xd6\x45\x25\x93\xe6\x79" "\x39\x63\x15\x3f\x38\x50\xbf\x85\x04\x2a\x5c\x13\x97\x99\xba\x8f\x6c" "\xb8\xd8\x77\xfc\x43\x6c\x4f\x16\x01\x27\x0d\x6e\x29\xd6\x0a\x4c\x80" "\xd6\x31\x5e\x46\xf4\x21\x94\x94\xce\x89\x71\x27\xd0\xb7\x6f\x5d\x68" "\x1e\x90\xf4\xe9\x28\x24\x68\xef\x79\x93\xcd\x92\x07\x6a\xed\x26\x6c" "\x1d\xb8\xb8\x1b\x93\xad\xc4\x96\x9c\x9b\x89\xb3\x2b\x87\x68\xc9\xf3" "\x9f\x2d\x14\x8e\x93\x3d\xbb\x65\x17\x46\xa9\x36\x4f\x49\x98\x6e\xf7" "\x3b\x4c\x29\xf6\x47\xb8\x2b\x83\x21\x6b\xb8\x17\x9f\xe5\x34\x6f\xda" "\xcd\xc5\xfd\xa4\xbd\x48\x87\x5c\xd2\xf1\xcf\x57\xa0\xc9\xa9\x1e\x05" "\x94\x46\xba\xc3\x10\xa6\xd6\x89\x48\x67\x5c\x35\xa8\xe4\x42\x16\x8f" "\xd8\x4d\x78\xd9\x80\x0e\x5b\x05\xbd\xbc\xe3\xa6\xea\xc6\x5b\xee\x72" "\x79\xa3\x62\x8f\x2a\x08\x93\x1d\x3d\x52\xce\x49\x06\x52\xc2\x0f\x8a" "\xe5\x29\xea\xf2\x4b\xf4\x21\xda\xd9\x76\xc6\x8b\x23\x4e\xe6\xf6\x21" "\x0c\x9f\x9a\xac\x3a\x55\xc6\x93\x9d\x6a\xa3\x80\x5b\x95\x61\x95\x46" "\x26\x4f\xf3\xff\x82\xd0\xdc\x69\x0e\x8e\xad\x61\xb6\xed\x52\x8c\x3c" "\x11\x7c\xd7\x71\xa3\xb7\xfe\xb2\x14\xce\x8d\x72\x06\x40\xd9\x7f\x14" "\xb3\x99\xb7\xf4\x6d\xc4\xaa\xd8\x31\x17\xe8\xe6\x42\xcc\xb1\x17\xd1" "\x3f\x34\x55\x36\xfc\x38\x01\xc1\x24\xcf\xaf\x8a\xa7\xaa\xff\xf6\xc8" "\xdf\x3f\xdd\x44\x69\xc0\x77\xec\xcb\xd8\xdd\xac\xad\x80\xd9\x11\x3d" "\xfd\xe2\x6a\xe6\x7b\x22\x61\x85\x74\x3b\x2d\x53\x66\x7f\xb3\x01\x6f" "\xe1\x14\xf8\x74\x84\xab\x61\x4d\xdf\x08\x87\xc4\xb2\xc8\x53\x51\xab" "\x21\xa0\xec\xe6\xc0\x66\xa1\x54\xb3\x8b\x4d\x7c\x17\x92\xd2\xdb\x2c" "\xc5\xf8\xce\xb4\x20\x78\x18\x79\x49\xd3\x54\xb7\xa0\x8d\x15\x29\xf3" "\xd1\x08\x14\x75\x71\x79\xc8\x60\xdb\x03\x1d\xad\x4a\x3d\xc1\x3c\xa0" "\x1d\x10\x13\x23\x8e\xd5\xf7\xa9\x67\x4f\xcc\x77\xf0\xd3\x4e\x21\x18" "\xfb\x85\x1c\x97\x0d\x86\xec\xf9\xde\x1c\xfd\xb8\xd3\xab\x19\x74\x80" "\xe2\x63\xc3\x20\x7c\x3d\x7e\xbe\x17\xf9\x54\x7c\x7c\x56\xb0\x8e\x83" "\xde\x87\x52\x94\xd0\xfd\x68\xdf\x19\x26\xec\xac\x24\x35\x0b\x2c\x70" "\xbd\x73\xe1\x41\x22\xed\x48\x0c\x56\x43\x53\xd3\x40\x49\xe6\x7c\x26" "\x03\x6f\xc3\x5d\x04\x02\x2c\xd3\x5d\x6a\xc0\x07\x56\xd3\xb8\x55\x0b" "\xb2\x2a\xe8\x0a\x4b\xd6\x30\xa0\x02\x68\xd0\x7f\xa2\x49\xb0\xbf\x54" "\x5d\xfb\xf0\x1b\xea\x2f\x12\xb3\x07\x38\xc6\xe1\x31\x56\x24\x4e\xb2" "\x4e\x6d\x69\xba\x7c\x3a\xcd\xbb\xef\xe8\xbb\xc0\x6b\x82\x1a\xeb\xf8" "\x36\xca\x07\xa3\xcc\x7b\x6b\x24\x68\x6e\xd8\xf3\xb2\x30\x85\xc8\x93" "\xe7\x21\x88\xb7\x97\x65\x1c\x5a\xb5\xcc\xeb\x14\x65\x41\x4a\x32\x5f" "\x79\x3a\x3a\xf6\xd0\x6e\xed\x7e\xb7\x34\xad\x05\xbc\x1f\x66\x19\xe8" "\x48\x52\x59\xf5\x70\xa4\x82\xa6\x72\x73\xee\x01\xfe\x15\xdd\x93\x8a" "\xfc\xe0\x26\xf1\x11\x1c\x7a\x38\xed\x6d\x1a\xba\x34\xf0\x09\xce\x1e" "\x99\x14\x0f\xd0\xdb\x2d\xe7\x41\x50\x54\x1f\xd4\x8d\xd2\xec\x5b\x1d" "\x15\x66\x9d\xe2\xff\xe3\xa1\x98\x18\x4b\x61\x86\xcc\xda\x31\xaa\x64" "\xc5\x85\xff\x8c\xb6\x5b\x67\xfe\x14\x55\x75\x38\x95\xa8\x8b\x6a\xb4" "\xc6\xbf\x1b\xb8\x32\x97\x39\x17\x81\x47\xe6\xf1\x58\x01\xbf\xa7\x07" "\xbd\x9e\xc9\xda\x66\x25\x73\xce\x07\xaf\x68\x4b\xb7\xc8\x80\xa7\xd6" "\x3b\x0a\x0a\x73\x00\x88\x14\x08\xc4\x4e\x95\xc6\x79\xea\x32\xb0\xea" "\xb8\x45\xd0\xb3\x33\xf2\x45\xe8\xd6\x00\x62\x58\x67\x87\x04\xaa\x8c" "\xcc\xda\xf8\x0c\xc4\x61\x38\xd5\xb7\xa0\x80\x4f\xdf\xa3\x4c\x91\xd6" "\x1a\x0d\x2f\xa6\xc6\x2e\x7d\x1a\x67\x5e\x57\x43\xf8\x45\xab\x40\xea" "\x5d\xf0\x18\x2d\x6e\xb9\x78\x19\x05\xc9\x47\x51\xc7\x5a\x41\x16\x99" "\xa7\x6f\x48\x43\x31\x42\xc5\xf1\x09\xd5\xdf\xdd\xcc\x0b\x1d\xc6\x25" "\x4e\xfd\x5e\xa5\x0d\x6f\xfb\xc7\xb9\xca\x03\x1e\x1a\x01\x23\x84\x4b" "\x63\xc4\x8b\x96\x46\x45\xc6\xd2\x47\x07\x58\x28\x25\xe2\x19\xbc\xd6" "\x16\x77\xed\x4f\xc4\x5e\xe1\xf4\xbe\x91\xb4\xc1\xb8\x56\xd6\x5a\x86" "\xac\xf2\x2b\x8b\x0d\x58\x8b\xc4\x73\x24\x8a\xc0\x40\x32\x6b\x14\x90" "\xc2\xfe\xa2\x4b\xc0\xc0\xa7\x21\xe2\xed\x63\xe3\x99\x73\xcd\x4d\x38" "\xdf\x10\x01\xdb\xa9\xb9\xd9\x95\xc2\x29\x65\x5d\xd2\x6f\x3c\xd3\xd6" "\x40\x77\xec\x11\x1e\x2c\x37\x07\x17\xcb\x4c\xd0\x68\xe0\xd3\xa5\x2f" "\x10\x27\xd3\xdf\x95\x3e\x1f\x1a\xc7\x68\xa7\x21\x5a\x36\x95\x72\x2b" "\x1b\x67\x14\xce\x43\x80\x14\x51\xa9\x53\x22\x12\xb6\x51\xd0\x73\xc7" "\x80\xd6\x17\x12\xae\xba\xdd\x14\x5c\x1c\xd9\x5c\x1d\xc0\xdc\xf5\x18" "\x50\x04\x6a\xe5\x77\x1e\x36\x5f\x45\x85\x8a\x36\xe4\x8a\xfe\x56\x3e" "\xc0\xaf\xee\x38\x03\xff\x6a\x35\xbc\x25\x21\x7b\x53\xed\xa3\x9b\xb8" "\x13\xb8\xd3\xd7\x28\xc2\x1a\x0b\x80\xd0\x14\x00\x31\x43\x66\x6c\x0d" "\x13\x98\xcc\x46\xa0\x1a\xaa\xf9\x71\x17\xed\xda\x21\x7f\x98\x40\x10" "\xe7\xc5\xcf\x32\x53\x5a\x66\x9d\x4f\x11\xf6\xb7\x0e\x3a\x3b\x82\x39" "\x87\xef\x7c\x9f\x87\x84\x15\x06\x3b\xf0\x52\x05\xe1\x3b\xcf\x7a\xcb" "\x28\x7b\xd0\xbb\x0f\xce\x77\x52\x9a\x71\x1f\x0e\xd1\x45\xea\x2e\xcf" "\x21\x94\x65\x8d\xff\x17\xc5\x68\x1c\xf8\xc7\xad\x85\x21\xd2\x35\xa7" "\x05\x29\x2a\xf4\x87\x8b\x3f\x12\x4b\xe2\xdf\x66\x10\x26\xc0\x91\xd6" "\xc0\x7a\xae\x1a\x74\xc9\x19\xf7\x47\x8d\x10\x83\xf7\x0b\x3a\x0f\xe0" "\x0c\x2e\x22\x0a\xb9\x98\xb4\x59\x52\x68\xb6\xf7\xca\xbb\xfc\x85\xe5" "\x9d\xfb\x6a\xb7\xa7\x94\xcd\x3f\xd7\x0d\x5c\xc4\xd7\x0c\xa9\x33\xa4" "\x45\x2d\xf5\xa3\x45\xcb\x31\xf3\x26\x7d\xe5\x35\x19\xba\x39\xc9\x15" "\xd4\x92\xcd\x46\x52\x84\x3f\x1d\x30\xa5\xfb\x31\x1e\x3b\x5d\x86\x83" "\x47\x96\x9f\x01\x3c\x5e\x3b\x48\x41\xb2\x22\x40\xab\xcb\x61\xa1\x4f" "\xf5\x67\x18\x67\x66\xce\x8f\x6a\xe6\x48\x77\xf6\x72\x83\x5d\xbf\xf4" "\xfc\xf1\x9c\x82\x30\xd8\xa4\x02\x39\x76\x30\xef\xfb\x69\x8a\x8b\x0c" "\x9a\x28\xae\x02\x8d\x79\x38\xff\xde\x48\x8f\xd6\x41\x13\x08\x5b\xce" "\x50\x4c\xd0\x55\x1e\x0e\xb3\x73\x0c\x3f\x78\x1c\xbe\xcf\x0c\x41\xd2" "\x33\x87\x66\xd3\xf6\x09\x66\x61\xc1\xf1\xbe\xc3\x16\x2b\x8a\x0c\x40" "\x99\xfc\xcd\x94\x80\xe8\x21\xdf\x87\x82\xc2\xe0\x70\x53\x0b\xef\xb6" "\x2b\xcc\xd8\x53\x9f\xe9\xdc\x7d\x8d\x3f\x9b\xde\xd1\xbb\x34\xdb\x3f" "\x2d\x60\x50\x88\x5c\x8f\x1d\x57\xf5\xe6\x03\xf6\x29\xde\x74\x91\xf5" "\xfd\x9f\xaf\xcc\xeb\x56\x5a\xbe\xae\xc8\x38\xb1\x0a\x76\x3a\x00\xa4" "\x60\x7d\x43\x30\xbd\xce\xdc\x06\x6d\x8c\xf9\x79\x0d\x80\x6e\x03\xc2" "\x19\x86\x6b\xb8\xf0\x53\xa6\xe6\x02\x64\x54\x36\xd1\xf4\x69\xdf\x1d" "\x50\x08\xf5\xdc\xd4\xbd\xb7\xce\x5b\x76\xec\x01\x5a\x8f\x46\x93\xcb" "\x2a\x63\xce\xb2\xbe\x00\xbc\xf2\x21\xf0\xca\x32\xdb\x4e\xfa\xf8\xf7" "\x02\x26\x22\xb3\x35\xfa\x8d\xea\x4a\xfd\xd8\x6b\xe1\x0b\xe6\xc4\xd6" "\x6e\x5f\x57\x41\x6a\xdd\x44\x80\x50\x9c\xb9\x8c\xf3\x1c\xdd\xa8\x46" "\x44\xee\xb7\x82\xee\xa0\x41\xd4\xbc\x0e\x00\x5a\x20\xbc\xcc\x3c\x4a" "\x08\xce\xfc\xdb\x91\xcc\x2c\x61\xd9\x23\x1c\x4e\x36\xe9\x6f\x6e\xdd" "\x21\x33\xf9\xb3\x4e\x7d\xa9\x0c\xe2\x0d\x1c\x60\xff\x22\x3c\x6a\x20" "\x4b\xb9\x42\x76\x6a\x35\x9b\x92\x35\x73\xbb\xba\xf2\xa8\x27\xd7\x9e" "\x4f\x64\x9e\x79\xa8\x40\x21\x6a\xc4\xdd\xb3\x40\x9c\x94\xe7\x1f\xf0" "\x8d\x10\x9b\xc3\xf0\xcf\x65\x83\x21\x9d\xe7\xd7\x13\x1a\x95\x6f\x83" "\x5e\xcf\x5c\x13\x1a\x0b\x1e\x05\x6a\x86\xd8\x00\xa0\x20\x42\x43\xf3" "\xb6\x95\x02\x95\x78\xc0\x64\x30\x6a\x31\xdb\x53\xf2\x8a\x8f\x0c\x03" "\x02\x48\x6c\xd0\x59\x70\x90\x4e\x9b\x5c\x53\x10\x0a\xc1\xaa\xbb\x31" "\x10\xa8\x98\x20\xe4\xd8\x30\x7c\x3d\x46\x08\x49\x99\xd0\x45\x6c\x53" "\xfe\xc6\x1a\x92\x42\xb4\x86\xeb\x41\xa9\x0f\x33\x00\xfd\xfd\x0d\x8a" "\x47\x2e\x8d\xa7\xa8\x42\x58\x87\x21\xd1\xdf\x1f\x5e\x4c\xc4\x25\xef" "\xeb\xc7\x5a\x90\x4e\xf4\xcc\x88\x13\x46\xa4\xbc\x23\xee\xf4\xd4\x92" "\xe3\xef\xcc\xeb\xab\x86\xae\x42\x13\xf4\x26\x71\x37\x05\x79\xee\x7f" "\x83\x41\x39\x6e\x95\x15\x61\x9e\x10\x0a\x8f\xae\x2c\x5c\xba\x01\x39" "\xa0\x88\x57\x9e\xce\x7a\x60\x3c\x8b\x8b\xab\x99\x98\x22\x3f\xe8\x62" "\xdf\xf8\x48\x0a\xea\xa5\x97\x0c\x90\xb8\x94\xe5\xf7\x1c\x27\x84\xe4" "\xdf\xd5\x0e\xd3\xe9\xed\x91\x03\x6e\x83\x56\xc0\x94\x64\xde\x13\xb4" "\xa9\x52\x27\x20\x31\x33\xb2\xc2\xc7\x1c\xd6\x32\x34\x92\xf0\x83\xbd" "\xa5\x8a\xd7\x72\x1b\x66\x66\xb9\xcd\x93\xf9\x3f\x02\x88\x48\x28\x13" "\xfd\x8a\xad\xe0\x2c\xca\x81\xcd\x35\x25\x7e\x02\x35\x04\xac\x4f\x86" "\xbe\x1c\x7a\x81\x0b\x67\xc6\xd7\x07\x7f\x5c\xdb\xd3\x05\xb6\x18\xa0" "\x5c\x03\xd1\x96\x89\x4b\xfb\x1a\x6f\xf5\x11\xe5\x9a\xc8\xce\x45\xd1" "\x6c\xee\x95\xe1\xde\x07\x97\xa5\x43\x72\x8c\xaa\xa4\x3e\x5a\xe4\x2a" "\x12\xb6\xbb\x79\x10\xd1\x8d\x4e\x1e\xa8\x9d\x26\x44\x91\x28\x7e\xb2" "\x3a\x76\x09\x5a\x12\xa3\x9c\x46\xa7\xc8\x53\x49\xe2\x96\x9e\xda\xed" "\x3c\x1f\xa6\xa2\x15\x04\x94\xf6\x3f\x4c\x98\xc6\x5f\xcd\xd6\x50\xac" "\x74\x24\xac\x1a\xe6\x44\x21\x29\x43\x56\xac\x1e\x4d\xbf\x9d\x4c\x81" "\x7f\x08\x1f\x4f\x77\x51\xeb\xf5\x67\x88\xd7\x99\xba\xc2\x9d\xc0\xbf" "\xe8\x3e\xad\x7a\xb3\xe3\x38\xb8\xb8\x4d\xf4\xca\xd2\xb5\x49\xaa\xac" "\x4e\x60\x48\xa6\xfa\x8f\x8f\x6f\x1f\x7e\x0e\x51\xc8\xb3\xc8\x72\xf1" "\x8c\x46\x6e\x59\x02\x22\xb0\x32\x30\xf4\x6b\xc8\xe9\xa0\x17\x1b\xbd" "\x20\x96\xc7\xa4\x80\xd6\xa6\xf2\x9b\xd7\x4b\x60\x10\x5b\xeb\xda\x42" "\xe5\x9c\xc8\x30\xc4\xb3\x1f\x6c\x52\x68\x7b\x4e\xc2\xba\x86\x91\x49" "\xae\x36\x3d\x71\x1d\x09\x9f\x94\xce\xad\xe1\xad\xa1\x93\xe9\x31\xed" "\x9a\xea\x0a\x28\x0e\xd5\xf2\x5a\xd5\xab\x3b\x40\x83\xf1\x40\xca\x17" "\xb4\x3e\x5f\x6a\xef\x2c\x24\xa2\x8a\x02\x62\xc8\x0a\x04\x01\x87\xe0" "\x52\xea\x7d\x54\xa5\x28\xb6\xfc\xc1\x76\xed\x3a\xfc\x07\xfe\x6a\x66" "\x1d\x05\x0f\xb4\xa3\xa6\xab\xfa\x3d\xac\x5f\x32\x30\x54\x0b\x45\xaf" "\x06\x07\x81\xcb\x54\x99\xc2\x89\x4d\x6a\x4a\x2b\xf9\x08\xdd\xd4\x8d" "\x6b\x34\x20\x7f\x56\xc3\x12\x29\xe2\x06\xc8\x8d\xb3\x55\x2c\xeb\x6e" "\x82\xa0\xfa\x2b\xf7\xf9\x7b\xaf\x60\x3d\x37\xd6\xa8\xb1\xf2\xb1\xf5" "\xf9\x5b\x25\x11\x29\xed\x05\x35\x16\x81\x90\x8b\x7c\xf5\xcf\x6c\xc8" "\x6d\xd8\x54\x17\x4c\xc1\x97\x13\xb4\xd2\x62\xb0\x21\x95\x2b\x6d\xa5" "\xf2\x0f\x57\xbb\xac\xca\x62\xf5\xb7\x12\x44\x09\xaa\x62\x5b\xbe\xa5" "\x98\x19\xba\xeb\xc1\xbc\x2d\xd1\x88\xfe\xba\x48\xc9\x98\xd0\xdb\xed" "\x60\xd4\x4b\x8a\x4f\x0a\xc2\x8f\x6c\x1c\x8c\x99\x98\xf7\x40\x6f\x1a" "\x34\xe4\xce\x90\x2b\xe2\x42\x0f\x7f\xf5\x1a\x5a\xb3\xb1\xfa\xa8\x6a" "\xb2\xec\x1e\xdb\xea\x24\x93\xca\xe0\x90\xab\xde\x43\xff\x27\xd6\x85" "\xc9\x93\xde\xdb\x24\xeb\x25\x57\x72\xcc\x56\xfb\xd1\x04\xf4\xf5\x27" "\x5f\x10\xd5\x4d\x7c\xac\xb8\xcb\xf1\x88\xae\x1a\x4d\x29\xea\x88\x00" "\x68\xfb\x26\x96\xb3\xba\x6e\x8a\x7c\x15\x93\x9e\x1f\x7c\x39\x4a\xb4" "\xbd\x4c\x4b\xef\x23\x83\x12\x1c\xbe\xb1\x86\x46\xa8\xe0\x13\xd5\x70" "\xce\xe3\xee\xec\xd7\xfb\xe8\x4a\x61\x9f\x8a\xa2\xe3\x4f\x2e\x1e\x9b" "\x99\xd0\xc7\xd7\xd1\x79\xd9\xdf\x8d\x2e\x2f\x1c\xd7\xba\x2c\x7e\x60" "\x16\x6d\xc1\x4e\x5e\x4e\xd9\xc4\x11\x95\x93\x5e\x28\x84\xb5\xbd\x00" "\x57\xed\x01\x55\xa5\xd4\xc6\x48\x2e\x8f\x55\x4e\x4c\xd0\xd0\xae\xf7" "\xd6\x48\x78\x01\xab\x54\xd5\x4e\xb4\x17\x55\xd8\x33\xab\x83\x88\x3b" "\x40\xf4\x75\x95\x06\x3a\xd2\xa0\xfe\xe5\xc6\x61\xf8\x6b\x8a\xb0\x4a" "\xd0\x04\x7d\x98\x8a\xd8\x6b\x3c\x52\x0e\xb7\x8d\xc3\xd7\x50\xa5\x7e" "\x77\x7f\x5d\x76\x63\x49\xf1\xa6\x87\xe0\x90\xf7\x44\x20\x6c\xb5\xd0" "\x48\x34\x60\x61\xb4\x14\x06\x0f\x68\x26\xd8\xa8\x84\xe9\x3f\x73\xf1" "\xf1\xf4\xcb\x8b\xd6\xe8\xd1\x21\x5d\x43\x6d\x39\x0d\xbd\xa3\x5b\x55" "\x5f\x55\x0e\x11\xe6\xd8\x00\x9f\xce\x1c\x42\x9b\xd9\xbb\xd0\x4a\x1f" "\xbb\x9d\xe2\x86\x63\xc1\xbe\x4d\x8d\x7e\x50\x6b\xc6\x81\xad\xa2\x8a" "\x69\x01\x4b\x97\x29\x19\xb5\xf7\x0c\xbb\x77\x03\x49\x32\x4c\x9a\xf0" "\xb7\xee\x7f\xf4\xcc\x8b\xfe\x80\x7f\xb9\xfa\xa0\xa6\x94\x98\x44\x8b" "\x22\x19\x2d\x57\x8a\x1e\x82\x58\x2b\x94\x30\x51\xbe\xb5\x43\xdd\xca" "\x8b\x64\x3e\xe6\xc7\x6e\xe3\x22\x78\xaa\x8b\xc9\x2b\x44\xa8\x43\x9a" "\x24\xed\x50\x40\x54\x53\x49\xab\x05\xe8\x31\xd4\x51\x1a\x8d\xa0\x3c" "\xa5\x39\x65\x95\x85\xb2\x26\x7a\x73\x77\x5f\x1c\xb7\xc2\xc5\x54\x8d" "\x35\x08\xc8\x96\xf9\x9a\x8e\x5c\xb5\x51\x60\xab\x12\x67\xe3\x20\xac" "\x2d\x7c\x8f\x8b\x57\x07\x9d\xd1\x4d\x30\x16\x36\xa1\x37\x4e\x24\x54" "\x1f\x8d\x45\x39\x78\x99\x8e\xd2\x56\xb3\x81\xbc\xf6\x38\xbb\x37\x2c" "\xe1\xeb\xef\xb3\x41\x65\x6c\x02\xf4\x09\x2a\x76\x67\xff\xec\x55\x05" "\xe4\x93\x8d\xcb\x03\xd4\x04\x65\x44\x30\xe2\x44\xf9\xf7\xf7\xd0\xfb" "\x41\x89\xa9\x3f\x7c\x2b\xd7\xa4\xfc\xb3\xcc\xff\x79\xe4\x1a\x98\xad" "\xca\xc3\xe4\xc1\x9e\xeb\xeb\xae\xc1\x5b\xd8\xce\xa1\xdf\x0e\x50\x9c" "\xde\xf6\x2a\xe1\x0c\x66\x73\x4d\x16\x2c\xaf\x35\xa6\xe5\x11\xba\xa7" "\x17\xf7\x69\xc2\xe4\x49\x89\x22\x24\xfa\x8a\xe7\x8d\xe9\x13\x8c\xf6" "\xea\x1d\x93\x99\x98\xa8\xcb\x68\xb0\xe8\x3c\xf6\x04\xe0\x3b\x99\x63" "\x47\x96\xd3\xd4\x95\xe4\x61\x7f\x8f\xdd\x97\x64\x63\x1e\x7e\xd6\xea" "\xfa\x79\x7d\xeb\x11\x59\x25\x97\x77\xbf\x29\x15\xd4\x8b\x63\x28\x6f" "\x6d\x65\x28\xad\x4c\xa5\x78\x36\x09\x26\x3d\x9a\x03\xaa\xd4\x1e\xc8" "\xef\x1e\x2e\x1e\x77\x73\x4d\x27\x22\x9f\x80\x11\x92\xbe\x23\x84\x68" "\x85\x49\x45\xc2\x0d\xab\x4e\x1b\xaf\xf9\xdd\x59\x33\x61\xef\xda\x1d" "\xe9\x5e\x04\x56\x1d\x33\xcd\x73\xa4\x5d\xff\x5f\x85\xb2\xe8\x5b\x07" "\x47\xa4\x93\x45\xac\x8d\x38\xad\xd8\xef\x9c\x14\x68\x5e\xb3\xd3\x43" "\x2f\x3f\x99\x4e\x3d\xdd\x4e\x45\xb1\x60\x05\x87\x04\x85\x25\x3a\xfc" "\x4f\x08\xd8\xa6\xd8\x02\x3b\x72\x22\x84\xd1\x1d\x56\xc6\xff\x92\x09" "\xa5\xba\xcb\x7c\xe1\x70\x82\x44\xbd\x21\x87\x8b\x8c\xd5\xc1\x3a\xb4" "\x53\xbd\x58\x9f\x61\x96\x32\x2d\xe9\xfa\xed\xe3\x9c\xe6\xf9\x4c\x75" "\xd0\x08\xd2\xd7\xce\xd2\x7a\x23\x75\xcc\x62\xc3\xd5\xc1\x5c\x1c\x43" "\x01\xa0\x12\x99\xd8\xf4\xc4\x1e\x5a\x44\xe4\x13\x0e\x95\x55\xa3\x56" "\xd6\xb1\x97\x28\xc7\xd3\xc8\x6c\xb9\xa1\xdd\xf9\x06\xab\x63\xa9\x44" "\x7f\x82\x33\xbc\xd0\x9b\xd7\x4c\xf9\x74\x9f\x08\x5f\x0c\x46\x89\xef" "\x40\xdb\xc4\x1a\x7a\x29\x9f\x0f\x89\x1d\x9d\x0d\x3e\x39\x40\x9d\x4d" "\x77\x4d\xa5\x3b\xfb\x6e\x8c\xe6\x68\xce\x50\x88\x55\x58\xe9\x09\xad" "\xd2\xcb\x9b\xda\x2f\x7e\x92\x32\x54\x1b\x1a\x7f\x74\x2a\x99\x74\x0f" "\x48\x6e\xf4\xf7\xc9\x8e\x40\x52\xf2\xda\x70\x5c\x56\xa1\x8d\x5a\x82" "\x89\xae\x6c\xbb\x9d\xc7\xde\x13\xa8\xcf\x42\x0b\x7a\x93\x0a\xba\xae" "\x81\x3b\x40\x51\x7d\x84\xae\x98\x4d\xfc\x94\xcd\x10\x21\xe0\xe4\xa7" "\xa9\xe7\xde\x84\x10\x18\xd4\x74\x08\x3c\xa2\x8a\x82\x9e\xe0\x3f\xe6" "\x25\xca\xfc\xbe\xda\xdc\xde\xf6\x62\x1c\xcd\x67\x9f\xcd\x9c\x9a\x9a" "\xb2\x13\x62\x11\xf8\xc9\xa6\x79\x89\x5a\xa3\x9f\xac\xf2\xd6\x66\x8e" "\x50\x98\xb3\xdd\x8e\x0a\xd7\x8d\x8c\xaf\x25\x0d\xc3\x8f\x2c\x95\x18" "\xbc\xcb\x35\x3e\xf3\x41\x8d\x39\x06\x82\x75\x14\xc1\x95\x9d\x58\x34" "\x4e\xe1\x1a\x0e\xf1\xc1\x42\x44\x95\xcc\x1a\x99\x10\x18\x76\x85\xa4" "\x7d\x6d\xd9\x1f\x07\xe5\x08\x1c\x5a\xc3\xf1\xb6\xe3\x63\x06\x96\x94" "\xdd\x90\x72\x68\x4c\x5a\xb0\xba\x56\x15\x7c\x10\xf5\xfa\x84\x09\xe5" "\xbc\x43\xb3\x8b\x31\xf2\x4a\x30\x6c\xa5\xf7\xe3\xde\x9a\x39\x2e\xac" "\x19\x84\xe8\x77\xec\xb3\xdf\xd0\x44\xf1\x44\x9b\x4a\xe9\xb5\x86\x05" "\x1b\x17\x80\xc0\xce\x46\x29\x19\xf4\xa4\xb5\x4a\xd8\x01\x1d\x01\x3c" "\x39\x62\xfc\x66\x97\xd3\x3c\x2d\xc6\x77\x1f\xec\x66\x4c\x82\xcb\x16" "\x14\x46\x19\xb2\x07\xde\xb4\x39\x18\x66\xd6\xc1\x97\x6b\x94\x5c\x59" "\x59\xd1\x90\x18\xf1\x53\x76\xce\x3b\x05\x66\x67\x47\x74\x35\x27\xf2" "\x2b\x54\x17\x1d\xa4\xda\xbe\xe2\xf4\xe4\x69\xa5\x52\x10\x67\xde\x4f" "\x92\xe2\xba\xd0\x2e\x15\xe8\x12\xb6\xcb\xd2\x7e\xc8\x8a\x9e\xcc\xf6" "\x00\xce\x7f\x56\x43\x39\x2d\xa9\xff\x6b\x64\x12\xf8\xe7\xc6\x8d\x8c" "\x8b\x9e\x00\x06\xe4\x17\x77\xe2\xa1\x36\x3a\x95\x56\xbe\xfb\xbb\x11" "\x0d\xff\x3a\x84\xb1\x79\xda\x38\x38\xac\xde\x0b\x25\xf5\x37\x98\x73" "\x3a\x9f\xb4\x63\xd7\x6b\x63\x0a\xef\x7c\x8a\x43\xf6\x21\x94\x82\xb3" "\x4b\x89\x3f\xd9\x9c\xf3\xa0\x13\xec\xef\xde\x7c\x5c\x65\x28\xe3\x04" "\xc1\x86\x8f\xf3\xfd\x8d\xd5\xab\xa3\x48\xa0\x5d\xc9\x50\xb1\xc4\xc2" "\x81\xcb\xb2\x8b\x80\x0d\x6d\x0d\xa1\x80\xfd\xee\x06\xec\x3b\xad\x6f" "\x97\x18\x02\x95\xed\x1d\x77\x07\x81\x56\xa8\x85\xb5\xb0\xc5\x01\xea" "\x56\x3e\x88\x71\xad\xb9\x7d\xd6\x05\x2d\xe0\xab\x36\x9b\xf2\xd9\x8f" "\x43\x4b\xb2\xd1\x72\xd9\x96\x7b\xb7\x3d\x3e\xba\x6b\x52\xbb\x8d\x55" "\xd8\x96\x3b\xf5\x8d\x31\x0a\xfe\xdb\x51\xc0\xf9\x4c\x78\x14\xb6\xda" "\x30\xfd\x80\x56\xab\x7b\xe7\x4a\xc3\x1b\x1b\x75\xc2\x17\xe3\xab\x93" "\xea\xdc\xb2\xd2\x53\xe5\xd8\xbb\xe4\x7c\x0f\x1a\x41\x1a\x9e\x50\x2c" "\xf4\x30\x1d\x89\x8d\x90\x5c\xd5\xdb\x82\x8e\x56\xa7\x22\x39\x4f\xa1" "\x1c\xca\x64\xa0\x3a\x42\xe7\xfc\x1b\x34\x81\xb7\x1c\xa0\xb6\xa3\xd9" "\xbd\x1f\xc8\x22\x9f\x7f\x9d\x3e\x6a\xa0\xd4\x80\x51\x94\x25\x79\xfb" "\x75\x92\x01\xd4\x71\x5d\xb9\xa2\xd3\x99\xe0\x74\x5a\x66\xdb\xbd\x57" "\x1a\xcc\xf1\xf2\xe1\x55\x73\xce\x83\x2e\x91\xbd\x1f\x04\x2a\xb7\x58" "\xd9\xec\x13\xe3\x54\xf3\x84\x54\xcc\x42\x66\x8c\x8d\x60\x35\x89\x16" "\xf7\xe9\x37\x01\x5f\x6c\x38\x73\x2b\xcf\x61\x31\xec\xde\x00\x18\x92" "\xcb\x20\xfe\x47\x15\x3e\x7e\x23\xb1\xcd\x2f\xc4\xa2\x26\x62\xe7\xbd" "\xe0\x9f\x7d\xf1\x0f\xcb\xf4\x75\x78\x3f\xe2\x3a\x0f\xdc\xb2\xc3\xbd" "\x8b\x28\x45\x3c\xe5\x23\xac\x19\xff\x77\xe6\x8c\x3e\x9f\xa0\x19\x3b" "\x79\x6e\xa6\x8f\x44\x13\x2b\x3a\x96\xad\xeb\xc0\x41\x81\xe5\x03\xf5" "\x2b\xe4\x77\x8e\xf4\x22\xce\x3e\x6c\xa3\x85\x14\xfa\x18\xb5\x00\xca" "\x51\x85\x90\x47\x9e\x8c\x73\xa7\x94\x2d\xc2\xe2\x37\xd8\x2c\xda\x95" "\x3a\xe1\xb2\x96\xb9\x7e\xe8\xed\x62\xe2\xe7\x55\xd6\xdd\xea\x7c\x03" "\x34\xe1\xb8\xd7\x6c\x27\x8b\xdc\x45\x47\x24\x00\x31\x06\xcb\x6f\xdc" "\x85\x34\x0d\x1e\x78\x4a\xc8\xb6\x55\x1e\xaa\xbc\x33\xc5\x02\x16\x3c" "\xe0\xd4\x01\x62\x7b\xd2\x2b\xa6\xbe\x90\x08\x93\x72\xbf\xa3\xf9\x1e" "\xe7\x45\xe4\x58\x44\xef\x8d\xc0\xfe\x39\x36\xbe\xf0\x7f\x9c\x1d\x3a" "\xad\xfa\x4c\x8e\x99\xbe\x6b\x03\x8b\xed\x6b\xeb\x95\x97\xad\xd8\x81" "\xda\x2a\xcc\x1a\x3a\x47\x1f\x50\x0d\x68\xf6\x39\xcd\x2b\xf6\xf4\xaf" "\xab\x91\x9a\x2c\xf7\x47\xbc\xbb\x42\xb9\x56\x84\xe8\x74\x1b\x48\x5c" "\x32\x97\xcf\x07\xc7\xbd\x98\xd6\x65\x34\x21\xb6\x1f\x70\x1a\x06\xb8" "\x2b\xe0\xfb\xee\xcd\x32\xeb\x00\xfe\xca\x9c\x57\x32\xbb\x5e\x56\x5b" "\xcc\xf8\xc9\xfe\xb2\x7a\x50\x76\x0a\x78\x5b\xbb\x50\x40\x27\x68\xcb" "\xd4\x58\x81\x1e\x28\x4a\x60\x4b\x33\x74\xfa\xf3\x48\x0e\x17\x36\x74" "\x36\x65\x61\x7d\xe9\xc3\x2f\xd1\x0e\x37\x10\x5a\xc6\xdd\x53\x03\xf1" "\xa6\xdc\x78\x95\x0b\xce\x56\x21\x5c\x2a\x2f\x9e\x0c\xcb\xc0\xbf\x9f" "\xe8\xcc\xf7\x64\x7e\xd2\x9e\x2a\xa4\x94\x86\x89\xd6\x81\xa7\xa9\xfe" "\x58\x26\x31\x33\x8f\x3e\xea\x3d\xf8\x46\xf2\x85\x64\x03\x8a\xb7\x5a" "\xa2\xa8\xee\x54\x16\xb6\x6c\xee\xda\x9d\x8f\x56\xec\xef\xe0\x7f\x6a" "\x21\xac\xe8\x3a\x2e\x15\xad\x40\x8d\x0a\x48\x0f\x56\x70\x8e\x3d\x1c" "\x96\x02\x0b\x12\x4c\x58\xf6\xff\x52\x47\xf7\x3a\xff\x7f\x77\xd3\x89" "\x16\x76\x50\xb8\xa0\xb9\x8c\x97\xf8\x7a\x1e\x5d\x6c\x08\xfa\x99\x87" "\x4f\xf1\x44\xbf\xa9\x05\xe9\xda\x38\x12\xf0\x10\xee\xee\x00\xf3\xc9" "\xb5\x94\x45\x0f\xaa\xb5\x34\x2e\x1b\x6e\x98\xfe\xd5\x71\x4a\x80\x2b" "\x67\xb3\xe5\xb1\x96\x4a\x62\x60\x6a\xac\xb8\x22\x2e\xfd\x49\x80\x82" "\x3f\x07\x66\x75\xae\x85\x9e\x64\xde\x7b\x08\xf7\xa0\xb3\xd8\xbc\x82" "\x9e\x1a\x93\xeb\x3b\x49\x75\xb4\x76\x1c\xd7\xfa\x74\x3e\x39\x3d\xa5" "\x37\xc9\x1f\x65\x8e\xa2\xb2\x3c\x94\x24\x44\x98\xcd\xc4\xbc\x32\xc8" "\xb9\x85\x9b\x9d\x97\x92\xee\xab\xdc\xe6\x35\xb2\xd6\x1c\x31\x19\x49" "\x20\x48\x26\x05\x4d\xba\x08\x80\x50\x5e\x2b\x53\xcc\x35\x21\xfa\x8b" "\x68\xbb\xba\x2e\xc0\x50\x50\xbd\x32\x44\xc0\x27\x52\xaf\x15\x55\x62" "\x5d\xdf\x50\xa3\x65\x6c\x00\x43\x00\x5c\x43\xc2\x6a\x2d\xc9\x07\xd5" "\xdd\x67\xef\xa8\x31\xad\x97\x41\x51\x06\x7b\x43\x6a\x75\xfe\x99\xb8" "\xc9\x4c\x9c\xa9\x73\x72\x79\xfa\x1a\xaa\x09\xb0\x10\x8c\x48\xc7\x9c" "\x7e\x4e\xc1\xee\xcc\xfd\x43\xaa\x8e\x7a\xb6\xca\xcf\x5a\x95\x6f\xc4" "\x7d\x4c\xe7\x7f\xe7\x19\xd6\xee\xc1\x73\x0d\x3e\x3b\x3b\xe7\x1d\x31" "\x3f\x64\x41\x77\xb6\xd1\x6d\xf0\x18\x08\x48\xc2\x8b\x85\x0f\xbf\x71" "\x16\x8a\x1e\xe4\xe5\x63\x9b\xc4\x6f\x25\x55\xb3\x98\x4d\xbb\x91\x52" "\x05\x38\xdf\xa6\xa1\x90\x5a\xbf\xb7\x23\x8f\xf3\x44\xd0\xa7\xd7\x60" "\xf0\x40\x71\x8a\x57\xcf\xb5\x66\x34\xe7\xde\x75\x84\x09\x7f\x69\xf8" "\x76\x30\x69\x3b\xcf\x41\x07\x96\x26\x6c\xc3\xf5\x03\x02\xfe\xac\xfb" "\x55\x6b\xad\x25\x06\xb7\x19\x10\x23\x81\x75\x27\xdf\xe5\x97\x31\x01" "\x71\x2b\xda\x92\x24\x72\x07\x66\x33\x13\x3a\x11\xa7\x6e\x8b\xc7\xd7" "\x63\xa2\xcd\xaa\x53\xfa\x8d\x47\xd4\x42\xfc\xc5\x72\xf7\x91\xd6\x6d" "\x10\xd8\xd6\xa9\x05\x8e\xcb\xbc\xd6\xd3\xdb\xe4\x5d\x67\xb7\x5e\x10" "\x91\xdd\x03\x68\xbe\xa3\x3e\xf0\xf5\x6b\xa6\x88\x85\x63\x04\x29\xc2" "\x48\x00\x92\x20\x62\xe1\x06\x6f\x2d\x4c\x4b\x79\x53\x32\xab\x03\x23" "\x95\x48\xdf\x4e\x6e\x01\xc4\x32\xfe\x5e\xb2\x9e\x8e\x63\xf6\xc7\xba" "\x4f\x2e\xde\xfa\x20\x8c\x69\xe7\x81\x78\x6e\x47\x17\xc2\xf7\x1d\xc2" "\x03\x2a\x98\xcf\x1e\x6d\x66\xc1\x08\x31\xe1\x7e\xe7\x76\xed\xc6\xb0" "\x60\xae\x20\xd0\x25\xdc\x57\x0a\x88\xe1\x7d\xa7\x71\xac\xd3\x2b\x7b" "\x93\xd4\x6e\x43\xa9\x17\xb8\xe2\xba\x82\x32\xad\x27\x07\x32\x4b\x9b" "\x04\xdd\x8e\xe5\x0c\x3c\x5a\x43\x72\xc0\xb1\x46\x1a\xb2\xb7\x42\x4f" "\xaf\x00\xc7\x16\x2b\xd8\xe8\xff\xc7\xfa\xdc\xb0\x55\x40\x3b\x0f\xa7" "\x08\x72\x26\xba\x43\x30\xe7\x46\xaf\x97\xa3\xf9\x15\xf0\xb9\xe1\x05" "\x75\x9e\x81\xfe\x94\xa0\xdf\x0c\xd6\xc3\x24\xfb\x0b\x87\x14\x91\xb5" "\x51\x6c\x2f\xbc\x82\xc7\x7b\x07\x15\x9e\x3f\x4c\x0b\x79\x52\xb7\x4c" "\xb4\xe2\x03\xa6\x9f\x24\x14\x85\x19\x1e\x1a\xfc\x76\xd1\x2a\x56\xdb" "\x06\x5b\x05\x13\xa4\x15\x82\xf6\x55\x34\x06\x03\xc7\x3c\xb3\x9b\x72" "\x8c\x97\xd1\xe9\x19\xec\xf9\x63\xb9\x1e\xc2\x28\x2d\x25\xdc\x42\x6d" "\xb8\x73\x39\x40\x55\xbe\xb0\xf9\xba\x20\x54\x5e\x24\x65\xce\x2d\x0d" "\x96\x2f\x42\xe1\xe4\xc7\x9b\xde\xa4\xcd\x28\x29\x26\x9f\xf7\xef\x65" "\x0b\xbe\xb5\x08\x3d\x39\xdc\x7a\xad\x66\x8a\xf0\xb0\x1c\x52\x11\x92" "\xc5\x48\x85\x74\x73\xb2\x99\x91\xf7\xbb\x91\x7b\x58\x14\xfe\x94\x5f" "\x4c\x3e\xd9\xbb\xe0\x56\x3f\x40\x04\xb3\x91\xb7\x68\x60\xe9\xfd\x6b" "\x7c\x0b\xaa\xe8\x2e\x4a\xc0\x33\xf6\x2a\x2c\x6c\xe6\xa2\x31\x1b\x87" "\x00\xb0\x6b\x52\x15\xe6\x04\xa9\xb9\x9d\x37\xe0\x04\x50\xfc\x77\x90" "\xe8\x93\x17\x6e\x9f\xec\xda\x22\x0f\x83\x8a\x07\x8a\x8e\xf7\xda\x7d" "\x49\x9b\x1f\xe0\xeb\x87\x80\xc4\xb9\x70\x5a\x6a\x10\x67\x4e\x61\xb5" "\xc2\x28\xfa\xe1\xc1\x34\x88\xf9\x8c\x10\xc1\x79\x2f\xa4\x02\x29\xdb" "\xa4\x4b\x1c\xb5\x34\xf9\xfa\xb6\xa1\x44\x07\x68\x77\x61\xd7\x38\xc9" "\x1f\x4b\x8d\x43\x71\xa1\xde\x1a\x47\xbd\xe0\x56\x3a\x6f\xc8\x8c\x48" "\x86\xbe\x5d\x48\xc4\xcb\x89\x07\x8c\x25\x5e\xb1\x63\x95\x98\x37\x9d" "\xaf\x50\xa6\x72\xcb\xf4\xd8\xad\xd2\xd4\xaf\x6c\x02\xae\xb1\xd0\xf8" "\x6b\x61\x1a\xbd\x36\x34\x09\xc7\xc7\xfc\x0b\x66\xf3\x07\xad\x3d\xf2" "\x42\x41\xfe\x06\xd0\xf7\x61\x7d\x6c\x39\x87\xbb\x9e\x5d\x8f\x17\x12" "\xae\xbf\x09\x5f\xad\x19\xb3\xb4\xfc\xb9\xcc\x4f\xb3\x90\x12\xf3\x33" "\xc4\xb0\x40\x66\x62\x59\xee\x7b\xc4\x3c\xff\x29\x9a\x52\x7a\x89\x14" "\xd7\x13\x24\xe9\x1c\x77\x4b\x84\xe9\x39\x2e\x61\x54\x53\xe9\xfc\x64" "\x8c\x53\x90\x59\xb6\x6f\x78\x0c\x88\x88\x92\xfe\x8b\x30\xeb\xa7\x99" "\xed\x18\xfa\xb0\x8e\xbc\x3b\x9d\xa8\xbc\x12\xa2\x49\x45\x63\x51\xbc" "\x0e\xba\xfc\x9f\x54\xd5\xd2\x46\x97\xfb\x53\xee\xb5\xe7\x34\x52\x7d" "\x69\x06\x20\x98\x9f\x60\x5f\x57\xdc\x65\xa1\x5a\x75\x4d\x30\x4b\xe5" "\x92\xac\xc6\x16\xcd\x52\x8b\x69\x86\x06\x4b\x44\x57\xb9\x6c\xf1\xfb" "\x0a\xb3\x83\xa0\x58\x5a\xcf\x98\x87\xb1\x8e\x1d\x6d\x3a\xff\x1e\x7f" "\x23\x28\xea\x03\x13\xa2\xb3\x6f\x6f\x79\xd6\x71\xd9\xdd\xc4\xd3\x4f" "\xb8\xfb\x55\xa5\x96\xb2\xa1\x6c\x63\x75\x70\x83\xfb\x4b\xd0\x1b\xe2" "\xe1\xd8\x2e\x47\xc5\xa4\x4e\x05\x22\x79\x09\x7c\x5a\x18\xfe\xae\x98" "\x84\xe1\x02\xcf\x08\x76\x11\xa3\xb9\x44\x67\xad\x61\x63\x5d\xae\x62" "\x75\x97\x4f\x6e\x6c\xa7\xa4\x2d\xed\x0e\xe4\x57\x75\x74\xd5\x6b\x14" "\x28\x53\xa8\xc9\x55\xd9\x2d\x1e\xb7\x80\xde\x11\xdc\x92\x89\xac\xd1" "\x93\x21\x4e\xd4\xc9\xf5\xf2\x6d\x04\x81\xcb\x3c\x0c\x0b\x8d\x4c\x9a" "\xd9\x29\xc6\x1f\xfe\xed\x66\xbf\x2e\x4f\x70\x18\x04\x95\x93\xb9\x93" "\x58\xd9\x35\x59\x84\x7d\x55\x65\x4c\xee\x93\xda\x30\xf6\x57\x8d\x2e" "\x29\x59\x09\x79\x1d\x22\x7a\x12\xc0\x9c\xd4\xa0\xed\xec\x25\xd3\x15" "\x50\x86\xb6\x4a\x78\x79\x97\xa5\x32\x65\xcb\xff\xb7\xfe\x6a\x2b\xfd" "\x58\x9e\x12\xb4\xd0\xe2\x1a\x60\x02\x76\xe9\x20\x39\x78\x88\x44\x35" "\x84\xaa\x99\xa0\x6d\x7c\xfe\xf8\xe6\x8e\xea\xb8\xfa\x73\x9c\x3d\x8f" "\xb7\x45\x81\xce\xff\x29\x51\x10\x74\x2e\x76\x33\x20\xbe\xd3\xa4\xbe" "\x98\x2b\x3e\xbe\xd1\x5e\xcd\xe3\x7e\x84\x9a\xaa\x91\x95\x93\x27\xd2" "\x51\x49\xf3\x88\x54\xea\x11\x37\xf8\x70\xaf\xf9\x99\x79\xe5\xe7\x4c" "\xc9\xe4\x5b\xe1\x2e\x3f\x0f\x99\x12\xa0\x95\x5e\x71\x8a\x49\x17\xe8" "\x35\xbc\xa5\x0f\x43\xce\x92\xa6\xbc\x60\xed\x00\x6b\x8f\x62\x3f\xba" "\xce\xbb\xfb\x3d\xcb\x4f\xab\xd9\x94\x1a\x54\x87\xc6\xf6\x37\xde\x9a" "\x20\x05\xa6\xbc\x40\x62\xe1\x21\x0a\x08\xa5\x1d\x6f\x8a\x5e\x3f\x6f" "\x97\xfe\x90\xdc\x7e\x2e\x21\xd4\xd2\xf0\x38\xc0\xfb\xc1\x91\x8a\xa0" "\x0e\x23\x0a\x4a\x0e\x5c\x41\xa4\x80\x8f\xb9\xa7\x31\x27\x1f\xcc\x1e" "\x73\x71\x3c\x95\x92\xaa\x4b\x2d\xdc\xcd\x0d\x13\xc3\xcb\x68\xd5\x11" "\x66\x62\x31\x53\x44\x5c\x9e\xc9\x55\xc6\x87\x0d\xc8\x54\x3c\x06\x84" "\x88\x31\x86\x08\x2e\x34\xea\x57\x14\xfe\xbf\x8b\x46\x92\x10\x15\xc3" "\x62\x32\x20\xd1\x75\x29\x89\x6e\x1a\x6e\xda\xc6\xe3\x2f\xea\x2b\xa3" "\x0d\xb2\x03\x23\x83\x00\x35\x36\x02\xc1\x7d\xdd\xad\x76\x08\xca\xd8" "\x17\x0b\x52\x0f\x6d\x9d\x32\xcd\xf0\x15\x6a\x1d\xe4\xe9\xb9\xee\xa7" "\x8f\x73\x25\x5d\xdc\x6d\xa6\x99\x4a\x60\x18\xff\x90\x0d\x98\x86\x59" "\x06\x02\xca\x6a\x07\x2d\x8a\xa5\x64\x5e\x2a\xda\xc0\x74\x4e\x2d\x5b" "\x2e\x10\x38\xc7\x46\x63\x5d\x58\x14\x69\x2c\x34\x98\xaa\x90\x43\xb6" "\x8f\x8c\xe7\x9c\x44\x67\x8c\x5a\x7d\x5b\xc2\x6c\x08\x54\x75\x85\x3b" "\x22\x9b\x2a\xf3\xdc\x82\x2e\xc5\x80\x47\xf3\x13\xc7\x78\xaa\xe2\xb6" "\x49\x95\x14\x81\x74\xe4\x29\x08\xf3\xec\xac\xd3\x92\x18\x55\x79\x0c" "\x0c\x5a\x25\x81\x44\x16\x93\x02\x93\x01\x0b\x4f\x91\x79\x79\xd8\x37" "\xf4\xef\x9d\x2d\x6d\xce\x80\x4f\x5c\x09\x26\x24\x40\x97\x74\x62\x52" "\x12\x4a\x6e\x00\x55\x55\x9f\xfa\xb1\x97\xc3\x87\x78\xf7\x17\x36\x21" "\x52\xaf\x8f\x6d\xbf\x7e\xe0\x3d\xf0\x50\xab\x9b\x89\x09\x55\x66\x91" "\xc2\xc2\x77\x5f\x0f\x9c\x26\xa5\x45\xdb\x7b\xa6\x98\xa4\xce\x37\xde" "\x87\x77\x05\xea\x97\xac\x0a\x00\x2d\xb2\x74\xea\x83\x60\xa4\xaa\x73" "\x2c\x2d\x5e\x74\x17\x13\x8c\x60\xcb\xea\x69\xd3\xb4\x99\x3a\xda\x6a" "\x9d\x8f\x51\xd8\x51\x54\x3a\x65\x00\xa3\x1b\xac\x5a\x05\x7d\xbe\xf4" "\x98\x00\x1f\x08\xa4\x4e\x3c\x41\x41\x90\x0e\x18\xb6\xd7\x3c\x28\xc8" "\xc6\x7d\xca\x80\x5e\xde\xb5\x37\x63\x84\xce\xfe\x75\xbe\x1f\x12\x72" "\x25\xe4\xd9\x72\x4b\x70\x47\xd6\x8f\xa2\xed\x46\x29\xe9\x17\x11\xa3" "\x7c\x80\x15\x8a\x07\xdb\xce\x78\x91\x89\x31\x40\x2b\x47\x2a\x98\xa5" "\xd5\xc6\xb6\x6a\x2d\x11\x63\x14\x57\x7e\x94\x29\x8c\x37\xbc\x44\x14" "\x99\xa9\xec\xea\x13\x2d\x87\xc5\xd3\x05\xa0\xf8\xf0\xb3\xed\x16\xf3" "\xb8\x20\x94\x10\x82\xc7\x3b\x28\x39\x1d\x84\x82\xca\x0c\xfa\x78\xe1" "\xe0\x9a\xa5\x88\xb0\xeb\x18\x49\xc6\xc7\x91\x6a\x6b\xbe\x56\x13\x4a" "\x6b\xd9\x3e\xa3\x06\xde\xc1\x25\x98\x26\x28\xde\xa1\xdb\x6d\x02\x2d" "\x21\x06\x27\x95\x9e\x1d\xc8\x19\xc8\x41\xf1\x73\xed\x25\xf3\x56\x90" "\x92\x22\xe4\x81\xa1\xeb\xb3\x11\x85\xfb\xae\xac\xbd\x35\x9d\x27\x79" "\xef\xe4\x55\x4c\xcd\xac\x7f\x4b\xcc\x52\x8f\x65\x6a\x45\x04\x93\x31" "\xe1\x6e\x9c\x0c\x79\x64\x23\xec\x9c\x7c\xba\x15\xc6\x9d\x4a\x8a\x77" "\x41\x69\x99\x10\xf3\x3c\xc9\x79\x8a\x8b\xf1\xe4\x81\x82\xf0\x80\x29" "\xa1\x4d\x01\x31\x65\x4f\xd3\x88\x22\x5d\x75\x09\xe1\xd7\xa4\x84\xe9" "\xc7\xdf\x34\xd1\x68\x0b\xfc\x6b\x8d\x1f\x6f\x39\x20\xcc\x41\x13\x50" "\x9f\xe4\x2d\xfb\xd6\xb2\x61\x00\x0d\xa9\x65\x1f\x7e\x18\x08\x8f\x6c" "\x25\x64\x47\x20\x46\xe5\xeb\x7e\x8c\x9f\x8b\x52\x86\xa7\x45\x27\x41" "\xa7\x10\x3c\xed\x71\x0b\xfb\x8e\x69\x9f\xb8\xb1\xa8\x5c\x0a\xe8\x87" "\xcc\x06\xef\x2f\xf9\xe2\xa2\xb1\xa7\x7b\xb4\xd4\x4d\xdd\x4a\x4e\x1b" "\xa6\x0a\xfc\xb9\x2b\xaa\xef\x10\x8b\x60\x48\x6d\x40\x98\x89\xcb\xb2" "\xb1\xcc\x77\xdd\xff\x7e\x4b\x6c\xaf\x8c\xf3\x48\x87\x64\xd8\x4b\xf3" "\x60\x5e\xb9\xdf\x70\x9a\xc6\xcb\x36\xd1\xa3\xde\x89\xcd\xd6\x65\x7f" "\x0e\x6b\x40\x09\xe6\xda\xc5\xd9\xbe\x14\xf4\xed\x99\x7c\xf6\x1e\x5a" "\xae\xc9\x32\x52\x0c\x32\x13\x59\xcf\x28\x6a\xdf\x6e\x2d\xc3\x09\x47" "\x94\xae\x61\xa4\xf1\x60\x89\xd0\x6e\x3d\xc6\x2c\x95\x89\x50\xe7\x32" "\x13\xc1\xe8\x65\xc8\x94\xfe\x7b\x8a\x30\xde\x65\xf5\x53\x4a\x1e\x9c" "\x5d\x19\xed\x49\x39\x79\x80\x12\x63\x22\xcb\x9c\x72\xc4\x6a\x86\xd7" "\x48\x75\x71\x30\x0d\x85\xb3\xb5\x66\x15\x55\xf2\x0a\xb6\x3a\x78\xf8" "\x46\xc1\xb8\xf5\x1a\x19\x61\x0a\x11\xff\xee\x44\xf7\xcc\xf0\xf1\xd6" "\x7f\x41\x48\xb2\xc8\x28\xd7\x4c\x7f\x39\x93\x96\x5c\x90\x67\x11\x44" "\x67\xa7\x1d\x24\x21\x13\xa6\x85\x74\xe2\x86\x01\xfc\xe3\x43\xa0\x23" "\xec\xc6\x8a\x72\xd7\x52\x59\xf9\xa5\xdc\xe1\x44\xa7\xf6\x1e\xf3\x27" "\x19\x2f\x64\x74\xd2\xbb\xd0\x6f\xde\x30\x49\xfe\x7f\xb3\x06\xba\x3f" "\x54\x33\x70\x08\xd7\xdb\xde\xaf\x28\xa3\x7a\x22\x4e\x38\xad\xe2\x3a" "\xdb\x07\x6c\xef\xd3\x14\x8e\xfc\xb6\x25\x39\xa9\x6d\x4d\xfc\x53\xf3" "\x69\xe3\x4c\x3d\x49\x3a\xc3\xa5\xe8\xc8\x88\x11\x33\xbe\x63\x0a\x2a" "\x90\x67\x03\xda\x62\xce\x7c\xc0\x2a\xce\x9f\x66\x6d\x6c\x3d\x4b\x97" "\x63\xa8\x35\x48\x82\x5e\xe1\xef\xb5\x4e\xe3\x47\x5b\x09\xe2\x61\x6c" "\x5b\xdd\xe3\xd1\x93\x18\x1b\xf0\x20\xe8\xac\x9a\xc2\x5f\x32\x60\x4b" "\x6c\x11\xde\x8a\xd1\xa1\x5b\x9f\x90\x8c\x6d\x7e\x79\x18\x1a\xad\x1d" "\x74\x1b\x74\x34\xaa\x92\x59\x7a\x83\x5c\x53\xb9\xe4\xb6\x1d\x60\x69" "\xfa\x4e\xe9\x21\x82\x4d\x17\xc9\x87\x84\xa8\xc0\x45\x90\xf8\xd2\xcf" "\x87\x76\x62\xb4\x10\xca\xe4\xeb\xd1\xba\x36\x16\x07\x4c\x02\x0d\x8c" "\xb6\x09\x9a\x09\x57\x35\x63\x54\x90\xd3\x18\x82\x13\x10\xdd\xd0\x16" "\x15\x0e\xdb\x80\x37\x0b\x8d\x4e\x2f\x05\x55\x7f\xd6\x19\xb1\x71\x92" "\xc1\x33\x53\xcd\xae\x76\xd4\x95\x82\x1c\x61\x0c\x86\x41\xe5\xb3\xdf" "\xf1\xe7\xf2\xea\x77\xb1\x78\x10\xca\x79\x75\xb8\xe3\x6b\x7f\x50\x1a" "\x87\x10\xb3\x26\xef\x92\x67\x20\x96\xef\x66\x59\x85\x10\x90\x2f\xe6" "\x63\xe2\xa9\xef\x00\xc3\xa0\x52\xf1\xcf\xb1\x73\x9f\xcc\xb4\x37\x1f" "\x8f\x28\xbb\x92\x65\x4d\xe5\xbf\x87\xcc\x28\x63\xe9\x2e\x6d\x7e\x4b" "\x45\xd7\x73\xf9\x0f\x43\x4e\xaf\xc8\xf8\x39\x8a\x48\x52\x7a\xf8\x29" "\xa6\xca\xe3\x59\xe7\xaf\x59\x41\xbe\xf1\x58\xf5\x37\x98\x05\x83\x51" "\x10\x7c\xe5\x8f\x79\xed\x21\x03\x67\x70\xf6\xe1\x0e\x7d\xa9\x2b\xbc" "\xa2\x5f\x36\x9e\xe8\x3a\x0f\x89\x4b\xbf\x36\x6a\x13\x61\xf8\x12\x5b" "\x4f\xfd\x8e\x8b\x4d\x47\xec\x68\xcd\x6b\x37\xc8\x40\xcc\x5b\xeb\x8c" "\xf6\x5b\x22\x69\xea\x1a\x0e\x9c\x37\x1a\x57\x1f\x30\x45\x8f\xf8\xad" "\x9b\xbf\x87\x23\xc1\x9d\xda\xe1\xde\x5c\xa7\x46\x1a\x43\x6f\xfc\xd1" "\x03\xc0\x1a\x20\xf3\x25\x2b\xa0\x96\x5e\xe9\x28\xcf\xb0\xd0\x02\xb9" "\xaa\x4d\x4f\x20\xc8\x05\xb7\x7e\x67\xc8\xd9\x91\xc4\xd0\x7e\x54\x19" "\xbe\xc9\x62\x6a\x32\xc1\x15\xd2\x82\x53\xdd\x5f\x16\xc1\x71\x82\xc1" "\x77\x9e\xdf\x49\xbd\xfe\x38\x23\xd8\x7f\xec\x88\x92\x98\x01\x16\x3a" "\x27\xbf\xae\xdd\xfd\x8c\xdc\xca\xe8\xcc\x3b\xfd\x6a\x9f\x2e\x2f\xec" "\x59\x71\xfa\x56\x0c\x43\x4d\xeb\xd4\x34\xff\x4d\x00\x58\xdc\xb0\x5d" "\x9f\x3a\xc5\x19\x3c\x45\x84\x72\xd6\xd1\x68\x5f\x9f\x46\xc8\x86\x49" "\x00\xc5\xed\xba\xee\xee\x08\x97\x1e\xe1\xc0\x87\xf2\xe1\x14\x67\xff" "\x47\x66\x74\x3b\xcc\xf9\xe3\x41\x4f\xee\xdd\x6d\xcb\x90\x4b\x92\xa0" "\x5e\xec\x5d\xe8\xdb\x95\x44\x4b\x92\x0c\x99\x5c\x77\x0e\xdc\xed\xcf" "\x7b\xff\xc4\x88\x36\xc8\xf3\x00\x37\xdd\xe4\x7f\x0e\x66\xfd\x79\x55" "\x0d\xe0\xeb\xc3\xc0\xc3\xeb\xa0\xb6\x6e\x2a\x35\x35\x42\xee\xb2\x03" "\x97\x80\x0e\x5f\x41\x63\x5c\x5e\xc2\xf9\xa2\x71\x46\x1b\xce\xe8\xe5" "\x70\xdd\xf9\x45\xb1\x86\xf1\x5a\xb5\xca\xbe\x2a\x31\x23\x18\x99\x35" "\xc6\xb9\x01\x0b\x31\x73\x2c\x42\x5a\x9b\x25\x82\xb0\x97\x48\x6a\x5a" "\x7b\x18\x80\xb2\xf1\x61\x04\x48\x4e\x1c\xa8\x3f\xa9\xc2\x78\xb8\x7e" "\x30\xe4\xb0\xcf\x6e\xd6\x6c\x87\xa9\x79\xc0\x56\x83\xac\x94\xa2\x95" "\xd1\xc5\x3e\x6f\x09\x75\xa0\x79\xdd\x9a\x28\x25\xfd\xd6\xae\x09\x26" "\xba\x1a\x69\xf3\xf6\x9f\x40\x8e\xea\x9d\x00\xfb\xd4\x32\x35\xa5\x2c" "\x53\xd1\x19\x63\xa6\x11\xb8\x1d\xd9\xf5\xe0\x55\x82\xe1\x82\x23\x98" "\x87\x3e\x88\x36\x62\xa6\x4c\x22\x5b\xe1\x9e\x0b\x85\xe1\x02\xe2\x3f" "\xb7\x3d\x5d\xcb\x11\x43\x5a\x54\x37\xd7\x41\x8b\x04\x09\xf2\xe6\x07" "\x93\x03\x8f\x55\xed\x54\xc7\x98\x82\xb3\xa1\x7e\x74\xae\x21\x48\xbd" "\x55\x8d\x13\x1d\xbf\x44\x6e\xde\xb0\xd0\x53\x53\x49\x25\x34\xe2\x16" "\x76\x1c\xfc\xf6\x58\x2d\x06\x6a\x82\x35\xa2\xbd\x5e\xb3\x83\x35\x0a" "\x52\xd7\xfc\x27\x61\x51\x4e\x27\xb6\x12\x5c\xb3\xe3\x87\xc1\x03\xdd" "\x62\xe3\x1f\x5b\x78\x9c\x21\x78\x11\xc8\x0c\xcb\xe3\xf1\x0f\xec\x7a" "\x19\xad\x32\xdc\x92\x71\x36\x8b\x6d\x6b\xa5\x49\xc4\x5d\xfd\x80\x18" "\x50\x7c\x40\x96\x2b\x6a\xc6\x46\x8c\x30\x78\xed\xb7\x1d\x8e\xc7\xf7" "\x28\xbe\x8c\xc2\x3d\xea\x11\x39\xac\x30\xc2\xe8\xd0\xfc\x07\x72\x80" "\xe4\x20\xfb\xbf\xfc\x89\x68\x63\xdb\x5f\x1e\x76\x92\x2d\x7d\xd8\xe4" "\x47\x9c\x1b\xe8\x22\xe7\x42\x12\xc6\xf7\x47\x65\xe1\x08\xf9\x16\xa1" "\xb8\x3f\x6e\xfc\x8e\xa5\x40\x80\xe9\xa2\x8b\x1b\xa5\x81\x3a\x1f\xef" "\xdd\xbe\x2d\x0c\xda\x41\x3e\xe1\x46\x39\x85\xb5\x1b\x59\xf8\x18\xf4" "\x40\xc9\xb6\xa1\x0e\x4e\xbf\x71\xd3\x79\x95\xae\x96\x94\xba\x58\x67" "\xca\x2e\xb2\xf7\xbf\x4e\x58\xd2\x61\x49\xf2\xb2\x59\x43\xfb\xa2\x16" "\xbe\xb3\xde\x1f\x95\x4b\xcf\x1b\xd3\x2c\xe3\x58\xb5\xd2\x30\x23\xab" "\x45\x6e\xbb\xc4\x93\xea\xd4\x1e\x25\xb6\x2b\x5b\x4a\xce\x6c\x5c\x18" "\xc9\xa8\xd5\x12\xa9\xcb\xb4\xdd\x59\xf3\x36\x63\xf6\x13\x8d\x6b\x06" "\xbc\x8e\xb1\xec\x9c\xac\xcc\x00\x77\xb2\xe6\x8e\x7a\x09\xd4\x12\xdf" "\xa3\x52\xe7\xe5\xc3\x94\x2b\x71\x0a\xb1\x64\x8e\x16\xd0\xad\xda\x42" "\x4d\x9f\xc2\xd1\x5c\x61\x9f\x4e\x80\x93\xc2\xb9\x52\x1e\x4c\xdb\x3f" "\x22\xe6\x55\xf5\x2c\xe0\xfc\xc1\xbf\xd9\x4e\x56\xcb\xa8\xde\xca\xdb" "\x68\x21\x44\x51\xbe\x53\xf9\x28\x6c\x82\xd2\xa4\x91\x2b\xd2\x39\x4d" "\x11\x33\xbe\x90\x84\x09\xd7\x91\xd6\xd8\xc2\x19\x4c\xa3\x7a\x76\xa3" "\x8d\x6d\x0a\x1f\xce\xd6\x47\x88\x48\x89\x1d\x92\x64\xcf\xc0\x8f\xa8" "\x49\xd7\x20\x33\x9c\xe0\x09\x77\xca\xd8\xd9\x73\x83\x72\x18\x40\x98" "\xa7\x33\x3d\xd1\x56\x4d\x1d\x77\x54\xb4\xaa\x4a\xfd\x62\x17\x58\x58" "\x04\x15\x9d\x31\xf5\x30\x17\x86\x9c\xb7\x8b\x71\x8c\x83\x7b\x7f\xd1" "\x76\xce\x19\xe3\xd6\x99\x6b\x6f\x05\x5e\xd3\xba\x7c\xd5\x5b\x03\x49" "\x67\x6c\x0c\x11\x3c\x33\xd0\x70\x08\x1c\xe4\xef\x29\xaf\x15\x6c\x4a" "\xc8\xce\x76\x00\x13\x68\x8d\x02\x95\xd9\x02\x71\xe2\x3e\xf3\xca\x10" "\xec\x2b\x3b\x88\x98\x55\xa1\x53\xc8\x67\xce\x79\x29\x7a\x10\xa0\x2d" "\x21\xe5\xe8\x99\x5f\xbc\x10\xd2\xf4\xd4\xbf\x52\x15\x65\x37\x60\x53" "\xb8\x09\x37\xbf\xaf\xaa\xc6\x88\x10\x8f\x99\x62\xb7\xc7\x2c\xf0\x11" "\x18\x74\xac\x8a\xe2\x7d\x02\x4e\xe2\xf9\xd5\x7f\x15\xb9\x91\x0a\x74" "\x86\xef\x75\x42\xc6\x62\x9f\xb0\x52\x0c\x93\xa4\x45\x54\x2d", 8192); *(uint64_t*)0x200002c0 = 0; *(uint64_t*)0x200002c8 = 0; *(uint64_t*)0x200002d0 = 0; *(uint64_t*)0x200002d8 = 0; *(uint64_t*)0x200002e0 = 0; *(uint64_t*)0x200002e8 = 0; *(uint64_t*)0x200002f0 = 0; *(uint64_t*)0x200002f8 = 0; *(uint64_t*)0x20000300 = 0; *(uint64_t*)0x20000308 = 0x20000940; *(uint32_t*)0x20000940 = 0x20; *(uint32_t*)0x20000944 = 0; *(uint64_t*)0x20000948 = 0; *(uint64_t*)0x20000950 = 0; *(uint32_t*)0x20000958 = 0; *(uint32_t*)0x2000095c = 0; *(uint64_t*)0x20000310 = 0; *(uint64_t*)0x20000318 = 0; *(uint64_t*)0x20000320 = 0; *(uint64_t*)0x20000328 = 0; *(uint64_t*)0x20000330 = 0; *(uint64_t*)0x20000338 = 0; syz_fuse_handle_req(r[1], 0x200021c0, 0x2000, 0x200002c0); break; case 6: memcpy((void*)0x20000180, "./file0\000", 8); res = syscall(__NR_openat, 0xffffff9c, 0x20000180ul, 0x24c01ul, 0ul); if (res != -1) r[3] = res; break; case 7: syz_fuse_handle_req(r[1], 0, 0, 0); break; case 8: memcpy((void*)0x20000000, "./file0\000", 8); memcpy((void*)0x20000040, "9p\000", 3); memcpy((void*)0x20000080, "trans=fd,", 9); memcpy((void*)0x20000089, "rfdno", 5); *(uint8_t*)0x2000008e = 0x3d; sprintf((char*)0x2000008f, "0x%016llx", (long long)r[0]); *(uint8_t*)0x200000a1 = 0x2c; memcpy((void*)0x200000a2, "wfdno", 5); *(uint8_t*)0x200000a7 = 0x3d; sprintf((char*)0x200000a8, "0x%016llx", (long long)r[3]); *(uint8_t*)0x200000ba = 0x2c; *(uint8_t*)0x200000bb = 0; syscall(__NR_mount, 0ul, 0x20000000ul, 0x20000040ul, 0ul, 0x20000080ul); break; } } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; }