// https://syzkaller.appspot.com/bug?id=0e634623108ac273135510bb2ec155416d178137 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } #define MAX_FDS 30 static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } if (symlink("/dev/binderfs", "./binderfs")) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } setup_binderfs(); loop(); exit(1); } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } #define FUSE_MIN_READ_BUFFER 8192 enum fuse_opcode { FUSE_LOOKUP = 1, FUSE_FORGET = 2, FUSE_GETATTR = 3, FUSE_SETATTR = 4, FUSE_READLINK = 5, FUSE_SYMLINK = 6, FUSE_MKNOD = 8, FUSE_MKDIR = 9, FUSE_UNLINK = 10, FUSE_RMDIR = 11, FUSE_RENAME = 12, FUSE_LINK = 13, FUSE_OPEN = 14, FUSE_READ = 15, FUSE_WRITE = 16, FUSE_STATFS = 17, FUSE_RELEASE = 18, FUSE_FSYNC = 20, FUSE_SETXATTR = 21, FUSE_GETXATTR = 22, FUSE_LISTXATTR = 23, FUSE_REMOVEXATTR = 24, FUSE_FLUSH = 25, FUSE_INIT = 26, FUSE_OPENDIR = 27, FUSE_READDIR = 28, FUSE_RELEASEDIR = 29, FUSE_FSYNCDIR = 30, FUSE_GETLK = 31, FUSE_SETLK = 32, FUSE_SETLKW = 33, FUSE_ACCESS = 34, FUSE_CREATE = 35, FUSE_INTERRUPT = 36, FUSE_BMAP = 37, FUSE_DESTROY = 38, FUSE_IOCTL = 39, FUSE_POLL = 40, FUSE_NOTIFY_REPLY = 41, FUSE_BATCH_FORGET = 42, FUSE_FALLOCATE = 43, FUSE_READDIRPLUS = 44, FUSE_RENAME2 = 45, FUSE_LSEEK = 46, FUSE_COPY_FILE_RANGE = 47, FUSE_SETUPMAPPING = 48, FUSE_REMOVEMAPPING = 49, CUSE_INIT = 4096, CUSE_INIT_BSWAP_RESERVED = 1048576, FUSE_INIT_BSWAP_RESERVED = 436207616, }; struct fuse_in_header { uint32_t len; uint32_t opcode; uint64_t unique; uint64_t nodeid; uint32_t uid; uint32_t gid; uint32_t pid; uint32_t padding; }; struct fuse_out_header { uint32_t len; uint32_t error; uint64_t unique; }; struct syz_fuse_req_out { struct fuse_out_header* init; struct fuse_out_header* lseek; struct fuse_out_header* bmap; struct fuse_out_header* poll; struct fuse_out_header* getxattr; struct fuse_out_header* lk; struct fuse_out_header* statfs; struct fuse_out_header* write; struct fuse_out_header* read; struct fuse_out_header* open; struct fuse_out_header* attr; struct fuse_out_header* entry; struct fuse_out_header* dirent; struct fuse_out_header* direntplus; struct fuse_out_header* create_open; struct fuse_out_header* ioctl; }; static int fuse_send_response(int fd, const struct fuse_in_header* in_hdr, struct fuse_out_header* out_hdr) { if (!out_hdr) { return -1; } out_hdr->unique = in_hdr->unique; if (write(fd, out_hdr, out_hdr->len) == -1) { return -1; } return 0; } static volatile long syz_fuse_handle_req(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3; struct fuse_out_header* out_hdr = NULL; char* buf = (char*)a1; int buf_len = (int)a2; int fd = (int)a0; if (!req_out) { return -1; } if (buf_len < FUSE_MIN_READ_BUFFER) { return -1; } int ret = read(fd, buf, buf_len); if (ret == -1) { return -1; } if ((size_t)ret < sizeof(struct fuse_in_header)) { return -1; } const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf; if (in_hdr->len > (uint32_t)ret) { return -1; } switch (in_hdr->opcode) { case FUSE_GETATTR: case FUSE_SETATTR: out_hdr = req_out->attr; break; case FUSE_LOOKUP: case FUSE_SYMLINK: case FUSE_LINK: case FUSE_MKNOD: case FUSE_MKDIR: out_hdr = req_out->entry; break; case FUSE_OPEN: case FUSE_OPENDIR: out_hdr = req_out->open; break; case FUSE_STATFS: out_hdr = req_out->statfs; break; case FUSE_RMDIR: case FUSE_RENAME: case FUSE_RENAME2: case FUSE_FALLOCATE: case FUSE_SETXATTR: case FUSE_REMOVEXATTR: case FUSE_FSYNCDIR: case FUSE_FSYNC: case FUSE_SETLKW: case FUSE_SETLK: case FUSE_ACCESS: case FUSE_FLUSH: case FUSE_RELEASE: case FUSE_RELEASEDIR: case FUSE_UNLINK: case FUSE_DESTROY: out_hdr = req_out->init; if (!out_hdr) { return -1; } out_hdr->len = sizeof(struct fuse_out_header); break; case FUSE_READ: out_hdr = req_out->read; break; case FUSE_READDIR: out_hdr = req_out->dirent; break; case FUSE_READDIRPLUS: out_hdr = req_out->direntplus; break; case FUSE_INIT: out_hdr = req_out->init; break; case FUSE_LSEEK: out_hdr = req_out->lseek; break; case FUSE_GETLK: out_hdr = req_out->lk; break; case FUSE_BMAP: out_hdr = req_out->bmap; break; case FUSE_POLL: out_hdr = req_out->poll; break; case FUSE_GETXATTR: case FUSE_LISTXATTR: out_hdr = req_out->getxattr; break; case FUSE_WRITE: case FUSE_COPY_FILE_RANGE: out_hdr = req_out->write; break; case FUSE_FORGET: case FUSE_BATCH_FORGET: return 0; case FUSE_CREATE: out_hdr = req_out->create_open; break; case FUSE_IOCTL: out_hdr = req_out->ioctl; break; default: return -1; } return fuse_send_response(fd, in_hdr, out_hdr); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void loop(void) { int i, call, thread; for (call = 0; call < 9; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); close_fds(); } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: memcpy((void*)0x200007c0, "./file0\000", 8); syscall(__NR_mknodat, 0xffffff9c, 0x200007c0ul, 0ul, 0); break; case 1: memcpy((void*)0x200001c0, "fd", 2); *(uint8_t*)0x200001c2 = 0x3d; sprintf((char*)0x200001c3, "0x%016llx", (long long)-1); *(uint8_t*)0x200001d5 = 0x2c; memcpy((void*)0x200001d6, "rootmode", 8); *(uint8_t*)0x200001de = 0x3d; sprintf((char*)0x200001df, "%023llo", (long long)0); *(uint8_t*)0x200001f6 = 0x2c; memcpy((void*)0x200001f7, "user_id", 7); *(uint8_t*)0x200001fe = 0x3d; sprintf((char*)0x200001ff, "%020llu", (long long)0); *(uint8_t*)0x20000213 = 0x2c; memcpy((void*)0x20000214, "group_id", 8); *(uint8_t*)0x2000021c = 0x3d; sprintf((char*)0x2000021d, "%020llu", (long long)0); *(uint8_t*)0x20000231 = 0x2c; *(uint8_t*)0x20000232 = 0; syscall(__NR_mount, 0ul, 0ul, 0ul, 0ul, 0x200001c0ul); break; case 2: memcpy((void*)0x20000100, "/dev/fuse\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000100ul, 2ul, 0ul); if (res != -1) r[0] = res; break; case 3: memcpy((void*)0x20000140, "./file0\000", 8); memcpy((void*)0x20000040, "fuse\000", 5); memcpy((void*)0x20000180, "fd=", 3); sprintf((char*)0x20000183, "%020llu", (long long)r[0]); memcpy((void*)0x20000197, "\x2c\x72\x6f\x6f\x74\x6d\x6f\x64\x65\x3d\x30\x30\x30\x30\x30\x30" "\x30\x30\x30\x30\x30\x30\x61\x30\xfc\x2a\xef\xed\x2e\x3d\xff\x1f" "\xaa\x63\x75\x73\x65\x72\x5f\x69\x64", 41); syscall(__NR_mount, 0x20000000ul, 0x20000140ul, 0x20000040ul, 0ul, 0x20000180ul); break; case 4: memcpy((void*)0x20000300, ".\000", 2); res = syscall(__NR_open, 0x20000300ul, 0ul, 0ul); if (res != -1) r[1] = res; break; case 5: memcpy((void*)0x20000340, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)" "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$" "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>" "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); memcpy((void*)0x20000140, "./file0/file0\000", 14); syscall(__NR_symlinkat, 0x20000340ul, r[1], 0x20000140ul); break; case 6: memcpy((void*)0x20000280, "./file0\000", 8); syscall(__NR_openat, r[1], 0x20000280ul, 0x80ul, 0x10ul); break; case 7: memcpy( (void*)0x200054c0, "\x97\x32\xf9\xc3\xdd\x21\xa8\xd3\xa6\x9e\xae\xf9\xbc\x39\xce\x78\xdf" "\x77\x8b\x0b\x94\xcf\xbd\xd0\x9b\x89\xf8\x54\x7a\xb5\x15\x1b\xdc\x51" "\xb7\x4b\x86\x1f\x79\x67\xf8\x80\x86\x49\x4e\x76\xeb\x12\xd2\xdc\x9e" "\x7e\x87\x6f\xee\xa5\x3c\x14\x4c\xf4\xb2\x1c\xdb\x6a\xa4\x84\x64\xbf" "\x05\x15\x8d\x2c\xc9\x92\xed\x6a\x7d\x59\x58\x2c\x82\x05\x9e\x2f\x6d" "\xfa\xd6\x35\xff\x7f\xcb\xee\x2b\x23\xec\x7a\x6e\x8d\x7a\x4a\x6c\x57" "\x2f\x9d\xd3\xab\x73\xfe\x6e\x5a\x8e\x6f\xb9\x59\x16\x35\xf7\x03\x6e" "\x04\x07\x40\xb0\x15\xbc\x56\x45\x48\x19\xe3\x50\x9b\x49\xbd\x30\x93" "\x0e\x24\x3b\x5c\xdf\x87\x9d\xc9\x58\xc6\xa6\xac\x83\x5d\x96\x2d\xff" "\x86\x83\x90\x58\xb8\x63\x54\x94\x22\x9e\x17\x59\x99\xe5\x70\xe9\x25" "\x43\x60\xb7\xf0\xea\x71\x4c\x1d\xd8\xfd\x6f\xf9\xbc\x9b\x59\x63\xb8" "\x33\xad\x38\xc6\x71\x16\xe0\x7d\x6b\xad\x6e\x7c\x05\x9f\x82\x22\xef" "\xb8\xb8\xc2\xd8\x38\xdf\x33\xf7\x0a\x1b\xf6\xd6\xcc\xfe\xbd\x9c\x2d" "\x6e\x2f\xf7\xba\xec\x97\x68\xfd\x1b\x1c\x6f\xd8\xcc\x17\x96\x29\xe4" "\x92\x48\x74\xdf\x45\x87\x0d\x93\xa4\x58\x23\x5b\xea\xf2\x27\x08\x9b" "\x45\xb1\x4c\x39\xc7\x21\x32\x2a\xa9\xbf\xba\x20\x4c\x59\x65\x94\x98" "\x8b\xe2\x6e\x4f\x0e\x4e\x0b\x84\x84\x9b\xec\x6d\xc6\x10\xf6\x2a\xfe" "\xd5\xde\x44\x7f\x32\x69\x1e\xc4\x70\x9d\x27\x3f\x49\xd2\x01\xa4\x27" "\x6e\x37\xd9\x70\x67\x7e\x10\x8e\x7e\xb3\xdb\x6f\x26\x8b\x48\xe6\x8d" "\x09\x95\x13\x04\x09\x06\x56\xb2\x20\x32\xce\x3b\xbe\x37\x68\xf9\x09" "\xdc\xd1\x98\xd6\x22\x42\x83\xfc\x4b\xef\x07\x19\x13\x43\x19\x4b\x4e" "\xad\xad\xfa\x3f\xa3\xd2\xd5\xa1\xfb\x93\x1a\xcd\xde\xe4\xab\x1f\x40" "\x91\x87\x52\xd7\xee\xa0\xc4\xa3\xbe\x04\xf7\xab\x35\xfe\x38\xd3\x1b" "\x99\x4e\xa3\x63\xfc\x6e\xa5\xab\xef\x76\x05\xaa\x12\x99\x67\x07\x8c" "\x05\xc4\xa4\xb4\xa7\x03\x1b\x33\xb5\x51\x7b\xaa\x6a\x96\x8b\x8b\xd5" "\xe6\x2c\xab\x9a\xba\xb4\xe8\x66\xc8\x5a\x18\xaa\x0d\xe2\xb3\xfb\xac" "\xd1\x0f\x7d\x9b\xfa\x25\x49\x05\x1d\x35\xef\xc0\x0b\xf9\x21\x39\x09" "\x56\x2e\x9a\x05\xe7\xa6\x40\xd1\x28\xca\x28\x6e\x47\xef\x87\xd7\x10" "\xd0\x50\x3c\x9c\xfb\x3a\xdf\xe5\x7c\x62\x4e\x83\xfc\x79\x21\x3f\x0f" "\xb1\x37\x53\xc6\x8c\x1b\x97\xef\x0d\x0b\xf1\xdb\xea\x1f\x43\x5f\x61" "\xb5\x37\xb7\xd0\xbe\xd3\x93\x29\xdb\x03\x52\x19\x86\x30\xd7\x2e\xe5" "\x76\x67\xae\x9f\xe4\x22\xe1\x7c\x89\x8a\xe4\xbb\xe8\xc1\xc0\x39\x01" "\xa4\x57\x12\x16\x28\x90\x87\x94\xc1\x65\x48\x60\xd6\x8a\xb5\xfc\x5c" "\xe8\x8d\x78\x9b\x8d\x83\xec\x6f\x86\xcc\x14\x5d\x76\x11\x73\x70\x90" "\xba\x20\x16\xab\x62\xec\xac\x31\x88\xa5\xa6\xc3\x2d\xac\x96\xb2\x29" "\xb9\x50\x84\x7c\xb4\x28\x9a\xf6\xff\x38\xce\x92\xd2\xf0\x31\x2b\xd7" "\x2b\x85\xa5\x3e\x75\xd0\x3b\x40\x36\x19\x67\xe7\x91\x9e\x4e\xad\x1b" "\x0b\x7e\x48\x84\x38\xf8\x4c\x8b\xb7\x17\x70\x6c\x84\x2a\x6b\xcb\x99" "\xa7\x8a\x07\xd8\x20\x3d\x17\xb0\xb6\x91\xe0\x95\x2a\xbd\x6e\x27\x79" "\x58\xad\x9b\x98\x16\x19\x4a\x0f\x4f\x73\xda\xc5\xaf\x27\x27\x93\xd1" "\x1f\xf2\x2e\x22\x0e\xff\x30\x9d\x38\x53\x80\xe9\xa4\x41\xcc\x8a\x0a" "\xa1\xd4\x57\xce\x86\x34\x23\x76\xe1\x13\xc7\x70\xd9\xab\xb6\x5f\x6f" "\xaa\x40\x69\x0b\x0b\xb3\x7e\x5f\x3a\x15\x39\x5e\xc5\x12\x3a\xd1\x4f" "\xc6\xac\x73\xe3\x1f\xca\xf7\xdb\x1b\xe5\xfb\xbb\x7c\x6b\x2b\xe4\xb7" "\x97\x6e\x1a\x95\x62\xa2\xe7\x63\x43\x13\x90\x4d\x09\x80\x09\x7a\xf8" "\x73\x05\xcc\x76\x65\xa3\x74\x31\xd4\x7d\xf5\x17\x1f\x4b\xd6\x33\x4a" "\xd2\x02\x55\x90\xcd\x2e\xcc\x50\xc4\x35\x66\x0b\x4c\x34\x68\x9d\x9f" "\xfc\x57\xe4\x1a\x4d\x52\x9e\xe7\x1c\x0b\xad\xd3\x74\xa0\x83\x99\x72" "\xe1\xd7\x4f\x1d\x32\x1e\x67\x54\x93\x7e\x02\x75\xce\x06\x82\x6f\xe8" "\xf3\x50\x8a\x94\xb8\xfd\x5b\xb8\x86\x1c\xf5\xf8\xef\xbe\x85\x52\xb5" "\x18\xc8\xb4\xba\x03\x85\x48\x97\x23\xaf\xad\x41\x08\xdf\xf8\xd0\x79" "\x4b\xeb\x7a\x2e\x3c\x6f\x48\xe7\x50\x64\xcc\x66\x1e\xb5\x5e\x80\x39" "\x26\x36\x0a\x29\xd9\x61\x3e\x02\x50\x2d\x43\x65\xbd\x6f\xe3\xce\xe0" "\x84\x2a\x42\xb9\x21\x60\x37\x96\x5d\xb8\xbc\x97\xda\xbb\x03\xdc\x33" "\x18\xb8\x19\x85\x8c\xfc\xad\x3d\x3b\xff\x77\x6d\x9f\xc0\xd0\x72\x30" "\x7f\xae\x60\xbb\xca\xe4\x54\x08\x47\xb7\x6d\xe4\xa1\x81\xbf\xfd\xb5" "\x13\xa2\xef\x79\x11\x15\x19\x43\xe0\x52\x9f\xcf\x96\x51\x3b\x0b\x2e" "\xdd\x76\x75\x52\x62\xa1\x01\x01\x5b\x8d\x33\x07\x02\x61\xfe\x8d\x4d" "\x0f\x6f\xe4\x28\x0f\x02\x5f\xb4\x5e\x72\xe8\x54\xf7\x14\xb5\x9e\xce" "\xbe\x6b\x57\x63\x59\x24\x75\x09\x75\x82\xec\x87\xc1\x40\x10\xe0\x8b" "\xbb\xb2\xa1\xcf\xe6\xde\x4d\x52\xfa\xce\x9e\x66\x34\x35\x2b\xa4\x34" "\xac\x5c\x6b\x95\xd0\x7d\x4e\x82\x13\x88\x79\xa1\xe8\x2e\xc9\x72\x2d" "\x70\x1c\x08\x73\xc6\xbd\xef\xd8\x4a\xe5\x6f\x70\x61\x7b\xcf\x6e\x85" "\x46\x3c\x29\x0c\xe5\x75\xc0\xe6\xd6\xa4\xe3\xbd\xa4\xc4\xdd\x20\x95" "\xac\xc0\xbd\xcc\x80\x80\xa2\x63\xcd\xb4\xbe\x12\x27\x06\x5a\x48\xfb" "\x04\x8b\x40\x98\xa0\xaa\xd9\x46\xd8\xca\x7c\x57\xae\x27\x76\x56\x10" "\x88\xab\xf1\x8f\xbd\x56\x9f\xcf\xc7\xfb\xdd\x93\xb8\x6f\x8d\x98\xb5" "\x9c\x2c\x68\x03\xb8\x20\x2b\x31\xa8\x11\x9d\xce\x0b\x76\xc8\x75\xa8" "\xca\xad\xca\xcb\x8f\x21\xc1\x15\x8d\x05\x2a\x9f\x4d\x4a\xe8\x7f\x5c" "\x64\x70\x99\xc8\x86\x35\xbd\xae\xa7\xd0\x28\x4d\x52\xfb\xd1\xae\x3e" "\x20\xc5\xea\xa2\x2b\x33\xbf\xdb\xea\xd2\xb1\xa1\x26\xf0\x45\x4c\x27" "\x59\x1a\xa5\x5f\xf3\x99\x77\x26\xf8\x79\xe2\x45\x10\x26\x26\xfd\x72" "\x86\x4f\xe2\x26\x93\x78\xfd\xaa\xe2\x2f\xff\xbb\xda\x15\x9a\xbf\x43" "\x26\x29\x01\x2c\x6a\xd2\x0d\x86\x2b\xc7\x59\xcd\xaf\x8c\x69\xd7\xad" "\x8b\x27\x1f\x9b\xb9\xf0\x98\x8a\x72\xcc\x9a\x62\xac\xa5\xaf\x4d\xb4" "\xe8\x08\x7b\xa7\xd6\x34\xea\x25\x31\x9c\x15\xbe\xa6\xb3\x6f\x32\xee" "\x8a\xeb\x50\xda\x23\x67\xc8\xf1\x93\xc6\x58\xa9\x07\x08\x8d\xf9\x2a" "\x69\xcf\xd3\x4d\xa9\x97\xed\x27\x2e\xc9\xe7\xe8\x4b\x29\x98\xd4\x7d" "\xe1\xee\x7b\x42\x88\xff\x1b\xb4\xea\x84\xb7\xbf\x36\x0d\xee\xb2\x8d" "\x50\x3d\x18\x44\xf2\xe0\x31\x3d\x52\x01\x88\x9a\x54\x12\xde\x73\x82" "\x38\x94\x24\x00\xdf\x10\xce\xac\xe3\xd7\x2f\xb6\x85\x2c\xd3\xd0\xad" "\x9e\x79\xbc\x15\x15\x95\xc1\xf8\x92\xae\xfe\xc6\x29\xb0\x7c\x06\x23" "\x3f\x55\xfc\xb6\xc5\x24\x61\xec\x04\x30\x99\x7d\x8f\x0f\x54\xa8\xe6" "\x07\x3b\x14\x84\x0f\x66\xf3\x9f\xd2\x2c\xaa\x0f\xaf\xe2\xc5\xe5\xa7" "\xc7\x31\x02\x5d\x49\x92\x97\x90\x1b\x0f\x75\x12\x93\x9e\xd5\x7c\x38" "\x59\xc0\x29\x20\xe4\x7c\x2e\xad\x6c\x2d\x23\xde\x65\x1a\xaf\x8b\xb2" "\xc4\x68\x5c\x0e\x51\xd8\x74\xc7\xba\xe3\xa3\x2b\xec\x11\x6a\x73\x88" "\x96\xa2\x01\xf5\xc3\xc0\xff\x96\xdb\x56\xf9\x1c\x6b\x46\x31\x50\xd7" "\xd4\xc5\x52\x33\x53\xd6\xde\xba\x19\xc5\xfd\xe0\x3f\x04\x57\x53\xe1" "\xa4\x5e\xbf\x5f\xe5\x26\x6a\xe8\x41\x2e\xa3\x8c\xe5\x67\xa6\xef\x63" "\xaa\x38\x64\x5a\x9a\x30\x5e\x38\x4a\x43\x3f\xca\xe2\x5b\x05\x6a\x18" "\x98\x3c\x10\xc3\x5e\x44\x19\x8b\xa6\xf1\x9a\xcb\xd1\x49\xa3\xe9\x44" "\x04\xa3\x2f\x31\x2c\xc3\x36\x5f\x42\xce\xd2\x86\x86\x7e\x7e\xe0\x5c" "\xcb\x6b\xd1\x2e\xda\xdc\x9f\xef\x89\x2c\x57\x35\xf7\xbb\x0d\xc1\xe4" "\x80\x40\xa3\xda\xb5\x71\x53\x13\xc8\xa0\x22\x86\x7d\xa1\x65\x52\x0c" "\xb2\xc5\x47\x8e\xc7\xdf\x68\xf2\x7e\x62\xe2\x13\x56\x07\xb3\xae\x59" "\x61\x85\xe6\x1e\xce\x7e\x76\x03\xe2\x0e\x7b\x64\x63\xe2\x98\x68\xa1" "\x2b\xec\xfb\xcf\x9d\x8e\x36\xaa\x27\x5b\x21\x2c\x36\x45\xb8\xef\xcd" "\xe1\x2e\x2d\x46\x9c\x35\x94\xc2\x67\xd3\x9e\x1e\xc3\xcc\x38\x61\x8d" "\x5b\xc8\x21\xea\x29\xf3\x23\x97\x63\xb0\x4c\x3f\xbc\x70\x9f\x91\x66" "\x28\x6a\x95\xd0\x12\x08\xa4\xbf\x97\x75\x57\x70\x17\x1e\xdf\x6d\x1c" "\xe2\x32\x06\x01\xea\x60\xd3\xdc\xd4\xe3\x83\x33\x67\x11\x0c\x3f\x49" "\x08\x64\x38\x24\x09\x2f\x6c\x2d\x37\x48\x7b\x58\xc7\x19\x79\x6e\x2c" "\xa9\xc1\xd3\xa9\x06\x61\x8e\x0a\x0d\xa3\xcb\xa2\xe7\x19\x11\xfc\xe0" "\xf9\x96\xda\xdf\x38\x7d\x76\x2c\x04\x01\x44\x59\x44\xb0\x9e\x1f\xd9" "\x16\x61\x0c\x67\x2f\x0d\x73\xbc\xe3\x12\xdd\xe2\xad\xaa\x52\x48\x1a" "\x96\x69\x13\x4f\x2d\x4c\xd2\x84\x28\x8f\x8f\x66\x24\xfc\x00\x65\x5e" "\xb1\x10\x63\x09\x3c\x41\x89\x29\xb2\xcd\xef\x0d\x52\x21\x2c\xc9\x7c" "\xbd\x01\x4d\x12\x60\x2c\x7e\x11\x74\xdc\x8e\x16\xad\xb0\x7f\xaa\x4a" "\x2f\xd9\xf1\xfc\xf5\x34\xa9\x4e\x7c\xf2\x03\x05\xc0\x1e\xda\xa8\x7a" "\xd4\x19\xca\x15\xa7\x4f\xd3\x00\xb8\x77\xed\xd6\x6e\x85\x1d\x0c\x28" "\x41\x9c\xea\x79\x2a\xdd\x9d\x0f\xa6\xed\x95\xd1\x9e\x41\x58\x8d\xd1" "\xc0\x29\x76\x7a\xe4\x27\x28\x7e\x0b\x6f\x08\xa6\xce\x33\xb5\xe6\x12" "\x39\x18\x14\x2a\x99\x85\x77\x82\xd3\xc0\x30\x9f\x0d\x25\xc1\xfb\x78" "\xcc\xfd\xe2\x18\xcb\x54\xf4\xcb\xd0\x56\x86\x2c\x6e\x01\xe5\x7d\x54" "\x6e\x8d\x05\x74\xec\xb2\x8e\x78\xa9\x42\x23\xcf\x77\x51\x94\x9f\x71" "\x76\xf7\x16\x78\xa8\x42\xbe\x2a\xeb\x6b\x46\x05\x0f\x90\xda\xf4\x83" "\xb1\xa3\x2b\x99\xb0\xe8\x27\xfd\x8c\x50\xea\xa6\x73\xbc\x0d\xc2\x04" "\x6e\x6a\x50\x3c\x55\xa2\xad\xfc\x3d\x8c\xf0\x61\x5f\x03\x2d\xfe\x7e" "\x92\x9c\x61\xa6\xd5\xb1\x71\x3e\xed\xd2\x89\x73\x69\x19\x1b\x6f\x46" "\x72\x91\x27\xf5\xee\xae\x90\x09\xca\xd9\x7d\x7d\xb3\x04\xda\xbe\x04" "\x56\x44\x0e\x79\x94\x52\xec\xd8\xd6\x92\x9e\x8f\xa6\x16\x07\x60\x9a" "\xf3\x0b\x31\xcd\x32\xd0\x77\xbe\x96\x92\x03\x18\xfc\xc6\xfd\xf5\x28" "\x1e\xb1\xa7\x3e\x5f\x36\x5e\xf5\x6f\xe3\x1d\xc7\xe1\x17\x73\x5f\x1d" "\x52\x9b\xbb\x67\xd7\x5e\x0c\xbd\x16\xcb\x30\x6f\xba\x0b\x70\xde\x90" "\x70\x99\xc1\x32\x2b\x99\xc1\x8e\xb6\x23\xe1\x67\xaf\xf8\x83\x35\x43" "\xab\x32\x51\x15\x59\xe6\x1a\xb5\x5b\xbe\xe2\x05\x6f\xab\x96\xe0\x6b" "\x6d\x5a\x28\x90\x6b\xc4\xa9\x6f\x58\x4a\xd6\xda\xd5\x41\x71\x89\xba" "\x94\xf7\x88\xb9\x48\xb7\xae\xaf\xfc\x89\x50\x64\x72\x3a\x04\xe3\xc1" "\xee\xd8\x08\x9e\x56\xf1\xba\x6e\x3d\xe1\x81\x14\x1f\x4e\xc9\x9b\xb0" "\xe9\x20\x10\xab\xb8\xed\xdb\x72\x6c\x35\xa8\x93\xdf\x33\x48\x73\x45" "\x33\xd7\x80\x83\xd7\xce\xc5\xe4\x80\x5d\xf0\x7d\x30\xfd\x37\xb2\x6e" "\xef\xed\xfa\xf8\x86\x24\xa7\x21\x0d\x84\xd4\xe7\x30\xfc\x8b\xaa\x92" "\x12\xe7\x4e\x52\xf4\xd1\x14\x5e\x42\x45\x40\xb7\x88\xa1\xea\x54\x5e" "\x3a\x02\x2d\xb8\x10\xf3\xc0\x70\xc8\x76\xee\x7e\xbd\x27\x25\x17\x28" "\x71\xb5\x34\xc4\x57\x22\xf0\x2d\xae\x8c\x64\xef\x9b\xd3\xae\xeb\x82" "\x4e\x17\x50\xbe\x6b\x46\x1f\xa8\x28\xaa\x46\x9a\x5f\xe5\x0b\xdb\xa8" "\x64\x29\x20\xe3\x5c\x17\x86\x53\xea\xe2\xd2\xe8\x98\x0a\x4e\x2c\x69" "\xca\x5f\x38\x68\x16\xae\x29\x3f\xd8\x10\x01\x2f\xc2\xbe\x9a\xa7\xfc" "\x8a\xad\xbc\xb4\xe2\x2b\xd8\x45\x0e\x81\xdf\xfe\xc1\x77\xf1\x53\x98" "\x9b\xc9\xc7\xbf\x68\x1c\xb8\x51\x6e\xb4\xeb\x0a\x86\x1b\x18\xd7\x0e" "\x9e\xe4\x55\xa4\x45\x08\x7b\x6e\x39\x08\x6b\xfb\xfd\x18\x0b\xd3\x62" "\x8f\x7e\xb7\x79\xa5\xe9\x4d\x3f\xb2\x5c\x23\x40\xb7\x80\x0e\x9f\x1d" "\xac\xf7\x83\xdb\x5d\x5a\xd2\xfb\x90\x84\x13\x52\x97\xd7\x8f\x83\xea" "\xe6\x12\x08\xfc\x95\xd7\xcd\x5b\x5f\x7c\x34\x9b\x93\x4b\x2b\x00\xd9" "\xf5\x98\x27\x85\x90\x5a\xf6\x7b\x8d\x17\x8a\xfb\xe9\x38\x19\xdf\x43" "\x00\xbd\x21\xc9\x22\xa6\xc4\x49\xf7\x8a\x42\xd1\xd4\x7b\x1d\xc2\x9e" "\x22\xd1\xe6\x26\x70\x6c\x9f\x64\x26\xd8\xeb\xc1\x3d\x5a\x73\xb2\x97" "\x95\x17\x6b\x05\x68\x8f\xca\x75\x54\xc2\x6a\xe6\x20\x49\x11\xb6\x44" "\x17\x89\x69\x21\x12\x25\x71\x21\x84\x04\x40\xb8\x83\x85\x84\x03\x1f" "\xb3\x2e\xce\xfe\x0f\x97\x20\x2f\x71\xae\xf4\x42\xed\x4a\x2d\x99\x04" "\xda\x00\x2e\xdd\x06\x7a\xf1\x68\x7f\x43\x2b\xd5\x66\x93\xea\x26\x94" "\xc4\x0c\x42\x3c\x2a\xb1\x4b\x2e\x38\x03\x9e\xca\x4b\x02\x10\xa4\x8c" "\x90\x8c\x26\xad\x33\x46\xbe\xfa\x0f\xf7\xa5\xd7\x56\x03\x5b\x8a\x81" "\x0c\x77\x5b\x76\xf5\x07\x10\x88\x42\x05\x0f\x7f\xc2\x5e\x1f\x40\x7d" "\xad\xfb\xeb\xa9\x87\x6c\x9f\x42\x5e\x29\xf0\x25\x71\x52\x9e\xe7\x41" "\x46\x2c\xd2\x92\x99\xe6\x99\x6b\x55\x48\x72\xef\x60\xca\x2a\x91\x6c" "\x61\x8a\xbc\x2c\x37\xe4\x98\x22\x84\x40\x68\x06\xef\x08\x49\xd9\x05" "\x32\x07\x3c\x4e\x0c\xa8\x01\x49\x05\xaf\x51\x4c\x5f\x68\x27\x4d\xff" "\x54\x0a\xec\xf3\xbe\x7b\x21\xb3\x12\x04\xe4\x31\xa5\x33\x92\xf6\x5b" "\x48\xf2\xd0\x1e\xc8\xc6\x46\x87\x66\xd0\x5b\xc4\x0c\x2c\x0c\x5e\x2c" "\x73\xb6\x27\xdd\xa9\x72\xc1\xa5\x74\x11\x4c\xce\xa7\x1c\x8a\x2e\x38" "\x29\x1b\x73\x7d\x87\x05\xac\x34\xf5\x8d\x6a\xad\x3f\x2e\xa4\xae\x2d" "\x63\xcc\x41\x3f\x71\x47\x47\x75\xa5\x98\x62\xa5\x56\x35\xe3\x2c\xfa" "\x4e\x43\xc6\x68\x8f\xb9\xf4\x3c\xb0\x58\xa6\x2b\xd5\xf9\x51\xaf\x0c" "\x35\xd2\xf8\xa7\x03\x94\x39\x90\x70\x4d\xa0\xf1\xa2\xa4\x96\x2f\xbb" "\x0d\x8e\xa0\x3a\x33\xb8\x2a\xff\x62\xba\x22\x39\x76\xc4\xca\xb0\x70" "\xd3\xa0\xe4\xae\x3b\xf7\xf7\x22\x65\xb6\xf6\x99\xc5\x54\x8d\xe3\xad" "\xb8\x6c\x2e\x4f\xc0\xfe\x99\x7b\x2b\xc4\xae\x31\xdc\x33\x51\x63\x99" "\x5e\xa4\xea\x69\xf3\x74\xfe\x46\x9b\xfa\x4c\x04\x11\x59\x30\x14\x9b" "\x75\xcd\xe7\x24\xec\xe3\x85\xce\xb0\x68\x1d\x37\xf1\x78\x92\xe4\x98" "\x9f\x9e\x28\x9a\x35\xeb\x5c\x3b\x16\x0d\x15\x72\x74\x89\xa3\x5d\x52" "\x88\x65\xd4\xfb\x3d\xdf\x80\xf9\x50\x61\x24\x1b\x53\x8a\xeb\x0d\xee" "\x83\xe8\xdd\xa6\x0f\x09\xcc\x30\x2d\xd3\x6c\xd2\xd0\x4e\x41\xb2\xef" "\xb4\x5c\x46\x15\x5e\x0e\xd8\xc4\x08\x9f\x57\x4e\xd6\x0d\x24\xdc\x2f" "\x2a\x2d\x50\xfa\x74\x9e\x7a\xe3\x2a\x03\x57\x7c\xcc\x6e\xfb\x52\x5e" "\x78\x01\x43\x3f\xd2\xb3\xd0\xcc\xa3\x7f\xa8\x6a\x63\xf0\x82\xb1\xa4" "\x34\xef\x24\x60\xe5\x14\x6e\xbe\xbe\x80\xe4\xae\x5d\x25\xd3\x04\xd4" "\x21\x77\x5a\x26\xd9\xab\x45\x63\xb4\x03\x2d\x88\x59\x36\xb2\x7f\x0c" "\x88\x35\xc7\xd2\xc3\x84\x99\xde\x4c\x35\x1c\x4c\x8b\x69\x3d\xe0\xc2" "\xd2\x1c\x9f\x26\xe4\xc4\x54\x88\x88\xdc\x59\x80\x20\x6d\x20\xd7\x40" "\x67\x2c\x4e\x85\xbe\x8e\x90\x22\xc9\x89\x2c\xe3\xf2\x60\xc5\x60\x52" "\x61\xd1\xd8\x98\xc5\x76\x8a\xff\x7b\x80\x7d\xc0\x5c\x47\xaa\xf1\x21" "\xdd\x73\x04\x0b\x86\x27\xb8\x35\x7c\xd9\x69\x8d\x2f\xdd\xc0\x93\x4b" "\x3d\x82\xe2\x82\x12\x2a\xe4\xba\xc4\x3d\x7a\xf2\x48\x65\x9d\x73\x76" "\xbe\xcf\xc6\x6e\x6d\x33\x2d\x82\xcc\x20\xfd\x6c\xb7\x40\x27\x2e\x24" "\x32\x95\xfc\x59\xd2\xe0\x25\x73\x18\xde\x01\x21\x11\xf1\xa6\x70\xeb" "\x12\x90\x06\xa7\xdd\x61\xc1\xc2\xce\x01\x34\xa9\x37\x80\xcb\xdf\x87" "\x04\xd3\x94\x0c\xfe\xdb\xa9\xcb\xfc\x61\x06\xb0\xab\xdf\xb0\x99\x41" "\x35\x41\xe2\xed\x9e\xb4\xe0\x22\x33\x89\x5e\xed\xde\x48\xaa\xb7\xa8" "\xf7\xc4\xe5\x89\x1a\x6e\x8d\x9a\x22\x27\xe0\xd4\xfb\xd1\xf8\xcd\x63" "\x9b\xca\x6f\xae\x24\x65\xc4\xeb\x35\xc9\xea\x99\xc3\xf8\x41\x8e\xeb" "\x45\x12\x6c\x99\x87\x45\xa2\x31\x97\xce\x10\x14\xcb\xed\xac\xae\xe9" "\x89\xcc\x11\xa9\xa1\x4e\x1b\x5d\xc7\x08\x59\xea\xe1\x64\x62\x21\x10" "\x7c\x23\xc1\x60\xd5\x2b\xf7\xa5\xcb\xdc\x50\x2c\xdc\x64\x22\xa5\x3e" "\x88\xaa\xe8\xd9\xd6\xa8\xb6\x3f\x11\xdf\x2b\x77\x95\x7e\x3a\x5c\xa8" "\x89\x19\xa3\x06\xf7\x3f\x89\x60\xb5\x94\x3b\x86\xf3\xd6\x95\xfd\x80" "\xb3\x28\xd1\xc2\x97\x0b\x5c\x37\x3e\x54\xb8\x65\x0d\x0e\xd4\x43\xe7" "\x57\x0d\x06\xcd\x26\x30\x23\xc9\x2e\x1f\x2f\xaa\x24\x28\x89\xe9\x62" "\x69\x24\xe8\xaa\xa3\xe8\xcc\x0f\x6a\x5f\x06\x63\xdc\x73\xa4\x28\x22" "\x05\x31\xbf\x92\xdb\xb8\x56\xb9\xb3\x16\xed\x86\x28\x1b\x5e\x44\x76" "\x0a\xf8\x60\x36\xbb\x0e\x25\xd0\x26\x63\x4f\xb9\x79\x45\xe0\x62\x62" "\xdc\x5c\x95\x5f\x13\xf4\x1a\x9b\x37\xe3\x8f\x72\xf5\xb1\xd5\x54\xac" "\xe2\x0a\xb2\x6c\x5e\xd3\xfb\x86\x16\x5b\xe4\xe1\x61\xa3\xae\x1b\xa0" "\x86\x9e\x4f\xc0\xd1\xac\x0d\x86\xfe\x4d\xc4\xa0\x0e\x50\xca\x19\x8c" "\xb5\x33\x88\x7e\xe8\xeb\xb8\xf2\x7b\x64\x9d\xf9\x63\xab\x2f\xce\xa4" "\x8b\x7c\x92\x95\xf1\x38\xa5\x7e\x12\xb5\x0c\x78\x73\x99\xfa\x93\x03" "\x4f\xf7\x05\x86\xbc\x39\xd8\x38\x74\xd9\x26\x3d\x21\x29\xcd\x3c\xcb" "\xcb\xc5\x0b\xbd\xfa\xab\x60\xf6\xbb\x83\xdb\xff\x97\xb4\xca\x53\xbe" "\xf3\x55\xfd\x3e\x7c\x0e\x20\xeb\xac\x08\xbb\x49\x9e\x3d\xab\x77\x80" "\x1f\x54\xe7\xc9\xff\x2c\x79\xcd\xb2\xef\xb8\x80\x57\x09\xb4\x1c\x1a" "\xdc\x03\x8d\x13\xdc\x2e\x25\x82\xad\x0d\x32\x8a\xf0\x96\xc2\x79\x2f" "\x5b\x5a\xe6\x47\x85\x9f\xaa\xec\x50\x37\x46\xdf\xba\xe2\xfb\xf6\xe3" "\x95\x21\xe7\x90\x42\x7b\xba\xba\x5d\x12\x58\x8c\x86\x84\x68\xfa\x1c" "\x92\x9d\x71\xba\xd1\x53\xb8\x7d\xff\xe0\x9f\x3b\x33\x59\xef\x5b\xad" "\xe7\x03\x03\x35\xdf\xbf\x35\x58\x78\xa8\x40\xc9\x36\xf8\x12\xca\x0d" "\xe7\x59\xb9\x47\x6e\x35\x39\x76\x27\xd4\xee\x2d\xee\x54\x69\xe4\x02" "\x04\x9a\x1b\x2a\xbf\xe8\xf1\x18\x30\xec\xc3\xa2\x1a\x4b\x1d\x79\x27" "\xd8\x66\x5c\x10\xdf\x91\xb5\x76\xe3\xe2\xd5\xb0\x4f\x68\xb5\xe1\xdb" "\xd3\x9b\x40\x2f\x46\xc7\x61\x2a\x63\xd7\xef\x30\x1e\xe4\x86\x31\x2d" "\xcb\x6b\x58\x14\xfd\x4b\x9f\x56\xec\x9b\xc0\x3b\x5f\xde\x16\x38\x87" "\xc0\xe3\xb5\x54\x9e\xe5\x57\x70\x32\xa3\x93\xc1\x2b\xf8\xa7\x89\xa1" "\x84\xb1\xf0\xab\x74\xf2\x59\xb7\x70\xb8\x26\xf7\x8b\x03\xa0\xa2\x70" "\x64\x10\xba\xd3\x87\xf0\xe3\x0f\xb9\x40\xb9\xae\x42\xf5\xbd\xda\x3a" "\xa7\x75\x91\x07\x1f\x01\x5c\x0c\xd6\x6c\x1c\x1d\x34\xd9\x96\xb8\xf2" "\x72\xd4\x78\x31\xc7\xda\xfc\xff\x33\x57\xc0\x63\x40\x63\x22\x34\x92" "\xef\xac\xef\x0a\xf1\xe0\x00\x74\x9f\xab\xbd\x1c\x1c\x21\x79\x63\x40" "\x7f\xa1\xee\xc3\xdc\xc7\xc8\xe8\x7b\xee\x9b\x1e\xcf\x02\x02\x5b\x00" "\x74\xfe\x8b\x7d\x15\x96\xb3\x75\xd9\xfd\xe6\x30\x68\x87\xf4\xa5\x97" "\x32\xb0\x7f\xae\x99\x9c\x66\x9b\x1e\xbf\x34\x69\x09\xa9\x45\xc8\xd0" "\x47\x8a\x42\x3c\x97\x22\x7f\x94\xe2\x21\x85\xdd\xc4\xdd\x42\xc9\x32" "\x56\x9e\x42\x15\x15\x0a\x37\xca\xd7\xb3\x04\xe8\x52\x4f\x9c\x19\xc1" "\x4d\x70\xb9\x6e\xdc\xa9\xbb\x2c\x4d\xbc\xd1\x6e\xe0\x16\x26\x2c\x7b" "\x0d\x61\xd2\x59\x7e\x78\x4d\xff\x26\x05\x2f\xaa\xf9\x28\x51\xeb\x9f" "\x57\xfc\x2f\x8a\x30\x0e\x3c\xd9\x9f\x6c\xcc\x38\x1a\x74\x51\x60\x84" "\xc4\xa0\xaa\xab\x8f\x4d\x2b\x3d\x9e\x08\xff\x12\x35\x50\xa4\x18\x0d" "\xe6\x21\x25\x0c\x2a\xea\xd2\xc7\x71\x4a\xe0\x36\x45\x57\x3e\x4d\xf4" "\x96\xe6\xb3\xdb\xb7\xee\x9f\xd0\xb5\x12\x05\xf5\x9e\x88\x8d\x07\x9d" "\x96\x9e\x4d\x28\x8f\x03\x64\x4f\x68\x46\x0d\xd2\xd9\x96\xb6\x0d\x01" "\x44\x5f\x97\xd1\x2f\x6c\xd1\x45\xb3\x68\x5b\x59\x35\xe0\x45\x7d\xab" "\xe7\xb4\xfc\x8f\x54\xe4\xa1\x6b\x5c\xa0\x86\xa8\xd2\x67\x61\x15\xa0" "\xdd\x2b\xc6\xf4\x96\x65\xd4\x5f\xab\x63\x25\x64\xef\xbd\xf6\xb8\x26" "\xca\x94\x2b\x01\xbf\xfd\x59\x74\x0e\x99\x3e\xc0\x6b\x14\x26\x00\x1f" "\x7a\x57\xd9\x63\x9c\x03\x05\xea\x11\x49\x2b\x66\xea\x94\x0e\xc0\x56" "\xac\xd5\xf4\x47\x00\xf1\x95\x4b\x2a\xa4\x50\xa4\x23\xbe\x85\x32\x22" "\xa6\x53\x9c\x2c\xb7\x54\xe6\x05\xd9\xca\x37\xb5\x88\x5d\x91\x0e\xc8" "\xfd\xc1\x57\xf5\x2c\x4f\xa2\xd6\x9e\x96\x3e\xa0\xba\xc7\x6a\x55\xa6" "\x61\x7b\x20\xf0\x22\x47\x95\x27\x61\x99\x2c\x33\x44\xac\x35\xe3\x9e" "\x61\xf7\x5c\x0a\xa6\x23\x89\x76\x0f\x49\xb2\xb5\x04\x02\xfe\xb6\x6e" "\xf7\xc8\x1b\x2f\x6c\xd6\x04\xd3\x84\x8f\xff\x4c\x3d\x97\x99\x0c\xbc" "\xf3\x0f\x7a\x2e\x6a\xcf\x4a\x6f\x32\x8e\xc8\x7a\x20\x1d\x77\x86\x3f" "\x44\xfa\xf9\x23\x53\xcf\x16\x62\x35\xb1\xd2\x0c\xf9\x8f\x0a\xeb\x86" "\x43\x1f\x97\x4c\xe0\x19\x18\xc0\x1b\xdb\x2e\xe2\x3b\xdf\x72\x69\x0d" "\xdc\x88\xfe\xe4\xc8\x7a\x91\xba\x1b\xd3\x8c\x2c\xce\x04\xe4\x9e\xe6" "\x2e\x4b\x15\x31\x0b\x65\xb3\xb4\xb7\x1e\x27\xe9\xa6\x75\xd7\xe5\x54" "\xc8\xa5\x8a\xfb\xa8\x1e\x9c\xf0\x2a\x39\x9a\x89\x25\xa0\x39\x59\x7b" "\xf6\x86\x0a\xe8\x2b\x15\x1f\x00\x49\x73\xd8\x0d\x68\xb5\x1c\xb6\xb3" "\x86\x34\x9b\xf8\x97\x29\x26\xff\x58\x53\xec\xc7\xe9\xa1\xae\xa2\x2c" "\x19\x24\x4b\x9c\xb9\xe6\xf4\xe4\x77\xae\x3b\xaf\x25\x7b\xcf\xfa\x88" "\x10\x5e\x67\x93\xa4\x56\xb2\x48\xdf\xcf\x23\x65\x0e\x60\x25\x15\xdf" "\x57\x08\xe1\xca\xb3\x1c\x0e\xc9\x25\xc1\x5c\x43\x17\xf7\x36\xb6\xfa" "\xfc\xa2\x52\xd0\x83\x78\xb8\x27\x68\xfc\xff\xc9\xa4\x35\x4c\x9b\x00" "\xa8\xfe\x35\xf6\xa0\xea\x6b\xbf\xf8\x18\xfa\x7e\x1f\x5b\xb6\x2d\x32" "\x6d\x29\x63\x9c\xdf\xbe\x66\x64\x2a\x64\xf4\x2d\xa8\x42\x38\xb3\xf9" "\x34\x15\x6c\x35\x07\x8d\x53\xf1\xfd\x03\xee\x4a\xe7\xb4\x81\xad\x4f" "\x0b\x5d\x63\x3a\xef\xa1\x40\x0d\x7d\xc9\x58\xd0\x94\xc7\xd9\xd6\xa3" "\xde\x73\xa4\x5c\x50\xf0\xac\x0f\x4c\x75\x57\xfa\xd1\xbe\x5f\x8d\x9c" "\x4a\x7b\xc5\xd0\xd7\x58\xb7\x69\xb1\xd2\xca\x94\x59\x69\x49\x78\xc8" "\x30\xfe\x4c\xe5\x09\xb2\x87\xf8\xd7\x42\x07\xaa\xf0\x9c\xb1\xcc\xe7" "\x85\x29\x87\x24\xe9\xf8\x25\x8b\xe3\x6d\xbf\x2b\x83\xcb\x33\x6f\xce" "\xf5\x6a\x24\xb4\x9e\xd8\x9d\xce\x28\x09\x7e\xab\xae\x47\x20\x82\x74" "\xa1\xf4\xe2\x28\x03\xa8\x30\xd2\x41\xce\x52\xa7\x6f\x46\xc5\x45\x84" "\x65\xc8\x4d\x7c\x32\x0b\x4c\x64\x57\x88\xc1\xcc\xa3\x4e\x69\xf8\x6e" "\xa2\x25\x05\x51\x0b\x9c\x1f\xc5\x88\xe5\x5a\x8a\x5d\x88\xef\xd6\x31" "\x2f\x7e\x73\xb4\xe2\xc7\xb9\xce\x7b\x2e\xbc\x3c\xf3\x84\x12\xa0\x29" "\xf4\xe1\xa4\x1b\xfb\x00\xb0\xe7\x28\x24\x4d\xce\x4d\xc2\x5c\xb5\x6a" "\xc3\xf9\x74\x3e\x6a\x39\xc5\xe1\x30\x87\xd6\xfd\x20\x42\xbd\x2b\x4c" "\x60\xd0\x01\xfd\x33\xa9\xdd\xa8\xe5\x5f\xb4\x25\x94\x38\x60\x4e\x5b" "\xfd\x02\x72\x44\x90\xdf\xab\xd7\xd4\x1e\x18\x1a\xf9\x77\x35\x1a\xca" "\x36\x73\x13\x75\xe5\x0a\x24\x50\xf9\x38\x24\x4b\xda\x7d\x37\x80\xb3" "\xea\xca\x61\x97\xda\x58\x31\x76\xb0\x83\x36\x10\xf0\x3a\x51\xae\x65" "\xa4\xf2\x62\x3d\x04\x26\x56\xc8\x6b\x0e\xd8\x20\xcd\x55\x1f\xcf\x03" "\xf3\x81\x4a\x43\xf3\x8e\x90\x66\xd6\xb7\xca\xfe\x5c\x4c\xdf\x4f\xaf" "\xe3\xdf\xa2\x26\x69\x03\x8b\xfc\x15\xe7\xb6\x68\xf5\x50\xc5\x53\x1f" "\xeb\xb9\x75\x5b\x2e\xbc\x68\x8c\xfb\xd5\xf8\x76\xa1\xb8\xb8\xe1\x39" "\xbe\x89\xfd\x0b\xb4\xe9\x44\x63\x22\x7d\x79\x7b\x1f\x93\x45\x62\xd9" "\x9d\x40\xd9\x57\x43\x66\x52\xbd\xeb\xa0\x8f\xbe\xef\xa8\x40\x44\xd6" "\x44\xb7\x57\x18\xd9\xd6\xb4\x29\x61\x4b\xba\xd8\xea\x8e\xde\x12\x26" "\x9d\x7e\x89\x69\x57\x61\xee\x87\x44\xca\xf1\xce\xa8\x2b\x4d\x4d\xc0" "\xe9\x33\xe0\x21\x25\x97\xc9\xee\xc9\x6d\x84\x40\xb8\xa9\x9d\x20\xe1" "\x96\xe3\x32\x2b\xd2\x09\xb1\x5f\x43\x52\x13\x10\x05\x98\x0e\x0e\x49" "\x47\x91\xd2\xce\x55\x95\x89\xd5\x87\x62\x7e\xc8\xc5\xd3\xcd\x44\xe1" "\x7f\xe2\xf9\xbd\xb1\x43\x47\x2e\x97\x4d\x3e\x8a\x83\x55\xde\xb6\xc2" "\x76\x86\xd0\x59\x50\x20\x70\xc6\x4a\x93\x01\xe1\x3f\xb8\x84\xfc\x08" "\x41\xf2\xe6\xea\xf2\xcb\x8e\xd0\x52\xa3\x19\xa0\x2a\x58\xde\xc8\xbe" "\x20\xe9\xbb\xf3\x44\x09\x70\x33\xb0\x1e\x4d\x04\xa3\xe3\x5e\x02\x33" "\xd0\xf8\x93\x86\x58\x37\x9b\x48\x6e\xe7\x39\x31\x0d\x92\x8d\x21\x31" "\xdd\x5d\x19\xcb\x39\x04\xf0\xfa\xfd\xb8\xaa\xd8\xc9\xcb\x8b\x16\x70" "\xed\x5f\x41\x42\x5b\xed\x0d\xb0\xc1\x8d\xe5\xfd\x6b\x85\xb0\x7b\x2e" "\x6d\x4a\x44\xcc\x8a\x5e\x31\x34\x3f\x4e\x9a\xaf\x9d\x0a\xbd\xfb\x5b" "\xac\x3e\xab\x73\x5f\x1d\x06\x4f\x41\x7d\x82\x48\x82\xff\x1c\xf2\xd0" "\xda\xfe\x97\x7a\xd5\x0c\xba\xd8\x2a\xfc\x53\x1d\x5a\x92\x38\xa2\xb2" "\xca\x49\x50\x26\xcc\x9b\x61\x23\x7c\x4b\x2d\x2b\x08\x6b\x6d\x11\x1b" "\x2f\xfc\x20\x08\xeb\xa3\x6a\x0e\x93\xaa\xc4\x82\x08\xe9\xda\xc3\x1b" "\xd9\x25\x76\x60\xab\x5f\x0b\xdf\x24\xf6\x96\xd8\x53\xd2\xb3\x72\x37" "\xb8\x0e\xbe\xc3\x8e\xe4\xc3\x4d\xb9\xfd\xdc\x52\x36\x23\xce\x52\xbe" "\xb9\x34\xb1\x5b\x34\x51\xb5\x5f\xa7\x64\xd5\x88\xb1\xfa\x7b\x37\x11" "\xf1\x78\x63\x13\x9d\xa7\x3d\xf9\x1b\x4d\xa8\x02\x2e\x8e\x20\x49\x77" "\xed\xcb\x47\x51\x45\x72\x0f\xeb\x7d\x00\x45\xac\x2d\xa9\x5a\x2f\xc1" "\x5f\x95\x4c\x59\x3f\xaa\xab\xce\x4e\x39\x6a\x33\x11\xbd\x2c\x38\xdf" "\xcf\xfb\xc0\x62\x18\xae\x08\x81\x54\x65\x44\x42\x95\x0c\xfc\xfa\xc3" "\xbe\xd0\xd0\xe4\x18\x92\xd8\xbd\xf5\x0d\xd4\xb7\xc8\x9c\x57\x9c\x6d" "\x6d\x95\xd9\xc4\x0e\x2e\x34\xbc\x8b\x2c\x12\x86\x91\xde\x94\x8a\x55" "\xda\xba\x05\xfe\x2a\xee\x29\x84\x33\x5e\x06\x05\xd6\xcb\x3e\xcf\xa6" "\x4f\x98\x36\x15\x61\x73\x07\x06\x27\xf6\xa7\xaf\x34\xdf\x98\x26\x61" "\x39\x92\x9b\x3d\x04\xaf\xaa\x0b\xb1\x77\xce\x4e\x9a\x68\x6c\x54\xd5" "\xb3\xde\xb5\x5b\xf6\x96\x2e\xf7\x8a\x92\x2b\xe7\xed\x74\x62\x59\xf7" "\xf6\x30\xc7\x02\x89\xad\x2d\x87\x2e\x4a\xcb\x56\x10\xdc\xdc\x7b\x95" "\x41\x5b\xb0\x26\xdd\x97\x99\xbd\x70\x5b\x9b\xdd\x0f\xe8\x0d\x94\x7b" "\x1e\xba\xf8\x36\xf0\xa1\x0c\x60\x5e\x58\xfe\xe3\x6d\xc2\x5f\x36\xf2" "\xd8\x41\xb1\x72\x36\xa3\xd5\xad\x98\xdd\xd7\xcf\x97\xdd\xcf\xbe\x26" "\x21\xfd\x71\xe1\x40\x08\x60\xe2\xe0\xff\x5f\xb6\xef\x77\xfc\x25\x95" "\x25\x0c\xf2\x9d\xfc\xc4\x10\xa5\x08\xe7\xa8\xac\xcc\x68\x51\x94\x10" "\xe7\xa5\xa2\xc5\x5f\x57\x80\x27\x87\xfa\x5f\xce\xa0\xac\x17\x89\xa1" "\xd9\xdb\x53\x8b\x1b\x36\x41\xb8\x17\xca\x4e\x05\x95\x60\x89\x7b\x55" "\x59\x29\x84\x15\xc6\xc3\xeb\x63\x77\xec\x59\x4b\xca\xf5\xf0\x57\x0b" "\xe8\x80\x5b\x04\xb5\x2c\xbe\x0e\x1a\x63\x73\x8d\x8a\x26\xde\xcb\x50" "\x59\x48\xa6\x58\x47\x96\x5b\x9d\x90\xc3\x51\xb5\x37\xaa\x95\x14\x4e" "\xb0\xb4\xc3\x70\x11\x4c\xb9\xb8\x11\x69\xe2\xd5\xfd\x18\xaf\xee\xdb" "\x76\x4a\x80\x4f\x92\x2c\xd0\x69\x3c\xb8\x5b\x0e\x47\xc8\xb2\x28\xc2" "\x72\xde\x68\x88\xb8\x7a\x14\x32\x5e\x06\xbf\x65\xd0\x1d\x9b\x8c\x6a" "\x6b\xa9\xc5\x4b\x5c\x52\xb4\x4d\xee\x0f\x79\x02\x1e\x92\xfb\xf2\xac" "\x0c\x4f\x26\x24\x42\x30\xc8\x3c\x8a\x17\xb4\x5c\xc5\x4a\x8e\x2e\x93" "\xfb\xe7\x2b\xc4\xba\x33\x86\xf7\x53\xb9\x60\x3b\x44\x6f\x1d\x1e\xd7" "\x83\x4e\x0b\x71\xb4\xc2\x95\x05\x42\x20\xd7\xca\x4b\x5a\x2c\xda\x1f" "\xda\x4f\xef\x38\x84\x8a\x50\xaa\x6b\x1c\x54\x59\x90\xac\x6d\xd2\x95" "\x10\xde\x91\xf2\xef\xb8\xec\x58\xad\xb4\xcf\xa7\xa9\x95\x75\x4a\x94" "\x32\xdb\xd5\x9c\xdd\x93\x26\xba\x74\x19\xa1\x12\x81\x39\xc7\x23\xf2" "\x31\x86\x30\x6e\xe8\x29\xf0\x19\x10\x75\xf9\xc3\xdb\xc9\x89\x5a\x80" "\xb4\x52\xb3\x35\x6f\x23\xda\x89\x11\x62\xbd\x7b\xa7\xc6\x23\x78\x34" "\x00\xe5\xbb\x77\x81\xb2\x0f\x95\x8b\xcb\x3c\x85\xbe\xa4\x1f\x4c\x0a" "\x39\x1c\x76\x3e\x12\xa2\x16\x22\x87\x45\x3e\x18\x05\xfe\xa7\x4c\x8b" "\x5d\x9d\xe0\x02\x69\x8a\xb5\x70\x08\x96\x9a\x85\x7e\x02\x8a\xf2\x68" "\xf8\x96\x41\xc1\xa5\xef\x99\x89\x2b\xb0\x0c\xc9\xa2\x02\xf2\xe6\x5a" "\xc1\xc0\xa0\x40\x71\x56\xf8\xe6\x61\x6b\x99\xa4\x35\x93\x64\x08\x2e" "\x86\x21\x19\xcf\x88\xfc\x5f\xe1\x27\x68\xf1\x3a\xde\x42\x88\x15\x41" "\x71\x7b\x60\xbd\xee\xfc\xbc\xa9\x3e\x5b\x01\x83\x24\xa1\xee\x80\xa4" "\xfd\x43\x66\xbb\x59\x30\x0a\x7c\xe9\x45\xac\xe6\x6f\xb4\x6c\xc0\x01" "\xdb\x41\x0c\xb1\x50\x55\xb7\x59\x1a\x1f\xa2\x09\x36\x7f\x4f\x8d\x59" "\x81\x25\x6b\x5f\x23\xc1\x38\x5c\xc3\x91\x89\x06\x8b\xdc\xa5\x32\x80" "\x4a\x8a\x55\x33\x68\x5b\x72\xc9\xe5\xdb\x46\x39\x03\xdd\xf5\x6a\xdf" "\xcf\x84\x5b\xa0\xaf\x53\xd9\xea\x12\xd7\x70\x2a\x0c\x6e\x62\xc8\xc9" "\x2c\x3e\xd6\x1b\x85\x1b\xa0\xd9\xcc\x10\x0e\xc6\x9e\xda\x5d\x77\xd4" "\x41\x60\x62\x03\xe6\xa9\xea\x36\x96\x51\x94\x36\x54\xdc\xe9\xee\x00" "\x8a\xca\x44\xa1\xca\x83\x07\x00\x01\x1d\x0a\x74\xe2\x96\xc1\xbf\x4a" "\x21\xc1\xb2\x12\x8e\x6d\x06\x48\x4b\x71\x99\xb0\x53\xe8\x77\x95\xae" "\xd8\xd6\x93\x53\x55\x59\x81\xa6\x72\x5b\x8a\x62\xa6\xbb\x16\x00\x8d" "\x12\x99\xff\x57\x3d\x72\x59\x05\x99\x84\x6b\xd3\x3d\x12\xf0\x44\x48" "\x50\x6d\x42\xe8\xea\x11\x36\x82\xd8\x5a\x2b\xab\x6c\x24\xa5\x4f\x51" "\xc0\x79\xbe\xc9\xbb\x05\xbd\x3a\x36\x43\x3a\xad\xa2\x7e\x55\x7e\x02" "\x90\x02\x78\xb8\x0b\xbf\x5c\x8e\x47\xeb\xe7\xee\xfd\x5e\x17\x7a\xce" "\xf2\x72\x85\x90\xbb\xe2\x48\x2a\xd6\x17\xc0\xfd\x23\x5e\x9d\x8d\xca" "\x6d\x30\x89\x7a\x21\x62\x8a\x47\xd0\x1d\x26\x51\xdc\x6d\x47\x47\xc7" "\x3a\x58\xe0\xf6\x7e\xaa\xe5\x41\x27\x7f\x5a\xfb\x96\x24\x78\xdd\xd1" "\x4d\x94\xf9\x1d\x1b\x33\x2b\xb4\x72\xc9\x0d\x7e\x80\x81\x00\x9f\x1f" "\x85\x51\x8e\xa8\x18\x7e\xcf\x80\x24\x75\xba\x4b\x79\x69\x45\x2e\xeb" "\xfa\x5f\xbd\xb3\x39\x28\xc1\x43\xe7\x80\x68\xb1\xa4\xac\xa3\x41\xc6" "\x32\x83\xd2\x49\xb0\x28\x55\xf8\x7d\x0e\xca\x1d\x37\x5c\x94\x86\x0b" "\xf9\xf4\x7b\x60\x33\x39\x77\x65\x24\x5b\x3e\xa1\xc1\x85\x06\x22\x32" "\x07\xc8\x57\xb6\xbd\x46\xe5\x2f\xa6\xb4\x6f\x6b\xb9\xa2\xe8\x5a\xa2" "\xc3\x1f\xcf\x87\xc2\xa1\x4e\x52\x5a\x2e\xf8\x29\x4e\x32\x85\xf9\x44" "\xd5\x72\x6b\x1d\x2e\xe2\xc7\x97\xf4\xb9\x43\x2f\xc1\x31\x7a\x6a\x85" "\x67\xc5\x2e\x40\x07\x24\x00\x2b\x3c\xe7\xa5\x1e\x95\x81\x91\xb2\xde" "\x21\x38\x54\x73\x70\xdf\x85\xda\x3e\x61\xa7\x5e\x04\xc4\x43\x5f\x2d" "\x72\x40\x87\x53\x5e\xe3\xd5\x11\x4b\x62\xb4\xab\x5f\xbf\xd8\xda\xbf" "\x75\x9a\x02\xd0\x2c\x79\x80\x65\x00\x5a\xbb\x6f\xad\x88\x39\xcd\x00" "\xb4\xa0\x97\x04\x83\x47\x45\x1b\x32\x66\x38\xf1\x27\x19\xd4\x55\x8c" "\x71\x08\x94\x0c\xd6\xf9\xfb\x4e\x28\x7d\x64\x4c\x5b\xc0\x3f\x9f\xf6" "\x54\x22\xa0\x92\x11\xbc\xe7\x09\x4a\x5b\x10\x8e\x49\x73\xae\x09\xed" "\xb6\xd4\xe1\x0c\xa7\x8b\x74\x88\x44\x19\x65\xb4\xbc\x56\xc4\xb9\x4f" "\x28\x46\x7a\x5b\x89\xb4\xd7\x60\x47\xd6\xd2\x3c\x04\xa2\x9a\xd0\x28" "\x1c\xe5\x33\xb5\x11\x09\xb9\xad\xc2\xad\x8a\xfb\xbc\xf4\xc9\x03\x1d" "\xe7\xb7\x09\xfb\x0f\x3b\xab\xe6\xe4\xd5\x00\x0c\xaf\xe7\x13\x5f\x9a" "\xf6\x3c\xff\xbb\x8f\x5c\x0f\xc4\xac\xea\xce\xcb\xf8\x78\x68\x46\xd6" "\x60\xb0\x4e\x95\x7f\xd6\x43\xae\xe5\x74\xe8\x97\x23\xe7\xf1\x65\x45" "\xf3\x40\x24\x1a\x47\x46\x4d\x70\x0c\x4c\xe6\xf0\xb6\x44\xf7\x1b\xc3" "\xfe\x35\xe9\xb4\x62\x09\xda\x51\x30\x50\x98\xd8\xf8\xd3\x8d\x25\xa9" "\x98\xaf\x5d\x7e\xf5\x9f\x0d\xd4\x05\x56\x81\x0c\x5b\x00\x08\x95\xef" "\xa0\x07\x9f\xfb\x51\x16\xeb\x9f\x06\x99\x5f\x7a\x5f\xf6\xe4\x94\x99" "\x87\x0b\x6f\xeb\xc5\x05\x16\xd9\xb7\x28\x4f\xa7\xe9\xcf\x08\xe4\x29" "\xb1\x7a\x40\x88\x70\x68\x57\xb7\xa7\x0d\x22\xff\xcd\x21\x71\xeb\x69" "\x2d\x7b\xe2\x4e\x41\xc5\x2a\xd3\x4e\x77\xf0\x6a\x48\x84\x1b\x8c\x22" "\x59\x35\x46\x0a\x5f\x0d\xaa\xeb\xd7\x48\x67\xc5\x03\xc1\x19\x2b\x93" "\xff\xca\x0e\x2e\x91\x42\xcd\x38\x61\x19\xc2\xad\x9c\xc8\x03\x27\x89" "\x08\x8b\xa5\x79\xec\x3d\x67\x54\x2e\xef\xaa\x61\x4e\xc2\x31\x78\xc5" "\xf2\x74\x0e\x18\x4f\xe2\x38\x17\x06\x99\x97\x68\x45\xbe\xcf\x7d\xc4" "\x0e\x85\xd4\xc1\x46\x70\xa2\xd5\xbe\x5f\x50\xa0\x2e\x77\x27\x2b\x8b" "\x0b\x64\x0f\x0a\xcd\xd1\x06\xdc\x0c\x60\x3a\x55\x68\xec\x7d\x44\x24" "\x7f\x72\xfe\xd9\x19\x35\x8c\x88\x53\x2c\x1d\xc8\x47\x07\xc7\x0a\xde" "\x45\xdb\x7e\x26\x3b\xea\x57\xa5\xe8\x25\xc8\xa0\x19\x8c\x71\x86\x62" "\x09\x8c\x65\xc0\x5f\x8d\x55\xc3\x30\xe6\x13\x08\x1d\x75\x75\x9a\x7d" "\xc4\xc3\xc0\x48\x90\x01\x92\xc6\xda\x51\x7a\xd2\xea\x16\x02\xab\x55" "\xeb\xbf\x79\xd0\x35\xcb\xba\x7e\xfe\xd4\x91\x5e\x0a\x7b\xa5\xd7\xd5" "\xd1\xed\xa7\xdb\x8c\xbf\xbc\x44\x30\x9a\xdc\x8d\x06\x4f\x7b\x68\xc9" "\x28\x18\x6d\xc3\x56\x8f\xb8\xad\x25\x0c\xbb\x92\x81\x28\x4d\x9a\x52" "\xe0\x6c\x3a\x15\x9f\x35\x71\xd0\x7c\x9f\x83\xf1\x6b\x08\x9f\x8f\xa6" "\xcb\xff\xcc\x9b\xb7\x69\x91\xa6\xea\x2c\x06\x67\xd5\x3f\x8c\x8f\x1a" "\x4c\xf4\x13\xd6\x08\x84\xf4\xeb\x05\xc8\xe2\x75\xd1\x0d\xb2\x5c\x94" "\x47\x5a\x61\x82\xf1\x05\x2b\x40\x6d\x68\xfb\x45\xe6\x3c\x15\x8d\x9c" "\x72\x84\xa5\x4d\x8f\x38\xa1\xd2\xfc\xa4\x79\xef\x20\xdc\x50\x56\x85" "\x6d\xdd\x9c\xf0\xdb\xa1\xe8\xc7\x13\x06\xca\x6a\xd6\xe8\xc5\x02\xa4" "\x3e\x72\xd9\x0f\x72\x0b\x51\xe6\x9f\x3f\x67\x97\x1c\xe5\x55\xd3\x00" "\x0c\x53\xa0\x06\x28\x7f\x61\xca\xef\x93\xb4\xdd\x12\x37\x0c\x34\x02" "\x85\x06\xb3\x38\x87\x31\x1e\x61\x9c\x4b\x00\x31\xa9\x8b\x8d\x10\x56" "\xe1\x67\x7b\x48\x34\x29\xc3\xd6\xfb\x01\x35\x0a\x7e\x1c\xe9\xd3\xb1" "\x69\xb9\x64\xc2\x40\xa1\x9e\x14\xfc\xad\xde\x17\xc8\x5f\x07\xcd\x0f" "\x16\xe1\xec\xad\x96\x31\xc9\x59\x65\xcb\xb6\x3c\x24\x02\xa8\x2b\xab" "\x87\x7d\x71\x83\xf6\x1b\xfc\x4e\xba\xa3\x55\x97\xb9\xa1\x1f\xfe\xba" "\x91\x97\xa5\x5e\xa6\x36\xd7\x6a\x65\x11\x33\x2b\x54\x47\x7b\x61\x66" "\x32\xe0\xb1\x54\xc5\x5a\x8b\xb4\xbc\x99\xe0\xb3\xee\xb6\x9d\x10\xe8" "\xa0\x6b\xc6\x53\x37\x3f\x27\xdb\x94\x17\x71\x00\x86\xc2\x4c\x68\xe2" "\x98\x2e\xdc\x46\x61\x86\x25\x28\x15\x73\xbb\x46\xf0\xa1\xf2\x54\xf2" "\xaf\xa5\x50\xfd\xeb\x4f\x42\x89\x79\x78\x52\xb0\xff\x84\x9c\x0a\x84" "\xb9\x59\xc8\x18\x2d\x89\x91\x50\xeb\x0d\x5e\xd1\x16\xd9\xac\xae\xad" "\xaa\x32\xfa\x67\x1c\x51\x7f\x8b\x36\x52\xfd\x95\xcc\xf2\xab\x01\x52" "\xa1\x89\x5e\x5c\x75\xdf\xdf\x8a\xa2\x05\x89\xa2\xa0\x9a\x1d\xd8\xc7" "\xed\xc4\x95\x44\xfd\xfd\xa1\xb6\xe8\x85\xf2\x33\x97\x52\xcb\x14\x43" "\x6a\x69\x46\x27\x86\x62\x75\x99\x6b\xbb\xcc\x8a\xf1\x51\x2b\x5f\x33" "\x0d\xb6\x3f\x77\x4f\x8f\x44\x65\x8c\x08\xbe\x48\xdc\xdd\x45\x3a\xc5" "\x44\x53\x3e\x14\x51\x4a\xdf\xba\x2a\xa0\x73\x89\x39\x35\x30\x06\xfd" "\x93\x48\xbb\xa9\x37\xdf\x8b\x12\x98\x2d\x7a\xfa\xfd\xf2\x2a\x01\x23" "\x94\xa2\xd1\x6a\x5c\xd7\x09\xe4\xd2\xcc\x2b\xa2\x25\x4d\x33\xc8\x13" "\x7f\xb9\xb6\xaa\x0c\xe7\xd2\xf8\xd1\x8d\xf6\x42\x47\x89\x11\xb2\xf8" "\x7d\x8d\x59\x7e\xe3\x31\x70\x65\x3b\x38\xe8\x7a\x17\x2c\x9f\xf9\x17" "\xef\x1d\x1f\xf9\x8a\xc4\xfe\x1e\x71\x2d\x1b\x11\x71\x30\xc5\xa1\x9c" "\x50\x8a\x86\x9a\x79\x8d\xfa\xa4\x41\x2e\x1f\x42\xbd\x7a\x1c\x5e\x70" "\x75\xf5\x2f\xf7\x39\x4b\x47\x44\x51\x09\xb1\xef\xc4\x4a\x83\x95\xf9" "\xe3\x2a\xf4\xb7\x98\xdc\x58\x0f\x3e\x17\x1f\x11\x32\xaf\x1a\xc3\x89" "\xbd\x6a\x24\x4f\xd1\x7c\xae\x4c\x05\x1f\x4f\x27\x82\xec\x2b\x77\x96" "\x43\x75\x9d\xf9\xb2\x0a\x16\x97\xa0\x67\x76\x27\xfa\x2e\x47\x70\x05" "\x3d\x62\xdf\x1f\x73\xd7\xe3\x01\xb3\x84\xec\x4f\x75\x39\x2d\xc1\xa0" "\x87\x12\x59\xda\xfc\xf8\xd1\x4b\x93\x41\x94\x30\x6d\x9f\x66\xb9\x8f" "\x31\x7f\x6b\x7f\x71\x04\x65\x77\xf5\x75\x14\x0c\x7f\x8c\x65\xa1\x1c" "\xc8\x5e\x54\x4b\xef\x69\xd8\x47\xa7\x1e\x17\x60\xd1\x4b\xb3\xae\x51" "\x38\x39\xf7\xac\xe0\x4a\xd5\x2a\xa1\xa2\x95\x5b\xba\x61\x82\x92\xca" "\xfe\xe5\x25\x3b\xb9\xcb\x39\xff\x97\x7a\xf7\xf8\xf7\x16\xd2\x21\xe1" "\x9e\x7c\x10\xcf\xb0\x01\x49\x62\xfb\x5e\x2f\x1e\x39\x6f\xcc\x39\x74" "\x2e\xe5\x89\x70\xaa\xc4\x6f\x25\xc9\x28\xa0\x2b\xaf\x79\xee\x3a\xf1" "\x92\xe1\x84\xa5\x3e\xc1\xc5\xe4\x2f\xdd\xc2\xf8\xc7\x4e\x3c\x49\x3a" "\x2a\x9b\xef\xf6\xca\xe3\x62\x1a\xf1\xc8\x48\x3e\x5b\x7e\xa7\xe8\x2e" "\x40\xb3\xf3\x1b\xfb\xc0\xce\x7d\x3b\x5b\x00\xcd\x7b\x2b\x95\x88\xe1" "\x3d\xef\x9e\x83\x48\x57\xa4\xc3\x03\x48\xfb\x2e\x59\x9e\x66\xc9\xf5" "\xa2\x3f\x4f\x95\xc2\xf0\x87\x6b\x47\xfa\x35\x5d\x76\x42\xbb\x06\x8b" "\x14\xe0\x79\xaf\x5b\xee\x74\x12\xb1\x5e\x15\xd9\xa2\xc9\x55\x78\x69" "\xbf\x94\xd5\x89\x60\x04\xa8\x02\x93\x80\x80\xb6\x5a\x63\x9e\x7f\x3d" "\xf1\xcf\x2a\x5a\x92\x92\xbd\x05\x4e\x3e\x78\x5e\xc8\x66\xf5\x9a\xa8" "\x44\x64\x3e\x73\x36\xe5\xd8\x69\xc3\x00\xed\xce\xe8\xa3\x16\x74\x23" "\x26\xac\x3a\x6e\x4e\xb8\x3f\xc1\xec\x85\x95\x86\xe0\x13\xf0\x64\xa4" "\xdf\x73\x09\xe4\xf8\xc3\xb4\x64\xfb\x92\x7f\x98\xc5\xd9\x54\x7e\xcf" "\xa6\x5a\xaf\x40\x59\x4d\x3a\xee\x20\x54\xcc\xc4\x0a\x03\x45\x1b\xca" "\xa2\xb8\xc5\x2e\xff\xdd\xdf\xa1\x1d\x4d\xa3\xe7\xfc\x44\xc0\xdf\x08" "\xa9\xde\x70\xc7\x40\x42\x6d\xda\x99\xb4\x53\xbf\xe6\xbb\xac\x16\x1e" "\xdf\x40\x32\xf8\x54\xa2\x35\xe1\xb5\xc6\x73\x73\x88\xa3\xb6\xf3\xc0" "\xd7\xa3\x7f\xf4\x2b\x76\x4e\x61\x77\xf5\x88\xd3\x39\x65\xb8\x66\x89" "\x80\xd7\x47\x10\xad\xfd\x09\xa2\xc1\x75\x17\x88\x3d\x1a\x8c\x51\x9b" "\x84\x0a\x56\x1a\x97\x3d\x6d\x9b\x4f\x22\xcf\x45\xd2\xa4\x3a\x50\x1f" "\x0e\xcb\xc6\x8c\x48\x75\xbb\xcb\x70\x65\x5c\x23\x61\x1e\xfc\xff\xe5" "\xb9\x46\xd3\x71\x4f\x73\xfa\xca\x11\x37\x11\x0f\xae\x13\x54\x11\xd5" "\xdc\x74\x37\x20\x22\xb9\x32\xcf\xf5\x58\xad\x2e\xdb\x04\x9b\x3a\xea" "\xbc\x85\x46\xb5\xe8\x43\x69\x8b\x3e\x51\x57\x2c\xc9\xc0\xe9\x4e\x02" "\x2d\xbe\xb3\x46\xb6\x7c\x16\x1a\x33\x59\x22\x1d\x07\xe5\xe9\x39\xf9" "\xca\xec\x73\x6b\x88\xb1\xd5\x7a\x7f\x6b\x9c\xe8\xd4\xbe\x95\xec\xd4" "\xf3\x8b\xa9\x8f\x7d\xe7\xd5\x9d\xb3\x46\x95\xe6\xb2\x12\x98\xcd\x0d" "\xff\x7f\xbc\x79\x86\x6d\xc9\x72\x70\x06\x48\x1e\x43\x4b\x37\x40\x35" "\x21\x8d\xbf\x0e\x03\x47\xeb\x36\x51\x27\x0a\x16\xdc\x3a\x76\x4d\x30" "\xd9\xbd\xf1\x4f\xa7\xcf\x75\x35\x1d\x67\xc4\xd2\x02\x6d\xe3\x65\x8f" "\xa2\x86\xb9\x78\xb2\xeb\x2c\x55\xdb\x4a\x0f\x43\x6e\x0f\x9d\x9b\xdb" "\x00\x7a\x29\x03\x08\xd5\x72\xdb\x7a\x00\x6e\xe3\xf0\x65\x27\x2c\x88" "\x23\x45\xb7\x27\x6d\x69\xaf\xb5\x6d\x1a\x68\x8f\x3b\xe7\xf7\x01\xe3" "\x29\xaf\xea\x26\x13\x43\xd7\x20\xac\x2a\xa4\xd9\x0c\x72\x5d\x65\x46" "\xd3\x55\x02\xe9\xb2\x42\x58\xc4\x04\x44\x07\xe2\x86\x23\x40\xc8\x0b" "\x66\xbe\x09\xed\x95\x8e\x36\x64\xb2\x21\x43\xb1\xe4\x4e\xb4", 8192); *(uint64_t*)0x20000bc0 = 0x20000340; *(uint32_t*)0x20000340 = 0x50; *(uint32_t*)0x20000344 = 0; *(uint64_t*)0x20000348 = 0; *(uint32_t*)0x20000350 = 7; *(uint32_t*)0x20000354 = 0x24; *(uint32_t*)0x20000358 = 0; *(uint32_t*)0x2000035c = 0; *(uint16_t*)0x20000360 = 0; *(uint16_t*)0x20000362 = 0; *(uint32_t*)0x20000364 = 0; *(uint32_t*)0x20000368 = 0; *(uint16_t*)0x2000036c = 0; *(uint16_t*)0x2000036e = 0; memset((void*)0x20000370, 0, 32); *(uint64_t*)0x20000bc8 = 0; *(uint64_t*)0x20000bd0 = 0; *(uint64_t*)0x20000bd8 = 0; *(uint64_t*)0x20000be0 = 0; *(uint64_t*)0x20000be8 = 0; *(uint64_t*)0x20000bf0 = 0; *(uint64_t*)0x20000bf8 = 0; *(uint64_t*)0x20000c00 = 0; *(uint64_t*)0x20000c08 = 0; *(uint64_t*)0x20000c10 = 0; *(uint64_t*)0x20000c18 = 0; *(uint64_t*)0x20000c20 = 0; *(uint64_t*)0x20000c28 = 0; *(uint64_t*)0x20000c30 = 0; *(uint64_t*)0x20000c38 = 0; syz_fuse_handle_req(r[0], 0x200054c0, 0x2000, 0x20000bc0); break; case 8: memcpy((void*)0x20000140, "./file0\000", 8); memcpy((void*)0x20000040, "fuse\000", 5); memcpy((void*)0x20000180, "fd=", 3); sprintf((char*)0x20000183, "%020llu", (long long)r[0]); memcpy((void*)0x20000197, "\x2c\x72\x6f\x6f\x74\x6d\x6f\x64\x65\x3d\x30\x30\x30\x30\x30\x30" "\x30\x30\x30\x30\x30\x30\x61\x30\xfc\x2a\xef\xed\x2e\x3d\xff\x1f" "\xaa\x63\x75\x73\x65\x72\x5f\x69\x64", 41); syscall(__NR_mount, 0x20000000ul, 0x20000140ul, 0x20000040ul, 0ul, 0x20000180ul); break; } } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); do_sandbox_none(); return 0; }