// https://syzkaller.appspot.com/bug?id=a1f5816d285b5e610d7d7f9b04bcfb9732fdc5ef // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include const int kFailStatus = 67; const int kRetryStatus = 69; __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } __attribute__((noreturn)) static void fail(const char* msg, ...) { int e = errno; fflush(stdout); va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); } #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } static void use_temporary_dir() { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) fail("failed to mkdtemp"); if (chmod(tmpdir, 0777)) fail("failed to chmod"); if (chdir(tmpdir)) fail("failed to chdir"); } static void vsnprintf_check(char* str, size_t size, const char* format, va_list args) { int rv; rv = vsnprintf(str, size, format, args); if (rv < 0) fail("tun: snprintf failed"); if ((size_t)rv >= size) fail("tun: string '%s...' doesn't fit into buffer", str); } static void snprintf_check(char* str, size_t size, const char* format, ...) { va_list args; va_start(args, format); vsnprintf_check(str, size, format, args); va_end(args); } #define COMMAND_MAX_LEN 128 static void execute_command(const char* format, ...) { va_list args; char command[COMMAND_MAX_LEN]; int rv; va_start(args, format); vsnprintf_check(command, sizeof(command), format, args); rv = system(command); if (rv != 0) fail("tun: command \"%s\" failed with code %d", &command[0], rv); va_end(args); } static int tunfd = -1; #define SYZ_TUN_MAX_PACKET_SIZE 1000 #define MAX_PIDS 32 #define ADDR_MAX_LEN 32 #define LOCAL_MAC "aa:aa:aa:aa:aa:%02hx" #define REMOTE_MAC "bb:bb:bb:bb:bb:%02hx" #define LOCAL_IPV4 "172.20.%d.170" #define REMOTE_IPV4 "172.20.%d.187" #define LOCAL_IPV6 "fe80::%02hxaa" #define REMOTE_IPV6 "fe80::%02hxbb" static void initialize_tun(uint64_t pid) { if (pid >= MAX_PIDS) fail("tun: no more than %d executors", MAX_PIDS); int id = pid; tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) fail("tun: can't open /dev/net/tun"); char iface[IFNAMSIZ]; snprintf_check(iface, sizeof(iface), "syz%d", id); struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, iface, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) fail("tun: ioctl(TUNSETIFF) failed"); char local_mac[ADDR_MAX_LEN]; snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC, id); char remote_mac[ADDR_MAX_LEN]; snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC, id); char local_ipv4[ADDR_MAX_LEN]; snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, id); char remote_ipv4[ADDR_MAX_LEN]; snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, id); char local_ipv6[ADDR_MAX_LEN]; snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, id); char remote_ipv6[ADDR_MAX_LEN]; snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, id); execute_command("sysctl -w net.ipv6.conf.%s.accept_dad=0", iface); execute_command("sysctl -w net.ipv6.conf.%s.router_solicitations=0", iface); execute_command("ip link set dev %s address %s", iface, local_mac); execute_command("ip addr add %s/24 dev %s", local_ipv4, iface); execute_command("ip -6 addr add %s/120 dev %s", local_ipv6, iface); execute_command("ip neigh add %s lladdr %s dev %s nud permanent", remote_ipv4, remote_mac, iface); execute_command("ip -6 neigh add %s lladdr %s dev %s nud permanent", remote_ipv6, remote_mac, iface); execute_command("ip link set dev %s up", iface); } static void setup_tun(uint64_t pid, bool enable_tun) { if (enable_tun) initialize_tun(pid); } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } static uintptr_t syz_emit_ethernet(uintptr_t a0, uintptr_t a1) { if (tunfd < 0) return (uintptr_t)-1; int64_t length = a0; char* data = (char*)a1; return write(tunfd, data, length); } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); unshare(CLONE_NEWNS); unshare(CLONE_NEWIPC); unshare(CLONE_IO); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { close(fd); return false; } close(fd); return true; } static int real_uid; static int real_gid; static int epid; static bool etun; __attribute__((aligned(64 << 10))) static char sandbox_stack[1 << 20]; static int namespace_sandbox_proc(void* arg) { sandbox_common(); write_file("/proc/self/setgroups", "deny"); if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) fail("write of /proc/self/uid_map failed"); if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) fail("write of /proc/self/gid_map failed"); setup_tun(epid, etun); if (mkdir("./syz-tmp", 0777)) fail("mkdir(syz-tmp) failed"); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) fail("mount(tmpfs) failed"); if (mkdir("./syz-tmp/newroot", 0777)) fail("mkdir failed"); if (mkdir("./syz-tmp/newroot/dev", 0700)) fail("mkdir failed"); if (mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND | MS_REC | MS_PRIVATE, NULL)) fail("mount(dev) failed"); if (mkdir("./syz-tmp/newroot/proc", 0700)) fail("mkdir failed"); if (mount(NULL, "./syz-tmp/newroot/proc", "proc", 0, NULL)) fail("mount(proc) failed"); if (mkdir("./syz-tmp/pivot", 0777)) fail("mkdir failed"); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) fail("chdir failed"); } else { if (chdir("/")) fail("chdir failed"); if (umount2("./pivot", MNT_DETACH)) fail("umount failed"); } if (chroot("./newroot")) fail("chroot failed"); if (chdir("/")) fail("chdir failed"); struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) fail("capget failed"); cap_data[0].effective &= ~(1 << CAP_SYS_PTRACE); cap_data[0].permitted &= ~(1 << CAP_SYS_PTRACE); cap_data[0].inheritable &= ~(1 << CAP_SYS_PTRACE); if (syscall(SYS_capset, &cap_hdr, &cap_data)) fail("capset failed"); loop(); doexit(1); } static int do_sandbox_namespace(int executor_pid, bool enable_tun) { real_uid = getuid(); real_gid = getgid(); epid = executor_pid; etun = enable_tun; mprotect(sandbox_stack, 4096, PROT_NONE); return clone( namespace_sandbox_proc, &sandbox_stack[sizeof(sandbox_stack) - 64], CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWUTS | CLONE_NEWNET, NULL); } long r[96]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); *(uint8_t*)0x20001000 = (uint8_t)0xaa; *(uint8_t*)0x20001001 = (uint8_t)0xaa; *(uint8_t*)0x20001002 = (uint8_t)0xaa; *(uint8_t*)0x20001003 = (uint8_t)0xaa; *(uint8_t*)0x20001004 = (uint8_t)0xaa; *(uint8_t*)0x20001005 = (uint8_t)0x0; memcpy((void*)0x20001006, "\xde\x89\x5d\xb1\x46\x8d", 6); *(uint16_t*)0x2000100c = (uint16_t)0xdd86; STORE_BY_BITMASK(uint8_t, 0x2000100e, 0x0, 0, 4); STORE_BY_BITMASK(uint8_t, 0x2000100e, 0x6, 4, 4); memcpy((void*)0x2000100f, "\xa2\x28\xaf", 3); *(uint16_t*)0x20001012 = (uint16_t)0x1400; *(uint8_t*)0x20001014 = (uint8_t)0x6; *(uint8_t*)0x20001015 = (uint8_t)0x0; *(uint8_t*)0x20001016 = (uint8_t)0xfe; *(uint8_t*)0x20001017 = (uint8_t)0x80; *(uint8_t*)0x20001018 = (uint8_t)0x0; *(uint8_t*)0x20001019 = (uint8_t)0x0; *(uint8_t*)0x2000101a = (uint8_t)0x0; *(uint8_t*)0x2000101b = (uint8_t)0x0; *(uint8_t*)0x2000101c = (uint8_t)0x0; *(uint8_t*)0x2000101d = (uint8_t)0x0; *(uint8_t*)0x2000101e = (uint8_t)0x0; *(uint8_t*)0x2000101f = (uint8_t)0x0; *(uint8_t*)0x20001020 = (uint8_t)0x0; *(uint8_t*)0x20001021 = (uint8_t)0x0; *(uint8_t*)0x20001022 = (uint8_t)0x0; *(uint8_t*)0x20001023 = (uint8_t)0x0; *(uint8_t*)0x20001024 = (uint8_t)0x0; *(uint8_t*)0x20001025 = (uint8_t)0xbb; *(uint8_t*)0x20001026 = (uint8_t)0xfe; *(uint8_t*)0x20001027 = (uint8_t)0x80; *(uint8_t*)0x20001028 = (uint8_t)0x0; *(uint8_t*)0x20001029 = (uint8_t)0x0; *(uint8_t*)0x2000102a = (uint8_t)0x0; *(uint8_t*)0x2000102b = (uint8_t)0x0; *(uint8_t*)0x2000102c = (uint8_t)0x0; *(uint8_t*)0x2000102d = (uint8_t)0x0; *(uint8_t*)0x2000102e = (uint8_t)0x0; *(uint8_t*)0x2000102f = (uint8_t)0x0; *(uint8_t*)0x20001030 = (uint8_t)0x0; *(uint8_t*)0x20001031 = (uint8_t)0x0; *(uint8_t*)0x20001032 = (uint8_t)0x0; *(uint8_t*)0x20001033 = (uint8_t)0x0; *(uint8_t*)0x20001034 = (uint8_t)0x0; *(uint8_t*)0x20001035 = (uint8_t)0xaa; *(uint16_t*)0x20001036 = (uint16_t)0x204e; *(uint16_t*)0x20001038 = (uint16_t)0x214e; *(uint32_t*)0x2000103a = (uint32_t)0x42424242; *(uint32_t*)0x2000103e = (uint32_t)0x42424242; STORE_BY_BITMASK(uint8_t, 0x20001042, 0x0, 0, 1); STORE_BY_BITMASK(uint8_t, 0x20001042, 0x0, 1, 3); STORE_BY_BITMASK(uint8_t, 0x20001042, 0x5, 4, 4); *(uint8_t*)0x20001043 = (uint8_t)0x2; *(uint16_t*)0x20001044 = (uint16_t)0x0; *(uint16_t*)0x20001046 = (uint16_t)0x0; *(uint16_t*)0x20001048 = (uint16_t)0x0; struct csum_inet csum_58; csum_inet_init(&csum_58); csum_inet_update(&csum_58, (const uint8_t*)0x20001016, 16); csum_inet_update(&csum_58, (const uint8_t*)0x20001026, 16); uint32_t csum_58_chunk_2 = 0x14000000; csum_inet_update(&csum_58, (const uint8_t*)&csum_58_chunk_2, 4); uint32_t csum_58_chunk_3 = 0x6000000; csum_inet_update(&csum_58, (const uint8_t*)&csum_58_chunk_3, 4); csum_inet_update(&csum_58, (const uint8_t*)0x20001036, 20); *(uint16_t*)0x20001046 = csum_inet_digest(&csum_58); r[59] = syz_emit_ethernet(0x4aul, 0x20001000ul); r[60] = syscall(__NR_socket, 0x11ul, 0x803ul, 0x0ul); memcpy((void*)0x2008e000, "\x00\x01\x01\x96", 4); r[62] = syscall(__NR_setsockopt, r[60], 0x107ul, 0xful, 0x2008e000ul, 0x4ul); *(uint64_t*)0x207fcfc8 = (uint64_t)0x20d03fa0; *(uint32_t*)0x207fcfd0 = (uint32_t)0x60; *(uint64_t*)0x207fcfd8 = (uint64_t)0x20990f90; *(uint64_t*)0x207fcfe0 = (uint64_t)0x6; *(uint64_t*)0x207fcfe8 = (uint64_t)0x20058000; *(uint64_t*)0x207fcff0 = (uint64_t)0x10; *(uint32_t*)0x207fcff8 = (uint32_t)0x42880; *(uint16_t*)0x20d03fa0 = (uint16_t)0x27; *(uint32_t*)0x20d03fa4 = (uint32_t)0x3; *(uint32_t*)0x20d03fa8 = (uint32_t)0x81; *(uint32_t*)0x20d03fac = (uint32_t)0x0; *(uint8_t*)0x20d03fb0 = (uint8_t)0x0; *(uint8_t*)0x20d03fb1 = (uint8_t)0x0; memcpy((void*)0x20d03fb2, "\xac\x37\xd7\x00\x19\x29\x62\xf3\xbb\x01\xa4\x62\xdb\xa3\x95" "\x59\x9c\x9c\x9b\xe7\x8f\x4b\xdf\xfb\xf1\xcc\x00\xa2\x4f\x9c" "\x55\xc4\xe3\x54\xe5\x16\x13\xca\xc2\xd1\x13\x81\x0b\x4c\x05" "\xca\xe7\x8f\x3e\x86\x1c\x32\x17\x87\xe0\x42\xeb\xd1\x15\x52" "\x22\x53\x41", 63); *(uint64_t*)0x20d03ff8 = (uint64_t)0x6; *(uint64_t*)0x20990f90 = (uint64_t)0x2077af8b; *(uint64_t*)0x20990f98 = (uint64_t)0x75; *(uint64_t*)0x20990fa0 = (uint64_t)0x20096000; *(uint64_t*)0x20990fa8 = (uint64_t)0x0; *(uint64_t*)0x20990fb0 = (uint64_t)0x20bc1000; *(uint64_t*)0x20990fb8 = (uint64_t)0x1000; *(uint64_t*)0x20990fc0 = (uint64_t)0x20338000; *(uint64_t*)0x20990fc8 = (uint64_t)0x0; *(uint64_t*)0x20990fd0 = (uint64_t)0x20956f62; *(uint64_t*)0x20990fd8 = (uint64_t)0x0; *(uint64_t*)0x20990fe0 = (uint64_t)0x20fb3000; *(uint64_t*)0x20990fe8 = (uint64_t)0x0; memcpy((void*)0x2077af8b, "\xe0\x01\x71\x05\x11\x21\x02\x00\x63\xe8\x14\x67\x1a\x8d\x2b" "\x66\xdf\x33\xa6\x7f\xc4\x1c\x5a\x4e\x75\x3a\xd6\xc5\x3e\x67" "\x01\x78\xf5\x99\x6c\x4b\xa3\xd9\x00\x00\x00\x02\xdf\x6f\x02" "\x00\xc9\x2b\x6e\x91\x00\x7c\xe6\x81\x27\x73\xee\xe7\x0b\x8f" "\x18\xd2\x23\x7a\xc5\xd3\xe6\x55\xe6\xc3\xcf\xb7\xcf\x8b\x86" "\x62\xa1\x82\x2c\x0d\x06\x37\x2a\x4d\xa1\x2d\x0b\x85\x23\xf9" "\x6d\x4b\x0f\x01\x18\xb1\x70\xe3\xa1\x2a\xdd\x46\x8d\x46\x3b" "\x22\x27\xef\x13\xaa\x8a\x39\x7f\x6b\x12\x91\x1b", 117); memcpy( (void*)0x20bc1000, "\x3f\x2b\x9c\xbc\xdf\xec\xfc\x7c\x02\xb1\x9e\xf5\xd4\xaa\xf9\x7c" "\xde\x37\x2a\xdb\xdc\x8c\x86\xfc\x6b\xeb\x23\x5f\x1a\x13\x2b\x4f" "\x46\xbf\x53\x9c\x82\x4c\xb5\xb3\x46\x97\xe8\xda\xc1\xbd\x3f\xc6" "\x4d\xcd\x9b\x60\x84\xe7\x0e\x1d\x51\x31\x34\x5c\x22\x2a\xd4\x6c" "\x77\xf8\x06\x68\x70\x88\x39\x27\x83\x4c\xcb\x3b\x68\x77\x05\x53" "\x38\x37\x7a\xce\x27\xda\x14\x91\x60\xfe\xfb\xba\xed\x75\xe9\x11" "\x1a\x35\xc9\xf3\x7f\x73\xea\xcc\x60\x70\x1d\xa8\x79\x9e\x33\xe6" "\x4d\x7d\xd0\xdb\x0f\xc8\xde\x0e\x26\x86\x48\x08\x70\xe3\xd1\x59" "\xff\xe0\x6e\x79\x5a\xd7\x31\x1c\x84\x29\x8d\x35\x33\x41\xa2\x23" "\x34\xd3\x32\xee\x17\xd6\x84\x77\x3c\xc6\xfc\x00\x64\x80\x0d\x2e" "\x0e\x4c\x86\x6e\xa4\x32\x7b\x91\xc1\xd9\xed\xa8\x0c\x3c\xf1\x50" "\x86\x88\xe4\x65\x57\x30\x9d\x94\x7d\x1c\xcf\xb4\xd8\xf7\x03\xf0" "\xd6\xc7\x43\x96\x5f\x48\xd2\xae\xc0\x10\xfb\x47\x8b\xa9\xbe\xa3" "\xf2\x82\x5e\xc3\x40\xc4\x80\x78\xb9\x8c\xdd\x90\x80\x85\x8a\x0f" "\xf0\x91\x1c\x81\x33\xb4\x36\xe8\xba\x1d\xb8\x06\x88\x7a\x5c\x2d" "\x54\x23\xc3\x68\x19\xa9\x4f\xf5\x12\x15\x07\x8d\x05\x75\x36\xa8" "\xac\xab\xd3\x0d\x01\xe4\x4b\x96\xd2\xb8\x9e\xd1\x91\x86\xfb\xe8" "\x15\x92\x6d\xc1\x8b\xa0\x10\xab\x5d\xa3\x63\xee\x11\x8c\x95\xc5" "\x96\xd3\x91\x75\xa6\x97\xf9\xe5\xfd\x80\xc7\xce\xbd\x87\x27\xc6" "\xee\xc7\x01\x4a\x78\x9c\x0a\x9d\x13\x1a\x82\xb4\xd8\x0a\xb2\xf1" "\x04\xd6\x92\xce\x38\x1a\xdb\xda\x05\x7f\xf2\x61\x6d\xdc\x40\x67" "\x42\x51\xbb\xee\xad\xab\x0d\x3c\x57\xce\x4c\x17\x5b\xcc\x09\xe3" "\xe4\xa1\xef\xaa\xb9\x75\x11\x7f\x05\xe6\x02\xc8\x5a\xf9\xcd\x47" "\x87\xfa\x35\x3a\x63\x84\x84\xff\x4f\x58\xd3\x06\xbc\xe1\xb9\xc0" "\x12\xb3\x5c\x03\x82\x8f\x8d\xfa\x68\x75\xfb\x82\xde\x35\x21\x39" "\x5b\x78\xde\x07\xe6\xa6\x7b\x0b\x0f\xdf\x59\x24\x14\xa2\x81\x33" "\xed\x5f\x42\xc4\xee\x94\xbc\x06\x9f\xb0\xb5\xe4\xdd\xf3\x99\xdf" "\x52\x89\x12\x59\x55\xfa\x18\x3f\x67\x78\xa8\x79\x2e\x6f\xdd\x73" "\x7c\x94\x8e\x5c\x8f\xa4\xd2\xcb\xa0\x02\x3f\xc9\x21\x24\x06\x04" "\x09\x88\x37\x27\x38\x8a\x26\x74\xf5\x4d\x56\x37\x6a\xb3\x98\xd1" "\x4d\x7d\xbc\xdd\x2f\x53\xae\x82\xf6\x2c\xfd\x94\x87\x1e\x9e\xaa" "\xdf\x1b\x9a\xd3\xfe\x29\xc4\xe9\xf0\x4b\x38\x1f\xe5\x7c\xd4\x99" "\x03\xdb\x57\x01\x26\x69\x54\x3a\xb9\xe8\x75\x9a\x4c\x92\x35\xaf" "\x3b\x7f\x9b\xf8\x53\x97\xd2\x98\x13\x07\x37\x2b\xac\x22\xa5\x4a" "\xec\xf0\x26\xfa\x6a\x03\x40\x72\x26\xfa\x68\xe7\xd5\xbd\xa1\x83" "\x4b\xbf\x6a\xa9\x10\xa7\xc2\xae\xbf\x08\x18\x75\x2a\x49\x8c\xaf" "\x33\x93\xfd\x56\x83\x58\x9b\x56\xe2\xcf\x0c\x77\xdf\x34\xb1\x94" "\xdd\x82\x99\xf0\xfd\x9c\x06\x0c\x98\x94\x08\xa7\x46\x02\xcf\x7f" "\x93\xde\x0e\x9a\xdb\xa9\x27\x10\xee\xf6\xc3\x21\xc2\x54\x48\xe8" "\x1a\x0e\x7d\xcb\x37\x40\x72\x7d\x6b\x28\x46\x1d\xdb\x85\x48\x14" "\x06\xdb\x97\xb8\x87\x19\x38\xca\x96\x38\x32\x95\xc3\xfc\xa8\x06" "\x8e\xad\x13\xe1\xeb\x90\xad\xde\x2c\x9d\xd2\x1e\xad\xb2\xa1\x98" "\x31\x61\xe1\x4f\x90\x1f\xce\xfe\x57\xdb\x1a\xc2\x9c\x19\xf6\xb9" "\x6b\x67\x2e\x69\x9f\x03\x26\x1d\x04\x9a\x6b\xa2\x5a\xc6\x05\xb3" "\x15\x1b\x7c\x91\xcd\x3f\xc6\x79\xaf\x84\x20\x21\x18\x61\x56\x2a" "\xf1\x4c\x6f\x9d\x24\x6e\xb2\xf9\x51\xe8\x0a\xb0\xac\xf3\x7e\x05" "\xe5\x77\x02\x92\xff\x69\xa6\xaa\x9e\x83\x82\x8a\x78\x0d\xd7\xcd" "\xa5\x80\x6b\xd4\xb4\xb3\xca\xeb\x49\xf2\x2c\x61\x14\x95\x4c\xad" "\xf6\x65\x8a\x3e\x06\x79\xba\x86\xc3\xdd\xf4\x45\x5b\xd6\xcc\x5a" "\x21\xe8\x40\xaf\x31\xc3\xfd\xd1\x57\x89\x9c\x4e\x91\x4f\x83\x0b" "\x76\x7f\x16\xfb\x40\x25\x45\x93\xa8\x0f\x4e\xc3\xd5\x6a\xc5\x97" "\xcd\x4a\xb4\x66\xbe\xea\x7c\xfa\xfe\x03\x8a\xe9\x6c\x60\xcc\x91" "\x14\x67\x40\x9d\x5d\x46\x8f\x7c\xcb\x77\x0e\xa1\xf0\x87\x77\xe1" "\xd2\xf7\xfb\x17\x00\xd2\x4d\xad\x6b\xe9\x5c\x12\xed\x16\xdc\x5e" "\x3f\xb1\x90\x9a\xd4\x48\x32\xd9\xc4\x36\x66\x9a\x2e\x42\xeb\xe5" "\x12\x00\x9f\x99\x3b\xeb\x55\x85\xb3\x52\xe5\xd5\xad\x57\x19\xdf" "\xbb\xac\x84\x24\x63\x30\x26\x6f\xfe\x32\xf7\x04\xa5\x03\x4c\x37" "\xdb\x08\x25\x0f\x54\x91\xb6\x4b\xe4\x18\xec\x0a\x9f\x75\xed\xad" "\xdd\x21\x7c\x4c\xfb\xc7\x6b\xb2\x5e\x1f\xfe\x3f\xfa\xed\x1a\xe3" "\xe9\xec\x50\x8e\xfa\x9d\x5b\x25\xcc\xa4\xf3\x76\x8e\xa5\xfd\xdb" "\x5b\x5a\x12\xe8\xdf\xb0\x83\x2b\x04\x07\x63\xc5\x9c\x27\x0e\x8c" "\xae\x4a\x56\xe0\x16\x51\x3e\x16\xd1\x83\x8a\xdd\x03\xd1\x22\x68" "\xde\x4e\x50\xf1\x2d\xb2\x69\x1b\x6e\x4d\x6a\xe8\xe6\xce\x2c\xd9" "\x7d\xc4\x7f\xe8\x38\x7a\x75\xb6\x89\xf8\xa8\x97\x2d\xf9\x40\xc5" "\x2d\xe7\x45\x59\x68\x71\xb9\x69\x9b\xfe\xd6\x09\x54\xad\x74\x9f" "\x36\x09\xbe\xdf\x39\x1e\xb9\x22\xff\x6b\x57\x22\xb4\x38\x4a\x48" "\xef\xaf\x44\xd0\x53\x03\x8f\x9d\xd3\x97\x52\xbe\x72\x98\x54\x8c" "\x93\xae\xa6\x4e\x85\x66\x99\x3b\xe0\xff\x46\xb9\x76\x6d\x3c\x13" "\x14\x8a\x28\xe3\xb9\x6d\x6d\x72\x26\xfb\x98\x12\x07\x0a\x0a\xab" "\xad\xaf\x3b\x3e\xc7\x22\x30\x7f\xc8\x04\x96\xf3\x1d\xc5\x20\x7b" "\xbc\x2a\xf8\x22\x80\x54\x0d\x06\x96\xe1\x83\xa8\xa4\x22\xc5\x18" "\xde\xdb\xa9\xe3\x31\xa7\xe0\x46\xe0\xfc\x61\x12\xbc\xd3\x8d\xd7" "\xd5\x39\xfb\x0a\x9c\x7b\x5d\x7b\x7f\x1c\x39\xba\x92\x4f\xdb\x65" "\x9e\x25\x55\x94\xcc\x26\xdf\xe5\x77\x16\xa8\x21\x4d\x32\xb2\x80" "\xca\xd8\x5e\xa8\x67\xef\xe8\x98\x1a\xf1\x90\xcc\x3e\x51\x0a\xcb" "\x30\x76\x11\x79\xe8\x02\xd3\x03\x47\x66\xc7\x45\x42\xca\x6d\xad" "\xc2\xf8\x87\x2b\x38\x22\xae\x4a\x1c\x90\xc5\xb5\xca\xd7\x8d\x18" "\xea\xd9\x26\x49\x28\x51\x2e\xee\x54\x4a\x25\x3f\x4b\xe4\x3c\x14" "\x67\x45\x02\xdd\xf9\x4e\x1c\xd5\x4e\x04\x18\x4e\xd9\xab\xd8\xb0" "\x16\xf1\x2f\x3c\x82\xda\x90\x96\xb8\x40\x6b\x17\x9b\x87\x66\x5e" "\x3b\x5f\x13\x0f\x07\x06\x78\xcd\x92\xa3\xba\x44\xb1\x23\xb2\xab" "\x2c\x5b\x50\xe4\x5c\x8f\x8e\xbe\x04\x06\xa1\x30\xd0\x5a\x61\x8a" "\xba\xb3\x9b\x8b\x1e\x00\x98\x69\xa6\x20\x8d\x6f\x84\x0a\x63\x3b" "\x95\x5f\x4d\x69\x3e\x06\xfd\xe1\x85\xde\x47\xff\xb2\xf1\x9e\x39" "\x03\x95\x41\xa6\xb8\x2c\x10\x37\xbe\x63\x89\xbe\xc6\x4e\x3b\xe1" "\x93\x80\x5f\xdc\x97\x84\x59\xb6\x65\x52\x5c\xac\xa7\x54\xb7\x00" "\x10\x37\xee\x41\xb8\x82\xa8\xf3\x5d\xbc\x49\xf2\xca\xe9\x20\x42" "\x63\xfd\xd9\x2a\xe6\x7e\x25\x65\x90\x33\x2f\x15\xf8\x27\x2d\x3c" "\x98\xf4\xd6\xea\x08\x77\x3b\x89\x56\x2f\xbf\x36\x7d\x82\x6b\x5a" "\x22\x89\x9f\xb9\xf5\x18\x76\x5c\x7f\x0a\x05\xa5\x1a\x5f\xe0\xf0" "\xcc\xdf\xc3\xb2\xdb\x5b\xa2\xab\x5d\x86\xb7\x99\xa9\xc4\x13\x85" "\x77\xc6\xef\x5f\x7b\xb5\x9d\x53\x82\x77\x03\x7d\xe2\x1b\xb0\x4a" "\x7d\xc0\x10\xe6\xc1\x1b\xdb\x98\x39\xad\x00\xf5\x87\x2d\xaf\x7f" "\xae\x62\x91\xc3\x17\x8d\xa7\x61\x9c\x01\x65\x72\x0d\xe4\xb6\x49" "\xc4\x6e\xfd\x8a\x7a\x4e\xc1\x2c\x21\x4b\x4e\xca\x42\x97\x1c\x17" "\x1d\x8d\x54\x56\x6f\xb0\x9a\x01\xee\x3b\x0f\xb8\xc3\xc6\x58\xb5" "\xd1\x92\x3e\x2a\x03\xed\x8d\xef\xb5\xb6\x7f\x66\x04\xb5\x6b\x50" "\x4b\x8b\xed\x0d\xad\x63\x2c\x45\x71\x85\x19\x49\xea\xae\xfe\x0e" "\x06\x3f\x44\x2f\x95\xdf\xba\x92\xc6\x67\xcc\x3d\x58\xde\xe6\x0f" "\xd4\x10\x93\xb2\xdd\x5d\x17\x6a\xec\x31\xfd\x90\x41\xa6\x73\x41" "\x89\xe6\x50\x7a\x1b\xa7\x21\x6b\x2e\xf0\xc7\x2d\xcd\xde\xcb\x1c" "\xfd\x83\x7d\x7a\x20\x2d\xe2\x9a\x2f\x66\xfa\xb6\xb8\x07\x13\x69" "\xc8\xd9\xd9\xc7\x4e\x51\xed\xf5\xb5\x3c\x5c\xb1\x5a\x1c\xf3\xed" "\x0a\xcf\x17\x27\x60\x72\xa4\xa7\x5e\xb4\xdf\xfe\x2a\x14\x32\x0f" "\xf1\xa8\xcd\x2d\x2e\x75\x1c\xf9\xfc\xe2\xf1\xa2\xad\x4c\xb4\xc1" "\xeb\x3f\x43\x5c\x51\xa2\xb2\x1b\x88\x9c\xe8\x35\xa4\xb9\x96\x80" "\xe4\x4b\x6d\x59\x27\x62\x8b\x9c\x57\x17\x1c\x0d\xb0\x24\x0a\x8d" "\x9f\x08\x1e\x8a\xd5\x0b\xda\x6a\xaf\xf4\x79\xd4\x5e\xca\x40\xd0" "\xb0\x6f\xe8\x70\xb3\x89\xbc\x34\x34\x05\x1f\xa8\x9f\xa7\x34\x8e" "\x25\x27\xa3\x42\x8e\xa2\x61\xbc\x94\x9b\xc0\xbd\xc9\x14\x05\x85" "\xb8\xa9\x6c\x2e\x3f\x74\x09\x27\x7e\xd5\xbc\xf8\xc1\xe8\x4a\x55" "\x6e\x19\x03\xc9\xb0\x5a\x34\x39\x43\xc9\x6d\x9c\xfc\xf5\x18\xe7" "\xf0\x7c\x35\xbc\x46\x57\x49\xb4\xf2\x7e\x07\x4d\x09\xce\x92\x89" "\x2b\xe3\x0c\x26\x2d\xd7\xf1\xd4\x55\x7d\xfb\xc2\x30\x71\x63\x2d" "\x48\xd3\xb7\x26\x2f\x5b\xad\x49\xd6\x36\x3a\xe4\x20\x78\xc6\xe8" "\xe7\x2d\x88\x6c\x80\xc3\xce\x0f\xdd\xec\xa7\x17\x22\x94\xf3\x4e" "\x54\xd7\xee\x8d\x01\xf9\x32\x65\x6e\x05\x7f\xd6\x3c\x19\x57\x89" "\x33\xb8\x23\xd3\x54\xac\x3d\xd9\xab\x99\x07\x62\xb5\x34\x3c\x06" "\x7b\x10\x92\x85\x80\x99\xfb\x75\x3d\xea\xab\xab\xda\x6a\xb3\x40" "\xc5\x19\xbd\x36\x57\xdc\x0f\xf2\xfb\x56\x6d\x2c\x0b\xbc\xa6\xae" "\xa1\xa5\x5b\x35\x27\xf8\xdb\x4b\xc7\xec\x24\x64\x08\x8e\x4f\xc7" "\x6e\x3f\x12\x0c\x33\x2b\x56\xa1\xd8\x44\xe2\xa4\x93\x4b\x85\xb7" "\x56\x2c\xe5\xfb\x88\x62\xda\x71\x7e\x12\x5b\xae\x84\xe0\x9b\x29" "\x00\x43\x27\x04\xde\x80\x19\xf0\xef\xb4\xc4\xc4\x62\x67\x25\x1b" "\xc5\x8d\x49\xd7\x0c\x7d\xff\x38\x27\xf9\xe6\x43\xbe\x7e\x0c\xa3" "\xce\x89\x9a\xce\xee\xd9\xee\x4c\x67\x63\x1b\x17\xd0\xcd\xe4\xcd" "\x83\xfc\x11\xac\xb9\xc9\x2c\xb8\xeb\x53\xd2\x3e\x40\x34\x6f\x27" "\x0f\x58\x63\x62\x46\xb5\xd0\x88\x31\x84\x7b\xd6\x57\xa2\xd8\x17" "\x34\x32\xcc\xde\x25\x52\x05\x91\xbf\xfa\x62\x17\x61\x10\x7b\x8f" "\xad\xdf\xdb\xb1\x71\xe4\xaa\xcb\x2b\xf6\xfb\xe9\x69\xba\x18\x0f" "\x49\x3c\xca\xcd\x42\x08\x6f\x2a\x82\x56\x73\x83\xef\xe0\xf1\x12" "\x90\xda\x96\xce\xb3\xd7\xbd\x49\x4a\x3c\xa9\x47\xc9\xd7\xc1\x8b" "\x57\xe5\xb7\x03\xbb\x42\xef\xef\x5b\x2c\xb6\xe9\xaf\x3e\xac\x10" "\xdb\xa9\x2e\x5d\x3d\x9b\xfb\x20\xa1\x7d\xbd\x43\x9d\x95\xce\x28" "\x1c\x71\xe3\x26\xc1\xe2\x9b\xf3\x90\x2b\xff\x0c\x18\x21\x85\x88" "\x92\x68\x1e\x3f\xe8\xad\xdf\x6c\xfa\x57\x33\x95\x5a\xd9\x79\xb9" "\x7f\x09\x48\x52\x16\x11\x6f\xd6\x5a\xc8\x93\xc5\x0b\xf2\xcb\x7b" "\xbf\x34\x57\x39\x93\x3e\x63\xc8\x7c\xc5\x7c\x65\x0b\x7b\xcf\xd9" "\xae\xbf\xb9\x2e\xb4\x54\x96\x84\x92\x9f\x71\xaf\x83\x5e\x67\x83" "\x3a\xd4\xa6\x06\x29\x6b\xfc\x0a\xd8\x79\xc8\x13\xb5\x97\x49\x64" "\x03\xd9\x0b\x76\x55\xcb\x76\xce\x2c\x4b\x66\x1e\xe0\x55\x55\x2f" "\xeb\xdc\xb4\xaa\x49\xb0\x25\x5e\xed\x06\xf7\x10\x58\xf0\x8d\xfe" "\x4c\x9c\xb6\xc8\x44\x0a\xd3\xea\x2e\x59\x06\xc8\x64\x84\x8e\xcf" "\x0c\xc6\x58\x63\x4f\x6b\xe5\xb4\x54\xd3\x89\x77\xf7\xd6\xb4\x54" "\x72\x7c\xb2\x8b\xc5\xd2\x52\x28\x9f\x4e\x91\x2b\xfa\x62\x30\x78" "\x1f\x52\xbc\xa2\xea\x00\xbd\xb4\x85\x39\xcf\xc0\xe1\xa1\xe1\x2b" "\xff\x96\x50\x8e\x3a\x2d\x19\xdf\xd1\x4b\x9f\x9a\x91\x9e\x48\x3d" "\x36\xec\x7e\x58\x70\xa4\xc5\x03\xc5\x43\x13\x3c\x98\xf4\x65\xaa" "\xbc\xfd\x08\xd5\x43\xbc\xff\x3b\x1f\x06\x34\x6b\x30\x13\x2c\x30" "\xa5\x5a\xaf\x67\x5d\xef\x7b\x32\xb8\xc8\xc8\xb3\xdf\xc7\x25\x9c" "\x8c\x11\x66\x75\xb4\x87\x50\xee\x9e\xa8\xcb\xc7\x11\x2f\x1e\xfa" "\x0b\x28\x98\x10\xfd\xb2\xb6\xf1\x70\x8c\xed\x2f\x7e\x7c\x4f\xce" "\x5b\x49\x8e\x4e\x9b\x95\xf6\xb5\xa3\x34\x3c\x54\x0e\x21\xc2\x60" "\xe6\x08\x76\xc9\x16\xe4\x21\x4d\xc2\x01\xdf\xb5\x5a\xff\x41\x20" "\x52\xad\xc2\x58\x33\xc5\xa4\xd2\xce\xfc\x9c\xb8\x7e\x62\x05\x02" "\x92\xd1\x92\x0e\xda\xf2\x2e\x42\x1e\x99\x02\x27\xe4\xc0\x65\xe2" "\x94\xcd\x59\x27\x9f\x24\xe0\x3a\xf4\x83\x25\xa3\x7e\x68\xd7\x0f" "\x7d\xc0\x10\x62\x53\x65\xbe\x71\x25\x9a\x78\x72\xdb\x87\x04\xf6" "\xd5\x47\x12\xdc\xa2\x25\xfb\xed\x4a\x12\x6a\x00\x9f\xa8\xb7\xfb" "\x3d\x5e\xa8\xea\xf4\x9a\xac\xab\x2e\x11\xfd\x99\x13\xe9\x3c\xe4" "\xfc\xf2\xc1\xe1\xc5\x29\xdc\x64\xc7\xaf\x82\x0d\x57\x93\x00\xb5" "\x98\x9a\x81\x90\x0c\xde\xc2\x41\xdc\x64\x12\xf4\x93\x20\x7e\xf5" "\x05\x69\x29\xc9\x1f\xea\x38\xe4\xad\x6b\x7d\x8e\x3e\xed\x45\xaf" "\xb5\x99\x64\x3e\x68\x29\x7a\x80\x43\xec\x63\x70\x68\x76\x6b\xcb" "\x39\x47\x99\x37\x22\x9c\x5c\xb0\x57\x98\x81\x53\x71\x07\x1c\x75" "\x02\x20\x5f\x4f\x8a\x13\x45\x31\xc0\x9a\xdd\x8c\x0d\x08\x2b\x61" "\x62\x72\x39\xd4\xba\x62\x81\x3a\x2d\x1b\xe0\x2a\xc4\x5a\x56\xd3" "\x7c\x67\xc3\xd7\x59\x5f\x52\x7b\xe5\x9a\x92\x35\x81\x2a\x3e\x67" "\x36\xd6\xf6\xda\x19\x6d\xdd\x39\x47\xe3\x10\xdd\x10\x6f\x8e\xdf" "\xa8\xf1\x18\x42\x26\x58\xdf\x41\xf2\x4c\x7c\x05\x2c\xcf\xac\x19" "\x46\x9e\x0b\x31\x0b\x05\xd3\x7c\x79\x79\xeb\x8f\xf4\x07\x0f\x1c" "\xca\x80\x0a\x00\xf4\x2e\xe5\x45\x50\x8b\x40\x39\x4e\x4d\x8b\x21" "\x74\x75\xf8\x54\xf0\x76\xe5\xbf\x6e\x1d\xa6\x1b\x48\x6a\x48\xf7" "\x4b\xb2\x0d\x41\xd5\x7e\x90\xdb\x91\x28\x19\x7f\x7c\xf7\x22\x57" "\x18\xc5\x13\x26\x74\xc3\x3c\x18\x3a\xb8\x60\x84\x64\xa7\x02\xc3" "\x2b\x2d\x80\xa5\x1b\x06\xee\x78\xb2\xc7\x77\x76\x7b\x6e\x81\x66" "\xbb\xf7\x8c\x5d\x3f\x8a\x1f\x3e\x4b\xa0\xc0\x80\xf8\x7b\x6c\x77" "\xb9\xa2\xf8\xea\x4d\xc2\x33\xb4\xdd\x90\xc3\x38\xa5\xa1\xf7\x03" "\x8e\xa3\x10\xd7\x5c\x82\xad\xef\x8d\x42\x83\xf3\x4a\xe8\x50\x69" "\xd2\xba\x13\x73\x7a\x44\x48\x26\xeb\xa5\x7c\xd5\x7e\xcc\xeb\x91" "\x4c\x6c\x62\xa8\x49\x3b\x13\xa9\xda\x49\xb4\xc7\xf5\xf6\x45\x78" "\x91\x92\xab\xe8\xa3\x08\x51\xb0\x84\xe0\x0f\x78\x2a\x26\x5b\x8f" "\xf2\xb5\xab\x24\x21\xdc\x3c\xe4\x80\x52\xc5\xd8\xef\x3d\x80\x4a" "\xb3\x1f\x14\x24\xd5\x77\x17\x07\x74\xfd\xdb\xc1\xcb\xa6\x86\x56" "\x69\xcc\xf6\xfe\x05\x73\x3f\x23\xc7\x84\x35\x23\xd3\xca\x67\x75" "\x54\xb4\x2e\x66\x7e\xde\x70\xa3\x7c\x5b\x20\xa8\xd2\x76\x19\x4a" "\xdc\xb1\xc6\x5b\xff\x26\x94\xfe\x48\x27\xb7\xac\x19\x58\xff\x52" "\x74\xf5\x05\x69\x21\x87\x38\x8c\x45\x42\x2d\xca\x56\x19\xa3\x9c" "\x2e\x30\xf5\xbf\x87\x44\x1c\x84\xee\x1b\x53\x52\x69\x6c\x47\x97" "\x49\x0c\x86\xf5\x07\xa7\x67\x56\x4c\x5b\x4d\x24\x97\x97\x38\xa3" "\x40\xda\x01\xa8\xd7\xcb\x34\x33\x10\xcd\x7c\x27\xa1\x3e\x58\x09" "\x5f\x8e\x8f\x29\x0b\x95\x10\xfe\x19\x1a\x6e\xba\x83\xa5\xc7\x55" "\x71\xed\x86\xb3\x6b\xbf\xd8\xbc\x75\x4e\x80\xf6\xd8\x81\x71\x13" "\x37\x4e\x05\x67\x4f\x6e\xcd\x3d\xd8\x4d\xc8\xa5\x40\x5d\x5e\x01" "\x45\x12\xca\x97\x0e\x2d\xfc\x28\x38\x02\x33\x41\xa1\x7c\xb0\x74" "\xc4\x9f\x06\x64\x3d\x1a\xf4\xd2\x89\x06\xb4\x5e\x7a\x4e\xdf\x26" "\xb0\xe5\x96\xb6\x98\x76\x32\x93\x38\x56\xa5\x1c\x7d\x36\xc8\x29" "\xf0\xf5\x56\x56\x43\xf5\xe6\x42\xba\xd8\xe3\xc8\xb1\x32\xda\x42" "\x6a\x53\x73\x70\x12\x80\x6c\x18\x60\x06\xee\x66\x0c\x2a\xdb\xf3" "\x29\x73\x45\xb8\x02\xe4\x1e\x18\x48\x92\x46\x58\xf8\x6d\x33\x86" "\xb4\xdd\xe8\x33\x0e\x0d\x5c\xc5\x73\xf1\x8b\x1a\xaf\x10\x56\x3b" "\xf0\xce\x0a\x5f\x27\x80\xf3\x82\x0f\x2a\xf5\x9d\x9a\x3f\x96\xa1" "\xbd\xed\xec\x51\x03\xdb\x8f\xc7\x3b\xfd\xaf\x91\xaf\xee\xeb\x1c" "\x6b\x3b\x01\x51\x6f\x44\x57\x55\x98\x25\xb3\xc5\xb5\x44\xba\x62" "\xc4\xae\xca\xbf\xcb\xa2\xc1\x66\xa8\x25\x6c\xf2\x25\xad\xec\x1f" "\x03\xf1\x08\x4f\x1e\xd9\xc0\x01\x1e\x80\x51\xd5\x7c\xa8\xd3\x7d" "\x6d\x3f\xe6\xa0\x63\xe4\xe1\xaf\x3a\x5c\x39\x5d\x93\x25\x77\xe1" "\x94\x58\x1c\x27\x01\xb7\x0d\x26\x80\x8c\xd3\xa9\xf7\x4e\x58\x9e" "\xa7\x6b\xbf\x9b\x2f\xdf\x12\x89\x78\x04\xa9\x62\xc2\x93\xc2\x92" "\xd6\x7c\xed\x7a\xe1\x51\x05\x28\x48\xb6\x88\xce\x44\x64\xa2\xe5" "\x89\x2f\xa2\xf6\xde\x35\x2d\x3b\x5a\x7e\x68\x11\x0f\x89\x54\xa9" "\xb3\x52\x54\x9f\x16\x9f\x09\x8e\x51\x51\x82\xaf\x39\xc4\xd4\xc9" "\x3a\xd7\xc6\x7b\x27\x79\x33\x2e\x8b\xe9\x8a\x19\x05\x7d\x12\x0b" "\x53\x31\x8a\xb2\xbc\x86\xef\xe4\x5a\xb0\xcc\x21\x8a\xff\x9c\x83" "\x20\x7d\x52\x95\xe1\x63\x33\x32\xe3\x7b\x59\xdb\x44\x1e\xa9\x94" "\xe4\x62\x3d\xc0\x33\x46\x34\x49\xa8\x24\x3f\x93\x08\x03\x2d\x6a" "\x97\x3a\x4b\xa2\x3b\xb0\xd4\xac\x5b\xcc\x86\x90\x41\x48\xd7\x06" "\x40\xc7\x51\x63\x78\x57\x34\x47\x6a\xf0\xc6\x09\xe6\x9b\xa2\xa2" "\xa7\x52\x76\x53\x9a\x3a\x29\xce\xcc\xc4\xf2\xea\x93\xdf\xb7\x28" "\x33\x68\xd6\x8f\x59\x55\x8c\x13\xa8\x4a\x76\xd9\xb8\x0b\x7d\xdd" "\xd1\x17\x60\x23\x2e\xab\x29\xd7\xa7\x5e\xfd\xa3\x03\x36\x8f\x6e" "\x81\xd8\xd3\x9f\x37\xe2\xa9\x36\x63\x84\xe6\x37\x98\xab\x03\x55" "\xec\xfa\xef\x0e\xc2\x5d\xfc\x87\x86\x54\xa4\x24\xa0\xe4\x1d\x28" "\x32\x9c\xa6\x65\x7f\xd4\x88\x5d\x0a\x5a\x04\x0b\xd4\xac\x70\x53" "\x92\x5b\xb4\x1c\x4d\x96\xb6\x55\x4d\x38\x39\xec\x01\xf6\xa0\xcc" "\x94\xad\xd4\xe1\x22\x68\x6c\x57\xcc\xa6\xcf\xff\x7c\x65\x2f\xf1" "\xc2\xcc\x3b\x74\xbe\xfd\xd5\xf4\x43\x9c\x08\xf1\x3a\x8b\xfb\xec" "\xf1\x10\x25\xa9\x9e\x45\x8b\x79\x97\xa8\xa2\xff\xa8\x47\x2c\x95" "\x83\xb4\xfa\x2c\x6a\x4a\xd3\x19\x5c\xcd\x79\x23\xed\x91\xcd\x33" "\x57\xc9\x00\xd1\x11\x37\x78\x4c\x49\xfa\xa4\x0e\xbf\xcd\xd3\x83" "\xf9\xd9\xe4\xf5\x72\x94\x43\x64\x33\xda\xa7\xa5\xa2\xfc\x13\xd4" "\xd1\x26\xe4\xa2\x04\xae\xa0\x0c\x7f\xab\x20\x9a\x39\xa2\x1f\xee" "\xa6\xae\xfa\x4c\xee\x2f\x6e\x6d\x4b\xdc\x65\xe1\x10\xb8\x77\xf1" "\x09\x9e\x9e\x89\xbd\x2f\x82\x5e\xb2\x10\x2a\x01\xde\x21\x6f\x88" "\xeb\xd7\x7d\xe9\xd9\xaa\xeb\x6c\x9d\x0f\x0c\x44\x40\xae\xc4\x93" "\x97\xfe\xa8\xba\x49\x81\x7d\xe3\xa7\xb0\x8c\xa4\x1c\x6e\x22\x21" "\x7b\xa6\xd9\xe9\x0f\xc5\x6d\xec\x1a\x96\xb1\x82\x03\x93\xfe\xa7" "\x51\x17\xcf\x63\x07\x4c\xc4\x72\x6a\xed\xb6\xf6\x11\x37\xbd\x43" "\x4b\x69\x0c\xe1\xad\x93\xa7\x1c\x27\xef\x9e\x95\x48\xee\xe7\xf3" "\x23\xf7\x59\x16\x8e\xb6\xe0\x0c\xb2\x7b\xf1\x3e\x63\x36\x85\xda" "\x16\x1e\xed\xaa\x40\x0e\x9c\xc3\x5b\xb9\xec\xb3\xf9\xbf\xc8\xdb" "\x8f\x94\xac\x23\x61\xa5\xeb\x4e\x7a\x01\xfe\xef\x31\xbc\x58\x64" "\x7b\x5e\x6d\x9f\x83\xe4\xce\x14\x7c\x38\x98\xf4\xad\x69\x85\x33" "\xe3\xcb\x1b\x59\x4e\x7f\xff\xf4\x75\x94\x71\x85\x99\x0d\x09\x68" "\x2c\xd8\xb0\x88\x8e\x7f\xf4\xc5\xd6\xd0\x05\x36\x25\x20\x29\xc0" "\xee\xa0\xdc\xfb\xe3\x78\x71\x54\xa5\x2f\x77\x70\x72\x46\x30\x74" "\x9f\x17\x64\x30\xb1\x23\xc1\xf1\x51\xf2\x5d\x66\xa1\x82\x5f\xa9" "\xff\xe7\x54\xc5\x46\x77\xbc\x8b\x1b\xbb\xa8\xeb\x09\x45\xe2\x9d" "\x03\x74\x1c\xc2\xd7\x31\xe9\xfb\x8a\xe8\xbc\x2f\x23\x8d\x4b\xd3" "\x41\xfb\x4d\x11\xeb\xf7\xbe\xbf\xbf\xce\x8b\x9e\xa5\xe4\x81\xb2" "\xc9\xcf\x19\xc6\x03\xf0\x5e\x0e\x48\x3d\x29\x2f\x7f\xf0\x2c\xc2" "\xb9\x76\x89\x39\x70\xc8\x8f\x45\x1c\x6a\x30\x97\x43\xdc\x32\xe4" "\x10\xea\x94\x89\x1d\x7d\xb3\x60\x5e\x00\x8c\xd0\xc2\xc6\x02\x06" "\x84\xb9\x67\x0c\x2f\x44\x0f\x16\x11\x59\x29\xb9\x86\x31\xfe\x95" "\xe2\x9d\xb9\x0a\x13\xdc\xf9\x1f\x3e\xf0\x7d\xf8\x3f\xe9\x3d\xfd" "\x0a\x9d\xcc\x85\x39\xe1\xdb\x11\x0c\xee\xf9\x85\x30\xeb\x91" "\x8f", 4096); *(uint64_t*)0x20058000 = (uint64_t)0x10; *(uint32_t*)0x20058008 = (uint32_t)0x107; *(uint32_t*)0x2005800c = (uint32_t)0x8; r[95] = syscall(__NR_sendmsg, r[60], 0x207fcfc8ul, 0x4010ul); } int main() { use_temporary_dir(); int pid = do_sandbox_namespace(0, true); int status = 0; while (waitpid(pid, &status, __WALL) != pid) { } return 0; }