// https://syzkaller.appspot.com/bug?id=041306b2941a77b5145617d4c162149513289283 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) { strcat(opts, ",errors=withdraw"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_mount_image$exfat arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 66 61 74 00} (length 0x6) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: mount_flags = 0x1200082 (8 bytes) // opts: ptr[in, fs_options[exfat_options]] { // fs_options[exfat_options] { // elems: array[fs_opt_elem[exfat_options]] { // fs_opt_elem[exfat_options] { // elem: union exfat_options { // errors_continue: buffer: {65 72 72 6f 72 73 3d 63 6f 6e 74 69 // 6e 75 65} (length 0xf) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // errors_continue: buffer: {65 72 72 6f 72 73 3d 63 6f 6e 74 69 // 6e 75 65} (length 0xf) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // utf8: buffer: {75 74 66 38} (length 0x4) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // umask: fs_opt["umask", fmt[oct, int32]] { // name: buffer: {75 6d 61 73 6b} (length 0x5) // eq: const = 0x3d (1 bytes) // val: int32 = 0x2396 (23 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // iocharset: fs_opt["iocharset", stringnoz[codepages_names]] { // name: buffer: {69 6f 63 68 61 72 73 65 74} (length 0x9) // eq: const = 0x3d (1 bytes) // val: buffer: {63 70 39 35 30} (length 0x5) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // discard: buffer: {64 69 73 63 61 72 64} (length 0x7) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // allow_utime: fs_opt["allow_utime", fmt[oct, int32]] { // name: buffer: {61 6c 6c 6f 77 5f 75 74 69 6d 65} (length // 0xb) eq: const = 0x3d (1 bytes) val: int32 = 0x5 (23 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // errors_remount: buffer: {65 72 72 6f 72 73 3d 72 65 6d 6f 75 // 6e 74 2d 72 6f} (length 0x11) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[exfat_options] { // elem: union exfat_options { // discard: buffer: {64 69 73 63 61 72 64} (length 0x7) // } // comma: const = 0x2c (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // chdir: int8 = 0x5 (1 bytes) // size: len = 0x1531 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x1531) // } // ] // returns fd_dir memcpy((void*)0x200000000000, "exfat\000", 6); memcpy((void*)0x2000000002c0, "./file0\000", 8); memcpy((void*)0x2000000003c0, "errors=continue", 15); *(uint8_t*)0x2000000003cf = 0x2c; memcpy((void*)0x2000000003d0, "errors=continue", 15); *(uint8_t*)0x2000000003df = 0x2c; memcpy((void*)0x2000000003e0, "utf8", 4); *(uint8_t*)0x2000000003e4 = 0x2c; memcpy((void*)0x2000000003e5, "umask", 5); *(uint8_t*)0x2000000003ea = 0x3d; sprintf((char*)0x2000000003eb, "%023llo", (long long)0x2396); *(uint8_t*)0x200000000402 = 0x2c; memcpy((void*)0x200000000403, "iocharset", 9); *(uint8_t*)0x20000000040c = 0x3d; memcpy((void*)0x20000000040d, "cp950", 5); *(uint8_t*)0x200000000412 = 0x2c; memcpy((void*)0x200000000413, "discard", 7); *(uint8_t*)0x20000000041a = 0x2c; memcpy((void*)0x20000000041b, "allow_utime", 11); *(uint8_t*)0x200000000426 = 0x3d; sprintf((char*)0x200000000427, "%023llo", (long long)5); *(uint8_t*)0x20000000043e = 0x2c; memcpy((void*)0x20000000043f, "errors=remount-ro", 17); *(uint8_t*)0x200000000450 = 0x2c; memcpy((void*)0x200000000451, "discard", 7); *(uint8_t*)0x200000000458 = 0x2c; *(uint8_t*)0x200000000459 = 0; memcpy( (void*)0x200000002f80, "\x78\x9c\xec\xdc\x0b\x98\x8e\x55\xf7\x30\xf0\xb5\xf6\xde\x37\x63\x9a\xf4" "\x34\xc9\x61\xd8\x7b\xaf\x9b\x87\x06\xdb\x24\x49\x0e\x49\x72\x48\x92\x24" "\x49\xce\x09\x49\x93\x24\x09\x89\x21\xa7\xa4\x21\x09\x39\x4e\x92\xc3\x10" "\x92\xc3\xc4\xa4\x71\x3e\x1f\x72\x4e\x92\x57\x92\x24\x21\x21\xc9\xfe\xae" "\x29\x7d\xfe\x6f\xfd\xdf\xab\xfe\xdf\xdb\xfb\x79\xff\xef\xac\xdf\x75\xdd" "\xd7\xec\x35\xcf\xb3\xd6\xb3\xee\x67\xcd\x35\xf7\xe1\xb9\x66\xbe\xee\x36" "\xbc\x56\x93\xda\xd5\x1b\x11\x11\xfc\x53\xf0\x97\x2f\x29\x00\x10\x03\x00" "\x83\x01\xe0\x1a\x00\x08\x00\xa0\x7c\x7c\xf9\xf8\xec\xc7\xf3\x48\x4c\xf9" "\xe7\x5e\x84\xfd\xb5\x1e\x4c\xbf\xd2\x1d\xb0\x2b\x89\xe7\x9f\xb3\xf1\xfc" "\x73\x36\x9e\x7f\xce\xc6\xf3\xcf\xd9\x78\xfe\x39\x1b\xcf\x3f\x67\xe3\xf9" "\xe7\x6c\x3c\x7f\xc6\x72\xb2\xad\x33\x0b\x5d\xcb\x5b\xce\xdd\x2e\xdd\xff" "\x8f\x01\xbe\xff\x9f\x03\xf1\xf1\x3f\x67\xe3\xf9\xff\xc7\xf0\xde\xf7\xf9" "\x1f\x27\xf1\xfc\x73\x36\x9e\x7f\xce\xc6\xf3\xcf\xd9\x78\xfe\x39\x1b\xcf" "\x3f\x67\xe3\xf9\xe7\x2c\xf6\x37\x31\xcf\x9f\xb1\x9c\xec\x2f\xb9\x8f\x9c" "\xfb\x52\xb1\x7f\xf8\x1c\xf1\xbf\xf9\x73\x86\x5f\xdf\xaa\x7f\xb2\x4e\xf1" "\xe0\x97\x32\xff\xaa\x3e\x83\xff\xa7\xbc\x2b\xf4\x63\xc7\x18\x63\x8c\x31" "\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63" "\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6" "\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c" "\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18" "\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31" "\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63" "\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x2c\x87\x39" "\xe7\x2f\x53\x00\xf0\xeb\xfa\x4a\xf7\xc5\x18\x63\x8c\x31\xc6\x18\x63\x8c" "\xb1\xbf\x8e\xcf\x7d\xa5\x3b\x60\x8c\x31\xc6\x18\x63\x8c\x31\xc6\xd8\xbf" "\x1e\x02\x28\x09\x0a\x02\xc8\x05\xb9\x21\x06\xf2\x40\x2c\x5c\x05\x71\x70" "\x35\xe4\x85\x6b\x20\x02\xd7\x42\x3c\x5c\x07\xf9\xe0\x7a\xc8\x0f\x05\xa0" "\x20\x14\x82\x04\x28\x0c\x45\x40\x83\x01\x0b\x04\x21\x14\x85\x62\x10\x85" "\xe2\x50\x02\x6e\x80\x44\x28\x09\xa5\xa0\x34\x38\x28\x03\x49\x70\x23\x94" "\x85\x9b\xa0\x1c\xdc\x0c\xe5\xe1\x16\xa8\x00\xb7\x42\x45\xa8\x04\x95\xa1" "\x0a\xdc\x06\x55\xe1\x76\xa8\x06\x77\x40\x75\xb8\x13\x6a\x40\x4d\xa8\x05" "\xb5\xe1\x2e\xa8\x83\x77\x43\x5d\xb8\x07\xea\xc1\xbd\x50\x1f\xee\x83\x06" "\x70\x3f\x34\x84\x07\xa0\x11\x3c\x08\x8d\xe1\x21\x68\x02\x0f\x43\x53\x68" "\x06\xcd\xa1\x05\xb4\x84\x56\xd0\xfa\xb7\xf9\xf0\x67\xf2\x9f\x87\x5e\xf0" "\x02\xf4\x86\x3e\x90\x02\x7d\xa1\x1f\xbc\x08\xfd\x61\x00\x0c\x84\x41\x30" "\x18\x5e\x82\x21\xf0\x32\x0c\x85\x57\x20\x15\x86\xc1\x70\x78\x15\x46\xc0" "\x6b\x30\x12\x5e\x87\x51\x30\x1a\xc6\xc0\x1b\x30\x16\xc6\xc1\x78\x98\x00" "\x13\x61\x12\xa4\xc1\x9b\x30\x19\xde\x82\x29\xf0\x36\x4c\x85\x69\x30\x1d" "\x66\x40\x3a\xcc\x84\x59\xf0\x0e\xcc\x86\x39\x30\x17\xde\x85\x79\xf0\x1e" "\xcc\x87\x05\xb0\x10\x16\x41\x06\xbc\x0f\x8b\x61\x09\x64\xc2\x07\xb0\x14" "\x3e\x84\x2c\x58\x06\xcb\x61\x05\xac\x84\x55\xb0\x1a\xd6\xc0\x5a\x58\x07" "\xeb\x61\x03\x6c\x84\x4d\xb0\x19\xb6\xc0\x56\xf8\x08\xb6\xc1\x76\xd8\x01" "\x3b\x61\x17\xec\x86\x3d\xf0\x31\xec\x85\x4f\x60\x1f\x7c\x0a\xfb\xe1\xb3" "\xff\x61\xfe\xd9\xdf\xe4\x77\x47\x40\x40\x81\x02\x15\x2a\xcc\x85\xb9\x30" "\x06\x63\x30\x16\x63\x31\x0e\xe3\x30\x2f\xe6\xc5\x08\x46\x30\x1e\xe3\x31" "\x1f\xe6\xc3\xfc\x98\x1f\x0b\x62\x41\x4c\xc0\x04\x2c\x82\x45\xd0\xa0\x41" "\x42\xc2\xa2\x58\x14\xa3\x18\xc5\x12\x58\x02\x13\x31\x11\x4b\x61\x29\x74" "\xe8\x30\x09\x93\xb0\x2c\xde\x84\xe5\xb0\x1c\x96\xc7\xf2\x58\x01\x2b\x60" "\x45\xac\x84\x95\xb0\x0a\x56\xc1\xaa\x58\x15\xab\x61\x35\xac\x7e\xeb\x02" "\x00\xac\x81\xb5\xb0\x16\xde\x85\x77\xe1\xdd\x58\x17\xeb\x62\x3d\xac\x87" "\xf5\xb1\x3e\x36\xc0\x06\xd8\x10\x1b\x62\x23\x6c\x84\x8d\xb1\x31\x36\xc1" "\x26\xd8\x14\x9b\x62\x73\x6c\x8e\x2d\xb1\x25\xb6\xc6\xd6\xd8\x06\xdb\x60" "\x5b\x6c\x8b\xed\xb1\x3d\x76\xc0\x0e\xd8\x11\x3b\x62\x32\x26\x63\x27\xec" "\x84\x9d\xb1\x33\x76\xc1\x2e\xd8\x15\xbb\x62\x37\xec\x86\xdd\xb1\x07\xf6" "\xc0\xe7\xf1\x79\x7c\x01\x5f\xc0\x3e\x58\x43\xf4\xc5\x7e\xd8\x0f\xfb\x63" "\x7f\x1c\x88\x83\x70\x10\xbe\x84\x43\xf0\x65\x7c\x19\x5f\xc1\x54\x1c\x86" "\xc3\xf1\x55\x7c\x15\x5f\xc3\x91\x78\x06\x47\xe1\x68\x1c\x83\x63\xb0\xaa" "\x18\x87\xe3\x71\x02\x92\x98\x84\x69\x98\x86\x93\x71\x32\x4e\xc1\x29\x38" "\x15\xa7\xe1\x34\x9c\x81\xe9\x38\x13\x67\xe1\x2c\x9c\x8d\x73\x70\x0e\xbe" "\x8b\xf3\xf0\x3d\x7c\x0f\x17\xe0\x02\x5c\x84\x19\x98\x81\x8b\x71\x09\x66" "\x62\x26\x2e\xc5\xb3\x98\x85\xcb\x70\x39\xae\xc0\x95\x00\xb8\x12\xd7\xe0" "\x5a\x5c\x83\xeb\x71\x03\xae\xc7\x4d\xb8\x09\xb7\xe0\x16\xfc\x08\x3f\xc2" "\xed\xb8\x1d\x77\xe2\x4e\xdc\x8d\xbb\xf1\x63\xfc\x18\x3f\xc1\x4f\x30\x15" "\x9b\x01\xc0\x01\x3c\x80\x07\xf1\x20\x1e\xc2\x43\x78\x18\x0f\xe3\x11\x3c" "\x82\x47\xf1\x28\x1e\xc3\x63\x78\x1c\x8f\xe3\x09\x3c\x89\xa7\xf0\x24\x9e" "\xc6\xd3\x78\x06\xcf\xe2\x39\x3c\x87\xe7\xf1\x3c\x5e\xc0\x67\x13\xbe\x6c" "\xbc\xbb\xe4\xba\x54\x10\xd9\x94\x50\x22\x97\xc8\x25\x62\x44\x8c\x88\x15" "\xb1\x22\x4e\xc4\x89\xbc\x22\xaf\x88\x88\x88\x88\x17\xf1\x22\x9f\xc8\x27" "\xf2\x8b\xfc\xa2\xa0\x28\x28\x12\x44\x82\x28\x22\x8a\x08\x23\x8c\x20\x11" "\x8a\xa2\xa2\xa8\x88\x8a\xa8\x28\x21\x4a\x88\x44\x91\x28\x4a\x89\x52\xa2" "\xaf\x70\x22\x49\x24\x89\xb2\xa2\xac\x28\x27\xca\x89\xf2\xe2\x16\x51\x41" "\xdc\x2a\x2a\x8a\x4a\xa2\x9d\xab\x22\xaa\x88\xaa\xa2\xbd\xab\x26\xee\x10" "\xd5\x45\x75\x51\x43\xd4\x14\xb5\x44\x6d\x51\x5b\xd4\x11\x75\x44\x5d\x51" "\x57\xd4\x13\xf5\x44\x7d\x51\x5f\x28\x00\x68\x28\xfa\xe2\x40\x7c\x50\x64" "\x4f\xa6\x89\x18\x86\x4d\xc5\x70\x6c\x2e\x5a\x88\x96\xa2\x95\x78\x0d\x1f" "\x11\x6d\xc4\x48\x6c\x2b\xda\x89\xf6\xe2\x31\x31\x1a\x47\x61\x47\xd1\xc6" "\x25\x8b\x27\x45\x27\x31\x1e\x3b\x8b\xa7\xc5\x04\x7c\x46\x74\x15\x93\xb0" "\x9b\x78\x4e\x74\x17\x3d\x44\x4f\xf1\xbc\xe8\x25\xda\xba\xde\xa2\x8f\x98" "\x8a\x7d\x45\x3f\x31\x03\xfb\x8b\x01\x62\xa0\x18\x24\x66\x63\x4d\x91\x3d" "\xb1\x5a\xe2\x15\x91\x2a\x86\x89\xe1\xe2\x55\xb1\x08\x5f\x13\x23\xc5\xeb" "\x62\x94\x18\x2d\xc6\x88\x37\xc4\x58\x31\x4e\x8c\x17\x13\xc4\x44\x31\x49" "\xa4\x89\x37\xc5\x64\xf1\x96\x98\x22\xde\x16\x53\xc5\x34\x31\x5d\xcc\x10" "\xe9\x62\xa6\x98\x25\xde\x11\xb3\xc5\x1c\x31\x57\xbc\x2b\xe6\x89\xf7\xc4" "\x7c\xb1\x40\x2c\x14\x8b\x44\x86\x78\x5f\x2c\x16\x4b\x44\xa6\xf8\x40\x2c" "\x15\x1f\x8a\x2c\xb1\x4c\x2c\x17\x2b\xc4\x4a\xb1\x4a\xac\x16\x6b\xc4\x5a" "\xb1\x4e\xac\x17\x1b\xc4\x46\xb1\x49\x6c\x16\x5b\xc4\x56\xf1\x91\xd8\x26" "\xb6\x8b\x1d\x62\xa7\xd8\x25\x76\x8b\x3d\xe2\x63\xb1\x57\x7c\x22\xf6\x89" "\x4f\xc5\x7e\xf1\x99\x38\x20\xfe\x26\x0e\x8a\xcf\xc5\x21\xf1\x85\x38\x2c" "\xbe\x14\x47\xc4\x57\xe2\xa8\xf8\x5a\x1c\x13\xdf\x88\xe3\xa2\x8f\x38\x21" "\x4e\x8a\x53\xe2\x3b\x71\x5a\x7c\x2f\xce\x88\xb3\xe2\x9c\xf8\x41\x9c\x17" "\x3f\x8a\x0b\xe2\x27\x71\x51\x78\x01\x12\xa5\x90\x52\x2a\x19\xc8\x5c\x32" "\xb7\x8c\x91\x79\x64\xac\xbc\x4a\xc6\xc9\xab\x65\x5e\x79\x8d\x8c\xc8\x6b" "\x65\xbc\xbc\x4e\xe6\x93\xd7\xcb\xfc\xb2\x80\x2c\x28\x0b\xc9\x04\x59\x58" "\x16\x91\x5a\x1a\x69\x25\xc9\x50\x16\x95\xc5\x64\x54\x16\x97\x25\xe4\x0d" "\x32\x51\x96\x94\xa5\x64\x69\xe9\x64\x19\x99\x24\x6f\x94\x65\xe5\x4d\xb2" "\x9c\xbc\x59\x96\x97\xb7\xc8\x0a\xf2\x56\x59\x51\x56\x92\x95\x65\x15\x79" "\x9b\xac\x2a\x6f\x97\xd5\xe4\x1d\xb2\xba\xbc\x53\xd6\x90\x35\x65\x2d\x59" "\x5b\xde\x25\xeb\xc8\xbb\x65\x5d\x79\x8f\xac\x27\xef\x95\xf5\xe5\x7d\xb2" "\x81\xbc\x5f\x36\x94\x0f\xc8\x46\xf2\x41\xd9\x58\x3e\x24\x9b\xc8\x87\x65" "\x53\xd9\x4c\x36\x97\x2d\x64\x4b\xd9\x4a\xb6\x96\x8f\xc8\x36\xf2\x51\xd9" "\x56\xb6\x93\xed\xe5\x63\xb2\x83\x7c\x5c\x76\x94\x4f\xc8\x64\xf9\xa4\xec" "\x24\x9f\x92\x9d\xe5\xd3\xb2\x8b\x7c\x46\x76\x95\xcf\xca\x6e\xf2\x39\xd9" "\x5d\xf6\x90\x3d\xe5\x4f\xf2\xa2\xf4\xb2\xb7\xec\x23\x53\x64\x5f\xd9\x4f" "\xbe\x28\xfb\xcb\xec\x63\xe1\x20\x39\x58\xbe\x24\x87\xc8\x97\xe5\x50\xf9" "\x8a\x4c\x95\xc3\xe4\x70\xf9\xaa\x1c\x21\x5f\x93\x23\xe5\xeb\x72\x94\x1c" "\x2d\xc7\xc8\x37\xe4\x58\x39\x4e\x8e\x97\x13\xe4\x44\x39\x49\xa6\xc9\x37" "\xe5\x64\xf9\x96\x9c\x22\xdf\x96\x53\xe5\x34\x39\x5d\xce\x90\xe9\x72\xa6" "\x1c\x78\xa9\xd2\xdc\x3f\x91\xff\xd6\xaf\xf9\x1e\x7f\x39\x24\xcb\x99\x72" "\x68\x4a\xaa\x1c\x96\xb2\x45\x6e\x95\x1f\xc9\x6d\x72\xbb\xdc\x21\x77\xca" "\x5d\x72\xb7\xdc\x23\xf7\xc8\xbd\x72\xaf\xdc\x27\xf7\xc9\xfd\x72\xbf\x3c" "\x20\x0f\xc8\x83\xf2\xa0\x3c\x24\x0f\xc9\xc3\xf2\xb0\x3c\x22\x8f\xc8\xa3" "\xf2\xa8\x3c\x26\x8f\xc9\xe3\xf2\xb8\x3c\x21\x4f\xca\x1f\xe4\x77\xf2\xb4" "\xfc\x5e\x9e\x91\x67\xe5\x59\xf9\x83\x3c\x2f\xcf\xcb\x0b\x97\xde\x03\x50" "\xa8\x84\x92\x4a\xa9\x40\xe5\x52\xb9\x55\x8c\xca\xa3\x62\xd5\x55\x2a\x4e" "\x5d\xad\xf2\x0a\x00\x50\xd7\xaa\x78\x75\x9d\xca\xa7\xae\x57\xf9\x55\x01" "\x55\x50\x15\x52\x09\xaa\xb0\x2a\xa2\xb4\x32\xca\x2a\x52\xa1\x2a\xaa\x8a" "\xa9\xa8\x2a\xae\x4a\xa8\x1b\x54\xa2\x2a\xa9\x4a\xa9\xd2\xca\xa9\x32\x2a" "\x49\xdd\xa8\x22\xff\x64\xfe\xdf\xf7\x27\x7f\xed\x6f\xc5\xf4\x5f\xde\x29" "\xd5\x5a\xb5\x56\x6d\x54\x1b\xd5\x56\xb5\x55\xed\x55\x7b\xd5\x41\x75\x50" "\x1d\x55\x47\x95\xac\x92\x55\x27\xd5\x49\x75\x56\x9d\x55\x17\xd5\x45\x75" "\x55\x5d\x55\x37\xd5\x4d\x75\x57\xdd\x55\x4f\xd5\x53\xf5\x52\xbd\x54\x6f" "\x04\x95\xa2\x52\x54\x3f\xf5\xa2\xea\xaf\x06\xa8\x81\x6a\x90\x1a\xac\x5e" "\x52\x43\xd4\x10\x35\x54\x0d\x55\xa9\x2a\x55\x0d\x57\xc3\xd5\x08\x35\x42" "\x8d\x54\x23\xd5\x28\x35\x4a\x8d\x51\x63\xd4\x58\x35\x56\x8d\x57\xe3\xd5" "\x44\x35\x51\xa5\xa9\x34\x35\x59\x4d\x56\x53\xd4\x14\x35\x55\x4d\x55\xd3" "\xd5\x74\x95\xae\xd2\xd5\x2c\x35\x4b\xcd\x56\xb3\xd5\x5c\x35\x57\xcd\x53" "\xf3\xd4\x7c\x35\x5f\x2d\x54\x0b\x55\x86\xca\x50\x8b\xd5\x62\x95\xa9\x32" "\xd5\x52\xb5\x54\x65\xa9\x65\x6a\x99\x5a\xa1\x56\xa8\x55\x6a\x95\x5a\xa3" "\xd6\xa8\x75\x6a\x9d\xda\xa0\x36\xa8\x4d\x6a\x93\xca\x52\x5b\xd5\x56\xb5" "\x4d\x6d\x53\x3b\xd4\x0e\xb5\x4b\xed\x52\x7b\xd4\x1e\xb5\x57\xed\x55\xfb" "\xd4\x3e\xb5\x5f\xed\x57\x07\xd4\x01\x75\x50\x1d\x54\x87\xd4\x21\x75\x58" "\x1d\x56\x47\xd4\x11\x75\x54\x1d\x55\xc7\xd4\x31\x75\x5c\x1d\x57\x27\xd4" "\x09\x75\x4a\x9d\x52\xa7\xd5\x69\x75\x46\x9d\x51\xe7\xd4\x39\x75\x5e\x9d" "\x57\x17\xd4\x05\x75\x51\x5d\xcc\x3e\xed\x0b\x44\x20\x02\x15\xa8\x20\x57" "\x90\x2b\x88\x09\x62\x82\xd8\x20\x36\x88\x0b\xe2\x82\xbc\x41\xde\x20\x12" "\x44\x82\xf8\x20\x3e\xc8\x17\x5c\x1f\xe4\x0f\x0a\x04\x05\x83\x42\x41\x42" "\x50\x38\x28\x12\xe8\xc0\x04\x36\xa0\x20\x0c\x8a\x06\xc5\x82\x68\x50\x3c" "\x28\x11\xdc\x10\x24\x06\x25\x83\x52\x41\xe9\xc0\x05\x65\x82\xa4\xe0\xc6" "\xa0\x6c\x70\x53\x50\x2e\xb8\x39\x28\x1f\xdc\x12\x54\x08\x6e\x0d\x2a\x06" "\x95\x82\xca\x41\x95\xe0\xb6\xa0\x6a\x70\x7b\x50\x2d\xb8\x23\xa8\x1e\xdc" "\x19\xd4\x08\x6a\x06\xb5\x82\xda\xc1\x5d\x41\x9d\xe0\xee\xa0\x6e\x70\x4f" "\x50\x2f\xb8\x37\xa8\x1f\xdc\x17\x34\x08\xee\x0f\x1a\x06\x0f\x04\x8d\x82" "\x07\x83\xc6\xc1\x43\x41\x93\xe0\xe1\xa0\x69\xd0\x2c\x68\x1e\xb4\x08\x5a" "\x06\xad\x82\xd6\x7f\x55\x7d\xcc\xae\xef\xfd\x99\x02\x8f\xba\xde\xba\x8f" "\xce\x0d\x7d\x75\x3f\xfd\xa2\xee\xaf\x07\xe8\x81\x7a\x90\x1e\xac\x5f\xd2" "\x43\xf4\xcb\x7a\xa8\x7e\x45\xa7\xea\x61\x7a\x78\xcc\xab\x7a\x84\x7e\x4d" "\x8f\xd4\xaf\xeb\x51\x7a\xb4\x1e\xa3\xdf\xd0\x63\xf5\x38\x3d\x5e\x4f\xd0" "\x13\xf5\x24\x9d\xa6\xdf\xd4\x93\xf5\x5b\x7a\x8a\x7e\x5b\x4f\xd5\xd3\xf4" "\x74\x3d\x43\xa7\xeb\x99\x7a\x96\x7e\x47\xcf\xd6\x73\xf4\x5c\xfd\xae\x9e" "\xa7\xdf\xd3\xf3\xf5\x02\xbd\x50\x2f\xd2\x19\xfa\x7d\xbd\x58\x2f\xd1\x99" "\xfa\x03\xbd\x54\x7f\xa8\xb3\xf4\x32\xbd\x5c\xaf\xd0\x2b\xf5\x2a\xbd\x5a" "\xaf\xd1\x6b\xf5\x3a\xbd\x5e\x6f\xd0\x1b\xf5\x26\xbd\x59\x6f\xd1\x5b\xf5" "\x47\x7a\x9b\xde\xae\x77\xe8\x9d\x7a\x97\xde\xad\xf7\xe8\x8f\xf5\x5e\xfd" "\x89\xde\xa7\x3f\xd5\xfb\xf5\x67\xfa\x80\xfe\x9b\x3e\xa8\x3f\xd7\x87\xf4" "\x17\xfa\xb0\xfe\x52\x1f\xd1\x5f\xe9\xa3\xfa\x6b\x7d\x4c\x7f\xa3\x8f\xeb" "\x6f\xf5\x09\x7d\x52\x9f\xd2\xdf\xe9\xd3\xfa\x7b\x7d\x46\x9f\xd5\xe7\xf4" "\x0f\xfa\xbc\xfe\x51\x5f\xd0\x3f\xe9\x8b\xda\x67\x9f\xdc\x67\x1f\xde\x8d" "\x32\xca\xe4\x32\xb9\x4c\x8c\x89\x31\xb1\x26\xd6\xc4\x99\x38\x93\xd7\xe4" "\x35\x11\x13\x31\xf1\x26\xde\xe4\x33\xf9\x4c\x7e\x93\xdf\x14\x34\x05\x4d" "\x82\x49\x30\x45\x4c\x11\x93\x8d\x0c\x99\xa2\xa6\xa8\x89\x9a\xa8\x29\x61" "\x4a\x98\x44\x93\x68\x4a\x99\x52\xc6\x19\x67\x92\x4c\x92\x29\x6b\xca\x9a" "\x72\xa6\x9c\x29\x6f\xca\x9b\x0a\xa6\x82\xa9\x68\x2a\x9a\xca\xa6\xb2\xb9" "\xcd\xdc\x66\x6e\x37\xb7\x9b\x3b\xcc\x1d\xe6\x4e\x73\xa7\xa9\x69\x6a\x9a" "\xda\xa6\xb6\xa9\x63\xea\x98\xba\xa6\xae\xa9\x67\xea\x99\xfa\xa6\xbe\x69" "\x60\x1a\x98\x86\xa6\xa1\x69\x64\x1a\x99\xc6\xa6\xb1\x69\x62\x9a\x98\xa6" "\xa6\xa9\x69\x6e\x9a\x9b\x96\xa6\xa5\x69\x6d\x5a\x9b\x36\xa6\x8d\x69\x6b" "\xda\x9a\xf6\xa6\xbd\xe9\x60\x3a\x98\x8e\xa6\xa3\x49\x36\xc9\xa6\x93\xe9" "\x64\x3a\x9b\xce\xa6\x8b\xe9\x62\xba\x9a\xae\xa6\x9b\xe9\x66\xba\x9b\xee" "\xa6\xa7\xe9\x69\x7a\x99\x5e\xa6\xb7\xe9\x6d\x52\x4c\x8a\xe9\x67\xfa\x99" "\xfe\xa6\xbf\x19\x68\x06\x9a\xc1\x66\xb0\x19\x62\x86\x98\xa1\x66\xa8\x49" "\x35\xa9\x66\xb8\x19\x6e\x46\x98\x11\x66\xa4\x19\x69\x46\x99\xd1\x66\x8c" "\x79\xc3\x8c\x35\xe3\xcc\x78\x33\xc1\x4c\x34\x93\x4c\x9a\x49\x33\x93\xcd" "\x64\x33\xc5\x4c\x31\x53\xcd\x54\x33\xdd\x4c\x37\xe9\x26\xdd\xcc\x32\xb3" "\xcc\x6c\x33\xdb\xcc\x35\x73\xcd\x3c\x33\xcf\xcc\x37\xf3\xcd\x42\xb3\xd0" "\x64\x98\x0c\xb3\xd8\x2c\x36\x99\x26\xd3\x2c\x35\x4b\x4d\x96\xc9\x32\xcb" "\xcd\x72\xb3\xd2\xac\x34\xab\xcd\x6a\xb3\xd6\xac\x35\xeb\xcd\x7a\xb3\xd1" "\x6c\x34\x9b\xcd\x66\xb3\xd5\x6c\x35\xdb\xcc\x36\xb3\xc3\xec\x30\xbb\xcc" "\x2e\xb3\xc7\xec\x31\x7b\xcd\x5e\xb3\xcf\xec\x33\xfb\xcd\x7e\x73\xc0\x1c" "\x30\x07\xcd\x41\x13\x03\x87\xcc\x61\x73\xd8\x1c\x31\x47\xcc\x51\x73\xd4" "\x1c\x33\xc7\xcc\x71\x73\xdc\x9c\x30\x27\xcc\x29\x73\xca\x9c\x36\xa7\xcd" "\x19\x73\xc6\x9c\x33\xe7\xcc\x79\xf3\xa3\xb9\x60\x7e\x32\x17\x8d\x37\x31" "\x36\x8f\x8d\xb5\x57\xd9\x38\x7b\xb5\xcd\x6b\xaf\xb1\xbf\x8d\x0b\xda\x42" "\x36\xc1\x16\xb6\x45\xac\xb6\xf9\x6d\x81\xbf\x8b\x8d\xb5\x36\xd1\x96\xb4" "\xa5\x6c\x69\xeb\x6c\x19\x9b\x64\x6f\xfc\x5d\x5c\xd1\x56\xb2\x95\x6d\x15" "\x7b\x9b\xad\x6a\x6f\xb7\xd5\x7e\x17\xd7\xb1\x77\xdb\xba\xf6\x1e\x5b\xcf" "\xde\x6b\x6b\xdb\xbb\xfe\x2e\xae\x6f\xef\xb3\x0d\xec\xc3\xb6\xa1\x6d\x66" "\x1b\xd9\x16\xb6\xb1\x6d\x65\x9b\xd8\x87\x6d\x53\xdb\xcc\x36\xb7\x2d\x6c" "\x4b\xdb\xca\x76\xb0\x8f\xdb\x8e\xf6\x09\x9b\x6c\x9f\xb4\x9d\xec\x53\xbf" "\x8b\x17\xdb\x25\x76\xad\x5d\x67\xd7\xdb\x0d\x76\xaf\xfd\xc4\x9e\xb3\x3f" "\xd8\xa3\xf6\x6b\x7b\xde\xfe\x68\x7b\xdb\x3e\x76\xb0\x7d\xc9\x0e\xb1\x2f" "\xdb\xa1\xf6\x15\x9b\x6a\x87\xfd\x2e\x1e\x63\xdf\xb0\x63\xed\x38\x3b\xde" "\x4e\xb0\x13\xed\xa4\xdf\xc5\xd3\xed\x0c\x9b\x6e\x67\xda\x59\xf6\x1d\x3b" "\xdb\xce\xf9\x5d\x9c\x61\xdf\xb7\xf3\x6c\xa6\x9d\x6f\x17\xd8\x85\x76\xd1" "\xcf\x71\x76\x4f\x99\xf6\x03\xbb\xd4\x7e\x68\xb3\xec\x32\xbb\xdc\xae\xb0" "\x2b\xed\x2a\xbb\xda\xae\xf9\xbf\xbd\xae\xb0\x9b\xec\x66\xbb\xc5\xee\xb1" "\x1f\xdb\x6d\x76\xbb\xdd\x61\x77\xda\x5d\x76\xf7\xcf\x71\xf6\x7e\xec\xb3" "\x9f\xda\xfd\xf6\x33\x7b\xc4\x7e\x65\x0f\xda\xcf\xed\x21\x7b\xcc\x1e\xb6" "\x5f\xfe\x1c\x67\xef\xdf\x31\xfb\x8d\x3d\x6e\xbf\xb5\x27\xec\x49\x7b\xca" "\x7e\x67\x4f\xdb\xef\xed\x19\x7b\xf6\xe7\xfd\xcf\xde\xf7\xef\xec\x4f\xf6" "\xa2\xf5\x16\x08\x49\x90\x24\x45\x01\xe5\xa2\xdc\x14\x43\x79\x28\x96\xae" "\xa2\x38\xba\x9a\xf2\xd2\x35\x14\xa1\x6b\x29\x9e\xae\xa3\x7c\x74\x3d\xe5" "\xa7\x02\x54\x90\x0a\x51\x02\x15\xa6\x22\xa4\xc9\x90\x25\xa2\x90\x8a\x52" "\x31\x8a\x52\x71\x2a\x41\x37\x50\x22\x95\xa4\x52\x54\x9a\x1c\x95\xa1\x24" "\xba\x91\xca\xd2\x4d\x54\x8e\x6e\xa6\xf2\x74\x0b\x55\xa0\x5b\xa9\x22\x55" "\xa2\xca\x54\x85\x6e\xa3\xaa\x74\x3b\x55\xa3\x3b\xa8\x3a\xdd\x49\x35\xa8" "\x26\xd5\xa2\xda\x74\x17\xd5\xa1\xbb\xa9\x2e\xdd\x43\xf5\xe8\x5e\xaa\x4f" "\xf7\x51\x03\xba\x9f\x1a\xd2\x03\xd4\x88\x1e\xa4\xc6\xf4\x10\x35\xa1\x87" "\xa9\x29\x35\xa3\xe6\xd4\x82\x5a\x52\x2b\x6a\x4d\x8f\x50\x1b\x7a\x94\xda" "\x52\x3b\x6a\x4f\x8f\x51\x07\x7a\x9c\x3a\xd2\x13\x94\x4c\x4f\x52\x27\x7a" "\x8a\x3a\xd3\xd3\xd4\x85\x9e\xa1\xae\xf4\x2c\x75\xa3\xe7\xa8\x3b\xf5\xa0" "\x9e\xf4\x3c\xf5\xa2\x17\xa8\x37\xf5\xa1\x14\xea\x4b\xfd\xe8\x45\xea\x4f" "\x03\x68\x20\x0d\xa2\xc1\xf4\x52\x0d\x00\xa0\xa1\xf4\x0a\xa5\xd2\x30\x1a" "\x4e\xaf\xd2\x08\x7a\x8d\x46\xd2\xeb\x34\x8a\x46\xd3\x18\x7a\x83\xc6\xd2" "\x38\x1a\x4f\x13\x68\x22\x4d\xa2\x34\x7a\x93\x26\xd3\x5b\x34\x85\xde\xa6" "\xa9\x34\x8d\xa6\xd3\x0c\x4a\xa7\x99\x34\x8b\xde\xa1\xd9\x34\x87\xe6\xd2" "\xbb\x34\x8f\xde\xa3\xf9\xb4\x80\x16\xd2\x22\xca\xa0\xf7\x69\x31\x2d\xa1" "\x4c\xfa\x80\x96\xd2\x87\x94\x45\xcb\x68\x39\xad\xa0\x95\xb4\x8a\x56\xd3" "\x1a\x9f\x1b\x80\xd6\xd3\x06\xda\x48\x9b\x68\x33\x6d\xa1\xad\xf4\x11\x6d" "\xa3\xed\x84\xb4\x93\x76\xd1\x6e\xda\x43\x1f\xd3\x5e\xfa\x84\xf6\xd1\xa7" "\xb4\x9f\x3e\xa3\x03\x84\x78\x90\x3e\xa7\x43\xf4\x05\x1d\xa6\x2f\xe9\x08" "\x7d\x45\x47\xe9\x6b\x3a\x46\xdf\xd0\x71\xfa\x96\x4e\xd0\x49\x3a\x45\xdf" "\xd1\x69\xfa\x9e\xce\xd0\x59\x3a\x47\x3f\xd0\x79\xfa\x91\x2e\xd0\x4f\x74" "\x91\x3c\x41\x88\xa1\x08\x65\xa8\xc2\x20\xcc\x15\xe6\x0e\x63\xc2\x3c\x61" "\x6c\x78\x55\x18\x17\x5e\x1d\xe6\x0d\xaf\x09\x23\xe1\xb5\x61\x7c\x78\x5d" "\x98\x2f\xbc\x3e\xcc\x1f\x16\x08\x0b\x86\x85\xc2\x84\xb0\x70\x58\x24\xd4" "\xa1\x09\x6d\x48\x61\x18\x16\x0d\x8b\x85\xd1\xb0\x78\x58\x22\xbc\x21\x4c" "\x0c\x4b\x86\xa5\xc2\xd2\xa1\x0b\xcb\x84\x49\xe1\x8d\x61\xd9\xf0\xa6\xb0" "\x5c\x78\x73\x58\x3e\xbc\x25\xac\x10\xde\x1a\x56\x0c\x2b\x85\x0f\xdf\x5b" "\x25\xbc\x2d\xac\x1a\xde\x1e\x56\x0b\xef\x08\xab\x87\x77\x86\x35\xc2\x9a" "\x61\xad\xb0\x76\x78\x57\x58\x27\xbc\x3b\xac\x1b\xde\x13\xd6\x0b\xef\x0d" "\xcb\x85\xf7\x85\x0d\xc2\xfb\xc3\x86\xe1\x03\x61\xa3\xf0\xc1\xb0\x71\xf8" "\x50\xd8\x24\x7c\x38\x6c\x1a\x36\x0b\x9b\x87\x2d\xc2\x96\x61\xab\xb0\x75" "\xf8\x48\xd8\x26\x7c\x34\x6c\x1b\xb6\x0b\xdb\x87\x8f\x85\x1d\xc2\xc7\xc3" "\x8e\xe1\x13\x61\x72\xf8\x64\xd8\x29\x7c\xea\x0f\x1f\x4f\x09\xfb\x86\xfd" "\xc2\x17\xc3\x17\x43\xef\xef\x91\x0b\xa3\x8b\xa2\x19\xd1\xf7\xa3\x8b\xa3" "\x4b\xa2\x99\xd1\x0f\xa2\x4b\xa3\x1f\x46\xb3\xa2\xcb\xa2\xcb\xa3\x2b\xa2" "\x2b\xa3\xab\xa2\xab\xa3\x6b\xa2\x6b\xa3\xeb\xa2\xeb\xa3\x1b\xa2\x1b\xa3" "\x9b\xa2\x9b\xa3\x5b\xa2\xde\xd7\xce\x0d\x0e\x9d\x70\xd2\x29\x17\xb8\x5c" "\x2e\xb7\x8b\x71\x79\x5c\xac\xbb\xca\xc5\xb9\xab\x5d\x5e\x77\x8d\x8b\xb8" "\x6b\x5d\xbc\xbb\xce\xe5\x73\xd7\xbb\xfc\xae\x80\x2b\xe8\x0a\xb9\x04\x57" "\xd8\x15\x71\xda\x19\x67\x1d\xb9\xd0\x15\x75\xc5\x5c\xd4\x15\x77\x25\xdc" "\x0d\x2e\xd1\x95\x74\xa5\x5c\x69\xe7\x5c\x19\x97\xe4\x5a\xb9\xd6\xae\xb5" "\x6b\xe3\x1e\x75\x6d\x5d\x3b\xd7\xde\x3d\xe6\x1e\x73\x8f\xbb\xc7\xdd\x13" "\xee\x09\xf7\xa4\xeb\xe4\x9e\x72\x9d\xdd\xd3\xae\x8b\x7b\xc6\x75\x75\xcf" "\xba\x67\xdd\x73\xae\xbb\xeb\xe1\x7a\xba\xe7\x5d\x2f\xf7\x82\xeb\xed\xfa" "\xb8\x14\x97\xe2\xfa\xb9\x7e\xae\xbf\xeb\xef\x06\xba\x81\x6e\xb0\x1b\xec" "\x86\xb8\x21\x6e\xa8\x1b\xea\x52\x5d\xaa\x1b\xee\x86\xbb\x11\x6e\x84\x1b" "\xe9\x46\xba\x51\x6e\x94\x1b\xe3\xc6\xb8\xb1\x6e\xac\x1b\xef\xc6\xbb\x89" "\x7e\xa2\x4b\x73\x69\x6e\xb2\x9b\xec\xa6\xb8\x29\x6e\xaa\x9b\xea\xa6\xbb" "\xe9\x2e\xdd\xa5\xbb\x59\x6e\x96\x9b\xed\x66\xbb\xb9\x6e\xae\x9b\x97\x38" "\xcf\xcd\x77\xf3\xdd\x42\xb7\xd0\x65\xb8\x0c\xb7\xd8\x2d\x76\x99\x2e\xd3" "\x2d\x75\x4b\x5d\x96\xcb\x72\xcb\xdd\x72\xb7\xd2\xad\x74\xab\xdd\x6a\xb7" "\xd6\xad\x75\xeb\xdd\x7a\xb7\xd1\x6d\x74\x9b\xdd\x66\xb7\xd5\x6d\x75\xdb" "\xdc\x36\xb7\xc3\xed\x70\xbb\xdc\x2e\xb7\xc7\xed\x71\x7b\xdd\x5e\xb7\xcf" "\xed\x73\xfb\xdd\x7e\x77\xc0\x1d\x38\xe7\xdd\x41\x77\xc8\x7d\xe1\x0e\xbb" "\x2f\xdd\x11\xf7\x95\x3b\xea\xbe\x76\xc7\xdc\x37\xee\xb8\xfb\xd6\x9d\x70" "\x27\xdd\x29\xf7\x9d\x3b\xed\xbe\x77\x67\xdc\x59\x77\xce\xfd\xe0\xce\xbb" "\x1f\xdd\x05\xf7\x93\xbb\xe8\xbc\x4b\x8b\xbc\x19\x99\x1c\x79\x2b\x32\x25" "\xf2\x76\x64\x6a\x64\x5a\x64\x7a\x64\x46\x24\x3d\x32\x33\x32\x2b\xf2\x4e" "\x64\x76\x64\x4e\x64\x6e\x04\x61\x5e\xe4\xbd\xc8\xfc\xc8\x82\xc8\xc2\xc8" "\xa2\x48\x46\xe4\xfd\xc8\xe2\xc8\x92\x48\x66\xe4\x83\xc8\xd2\xc8\x87\x91" "\xac\xc8\xb2\xc8\xf2\xc8\x8a\xc8\xca\xc8\xaa\x88\xf7\x85\xb7\x85\xbe\xa8" "\x2f\xe6\xa3\xbe\xb8\x2f\xe1\x6f\xf0\x89\xbe\xa4\x2f\xe5\x4b\x7b\xe7\xcb" "\xf8\x24\x7f\xa3\x2f\xeb\x6f\xf2\xe5\xfc\xcd\xbe\xbc\xbf\xc5\x57\xf0\xb7" "\xfa\x8a\xbe\x92\xaf\xec\x9b\xf9\xe6\xbe\x85\x6f\xe9\x5b\xf9\xd6\xfe\x11" "\xdf\xc6\x3f\xea\xdb\xfa\x76\xbe\xbd\x7f\xcc\x77\xf0\x8f\xfb\x8e\xfe\x09" "\x9f\xec\x9f\xf4\x9d\xfc\x53\xbe\xb3\x7f\xda\x77\xf1\xcf\xf8\xae\xfe\x59" "\xdf\xcd\x3f\xe7\xbb\xfb\x1e\xbe\xa7\x7f\xde\xf7\xf2\x2f\xf8\xde\xbe\x8f" "\x4f\xf1\x7d\x7d\x3f\xff\xa2\xef\xef\x07\xf8\x81\x7e\x90\x1f\xec\x5f\xf2" "\x43\xfc\xcb\x7e\xa8\x7f\xc5\xa7\xfa\x61\x7e\xb8\x7f\xd5\x8f\xf0\xaf\xf9" "\x91\xfe\x75\x3f\xca\x8f\xf6\x63\xfc\x1b\x7e\xac\x1f\xe7\xc7\xfb\x09\x7e" "\xa2\x9f\xe4\xd3\xfc\x9b\x7e\xb2\x7f\xcb\x4f\xf1\x6f\xfb\xa9\x7e\x9a\x9f" "\xee\x67\xf8\x74\x3f\xd3\xcf\xf2\xef\xf8\xd9\x7e\x8e\x9f\xeb\xdf\xf5\xf3" "\xfc\x7b\x7e\xbe\x5f\xe0\x17\xfa\x45\x3e\xc3\xbf\xef\x17\xfb\x25\x3e\xd3" "\x7f\xe0\x97\xfa\x0f\x7d\x96\x5f\xe6\x97\xfb\x15\x1e\x62\x56\xf9\xd5\x7e" "\x8d\x5f\xeb\xd7\xf9\xf5\x7e\x83\xdf\xe8\x37\xf9\xcd\x7e\x8b\xdf\xea\x3f" "\xf2\xdb\xfc\x76\xbf\xc3\xef\xf4\xbb\xfc\x6e\xbf\xc7\x7f\xec\xf7\xfa\x4f" "\xfc\x3e\xff\xa9\xdf\xef\x3f\xf3\x07\xfc\xdf\xfc\x41\xff\xb9\x3f\xe4\xbf" "\xf0\x87\xfd\x97\xfe\x88\xff\xca\x1f\xf5\x5f\xfb\x63\xfe\x1b\x7f\xdc\x7f" "\xeb\x4f\xf8\x93\xfe\x94\xff\xce\x9f\xf6\xdf\xfb\x33\xfe\xac\x3f\xe7\x7f" "\xf0\xe7\xfd\x8f\xfe\x82\xff\xc9\x5f\xe4\xbf\x59\x63\x8c\x31\xc6\x18\xfb" "\x53\xe4\x1f\x3c\xde\xf7\xbf\xf9\x9e\xb8\xb4\x65\xeb\x07\x00\x57\x6f\x2f" "\x74\xf8\xb7\x35\x37\xe6\xff\x65\x3d\x40\x24\x74\x88\x00\xc0\x93\x7d\xba" "\x3d\x78\xe9\xd3\x8d\x94\x1a\x35\x52\x52\x52\x2e\x3d\x37\x4b\x42\x50\x6c" "\x01\x00\x44\x2e\xe7\xe7\x82\xcb\xf1\x32\x68\x0f\x8f\x43\x32\xb4\x83\xb2" "\xff\x6d\x7f\x03\x44\x8f\xf3\x74\xa9\xfe\xaf\xdb\x6f\xeb\x47\x6f\x01\x88" "\xfd\x2f\x39\x31\x70\x39\xbe\x5c\xff\xa6\x7f\x50\x7f\xdc\xbc\x3f\xac\xbf" "\x00\x20\xb1\xd8\xe5\x9c\x3c\x70\x39\xbe\x5c\xbf\xdc\x3f\xa8\x5f\xa0\xcd" "\x1f\xd4\xcf\xf3\x79\x1a\x40\xdb\xff\x92\x13\x07\x97\xe3\xcb\xf5\x93\xe0" "\x51\x78\x0a\x92\xff\x68\xa0\xbf\x38\xf0\xa7\x9e\xc5\x18\x63\x8c\x31\xc6" "\x18\x63\xec\x3f\xc6\x00\x51\xb9\xcb\x1f\x5d\xdf\x66\x5f\x9f\x27\xa8\xcb" "\x39\xb9\xe1\x72\xfc\x47\xd7\xe7\x3f\xfb\x73\xd7\xa4\x8c\x31\xc6\x18\x63" "\x8c\x31\xc6\x18\xfb\x17\x79\xa6\x47\xcf\x27\x1e\x49\x4e\x6e\xd7\xe5\x4a" "\x2d\x00\xae\xe4\xab\xf3\xe2\xcf\x2c\x72\xfd\x7b\xb4\xf1\x1f\xb6\x90\xff" "\x1e\x6d\xfc\xa3\xc5\x95\xfe\xcd\xc4\x18\x63\x8c\x31\xc6\x18\xfb\xab\x5d" "\x3e\xe9\xbf\xd2\x9d\x30\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18" "\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31" "\xc6\x18\x63\x8c\x31\xc6\x18\x63\x39\xd7\xff\x8f\x7f\x27\x76\xa5\xf7\x91" "\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18" "\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31" "\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\xbb\xd2\xfe\x4f\x00\x00" "\x00\xff\xff\xb5\x58\x22\x35", 5425); syz_mount_image( /*fs=*/0x200000000000, /*dir=*/0x2000000002c0, /*flags=MS_STRICTATIME|MS_RELATIME|MS_NOSUID|MS_DIRSYNC*/ 0x1200082, /*opts=*/0x2000000003c0, /*chdir=*/5, /*size=*/0x1531, /*img=*/0x200000002f80); // open arguments: [ // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) // } // flags: open_flags = 0x145142 (8 bytes) // mode: open_mode = 0x0 (8 bytes) // ] // returns fd memcpy((void*)0x200000000240, "./file1\000", 8); res = syscall( __NR_open, /*file=*/0x200000000240ul, /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_DIRECT|O_CREAT|0x2*/ 0x145142ul, /*mode=*/0ul); if (res != -1) r[0] = res; // ioctl$FS_IOC_SETFSLABEL arguments: [ // fd: fd (resource) // cmd: const = 0x41009432 (4 bytes) // arg: ptr[in, buffer] { // buffer: {51 87 e1 5e 2f d0 ba 11 c3 a2 3a 1b c3 ae 15 3b b7 6d e7 6f // 0a 02 22 11 10 21 f9 88 2c 8b af 51 25 23 46 b1 7a 27 81 51 84 fa 7b // 7b 29 50 4f 40 d2 f8 70 57 4c bf e2 40 eb 23 94 79 00 ce a3 52 f4 64 // d2 be 6a 27 e1 af 89 d7 f0 db ec 07 9a ea 02 04 80 6b 72 0d 67 d8 9d // 9f 48 26 e3 86 bc 10 96 ea f0 64 15 ba 2f 11 36 f5 6c df 0b d6 a6 d7 // 50 61 50 30 dc f5 cc 03 c5 52 dd 3a 1c e4 e6 4c 5c 40 31 18 03 b7 65 // 15 11 02 31 f0 96 16 9c 8e 22 be 68 ea f6 28 74 47 18 a9 be 78 60 b6 // 77 18 2f 9b b7 22 a8 71 d1 bb 43 9e f1 7e 03 61 84 e3 aa cc c4 bc d4 // fc 04 3c 01 e6 53 9e 4b b5 2b 9e e9 67 73 d8 76 28 14 8a d8 cf 36 76 // 39 ec 8a b8 21 3e af 7f d3 ae ee 64 0b fd 9a 24 72 d6 35 7a 5d 08 57 // 00 4d 2a df 23 c2 fa f5 e8 dc 14 6e 3b 7c ab 97 7c c7 06 78 a3 1e 40 // 56 a1 9c 8c d1 c1} (length 0x100) // } // ] memcpy( (void*)0x2000000007c0, "\x51\x87\xe1\x5e\x2f\xd0\xba\x11\xc3\xa2\x3a\x1b\xc3\xae\x15\x3b\xb7\x6d" "\xe7\x6f\x0a\x02\x22\x11\x10\x21\xf9\x88\x2c\x8b\xaf\x51\x25\x23\x46\xb1" "\x7a\x27\x81\x51\x84\xfa\x7b\x7b\x29\x50\x4f\x40\xd2\xf8\x70\x57\x4c\xbf" "\xe2\x40\xeb\x23\x94\x79\x00\xce\xa3\x52\xf4\x64\xd2\xbe\x6a\x27\xe1\xaf" "\x89\xd7\xf0\xdb\xec\x07\x9a\xea\x02\x04\x80\x6b\x72\x0d\x67\xd8\x9d\x9f" "\x48\x26\xe3\x86\xbc\x10\x96\xea\xf0\x64\x15\xba\x2f\x11\x36\xf5\x6c\xdf" "\x0b\xd6\xa6\xd7\x50\x61\x50\x30\xdc\xf5\xcc\x03\xc5\x52\xdd\x3a\x1c\xe4" "\xe6\x4c\x5c\x40\x31\x18\x03\xb7\x65\x15\x11\x02\x31\xf0\x96\x16\x9c\x8e" "\x22\xbe\x68\xea\xf6\x28\x74\x47\x18\xa9\xbe\x78\x60\xb6\x77\x18\x2f\x9b" "\xb7\x22\xa8\x71\xd1\xbb\x43\x9e\xf1\x7e\x03\x61\x84\xe3\xaa\xcc\xc4\xbc" "\xd4\xfc\x04\x3c\x01\xe6\x53\x9e\x4b\xb5\x2b\x9e\xe9\x67\x73\xd8\x76\x28" "\x14\x8a\xd8\xcf\x36\x76\x39\xec\x8a\xb8\x21\x3e\xaf\x7f\xd3\xae\xee\x64" "\x0b\xfd\x9a\x24\x72\xd6\x35\x7a\x5d\x08\x57\x00\x4d\x2a\xdf\x23\xc2\xfa" "\xf5\xe8\xdc\x14\x6e\x3b\x7c\xab\x97\x7c\xc7\x06\x78\xa3\x1e\x40\x56\xa1" "\x9c\x8c\xd1\xc1", 256); syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x41009432, /*arg=*/0x2000000007c0ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; loop(); return 0; }